Commit f3cc5bd
Bump to 2.5.18: agentscore-py 2.6.4, x402 2.19.0, and routine deps (#110)
## Summary
Version bump to 2.5.18 plus the full dependency sweep, together so one
release carries both.
- **`agentscore-py` floor raised to 2.6.4**, the version just published
from the sdk repo.
- **`x402` 2.18.0 to 2.19.0.** This was held on a previous pass for
lacking protocol-field evidence; the evidence was gathered rather than
the hold re-carried. Both wheels were unpacked and compared, and every
protocol-governed field count is identical (`maxAmountRequired` 16,
`x402Version` 105, `decimals` 2300, `payTo` 26, `asset` 1333, `scheme`
1068), so nothing on the wire contract moved. Five files differ, and the
one that matters is a security fix: `x402_http_server_base` normalized
the request path by decoding percent-escapes globally, so a decoded byte
could create a segment boundary the router never saw, and a wildcard
tail carrying a decoded line feed failed to match its own route,
skipping payment verification and settlement. 2.19.0 decodes one segment
at a time, re-escapes any separator a decode yields, and compiles the
route regex with `DOTALL`.
- **`stripe` 15.5.0, `trio` 0.34.0, `ty` 0.0.70.**
2.19.0's only `constants.py` change is Monad Mainnet's USDC name (`"USD
Coin"` to `"USDC"`), a chain we do not settle on. Base mainnet keeps
`"USD Coin"` in both versions, which is the value the EIP-712 domain
hash depends on, so signature verification on our rail is untouched.
That was checked by reading the network block rather than inferred from
the field name.
Six transitives stay behind latest (`websockets`, `pydantic-core`,
`eth-keyfile`, `construct-typing`, `parsimonious`, `jsonalias`). Each is
constrained by its parent (pydantic, solana, web3, sanic, eth-abi,
solders) rather than by anything this repo declares, so forcing them
would override a peer's own resolution. They move when their parents
move.
This release should land after the Solana confirmation-timeout fix
(#109) so the published version carries both.
## Type of change
- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only
## Public API
None. No exported type, function signature, wire format, or response
shape changes. The `x402` peer moves within its existing `>=2.9,<3`
range, so no caller migration.
## Test plan
Full local gate set on the upgraded lock: `ruff check` and `ruff format
--check` (215 files) clean, `ty check agentscore_commerce/` clean, and
`pytest tests/` at 1841 passed / 4 skipped with coverage 95.36% against
the 95% floor. No test changes were needed since no behavior in this
repo changed; the x402 fix is upstream and covered by its own suite.
Reproduce with `uv sync --all-extras && uv run pytest tests/`.
## Checklist
- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>1 parent 52c861a commit f3cc5bd
2 files changed
Lines changed: 34 additions & 34 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4 | 4 | | |
5 | 5 | | |
6 | 6 | | |
7 | | - | |
| 7 | + | |
8 | 8 | | |
9 | 9 | | |
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
13 | 13 | | |
14 | 14 | | |
15 | | - | |
| 15 | + | |
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
| |||
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.
0 commit comments