asap-protocol 2.5.6__tar.gz → 2.5.8__tar.gz

{asap_protocol-2.5.6 → asap_protocol-2.5.8}/CHANGELOG.md

@@ -16,6 +16,114 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.5.8] - 2026-10-21
+
+**Security & coverage patch** — record the repository dependency overrides
+and regression tests that landed on `main` after v2.5.7 via
+[#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417).
+This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
+at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)
+· PyPI `asap-protocol==2.5.8`.
+
+### Security
+
+- **Repository uv overrides and `[mcp]` extra (#413)** —
+  ``[tool.uv] override-dependencies`` pins ``aiohttp>=3.14.4,<4``
+  (CVE-2026-111063 and related), ``certifi>=2026.10.19`` (PYSEC-2026-4320),
+  and ``pillow>=13.0.0`` (CVE-2026-112395 / 112397 / 112400 / 112404 /
+  112895 / 112896 / 112897 / 112899). Those overrides apply in this
+  repository. They are not requirements of the published wheel. The
+  optional ``[mcp]`` extra requires ``mcp>=1.30.0,<2`` (CVE-2026-59951).
+- **`apps/web` Vite (#413)** — npm override pins ``vite`` to ``8.1.6``
+  (GHSA-587h-7wmj-h5pm and the other launch-editor advisories on Vite
+  8.0.0–8.1.5). This pin is the web app in this repository, not a PyPI
+  requirement.
+- **`apps/web` audit CI** — ``quality (web)`` installs npm 11.21.0 before
+  ``npm audit`` and ``audit-ci``. ``audit-ci.jsonc`` sets
+  ``package-manager`` to ``npm``. npm 10 (Node 20) and pnpm 9 still call
+  the retired ``/-/npm/v1/security/audits/quick`` endpoint. Both audit
+  steps retry a registry 503 and still fail immediately on a real advisory.
+
+### Quality
+
+- **Quota, replay, and nonce regression tests (#413)** — webhook partial
+  refill, truncated public keys, JTI eviction, nonce expiry, and discovery
+  health. Batch ``check_n`` cost shipped in v2.5.7.
+- **Metering, SLA, usage, and delivery regression tests (#414)** — metering
+  windows, SLA boundaries, audit queries, the existing one-time
+  ``delegate_urn`` column add, usage pagination, webhook status band, batch
+  size, OpenAPI schema depth, and snapshot-loop edges.
+- **Refresh, cache, and revocation regression tests (#415)** — OAuth refresh
+  on the buffer second, introspection cache expiry, discovery and registry
+  cache TTL, delegation expiry, ack timeout, revocation of a non-agent URN,
+  and dashboard action edges.
+- **Expiry, receipt, and session regression tests (#416)** — receipt reads
+  at exact expiry, registration receipts, reactivation lifetime, approval
+  deadlines, host JWT skew, scope-claim types, envelope timestamps, and
+  compliance preflight edges.
+- **Lifetime and size regression tests (#417)** — verify and reactivate
+  lifetime edges, blank IssueOps fields, request and decompressed size caps,
+  WebSocket idle and heartbeat fences, and truncated key age
+  (``timedelta.days`` inside ``warn_if_key_old``, distinct from the truncated
+  public-key fence in #413).
+
+### Migration
+
+- **v2.5.7 → v2.5.8**: See [migration guide](docs/migration.md#upgrading-from-v257-to-v258).
+  No wire-protocol or manifest schema breaking changes. Installs of the
+  optional ``[mcp]`` extra now require ``mcp>=1.30.0,<2``.
+
+---
+
+## [2.5.7] - 2026-10-11
+
+**Quality & coverage patch** — correct batch HTTP rate-limit accounting,
+transitive dependency overrides for CI security gates, `apps/web` audit-ci
+enforcement, and consolidated regression tests on `main` via
+[#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399).
+This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
+at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)
+· PyPI `asap-protocol==2.5.7`.
+
+### Fixed
+
+- **Batch rate limits (#394)** — ``ASAPRateLimiter.check_n`` passes ``cost=n`` to
+  the moving-window strategy instead of ``n`` separate unit-cost ``hit`` calls,
+  so multi-item requests consume the correct quota.
+
+### Security
+
+- **Transitive Python deps** — ``uv`` override pins for advisories on optional
+  integration paths (``multidict``, ``pydantic-ai``, ``werkzeug``, ``fsspec``)
+  so CI ``pip-audit`` stays green ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)
+  train).
+- **`apps/web` npm audit** — CI uses ``audit-ci`` with ``audit-ci.jsonc``;
+  production overrides bump ``sharp`` and ``source-map-js``
+  ([#395](https://github.com/asap-protocol/asap-protocol/pull/395) train).
+
+### Quality
+
+- **Transport & auth regression tests (#395, #397, #394)** — stale-key grants and
+  409 races, WebSocket token bursts and snapshot replace, streamed limits and
+  ceremony retry paths.
+- **Registry & compliance harness (#389)** — endpoint rewrite, webhook DNS match,
+  compliance preflight edges.
+- **Identity, economics, ingress (#398, #399)** — JWT middleware and metering
+  bridges, SSRF and ingress policy, adapter storage edges.
+
+### Migration
+
+- **v2.5.6 → v2.5.7**: See [migration guide](docs/migration.md#upgrading-from-v256-to-v257).
+  No wire-protocol or manifest schema breaking changes. Operators using
+  JSON-RPC batch or other ``check_n`` paths should expect quota to reflect batch
+  size; oversized batches that v2.5.6 could accept may now raise
+  ``RateLimitExceeded`` (intended behavior). With default limits, a batch of 50
+  against ``10/second`` can trip in one call.
+
+---
+
 ## [2.5.6] - 2026-10-01
 
 **Security & quality patch** — Lite Registry IssueOps envelope and endpoint SSRF

{asap_protocol-2.5.6 → asap_protocol-2.5.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: asap-protocol
-Version: 2.5.6
+Version: 2.5.8
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/asap-protocol/asap-protocol
 Project-URL: Documentation, https://asap-protocol.github.io/asap-protocol
@@ -73,7 +73,7 @@ Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.28.1; extra == 'mcp'
+Requires-Dist: mcp<2,>=1.30.0; extra == 'mcp'
 Provides-Extra: openapi
 Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.6** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.8** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -156,16 +156,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.6)
+uv add asap-protocol  # latest on PyPI (currently 2.5.8)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.6
+pip install asap-protocol==2.5.8
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.6; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.8; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.6** (security & quality patch) is **shipped** — see [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.8** (security & coverage patch) is **shipped** — see [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -265,6 +265,8 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
@@ -290,7 +292,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.6** is the security/quality patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.8** is the security/coverage patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.6 → asap_protocol-2.5.8}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.6** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.8** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -64,16 +64,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.6)
+uv add asap-protocol  # latest on PyPI (currently 2.5.8)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.6
+pip install asap-protocol==2.5.8
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.6; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.8; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.6** (security & quality patch) is **shipped** — see [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.8** (security & coverage patch) is **shipped** — see [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -173,6 +173,8 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
@@ -198,7 +200,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.6** is the security/quality patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.8** is the security/coverage patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.6 → asap_protocol-2.5.8}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.6"
+version = "2.5.8"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -84,8 +84,8 @@ webauthn = [
 ]
 # Framework integration extras.
 mcp = [
-    # Floor 1.28.1 for CVE-2026-52869 / CVE-2026-52870 / CVE-2026-59950.
-    "mcp>=1.28.1",
+    # Floor 1.30.0 for CVE-2026-59951 (prior: 1.28.1 for CVE-2026-52869 / 52870 / 59950).
+    "mcp>=1.30.0,<2",
 ]
 langchain = [
     "langchain-core>=1.3.3",
@@ -124,13 +124,14 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # Override transitive dependencies for security fixes:
 # - pyjwt>=2.14.0 for PYSEC-2026-4140–4152 (prior: CVE-2026-32597 baseline at 2.12.0)
 # - anyio>=4.14.2 for PYSEC-2026-4024 / PYSEC-2026-4025
-# - aiohttp>=3.14.3,<4 for PYSEC-2026-3545/3546/3547 (prior: CVE-2026-34993 / CVE-2026-47265 at >=3.14.0)
+# - aiohttp>=3.14.4,<4 for CVE-2026-111063/111064/111065/111066/111748/111749/111750 and GHSA-2g87-pp6c-29x5 (prior: PYSEC-2026-3545/3546/3547 at >=3.14.3)
 # - zeroconf>=0.149.5 for CVE-2026-47180/47183/47184 ([dns-sd] extra)
 # - pyasn1>=0.6.4 for CVE-2026-30922 / CVE-2026-59885 / CVE-2026-59886 / PYSEC-2026-3455/3456/3457 (transitive, auth/JWT stack)
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=50.0.0 for PYSEC-2026-3552 (PKCS7 Bleichenbacher; 3553/3554 fixed in 49.0.0; prior GHSA-537c-gmf6-5ccf at >=48.0.1)
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
-# - pillow>=12.3.0 for PYSEC-2026-2253–2257 (prior: CVE-2026-40192 at >=12.2.0; transitive, e.g. pdf/vision stacks)
+# - pillow>=13.0.0 for CVE-2026-112395/112397/112400/112404/112895/112896/112897/112899 (prior: PYSEC-2026-2253–2257 at >=12.3.0; transitive, e.g. pdf/vision stacks)
+# - certifi>=2026.10.19 for PYSEC-2026-4320 (transitive via requests/httpx)
 # - click>=8.3.3 for PYSEC-2026-2132 (transitive, e.g. typer / uvicorn / mkdocs stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
 # - python-multipart>=0.0.31 for CVE-2026-53538–53540 (FastAPI stack; prior floor 0.0.27)
@@ -153,16 +154,21 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # - setuptools>=83.0.0 for PYSEC-2026-3447 (transitive build/tooling path)
 # - pyopenssl>=26.4.0 for cryptography 50 ABI (webauthn extra; GEN_EMAIL / PKCS7)
 # - mkdocs-material>=9.7.7 for PYSEC-2026-3864 / CVE-2026-73295 (DOM XSS in search.suggest)
+# - multidict>=6.9.1 for CVE-2026-104874
+# - pydantic-ai>=1.107.7,<2 for CVE-2026-107287–107291
+# - werkzeug>=3.1.9 for CVE-2026-102598
+# - fsspec>=2026.6.0 for CVE-2026-104851
 [tool.uv]
 override-dependencies = [
-    "aiohttp>=3.14.3,<4",
+    "aiohttp>=3.14.4,<4",
+    "certifi>=2026.10.19",
     "anyio>=4.14.2",
     "pyjwt>=2.14.0,<3",
     "pyasn1>=0.6.4",
     "tinytag>=2.2.1",
     "cryptography>=50.0.0,<51",
     "requests>=2.33.0",
-    "pillow>=12.3.0",
+    "pillow>=13.0.0",
     "click>=8.3.3",
     "pytest>=9.0.3",
     "python-multipart>=0.0.31",
@@ -186,6 +192,10 @@ override-dependencies = [
     "h2>=4.4.1",
     "pyopenssl>=26.4.0",
     "mkdocs-material>=9.7.7",
+    "multidict>=6.9.1",
+    "pydantic-ai>=1.107.7,<2",
+    "werkzeug>=3.1.9",
+    "fsspec>=2026.6.0",
 ]
 
 [project.scripts]

{asap_protocol-2.5.6 → asap_protocol-2.5.8}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.5.6"
+__version__ = "2.5.8"
 
 __all__ = ["__version__", "create_from_openapi"]
 

{asap_protocol-2.5.6 → asap_protocol-2.5.8}/src/asap/transport/rate_limit.py

@@ -142,7 +142,7 @@ class ASAPRateLimiter:
             return
         key = self._key_func(request)
         for rate_limit in self._rate_limits:
-            if not self._strategy.test(rate_limit, key):
+            if not self._strategy.test(rate_limit, key, cost=n):
                 window_stats = self._strategy.get_window_stats(rate_limit, key)
                 retry_seconds = max(1, int(window_stats[0] - time.time()))
                 raise RateLimitExceeded(
@@ -151,8 +151,14 @@ class ASAPRateLimiter:
                     limit=str(rate_limit),
                 )
         for rate_limit in self._rate_limits:
-            for _ in range(n):
-                self._strategy.hit(rate_limit, key)
+            if not self._strategy.hit(rate_limit, key, cost=n):
+                window_stats = self._strategy.get_window_stats(rate_limit, key)
+                retry_seconds = max(1, int(window_stats[0] - time.time()))
+                raise RateLimitExceeded(
+                    detail=f"Rate limit exceeded: {rate_limit}",
+                    retry_after=retry_seconds,
+                    limit=str(rate_limit),
+                )
 
     def test(self, request: Request) -> bool:
         """Return True if *request* would pass all limits (no counter increment)."""