[vvillait88]

Summary

Maintenance sweep release, 2.8.3. This is a lock refresh with no manifest range changes beyond the version.

• certifi 2026.10.19 to 2026.10.23 (runtime; the >=2026.10.19 floor is unchanged).
• Dev: coverage 7.16.2 to 7.17.0, ruff 0.17.1 to 0.17.2, ty 0.0.90 to 0.0.91; tomli drops out of the lock.

Checked and current: every GitHub Action, and dependabot (uv and actions, last runs succeeded). No Dockerfile. No prerelease versions in uv.lock.

Worked with: Varun, who asked for the sweep.

Not taken: nothing outstanding.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

ruff check, ruff format --check, ty check, vulture and pytest (172 passed, 2 skipped, 99% coverage) all exit 0 locally. osv-scanner scan source --lockfile=uv.lock reports no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review of aa90773 (base a9b8e81, which is current main). No blocking findings.

Lock moves. I parsed both uv.lock files with tomllib and diffed name and version: 24 packages to 23. The changes are agentscore-py 2.8.2 to 2.8.3, certifi 2026.10.19 to 2026.10.23, coverage 7.16.2 to 7.17.0, ruff 0.17.1 to 0.17.2, ty 0.0.90 to 0.0.91, and tomli 2.5.0 removed. Nothing else moved, and requires-python (>=3.11) and the lock revision are unchanged. The bulk of the 163/228 line diff is wheel tables. tomli drops out for a real reason: coverage 7.17.0 declares requires_python >=3.11 and no requires_dist at all, so its toml extra is gone and pytest-cov's edge in the lock is now { name = "coverage" } where it used to be extra = ["toml"]. pyproject has no [tool.coverage] table, so nothing depended on that path.

Prereleases. No row in the head lock matches (a|b|rc|.dev)N (0 of 23). The positive control 1.0b2 matches. uv lock --upgrade --dry-run at the head reports "No lockfile changes detected", so nothing outdated was missed. PyPI latest for every direct and dev dependency matches the lock: certifi, coverage, ruff, ty, httpx 0.28.1, vulture 2.16, pytest 9.1.1, pytest-cov 7.1.0, pytest-asyncio 1.4.0, respx 0.23.1, python-dotenv 1.2.4, lefthook 2.2.2.

certifi floor comment. I checked it against the advisory and against the bundles themselves. GHSA-6q48-6c7w-9gw2 names emSign ECC Root CA - G3 as the compromised root, with the range >= 2019.03.09, < 2026.10.19. I extracted cacert.pem from each wheel and read the emSign labels:

• 2026.7.22 has 4 (C1, C3, G1, G3).
• 2026.10.18 has 0, because it removed all of them.
• 2026.10.19 has 3 and leaves G3 out. That is upstream's "Restore unaffected emSign roots".
• 2026.10.23 has 1 (G1). C1 and C3 left in upstream's routine bundle sync, and no advisory is attached.

No 2026.10.23 bundle carries G3, so the >=2026.10.19 floor and its comment still hold. OSV returns nothing for 2026.10.19. For 2026.10.18 it returns GHSA-6q48-6c7w-9gw2 and PYSEC-2026-4320, so the floor sits exactly at the advisory's fix.

Gates at the head, using CI's invocations (uv sync --frozen --all-extras --all-groups --python 3.15, uv 0.13.5):

• ruff check ., ruff format --check ., ty check agentscore/ ("All checks passed!") and vulture . vulture_whitelist.py --min-confidence 80 --exclude .venv all exit 0.
• pytest tests/ --cov=agentscore reports 172 passed, 2 skipped, 99.81% coverage against the 95% floor.
• I re-ran pytest under 3.11, the matrix floor and the only interpreter where tomli used to install. It reports 172 passed, 2 skipped.
• uv lock --check exits 0. The installed versions read back as coverage 7.17.0, certifi 2026.10.23, ruff 0.17.2 and ty 0.0.91.
• All 12 PR checks are green, including the 3.11 to 3.15 matrix, Python Audit and Dependency Scan.

OSV. osv-scanner 2.7.0 with an explicitly empty config scanned the head uv.lock (23 packages) and reported "No issues found". As a positive control I copied the same lock with certifi set to 2026.10.18, and the scan reports PYSEC-2026-4320 / GHSA-6q48-6c7w-9gw2. There is one lockfile and no osv-scanner.toml, so there are no ignores to audit.

Actions and dependabot. setup-uv v10.3.2, the uv version input 0.13.5, pypi-publish v1.14.3 and the osv-scanner binary v2.7.0 are all upstream latest. setup-python v7 and cache v6 are floating at their current majors. The last Dependabot Updates runs (uv and actions) succeeded, and no dependabot PRs are open.

Non-blocking: none.