[vvillait88]

Summary

Maintenance sweep release, 3.2.4.

• agentscore-py floor >=2.8.2 to >=2.8.3 (the sweep release).
• uv lock --upgrade: asgiref 3.13.0, cdp-sdk 1.51.0, certifi 2026.10.23, fastapi 0.162.0, google-api-core 2.43.0, googleapis-common-protos 1.76.0, pycparser 3.12, starlette 1.10.0; dev coverage 7.17.0, ruff 0.17.2, ty 0.0.91; tomli drops out.
• The only prereleases in the lock are OpenTelemetry's never-stable 0.66b1 packages, which prerelease = "if-necessary" admits by design.

Holds re-tested and standing: the aiohttp>=3.14.4 floor (pympp 0.14.0 still exact-pins yarl==1.24.5 and propcache==0.5.2) and web3<8 (pympp 0.14.0 still requires eth-abi<6).

Hand-implemented specs are mirrored from node-commerce; the upstream and live-document check is on node-commerce's sweep PR and found nothing to move.

Worked with: Varun, who asked for the sweep.

Not taken: nothing outstanding.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

ruff check, ruff format --check, ty check agentscore_commerce/, ty check over examples, vulture and pytest (1674 passed, 4 skipped, 97.44% coverage) all exit 0 locally, and uv lock --check passes. osv-scanner reports no issues on uv.lock.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review of cfec421 (base ea8f1c3). No blocking findings.

Lock. I parsed both uv.lock files and diffed name and version: 164 packages to 163. The changes are exactly the body's list (asgiref, cdp-sdk, certifi, coverage, fastapi, google-api-core, googleapis-common-protos, pycparser, ruff, starlette, ty, plus the two agentscore versions), and tomli is removed. uv lock --upgrade --dry-run at the head reports "No lockfile changes detected". fastapi 0.162.0 and starlette 1.10.0 are PyPI latest.

Prereleases. The only a/b/rc rows are opentelemetry-exporter-http-transport, opentelemetry-exporter-otlp-common and opentelemetry-semantic-conventions at 0.66b1. PyPI lists 0 stable releases for each, so if-necessary admits them as designed.

FastAPI 0.159.1 to 0.162.0 and Starlette 1.9.0 to 1.10.0 against the identity adapters. I diffed the installed packages from both venvs rather than relying on release notes alone.

• Exception handling. identity/fastapi.py _install_gate_denial_handler walks app.middleware_stack and writes into the private ExceptionMiddleware._exception_handlers map. Across 1.9.0 to 1.10.0:
  • starlette/middleware/exceptions.py, applications.py, requests.py and middleware/errors.py are byte-identical.
  • The single change in the raise path is in _exception_handler.py: after the handler has run and the response has been sent, it sets exc.__traceback__ = None. Nothing in agentscore_commerce reads __traceback__.
  • The handler-map lookup and the middleware chain the walk depends on are unchanged.
• Dependencies. FastAPI changed routing.py and dependencies/utils.py, and both changes are confined to parameter and form models: 0.160 removes _get_request_param_names, so model extra now applies to sibling fields, and 0.162 changes omitted boolean form fields. The adapters declare no Query(), Header(), Cookie(), Form() or parameter models. They take Request through Depends(gate), which neither change touches.
• Starlette 1.10's other changes. These are form parsing, multidict equality order, http.response.start without headers, and FileResponse Range. The identity and middleware packages call none of request.form, query_params comparison, BaseHTTPMiddleware or FileResponse.
• Request body caching. starlette/requests.py is unchanged.
• Warnings. The suite emits the same 83 warnings on base and head, so the new deprecation (FormMessage) is not hit.

Holds re-tested.

• pympp / aiohttp floor. pympp 0.14.0 (latest) still pins yarl==1.24.5 and propcache==0.5.2 in its tempo, stripe and mcp extras. aiohttp 3.14.4 and 3.14.5 (latest) both require yarl>=1.25.1, so the aiohttp>=3.14.4 floor still makes pympp 0.14 unsatisfiable. The lock stays on pympp 0.11.0, aiohttp 3.14.5 and yarl 1.25.1.
• web3<8. web3 8.0.0 requires eth-abi>=6, and pympp 0.14.0 still declares eth-abi<6,>=5.0. The lock has web3 7.16.0, eth-abi 5.2.0 and solana 0.40.1.

Both holds stand.

Gates at the head, using CI's invocations (uv sync --frozen --all-extras --python 3.15):

• ruff check, ruff format --check, ty check agentscore_commerce/, ty check -c 'src.include=["examples"]' and vulture . --min-confidence 80 --exclude .venv all exit 0.
• pytest reports 1674 passed, 4 skipped, 97.44% coverage. uv lock --check exits 0.
• All 12 PR checks are green, including the 3.11 to 3.15 matrix, Python Audit and Dependency Scan. No dependabot PRs are open.

OSV. osv-scanner 2.7.0 with an explicitly empty config reports "No issues found" over 163 packages. The osv-scanner.toml holds only comments, so there are no ignores to audit.

Non-blocking: _install_gate_denial_handler depends on a private Starlette attribute. It survives this bump unchanged, and it is the first thing to re-read on any Starlette minor.