[vvillait88]

Summary

Release 3.2.2. This raises the agentscore-py floor from 2.8.0 to 2.8.1.

agentscore-py 2.8.1 requires certifi>=2026.10.19. Older certifi releases trust emSign roots whose intermediate CA keys were compromised (GHSA-6q48-6c7w-9gw2). With the new floor, any install of agentscore-commerce 3.2.2 resolves a certifi that does not trust those roots. The floor lives in agentscore-py, so this package does not repeat it.

In the lockfile, agentscore-py moves to 2.8.1 and certifi moves from 2026.10.18 to 2026.10.19.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged. The one changed requirement is agentscore-py>=2.8.1.

Test plan

• uv sync --frozen --all-extras --all-groups, then:
  • uv run pytest: 1674 passed, 4 skipped.
  • uv run ruff check . and uv run ruff format --check .: clean.
  • uv run ty check: clean.
  • uv run vulture . --min-confidence 80 --exclude .venv: clean.
• osv-scanner on uv.lock: no issues found.

Checklist

• Tests cover the new behavior, and the suite passes locally (a dependency floor adds no behavior to test; the existing suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: Release 3.2.2

Verdict: no blocking findings. Reviewed at head 98794e31df0e80a44fc33550f684b4c320cda6a5, base 5c8672c7b6e8cdda49be381e2f916c634d0bbea8 (equal to current main).

Diff

• 2 files, 1 commit. pyproject.toml: version 3.2.1 to 3.2.2, agentscore-py>=2.8.0 to >=2.8.1. httpx and every extra and dev group are unchanged.
• uv.lock, every changed line read: the editable package version; the requires-dist floor; agentscore-py 2.8.0 to 2.8.1, which now lists certifi as a dependency; certifi 2026.10.18 to 2026.10.19. Nothing else moved. The package count is 164 on both sides.

Registry

• agentscore-py 2.8.1 on PyPI: requires_dist contains certifi>=2026.10.19. The sdist sha256 0e8946ca...38f9f0 and wheel sha256 9e8ac23d...9072a0 both match uv.lock.
• certifi 2026.10.19 on PyPI: the sdist 035c1e85...780a1ae and wheel 42d35340...8670e1b match uv.lock.
• 3.2.2 is unreleased: the PyPI JSON for agentscore-commerce/3.2.2 returns 404, while 3.2.1 returns 200 (control). There is no v3.2.2 tag (latest v3.2.1).

osv-scanner 2.7.0

• Base lock (positive control): 164 packages, 1 Critical (GHSA-6q48-6c7w-9gw2, certifi 2026.10.18), exit 1.
• Head lock: 164 packages, no issues, exit 0.

Claims in the body

• "The floor lives in agentscore-py, so this package does not repeat it": verified above. The new >=2.8.1 floor carries certifi>=2026.10.19 into every resolution of this package.

Hardcoded versions

Grep of the head tree (excluding the lock) for 3.2.1, 3.2.2 and 2.8.0: one hit is pyproject.toml. The other is an unrelated RFC 8785 section reference in identity/ucp_jwks.py. __version__ and the default User-Agent both read importlib.metadata, so nothing else needs a bump.

PR body

Follows the repo template. Bug fix is ticked, and the two unticked checklist items carry reasons. No em-dashes, ticket ids or session links in the title, body or commit.

Checks

All 12 rows pass: ci, test (3.11 to 3.15), Python Audit, Dependency Scan, CodeQL, Analyze (actions), and both Analyze (python) runs.