asap-protocol 2.5.5__tar.gz → 2.5.7__tar.gz

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/CHANGELOG.md

@@ -16,6 +16,119 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.5.7] - 2026-10-11
+
+**Quality & coverage patch** — correct batch HTTP rate-limit accounting,
+transitive dependency overrides for CI security gates, `apps/web` audit-ci
+enforcement, and consolidated regression tests on `main` via
+[#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399).
+This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
+at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)
+· PyPI `asap-protocol==2.5.7`.
+
+### Fixed
+
+- **Batch rate limits (#394)** — ``ASAPRateLimiter.check_n`` passes ``cost=n`` to
+  the moving-window strategy instead of ``n`` separate unit-cost ``hit`` calls,
+  so multi-item requests consume the correct quota.
+
+### Security
+
+- **Transitive Python deps** — ``uv`` override pins for advisories on optional
+  integration paths (``multidict``, ``pydantic-ai``, ``werkzeug``, ``fsspec``)
+  so CI ``pip-audit`` stays green ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)
+  train).
+- **`apps/web` npm audit** — CI uses ``audit-ci`` with ``audit-ci.jsonc``;
+  production overrides bump ``sharp`` and ``source-map-js``
+  ([#394](https://github.com/asap-protocol/asap-protocol/pull/394) train).
+
+### Quality
+
+- **Transport & auth regression tests (#395, #397, #394)** — stale-key grants and
+  409 races, WebSocket token bursts and snapshot replace, streamed limits and
+  ceremony retry paths.
+- **Registry & compliance harness (#389)** — endpoint rewrite, webhook DNS match,
+  compliance preflight edges.
+- **Identity, economics, ingress (#398, #399)** — JWT middleware and metering
+  bridges, SSRF and ingress policy, adapter storage edges.
+
+### Migration
+
+- **v2.5.6 → v2.5.7**: See [migration guide](docs/migration.md#upgrading-from-v256-to-v257).
+  No wire-protocol or manifest schema breaking changes. Operators relying on
+  batch endpoints should expect slightly stricter rate limiting when ``check_n``
+  is used (intended behavior).
+
+---
+
+## [2.5.6] - 2026-10-01
+
+**Security & quality patch** — Lite Registry IssueOps envelope and endpoint SSRF
+hardening, compliance harness open-redirect SSRF, constrained capability execute,
+Agent JWT rotate-key lifecycle race, dependency bumps, and consolidated regression
+tests on `development` via [#354](https://github.com/asap-protocol/asap-protocol/pull/354)–[#379](https://github.com/asap-protocol/asap-protocol/pull/379).
+This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
+at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)
+· PyPI `asap-protocol==2.5.6`.
+
+### Fixed
+
+- **Lite Registry IssueOps envelope (#354)** — `save_registry` again writes a
+  `LiteRegistry` object (`version`, `updated_at`, `agents`) so
+  `discover_from_registry` and Python validation keep working after
+  registration/removal. CI `validate_registry.py` and auto-merge eligibility
+  now reject a bare root array on production `registry.json` (fixture dry-runs
+  use `--allow-agents-array`).
+
+- **Agent JWT rotate-key lifecycle (#372)** — lifecycle persistence uses
+  compare-and-set on `expected_public_key` so stale snapshots cannot undo
+  `POST /asap/agent/rotate-key`.
+
+### Security
+
+- **Capability execute omitted arguments (#373)** — ``CapabilityRegistry.check_grant``
+  and ``POST /asap/capability/execute`` treat a missing ``arguments`` object
+  as empty when the grant has constraints. Constrained fields stay required,
+  so omitting the object no longer skips the allowlist.
+
+- **Compliance harness open-redirect SSRF (#370)** — ``run_compliance_harness_v2_from_url``
+  no longer sets ``follow_redirects=True``. Auto-registration
+  (``POST /registry/agents``) allowlists the harness base URL once, then the
+  harness preflight and checks use that client; a public agent could
+  ``302`` to ``http://169.254.169.254/`` (or another blocked hop) and the
+  registry-bot would fetch it. Same fail-closed policy as
+  ``fetch_manifest_at_url``. ``asap compliance-check`` against a hostile
+  URL is covered by the same client.
+
+- **IssueOps registry endpoint SSRF (#371)** — `process_registration` rejects HTTP
+  and WebSocket endpoints that resolve to private, loopback, cloud-metadata, or
+  NAT64-embedded private hosts before writing `registry.json`. Manifest fetch was
+  already allowlisted; the advertised agent URLs were not, so a public signed
+  manifest could list `http://169.254.169.254/` and SDK `MarketClient.run`
+  would dial IMDS.
+
+### Changed
+
+- **GitHub Actions deps (#374)** — grouped bump for CI and release workflows.
+- **`apps/web` npm deps (#375)** — grouped production and dev dependency updates.
+
+### Quality
+
+- **Consolidated regression tests (#376–#379)** — SSRF and web policy coverage,
+  transport binding/nonce/validation edges, streaming registration and SLA idle
+  windows, and auth lifecycle/session gates.
+
+### Migration
+
+- **v2.5.5 → v2.5.6**: See [migration guide](docs/migration.md#upgrading-from-v255-to-v256).
+  No wire-protocol or manifest schema breaking changes. Capability clients with
+  constrained grants must send an ``arguments`` object (may be empty). Registry
+  operators must keep `registry.json` as a `LiteRegistry` envelope.
+
+---
+
 ## [2.5.5] - 2026-09-11
 
 **Security & quality patch** — OpenAPI path-parameter climb, Lite Registry

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: asap-protocol
-Version: 2.5.5
+Version: 2.5.7
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/asap-protocol/asap-protocol
 Project-URL: Documentation, https://asap-protocol.github.io/asap-protocol
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.5** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.7** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -156,16 +156,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.5)
+uv add asap-protocol  # latest on PyPI (currently 2.5.7)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.5
+pip install asap-protocol==2.5.7
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.5; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.7; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.5** (security & quality patch) is **shipped** — see [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.7** (quality & coverage patch) is **shipped** — see [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -265,6 +265,8 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
+| **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
 | **v2.5.3** | **Adapter Lab II** — **[GitHub Release `v2.5.3`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.3)** · workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
@@ -289,7 +291,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.5** is the security/quality patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.7** is the quality/coverage patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.5** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.7** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -64,16 +64,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.5)
+uv add asap-protocol  # latest on PyPI (currently 2.5.7)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.5
+pip install asap-protocol==2.5.7
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.5; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.7; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.5** (security & quality patch) is **shipped** — see [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.7** (quality & coverage patch) is **shipped** — see [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -173,6 +173,8 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
+| **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
 | **v2.5.3** | **Adapter Lab II** — **[GitHub Release `v2.5.3`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.3)** · workflow OpenAPI connectors + security guide, experimental MAF / NeMo guides, JSON-safe `-32602`, MCP example client DX. See [CHANGELOG](CHANGELOG.md#253---2026-07-14), [PRD](product/prd/prd-v2.5.3-adapter-lab-ii.md), and [Migration (v2.5.2 → v2.5.3)](docs/migration.md#upgrading-from-v252-to-v253) |
@@ -197,7 +199,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.5** is the security/quality patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.7** is the quality/coverage patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.5"
+version = "2.5.7"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -122,7 +122,8 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 "PyPI" = "https://pypi.org/project/asap-protocol/"
 
 # Override transitive dependencies for security fixes:
-# - pyjwt>=2.13.0 for PYSEC-2026-175/177/178/179 (CVE-2026-32597 baseline at 2.12.0)
+# - pyjwt>=2.14.0 for PYSEC-2026-4140–4152 (prior: CVE-2026-32597 baseline at 2.12.0)
+# - anyio>=4.14.2 for PYSEC-2026-4024 / PYSEC-2026-4025
 # - aiohttp>=3.14.3,<4 for PYSEC-2026-3545/3546/3547 (prior: CVE-2026-34993 / CVE-2026-47265 at >=3.14.0)
 # - zeroconf>=0.149.5 for CVE-2026-47180/47183/47184 ([dns-sd] extra)
 # - pyasn1>=0.6.4 for CVE-2026-30922 / CVE-2026-59885 / CVE-2026-59886 / PYSEC-2026-3455/3456/3457 (transitive, auth/JWT stack)
@@ -137,7 +138,7 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # - pygments>=2.20.0 for CVE-2026-4539
 # - langsmith>=0.8.18 for GHSA-f4xh-w4cj-qxq8 (prior: CVE-2026-45134 at >=0.8.0)
 # - langchain-core>=1.3.3 for CVE-2026-44843
-# - urllib3>=2.7.0 for CVE-2026-44431 / CVE-2026-44432
+# - urllib3>=2.8.0 for PYSEC-2026-4175–4177 (prior: CVE-2026-44431 / CVE-2026-44432 at >=2.7.0)
 # - pip>=26.2 for PYSEC-2026-3721 (prior: PYSEC-2026-196 / CVE-2026-6357 at >=26.1.2)
 # - h2>=4.4.1 for PYSEC-2026-3628 (HTTP/2 HPACK; transitive via httpx[http2])
 # - python-dotenv>=1.2.2 for CVE-2026-28684 (transitive, e.g. pydantic-settings / uvicorn stacks)
@@ -152,10 +153,15 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # - setuptools>=83.0.0 for PYSEC-2026-3447 (transitive build/tooling path)
 # - pyopenssl>=26.4.0 for cryptography 50 ABI (webauthn extra; GEN_EMAIL / PKCS7)
 # - mkdocs-material>=9.7.7 for PYSEC-2026-3864 / CVE-2026-73295 (DOM XSS in search.suggest)
+# - multidict>=6.9.1 for CVE-2026-104874
+# - pydantic-ai>=1.107.7,<2 for CVE-2026-107287–107291
+# - werkzeug>=3.1.9 for CVE-2026-102598
+# - fsspec>=2026.6.0 for CVE-2026-104851
 [tool.uv]
 override-dependencies = [
     "aiohttp>=3.14.3,<4",
-    "pyjwt>=2.13.0,<3",
+    "anyio>=4.14.2",
+    "pyjwt>=2.14.0,<3",
     "pyasn1>=0.6.4",
     "tinytag>=2.2.1",
     "cryptography>=50.0.0,<51",
@@ -168,7 +174,7 @@ override-dependencies = [
     "pygments>=2.20.0",
     "langsmith>=0.8.18",
     "langchain-core>=1.3.3",
-    "urllib3>=2.7.0",
+    "urllib3>=2.8.0",
     "pip>=26.2",
     "zeroconf>=0.149.5",
     "python-dotenv>=1.2.2",
@@ -184,6 +190,10 @@ override-dependencies = [
     "h2>=4.4.1",
     "pyopenssl>=26.4.0",
     "mkdocs-material>=9.7.7",
+    "multidict>=6.9.1",
+    "pydantic-ai>=1.107.7,<2",
+    "werkzeug>=3.1.9",
+    "fsspec>=2026.6.0",
 ]
 
 [project.scripts]

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.5.5"
+__version__ = "2.5.7"
 
 __all__ = ["__version__", "create_from_openapi"]
 

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/src/asap/auth/capabilities.py

@@ -228,7 +228,12 @@ class CapabilityRegistry:
         capability: str,
         arguments: dict[str, Any] | None = None,
     ) -> GrantCheckResult:
-        """Return whether *agent_id* may invoke *capability* with *arguments*."""
+        """Return whether *agent_id* may invoke *capability* with *arguments*.
+
+        Constrained grants treat omitted ``arguments`` as ``{}``. Each
+        constrained field is required, so a caller cannot skip the allowlist
+        by leaving the object out of the execute body.
+        """
         agent_grants = self._grants.get(agent_id, {})
         g = agent_grants.get(capability)
 
@@ -241,8 +246,8 @@ class CapabilityRegistry:
         if g.expires_at is not None and datetime.now(timezone.utc) > g.expires_at:
             return GrantCheckResult(allowed=False, violations=[], grant=g)
 
-        if g.constraints and arguments is not None:
-            violations = validate_constraints(g.constraints, arguments)
+        if g.constraints:
+            violations = validate_constraints(g.constraints, arguments or {})
             if violations:
                 return GrantCheckResult(allowed=False, violations=violations, grant=g)
 

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/src/asap/auth/identity.py

@@ -36,6 +36,17 @@ class RevokedAgentOverwriteError(ValueError):
     """
 
 
+class StaleAgentPublicKeyError(ValueError):
+    """Raised when ``save`` would persist against a rotated public key.
+
+    Example:
+        >>> raise StaleAgentPublicKeyError(
+        ...     "refusing to overwrite agent 'a1': stored public_key thumbprint "
+        ...     "'abc' != expected 'def'"
+        ... )
+    """
+
+
 def validate_okp_public_key(value: dict[str, Any]) -> dict[str, Any]:
     """Validate that the dict represents a valid OKP (Ed25519) public JWK."""
     try:
@@ -103,24 +114,23 @@ class AgentSession(ASAPBaseModel):
 class AgentStore(Protocol):
     """Persistence layer for agent sessions under a host."""
 
-    async def save(self, agent: AgentSession) -> None:
+    async def save(
+        self,
+        agent: AgentSession,
+        *,
+        expected_public_key: dict[str, Any] | None = None,
+    ) -> None:
         """Persist or replace an agent session.
 
         Must refuse replacing a ``revoked`` row with a non-revoked snapshot by
-        raising :class:`RevokedAgentOverwriteError`. The check and write must be
-        one compare-and-set, equivalent to::
-
-            UPDATE agents SET ... = :row
-             WHERE agent_id = :id AND status <> 'revoked'
-            -- reject when rowcount == 0 and the stored status is revoked
-
-        Do **not** implement this as get → await I/O → overwrite: that TOCTOU
-        can resurrect a revoked agent (#324 / LIFE-005). Same class as
-        ``NonceStore.check_and_mark``. Persisting an already-revoked snapshot
-        remains allowed.
+        raising :class:`RevokedAgentOverwriteError`. When *expected_public_key*
+        is set, raise :class:`StaleAgentPublicKeyError` if the stored JWK
+        thumbprint no longer matches (concurrent rotate-key). Check and write
+        must be one compare-and-set; do not get → await I/O → overwrite
+        (#324 / LIFE-005). Persisting an already-revoked snapshot is allowed.
 
         Example:
-            >>> await store.save(session)
+            >>> await store.save(session, expected_public_key=session.public_key)
         """
         ...
 
@@ -256,23 +266,48 @@ class InMemoryHostStore:
             await self._agent_store.revoke_by_host(host_id)
 
 
-class InMemoryAgentStore:
-    """In-memory `AgentStore` for development and tests.
+def _cas_public_key_row(
+    existing: AgentSession,
+    agent: AgentSession,
+    expected_public_key: dict[str, Any],
+) -> AgentSession:
+    """Return the row to persist, or raise if the stored JWK already rotated."""
+    try:
+        stored_tp = jwk_thumbprint_sha256(existing.public_key)
+        incoming_tp = jwk_thumbprint_sha256(agent.public_key)
+        expected_tp = jwk_thumbprint_sha256(expected_public_key)
+    except (KeyError, TypeError, ValueError) as exc:
+        msg = f"cannot compare public_key thumbprints for agent {agent.agent_id!r}: {exc}"
+        raise StaleAgentPublicKeyError(msg) from exc
+    if stored_tp != expected_tp:
+        msg = (
+            f"refusing to overwrite agent {agent.agent_id!r}: stored public_key "
+            f"thumbprint {stored_tp!r} != expected {expected_tp!r}"
+        )
+        raise StaleAgentPublicKeyError(msg)
+    if incoming_tp != expected_tp:
+        return existing.model_copy(update={"public_key": agent.public_key})
+    return agent
 
-    ``save`` refuses to replace a ``revoked`` row with a non-revoked snapshot so
-    stale get→mutate→full-row-save races cannot resurrect revoked agents.
-    """
+
+class InMemoryAgentStore:
+    """In-memory AgentStore; save refuses revoked→live and stale-key overwrites."""
 
     def __init__(self) -> None:
         self._agents: dict[str, AgentSession] = {}
 
-    async def save(self, agent: AgentSession) -> None:
-        """Persist or replace a session; refuse revoked→non-revoked atomically.
+    async def save(
+        self,
+        agent: AgentSession,
+        *,
+        expected_public_key: dict[str, Any] | None = None,
+    ) -> None:
+        """Persist a session. Refuse revoked→live; CAS public_key when expected.
 
         Example:
-            >>> await store.save(session)
+            >>> await store.save(session, expected_public_key=session.public_key)
         """
-        # No await between the revoked check and the write (LIFE-005 / #324).
+        # No await between the revoked/key check and the write (LIFE-005 / #324).
         existing = self._agents.get(agent.agent_id)
         if existing is not None and existing.status == "revoked" and agent.status != "revoked":
             msg = (
@@ -280,6 +315,8 @@ class InMemoryAgentStore:
                 f"with status {agent.status!r}"
             )
             raise RevokedAgentOverwriteError(msg)
+        if expected_public_key is not None and existing is not None:
+            agent = _cas_public_key_row(existing, agent, expected_public_key)
         self._agents[agent.agent_id] = agent
 
     async def touch_if_current(
@@ -330,23 +367,33 @@ class InMemoryAgentStore:
             await self.revoke(aid)
 
 
-async def save_agent_unless_revoked(agent_store: AgentStore, agent: AgentSession) -> None:
+async def save_agent_unless_revoked(
+    agent_store: AgentStore,
+    agent: AgentSession,
+    *,
+    expected_public_key: dict[str, Any] | None = None,
+) -> None:
     """Persist *agent* through :meth:`AgentStore.save` (refuse-revoked contract).
 
-    Call sites that load a session, mutate it, then persist the full row should
-    use this helper so the intent is obvious. It does **not** add a get-then-save
-    window; atomic refuse-revoked belongs inside ``save`` (same class as
-    ``NonceStore.check_and_mark``).
+    Pass *expected_public_key* so a concurrent rotate-key is not reverted by a
+    stale lifecycle snapshot. Atomic refuse-revoked/key CAS belongs inside
+    ``save``.
 
     Example:
-        >>> await save_agent_unless_revoked(store, rotated_session)
+        >>> await save_agent_unless_revoked(
+        ...     store, rotated_session, expected_public_key=old_jwk
+        ... )
     """
-    await agent_store.save(agent)
-
+    if expected_public_key is None:
+        await agent_store.save(agent)
+        return
+    try:
+        await agent_store.save(agent, expected_public_key=expected_public_key)
+    except TypeError as exc:
+        if "expected_public_key" not in str(exc):
+            raise
+        await agent_store.save(agent)
 
-# ---------------------------------------------------------------------------
-# Agent session lifecycle (session TTL, max lifetime, absolute lifetime)
-# ---------------------------------------------------------------------------
 
 ExpiryStatus = Literal["active", "expired", "revoked"]
 

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/src/asap/registry/auto_registration.py

@@ -27,7 +27,7 @@ from asap.registry.anti_spam import TRUST_LEVEL_SELF_SIGNED, auto_register_verif
 from asap.registry.bot_pr import BotPRResult, BotPRSettings, open_registry_pull_request
 from asap.testing.compliance import ComplianceReport, run_compliance_harness_v2_from_url
 from asap.transport.rate_limit import RateLimitExceeded
-from asap.transport.webhook import validate_callback_url
+from asap.transport.webhook import validate_agent_endpoint_url, validate_callback_url
 
 logger = logging.getLogger(__name__)
 
@@ -136,6 +136,21 @@ async def fetch_manifest_at_url(client: httpx.AsyncClient, manifest_url: str) ->
         raise ManifestValidationError(str(exc), field="signature") from exc
 
 
+async def _validate_persisted_registry_endpoints(manifest: Manifest) -> None:
+    """Reject private/metadata hosts on every URL stored in ``registry.json``."""
+    for label, url in (
+        ("HTTP", manifest.endpoints.asap),
+        *([("WebSocket", manifest.endpoints.events)] if manifest.endpoints.events else []),
+    ):
+        try:
+            await validate_agent_endpoint_url(url, require_https=True)
+        except WebhookURLValidationError as exc:
+            raise HTTPException(
+                status_code=400,
+                detail=f"{label} endpoint blocked: {exc}",
+            ) from exc
+
+
 def _build_registry_entry(manifest: Manifest, manifest_url: str) -> RegistryEntry:
     endpoints: dict[str, str] = {
         "http": manifest.endpoints.asap,
@@ -243,6 +258,8 @@ def create_auto_registration_router(config: AutoRegistrationConfig | None = None
                 detail=f"Harness base URL blocked: {exc}",
             ) from exc
 
+        # Harness HTTP client does not follow redirects. This allowlist is
+        # one-shot; following Location would skip SSRF checks (IMDS/link-local).
         report = await _run_harness(harness_url)
         if report.score < 1.0:
             failed = [c.model_dump(mode="json") for c in report.checks if not c.passed]
@@ -255,6 +272,8 @@ def create_auto_registration_router(config: AutoRegistrationConfig | None = None
                 ).model_dump(mode="json"),
             )
 
+        await _validate_persisted_registry_endpoints(manifest)
+
         entry = _build_registry_entry(manifest, manifest_url_str)
 
         try:

{asap_protocol-2.5.5 → asap_protocol-2.5.7}/src/asap/testing/compliance.py

@@ -419,6 +419,13 @@ async def run_compliance_harness_v2_from_url(
     Raises:
         httpx.ConnectError: If the TCP connection cannot be established (preflight ``GET /``).
         httpx.TimeoutException: If the preflight request times out.
+
+    Note:
+        Redirects are not followed. Auto-registration validates the harness
+        URL once, then calls this runner; following ``Location`` would let a
+        public agent bounce the registry-bot (or ``asap compliance-check``)
+        onto link-local/IMDS targets after that check. Same policy as
+        ``fetch_manifest_at_url``.
     """
     normalized = base_url.rstrip("/")
     timeout_cfg = Timeout(request_timeout)
@@ -426,14 +433,16 @@ async def run_compliance_harness_v2_from_url(
         base_url=normalized,
         timeout=timeout_cfg,
         headers=default_headers,
-        follow_redirects=True,
+        follow_redirects=False,
     ) as client:
         # Fail fast on unreachable hosts so callers (e.g. CLI) can treat as transport error,
         # instead of a synthetic all-failed report from per-check exception handlers.
         try:
-            await client.get("/")
+            preflight = await client.get("/")
         except httpx.ConnectError:
             raise
         except httpx.TimeoutException:
             raise
+        if 300 <= preflight.status_code < 400:
+            preflight.raise_for_status()
         return await run_compliance_harness_with_client(client, categories=categories)