PyPI - asap-protocol - Versions diffs - 2.5.7__tar.gz → 2.5.8__tar.gz - Mend

asap-protocol 2.5.7tar.gz → 2.5.8tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (239) hide show

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/CHANGELOG.md RENAMED Viewed

@@ -16,12 +16,72 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ---
+## [2.5.8] - 2026-10-21
+**Security & coverage patch** — record the repository dependency overrides
+and regression tests that landed on `main` after v2.5.7 via
+[#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417).
+This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
+at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)
+· PyPI `asap-protocol==2.5.8`.
+### Security
+- **Repository uv overrides and `[mcp]` extra (#413)** —
+  ``[tool.uv] override-dependencies`` pins ``aiohttp>=3.14.4,<4``
+  (CVE-2026-111063 and related), ``certifi>=2026.10.19`` (PYSEC-2026-4320),
+  and ``pillow>=13.0.0`` (CVE-2026-112395 / 112397 / 112400 / 112404 /
+  112895 / 112896 / 112897 / 112899). Those overrides apply in this
+  repository. They are not requirements of the published wheel. The
+  optional ``[mcp]`` extra requires ``mcp>=1.30.0,<2`` (CVE-2026-59951).
+- **`apps/web` Vite (#413)** — npm override pins ``vite`` to ``8.1.6``
+  (GHSA-587h-7wmj-h5pm and the other launch-editor advisories on Vite
+  8.0.0–8.1.5). This pin is the web app in this repository, not a PyPI
+  requirement.
+- **`apps/web` audit CI** — ``quality (web)`` installs npm 11.21.0 before
+  ``npm audit`` and ``audit-ci``. ``audit-ci.jsonc`` sets
+  ``package-manager`` to ``npm``. npm 10 (Node 20) and pnpm 9 still call
+  the retired ``/-/npm/v1/security/audits/quick`` endpoint. Both audit
+  steps retry a registry 503 and still fail immediately on a real advisory.
+### Quality
+- **Quota, replay, and nonce regression tests (#413)** — webhook partial
+  refill, truncated public keys, JTI eviction, nonce expiry, and discovery
+  health. Batch ``check_n`` cost shipped in v2.5.7.
+- **Metering, SLA, usage, and delivery regression tests (#414)** — metering
+  windows, SLA boundaries, audit queries, the existing one-time
+  ``delegate_urn`` column add, usage pagination, webhook status band, batch
+  size, OpenAPI schema depth, and snapshot-loop edges.
+- **Refresh, cache, and revocation regression tests (#415)** — OAuth refresh
+  on the buffer second, introspection cache expiry, discovery and registry
+  cache TTL, delegation expiry, ack timeout, revocation of a non-agent URN,
+  and dashboard action edges.
+- **Expiry, receipt, and session regression tests (#416)** — receipt reads
+  at exact expiry, registration receipts, reactivation lifetime, approval
+  deadlines, host JWT skew, scope-claim types, envelope timestamps, and
+  compliance preflight edges.
+- **Lifetime and size regression tests (#417)** — verify and reactivate
+  lifetime edges, blank IssueOps fields, request and decompressed size caps,
+  WebSocket idle and heartbeat fences, and truncated key age
+  (``timedelta.days`` inside ``warn_if_key_old``, distinct from the truncated
+  public-key fence in #413).
+### Migration
+- **v2.5.7 → v2.5.8**: See [migration guide](docs/migration.md#upgrading-from-v257-to-v258).
+  No wire-protocol or manifest schema breaking changes. Installs of the
+  optional ``[mcp]`` extra now require ``mcp>=1.30.0,<2``.
+---
 ## [2.5.7] - 2026-10-11
 **Quality & coverage patch** — correct batch HTTP rate-limit accounting,
 transitive dependency overrides for CI security gates, `apps/web` audit-ci
 enforcement, and consolidated regression tests on `main` via
-[#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399).
+[#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399).
 This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
 at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
 Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)
@@ -37,11 +97,11 @@ Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.
 - **Transitive Python deps** — ``uv`` override pins for advisories on optional
   integration paths (``multidict``, ``pydantic-ai``, ``werkzeug``, ``fsspec``)
-  so CI ``pip-audit`` stays green ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)
+  so CI ``pip-audit`` stays green ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)
   train).
 - **`apps/web` npm audit** — CI uses ``audit-ci`` with ``audit-ci.jsonc``;
   production overrides bump ``sharp`` and ``source-map-js``
-  ([#394](https://github.com/asap-protocol/asap-protocol/pull/394) train).
+  ([#395](https://github.com/asap-protocol/asap-protocol/pull/395) train).
 ### Quality
@@ -56,9 +116,11 @@ Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.
 ### Migration
 - **v2.5.6 → v2.5.7**: See [migration guide](docs/migration.md#upgrading-from-v256-to-v257).
-  No wire-protocol or manifest schema breaking changes. Operators relying on
-  batch endpoints should expect slightly stricter rate limiting when ``check_n``
-  is used (intended behavior).
+  No wire-protocol or manifest schema breaking changes. Operators using
+  JSON-RPC batch or other ``check_n`` paths should expect quota to reflect batch
+  size; oversized batches that v2.5.6 could accept may now raise
+  ``RateLimitExceeded`` (intended behavior). With default limits, a batch of 50
+  against ``10/second`` can trip in one call.
 ---

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/PKG-INFO RENAMED Viewed

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: asap-protocol
-Version: 2.5.7
+Version: 2.5.8
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/asap-protocol/asap-protocol
 Project-URL: Documentation, https://asap-protocol.github.io/asap-protocol
@@ -73,7 +73,7 @@ Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.28.1; extra == 'mcp'
+Requires-Dist: mcp<2,>=1.30.0; extra == 'mcp'
 Provides-Extra: openapi
 Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 > A production-ready protocol for agent-to-agent communication and task coordination.
-**Quick Info**: [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
-> 📦 **Install** — [`asap-protocol` **2.5.7** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.8** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
@@ -156,16 +156,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.7)
+uv add asap-protocol  # latest on PyPI (currently 2.5.8)
 ```
 Or with pip:
 ```bash
-pip install asap-protocol==2.5.7
+pip install asap-protocol==2.5.8
 ```
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.7; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.8; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
-**Python v2.5.7** (quality & coverage patch) is **shipped** — see [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.8** (security & coverage patch) is **shipped** — see [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 ## Quick Start
@@ -265,7 +265,8 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 | Version | What shipped |
 | :-- | :-- |
-| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
+| **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
@@ -291,7 +292,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.7** is the quality/coverage patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.8** is the security/coverage patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/README.md RENAMED Viewed

@@ -7,9 +7,9 @@
 > A production-ready protocol for agent-to-agent communication and task coordination.
-**Quick Info**: [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
-> 📦 **Install** — [`asap-protocol` **2.5.7** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.8** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
@@ -64,16 +64,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.7)
+uv add asap-protocol  # latest on PyPI (currently 2.5.8)
 ```
 Or with pip:
 ```bash
-pip install asap-protocol==2.5.7
+pip install asap-protocol==2.5.8
 ```
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.7; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.8; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
-**Python v2.5.7** (quality & coverage patch) is **shipped** — see [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.8** (security & coverage patch) is **shipped** — see [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 ## Quick Start
@@ -173,7 +173,8 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 | Version | What shipped |
 | :-- | :-- |
-| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
+| **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
@@ -199,7 +200,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.7** is the quality/coverage patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.8** is the security/coverage patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/pyproject.toml RENAMED Viewed

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.7"
+version = "2.5.8"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -84,8 +84,8 @@ webauthn = [
 ]
 # Framework integration extras.
 mcp = [
-    # Floor 1.28.1 for CVE-2026-52869 / CVE-2026-52870 / CVE-2026-59950.
-    "mcp>=1.28.1",
+    # Floor 1.30.0 for CVE-2026-59951 (prior: 1.28.1 for CVE-2026-52869 / 52870 / 59950).
+    "mcp>=1.30.0,<2",
 ]
 langchain = [
     "langchain-core>=1.3.3",
@@ -124,13 +124,14 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # Override transitive dependencies for security fixes:
 # - pyjwt>=2.14.0 for PYSEC-2026-4140–4152 (prior: CVE-2026-32597 baseline at 2.12.0)
 # - anyio>=4.14.2 for PYSEC-2026-4024 / PYSEC-2026-4025
-# - aiohttp>=3.14.3,<4 for PYSEC-2026-3545/3546/3547 (prior: CVE-2026-34993 / CVE-2026-47265 at >=3.14.0)
+# - aiohttp>=3.14.4,<4 for CVE-2026-111063/111064/111065/111066/111748/111749/111750 and GHSA-2g87-pp6c-29x5 (prior: PYSEC-2026-3545/3546/3547 at >=3.14.3)
 # - zeroconf>=0.149.5 for CVE-2026-47180/47183/47184 ([dns-sd] extra)
 # - pyasn1>=0.6.4 for CVE-2026-30922 / CVE-2026-59885 / CVE-2026-59886 / PYSEC-2026-3455/3456/3457 (transitive, auth/JWT stack)
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=50.0.0 for PYSEC-2026-3552 (PKCS7 Bleichenbacher; 3553/3554 fixed in 49.0.0; prior GHSA-537c-gmf6-5ccf at >=48.0.1)
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
-# - pillow>=12.3.0 for PYSEC-2026-2253–2257 (prior: CVE-2026-40192 at >=12.2.0; transitive, e.g. pdf/vision stacks)
+# - pillow>=13.0.0 for CVE-2026-112395/112397/112400/112404/112895/112896/112897/112899 (prior: PYSEC-2026-2253–2257 at >=12.3.0; transitive, e.g. pdf/vision stacks)
+# - certifi>=2026.10.19 for PYSEC-2026-4320 (transitive via requests/httpx)
 # - click>=8.3.3 for PYSEC-2026-2132 (transitive, e.g. typer / uvicorn / mkdocs stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
 # - python-multipart>=0.0.31 for CVE-2026-53538–53540 (FastAPI stack; prior floor 0.0.27)
@@ -159,14 +160,15 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # - fsspec>=2026.6.0 for CVE-2026-104851
 [tool.uv]
 override-dependencies = [
-    "aiohttp>=3.14.3,<4",
+    "aiohttp>=3.14.4,<4",
+    "certifi>=2026.10.19",
     "anyio>=4.14.2",
     "pyjwt>=2.14.0,<3",
     "pyasn1>=0.6.4",
     "tinytag>=2.2.1",
     "cryptography>=50.0.0,<51",
     "requests>=2.33.0",
-    "pillow>=12.3.0",
+    "pillow>=13.0.0",
     "click>=8.3.3",
     "pytest>=9.0.3",
     "python-multipart>=0.0.31",

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/__init__.py RENAMED Viewed

@@ -8,7 +8,7 @@ from __future__ import annotations
 from typing import Any
-__version__ = "2.5.7"
+__version__ = "2.5.8"
 __all__ = ["__version__", "create_from_openapi"]

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/.gitignore RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/LICENSE RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/agent.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/artifact.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/conversation.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/manifest.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/message.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/state_snapshot.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/entities/task.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/envelope.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/examples/shellclaw-jetson-capabilities.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/parts/data_part.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/parts/file_part.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/parts/resource_part.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/parts/template_part.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/parts/text_part.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/artifact_notify.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/mcp_resource_data.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/mcp_resource_fetch.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/mcp_tool_call.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/mcp_tool_result.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/message_send.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/state_query.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/state_restore.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/task_cancel.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/task_request.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/task_response.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/schemas/payloads/task_update.schema.json RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/auth_middleware.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/capability_map.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/config.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/errors.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/jwt_extractor.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/mcp/protected_server.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/openapi/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/openapi/approval.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/openapi/capability_mapper.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/openapi/factory.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/openapi/handler.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/adapters/openapi/spec_loader.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/_scope_parse.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/agent_jwt.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/agent_jwt_session.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/approval.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/capabilities.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/identity.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/introspection.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/jti_replay_cache.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/jwks.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/middleware.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/oauth2.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/oidc.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/scopes.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/self_auth.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/webauthn.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/auth/webauthn_store.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/_compat.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/audit_export.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/compliance_check.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/delegation.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/keys.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/manifest.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/repl.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/schemas.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/cli/trace.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/client/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/client/cache.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/client/http_client.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/client/market.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/client/revocation.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/client/trust.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/crypto/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/crypto/keys.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/crypto/models.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/crypto/signing.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/crypto/trust.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/crypto/trust_levels.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/discovery/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/discovery/dnssd.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/discovery/health.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/discovery/registry.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/discovery/validation.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/discovery/wellknown.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/audit.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/delegation.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/delegation_storage.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/hooks.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/metering.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/sla.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/sla_storage.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/economics/storage.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/errors.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/README.md RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/__init__.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/a2h_approval.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/agent_failover.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/auth_patterns.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/coordinator.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/echo_agent.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/error_recovery.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/long_running.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/mcp_client_demo.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/mcp_integration.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/multi_step_workflow.py RENAMED Viewed

File without changes

{asap_protocol-2.5.7 → asap_protocol-2.5.8}/src/asap/examples/orchestration.py RENAMED Viewed

File without changes

asap-protocol 2.5.7__tar.gz → 2.5.8__tar.gz

asap-protocol 2.5.7tar.gz → 2.5.8tar.gz