asap-protocol 2.5.7__tar.gz → 2.5.9__tar.gz

{asap_protocol-2.5.7 → asap_protocol-2.5.9}/CHANGELOG.md

@@ -16,12 +16,132 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.5.9] - 2026-10-23
+
+**Security & CI patch** — promote `development` onto `main` after v2.5.8.
+Dependency floors, the `security (web)` job, and regression fences. This is
+**not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain at
+**2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9)
+· PyPI `asap-protocol==2.5.9`.
+
+### Security
+
+- **Direct floors** — `brotli>=1.2.1` (PYSEC-2026-4322 / GHSA-9v8h-qqgm-4m35)
+  and `opentelemetry-api>=1.45.1` (CVE-2026-114603), with the matching SDK,
+  exporter, and instrumentation releases. These are published requirements.
+- **Repository uv overrides** — `fastmcp>=3.4.10,<4` (lock 3.4.11,
+  GHSA-7xgj-8392-5q4r) and `setuptools>=84.1.0` (lock 84.2.1,
+  GHSA-xmj3-9gf7-h52w). Another project's `pip install asap-protocol==2.5.9`
+  does not apply these pins.
+- **`apps/web` `fast-uri`** — override `^3.1.9` (GHSA-w74x-v6f9-j3xg and the other 3.1.8 advisories).
+- **`apps/web`** — Next.js and `eslint-config-next` **16.4.3**
+  (GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r, GHSA-673q-mjm6-r5xr), `zod`
+  **4.6.7** (GHSA-mrhx-c7xc-m3w5), `shadcn` **4.22.1**, and `body-parser`
+  **^2.4.0** (GHSA-27r3-jxmh-p828). These pins are this repository's web
+  app, not PyPI requirements
+  ([#425](https://github.com/asap-protocol/asap-protocol/pull/425),
+  [#426](https://github.com/asap-protocol/asap-protocol/pull/426)).
+
+### CI
+
+- **One diff base** — the path filter and Prettier share `base_sha`. Pull
+  requests use `merge-base`. `quality (web)` checks out the pull-request
+  head. An empty base fails the format step
+  ([#425](https://github.com/asap-protocol/asap-protocol/pull/425)).
+- **Stack jobs** — unchanged stacks are skipped; a failed `changes` job
+  still runs the suite
+  ([#420](https://github.com/asap-protocol/asap-protocol/pull/420)).
+- **Coverage** — collected in the parallel test run. `serial_mcp` stays out
+  of xdist and is appended with `--cov-append`. The coverage job enforces
+  `--fail-under=85`
+  ([#419](https://github.com/asap-protocol/asap-protocol/pull/419)).
+- **`security (web)`** — npm audits for `apps/web` live in their own job.
+  Protect main requires it.
+
+### Quality
+
+- **Auth, billing, and registry fences (#423)** — identity binding, keys,
+  delegation allow-list and reissue, metering windows, usage intervals,
+  registry IO, batch, auth helpers, and circuit-open refresh.
+- **SLA and JWT fences (#426)** — oldest SLA timestamp on memory and SQLite,
+  legacy `alg: EdDSA` plus a real signature flip, and host/agent
+  `alg: Ed25519`.
+
+### Migration
+
+- **v2.5.8 → v2.5.9**: See [migration guide](docs/migration.md#upgrading-from-v258-to-v259).
+  No wire-protocol or manifest schema breaking changes. Installs pick up
+  `brotli>=1.2.1` and `opentelemetry-api>=1.45.1`.
+
+---
+
+## [2.5.8] - 2026-10-21
+
+**Security & coverage patch** — record the repository dependency overrides
+and regression tests that landed on `main` after v2.5.7 via
+[#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417).
+This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
+at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)
+· PyPI `asap-protocol==2.5.8`.
+
+### Security
+
+- **Repository uv overrides and `[mcp]` extra (#413)** —
+  ``[tool.uv] override-dependencies`` pins ``aiohttp>=3.14.4,<4``
+  (CVE-2026-111063 and related), ``certifi>=2026.10.19`` (PYSEC-2026-4320),
+  and ``pillow>=13.0.0`` (CVE-2026-112395 / 112397 / 112400 / 112404 /
+  112895 / 112896 / 112897 / 112899). Those overrides apply in this
+  repository. They are not requirements of the published wheel. The
+  optional ``[mcp]`` extra requires ``mcp>=1.30.0,<2`` (CVE-2026-59951).
+- **`apps/web` Vite (#413)** — npm override pins ``vite`` to ``8.1.6``
+  (GHSA-587h-7wmj-h5pm and the other launch-editor advisories on Vite
+  8.0.0–8.1.5). This pin is the web app in this repository, not a PyPI
+  requirement.
+- **`apps/web` audit CI** — ``quality (web)`` installs npm 11.21.0 before
+  ``npm audit`` and ``audit-ci``. ``audit-ci.jsonc`` sets
+  ``package-manager`` to ``npm``. npm 10 (Node 20) and pnpm 9 still call
+  the retired ``/-/npm/v1/security/audits/quick`` endpoint. Both audit
+  steps retry a registry 503 and still fail immediately on a real advisory.
+
+### Quality
+
+- **Quota, replay, and nonce regression tests (#413)** — webhook partial
+  refill, truncated public keys, JTI eviction, nonce expiry, and discovery
+  health. Batch ``check_n`` cost shipped in v2.5.7.
+- **Metering, SLA, usage, and delivery regression tests (#414)** — metering
+  windows, SLA boundaries, audit queries, the existing one-time
+  ``delegate_urn`` column add, usage pagination, webhook status band, batch
+  size, OpenAPI schema depth, and snapshot-loop edges.
+- **Refresh, cache, and revocation regression tests (#415)** — OAuth refresh
+  on the buffer second, introspection cache expiry, discovery and registry
+  cache TTL, delegation expiry, ack timeout, revocation of a non-agent URN,
+  and dashboard action edges.
+- **Expiry, receipt, and session regression tests (#416)** — receipt reads
+  at exact expiry, registration receipts, reactivation lifetime, approval
+  deadlines, host JWT skew, scope-claim types, envelope timestamps, and
+  compliance preflight edges.
+- **Lifetime and size regression tests (#417)** — verify and reactivate
+  lifetime edges, blank IssueOps fields, request and decompressed size caps,
+  WebSocket idle and heartbeat fences, and truncated key age
+  (``timedelta.days`` inside ``warn_if_key_old``, distinct from the truncated
+  public-key fence in #413).
+
+### Migration
+
+- **v2.5.7 → v2.5.8**: See [migration guide](docs/migration.md#upgrading-from-v257-to-v258).
+  No wire-protocol or manifest schema breaking changes. Installs of the
+  optional ``[mcp]`` extra now require ``mcp>=1.30.0,<2``.
+
+---
+
 ## [2.5.7] - 2026-10-11
 
 **Quality & coverage patch** — correct batch HTTP rate-limit accounting,
 transitive dependency overrides for CI security gates, `apps/web` audit-ci
 enforcement, and consolidated regression tests on `main` via
-[#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399).
+[#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399).
 This is **not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain
 at **2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
 Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)
@@ -37,11 +157,11 @@ Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.
 
 - **Transitive Python deps** — ``uv`` override pins for advisories on optional
   integration paths (``multidict``, ``pydantic-ai``, ``werkzeug``, ``fsspec``)
-  so CI ``pip-audit`` stays green ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)
+  so CI ``pip-audit`` stays green ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)
   train).
 - **`apps/web` npm audit** — CI uses ``audit-ci`` with ``audit-ci.jsonc``;
   production overrides bump ``sharp`` and ``source-map-js``
-  ([#394](https://github.com/asap-protocol/asap-protocol/pull/394) train).
+  ([#395](https://github.com/asap-protocol/asap-protocol/pull/395) train).
 
 ### Quality
 
@@ -56,9 +176,11 @@ Tag [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.
 ### Migration
 
 - **v2.5.6 → v2.5.7**: See [migration guide](docs/migration.md#upgrading-from-v256-to-v257).
-  No wire-protocol or manifest schema breaking changes. Operators relying on
-  batch endpoints should expect slightly stricter rate limiting when ``check_n``
-  is used (intended behavior).
+  No wire-protocol or manifest schema breaking changes. Operators using
+  JSON-RPC batch or other ``check_n`` paths should expect quota to reflect batch
+  size; oversized batches that v2.5.6 could accept may now raise
+  ``RateLimitExceeded`` (intended behavior). With default limits, a batch of 50
+  against ``10/second`` can trip in one call.
 
 ---
 

{asap_protocol-2.5.7 → asap_protocol-2.5.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: asap-protocol
-Version: 2.5.7
+Version: 2.5.9
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/asap-protocol/asap-protocol
 Project-URL: Documentation, https://asap-protocol.github.io/asap-protocol
@@ -22,7 +22,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.13
 Requires-Dist: aiosqlite>=0.20
 Requires-Dist: authlib<2,>=1.6.12
-Requires-Dist: brotli>=1.2.0
+Requires-Dist: brotli>=1.2.1
 Requires-Dist: cryptography<51,>=50.0.0
 Requires-Dist: fastapi>=0.136.1
 Requires-Dist: httpx[http2]>=0.28.1
@@ -30,11 +30,11 @@ Requires-Dist: jcs>=0.2.0
 Requires-Dist: joserfc<2,>=1.6.7
 Requires-Dist: jsonschema>=4.23.0
 Requires-Dist: limits>=3.0
-Requires-Dist: opentelemetry-api>=1.20
-Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20
-Requires-Dist: opentelemetry-instrumentation-fastapi>=0.41
-Requires-Dist: opentelemetry-instrumentation-httpx>=0.41
-Requires-Dist: opentelemetry-sdk>=1.20
+Requires-Dist: opentelemetry-api>=1.45.1
+Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.45.1
+Requires-Dist: opentelemetry-instrumentation-fastapi>=0.66b1
+Requires-Dist: opentelemetry-instrumentation-httpx>=0.66b1
+Requires-Dist: opentelemetry-sdk>=1.45.1
 Requires-Dist: packaging>=25.0
 Requires-Dist: pydantic<3,>=2.12.5
 Requires-Dist: python-ulid>=3.0
@@ -47,7 +47,7 @@ Provides-Extra: crewai
 Requires-Dist: crewai>=0.80; extra == 'crewai'
 Provides-Extra: dev
 Requires-Dist: asgi-lifespan>=2.1.0; extra == 'dev'
-Requires-Dist: brotli>=1.1.0; extra == 'dev'
+Requires-Dist: brotli>=1.2.1; extra == 'dev'
 Requires-Dist: fakeredis>=2.26.0; extra == 'dev'
 Requires-Dist: mypy>=1.19.1; extra == 'dev'
 Requires-Dist: pip-audit>=2.7; extra == 'dev'
@@ -73,7 +73,7 @@ Requires-Dist: langchain-core>=1.3.3; extra == 'langchain'
 Provides-Extra: llamaindex
 Requires-Dist: llama-index-core>=0.10; extra == 'llamaindex'
 Provides-Extra: mcp
-Requires-Dist: mcp>=1.28.1; extra == 'mcp'
+Requires-Dist: mcp<2,>=1.30.0; extra == 'mcp'
 Provides-Extra: openapi
 Requires-Dist: openapi-pydantic>=0.5; extra == 'openapi'
 Provides-Extra: openclaw
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.7** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.9** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -156,16 +156,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.7)
+uv add asap-protocol  # latest on PyPI (currently 2.5.9)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.7
+pip install asap-protocol==2.5.9
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.7; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.9; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.7** (quality & coverage patch) is **shipped** — see [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.9** (security & CI patch) is **shipped** — see [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -193,15 +193,7 @@ uv run python -m asap.examples.run_demo
 
 ## Testing
 
-```bash
-uv run pytest -n auto --tb=short
-```
-
-With coverage (separate run — do not combine with `-n auto`):
-
-```bash
-uv run pytest --tb=short --cov=asap --cov-report=term-missing --cov-fail-under=85
-```
+Fast loop, local coverage floor, and the CI argv are the [canonical commands](.cursor/README.md#canonical-commands).
 
 [Testing Guide](https://github.com/asap-protocol/asap-protocol/blob/main/docs/testing.md) (structure, fixtures, property/load/chaos tests). [Contributing](https://github.com/asap-protocol/asap-protocol/blob/main/CONTRIBUTING.md) (dev setup, CI).
 
@@ -265,7 +257,9 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
-| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
+| **v2.5.9** | **Security & CI patch** — **[GitHub Release `v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9)** · `brotli` 1.2.1, OpenTelemetry 1.45.1, `security (web)`, and regression fences ([#419](https://github.com/asap-protocol/asap-protocol/pull/419)–[#426](https://github.com/asap-protocol/asap-protocol/pull/426)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#259---2026-10-23) and [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259) |
+| **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
@@ -291,7 +285,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.7** is the quality/coverage patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.9** is the security/CI patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.7 → asap_protocol-2.5.9}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.7** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.9** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -64,16 +64,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.7)
+uv add asap-protocol  # latest on PyPI (currently 2.5.9)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.7
+pip install asap-protocol==2.5.9
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.7; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.9; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.7** (quality & coverage patch) is **shipped** — see [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.9** (security & CI patch) is **shipped** — see [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -101,15 +101,7 @@ uv run python -m asap.examples.run_demo
 
 ## Testing
 
-```bash
-uv run pytest -n auto --tb=short
-```
-
-With coverage (separate run — do not combine with `-n auto`):
-
-```bash
-uv run pytest --tb=short --cov=asap --cov-report=term-missing --cov-fail-under=85
-```
+Fast loop, local coverage floor, and the CI argv are the [canonical commands](.cursor/README.md#canonical-commands).
 
 [Testing Guide](https://github.com/asap-protocol/asap-protocol/blob/main/docs/testing.md) (structure, fixtures, property/load/chaos tests). [Contributing](https://github.com/asap-protocol/asap-protocol/blob/main/CONTRIBUTING.md) (dev setup, CI).
 
@@ -173,7 +165,9 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
-| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#395](https://github.com/asap-protocol/asap-protocol/pull/395)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
+| **v2.5.9** | **Security & CI patch** — **[GitHub Release `v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9)** · `brotli` 1.2.1, OpenTelemetry 1.45.1, `security (web)`, and regression fences ([#419](https://github.com/asap-protocol/asap-protocol/pull/419)–[#426](https://github.com/asap-protocol/asap-protocol/pull/426)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#259---2026-10-23) and [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259) |
+| **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
+| **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
 | **v2.5.5** | **Security & quality patch** — **[GitHub Release `v2.5.5`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.5)** · OpenAPI path-param climb, registry URN overwrite guard, marketplace SSRF DNS pin, capability-replace consent, fail-closed reactivate, Agent JWT persist/revoke races. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#255---2026-09-11) and [Migration (v2.5.4 → v2.5.5)](docs/migration.md#upgrading-from-v254-to-v255) |
 | **v2.5.4** | **Distribution Loop** — **[GitHub Release `v2.5.4`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.4)** · thin starters (`examples/starters/`), [Build for agents](docs/guides/build-for-agents.md), homepage agent-first CTAs, telemetry ops (no public metrics UI). See [CHANGELOG](CHANGELOG.md#254---2026-07-18), [PRD](product/prd/prd-v2.5.4-distribution-loop.md), and [Migration (v2.5.3 → v2.5.4)](docs/migration.md#upgrading-from-v253-to-v254) |
@@ -199,7 +193,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.7** is the quality/coverage patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.9** is the security/CI patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.7 → asap_protocol-2.5.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.7"
+version = "2.5.9"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -39,18 +39,21 @@ dependencies = [
     "typer>=0.21.1",
     "watchfiles>=0.21.0",
     "websockets>=12.0",
-    "brotli>=1.2.0",
-    "opentelemetry-api>=1.20",
-    "opentelemetry-sdk>=1.20",
-    "opentelemetry-instrumentation-fastapi>=0.41",
-    "opentelemetry-instrumentation-httpx>=0.41",
-    "opentelemetry-exporter-otlp-proto-grpc>=1.20",
+    # Floor 1.2.1 for PYSEC-2026-4322 / GHSA-9v8h-qqgm-4m35 (decoder OOB write).
+    "brotli>=1.2.1",
+    # Floor 1.45.1 for CVE-2026-114603. SDK 1.45.1 requires this API;
+    # instrumentation 0.66b1 is the matching release.
+    "opentelemetry-api>=1.45.1",
+    "opentelemetry-sdk>=1.45.1",
+    "opentelemetry-instrumentation-fastapi>=0.66b1",
+    "opentelemetry-instrumentation-httpx>=0.66b1",
+    "opentelemetry-exporter-otlp-proto-grpc>=1.45.1",
 ]
 
 [project.optional-dependencies]
 dev = [
     "asgi-lifespan>=2.1.0",
-    "brotli>=1.1.0",
+    "brotli>=1.2.1",
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24",
     "pytest-cov>=6.0",
@@ -84,8 +87,9 @@ webauthn = [
 ]
 # Framework integration extras.
 mcp = [
-    # Floor 1.28.1 for CVE-2026-52869 / CVE-2026-52870 / CVE-2026-59950.
-    "mcp>=1.28.1",
+    # Floor 1.30.0 for CVE-2026-59951 (also covers CVE-2026-52869 / CVE-2026-52870 /
+    # CVE-2026-59950). Stay on 1.x: mcp 2.x replaces mcp.server.fastmcp and depends on httpx2.
+    "mcp>=1.30.0,<2",
 ]
 langchain = [
     "langchain-core>=1.3.3",
@@ -124,13 +128,15 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # Override transitive dependencies for security fixes:
 # - pyjwt>=2.14.0 for PYSEC-2026-4140–4152 (prior: CVE-2026-32597 baseline at 2.12.0)
 # - anyio>=4.14.2 for PYSEC-2026-4024 / PYSEC-2026-4025
-# - aiohttp>=3.14.3,<4 for PYSEC-2026-3545/3546/3547 (prior: CVE-2026-34993 / CVE-2026-47265 at >=3.14.0)
+# - aiohttp>=3.14.4,<4 for CVE-2026-111063–111066 / CVE-2026-111748–111750 / GHSA-2g87-pp6c-29x5 (prior: PYSEC-2026-3545/3546/3547 at >=3.14.3)
 # - zeroconf>=0.149.5 for CVE-2026-47180/47183/47184 ([dns-sd] extra)
 # - pyasn1>=0.6.4 for CVE-2026-30922 / CVE-2026-59885 / CVE-2026-59886 / PYSEC-2026-3455/3456/3457 (transitive, auth/JWT stack)
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=50.0.0 for PYSEC-2026-3552 (PKCS7 Bleichenbacher; 3553/3554 fixed in 49.0.0; prior GHSA-537c-gmf6-5ccf at >=48.0.1)
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
-# - pillow>=12.3.0 for PYSEC-2026-2253–2257 (prior: CVE-2026-40192 at >=12.2.0; transitive, e.g. pdf/vision stacks)
+# - certifi>=2026.10.19 for PYSEC-2026-4320 (transitive via requests / httpx)
+# - pillow>=13.0.0 for the Pillow 12.3.0 advisories fixed in 13.0.0 (CVE-2026-112390 and related; prior: PYSEC-2026-2253–2257 at >=12.3.0)
+# - mcp>=1.30.0,<2 for CVE-2026-59951 (2.2.0+ also fixes it; 2.x breaks FastMCP — see SECURITY.md)
 # - click>=8.3.3 for PYSEC-2026-2132 (transitive, e.g. typer / uvicorn / mkdocs stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
 # - python-multipart>=0.0.31 for CVE-2026-53538–53540 (FastAPI stack; prior floor 0.0.27)
@@ -150,23 +156,28 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # - joserfc>=1.6.7 for CVE-2026-48990 (JWT/JWS primitives; direct + override)
 # - python-engineio>=4.13.2 for CVE-2026-48802 / CVE-2026-48809 (transitive, locust stack)
 # - python-socketio>=5.16.2 for CVE-2026-48804 (transitive, locust stack)
-# - setuptools>=83.0.0 for PYSEC-2026-3447 (transitive build/tooling path)
+# - setuptools>=84.1.0 for GHSA-xmj3-9gf7-h52w (also covers PYSEC-2026-3447)
+# - fastmcp>=3.4.10,<4 for GHSA-7xgj-8392-5q4r (transitive via pydantic-ai)
 # - pyopenssl>=26.4.0 for cryptography 50 ABI (webauthn extra; GEN_EMAIL / PKCS7)
 # - mkdocs-material>=9.7.7 for PYSEC-2026-3864 / CVE-2026-73295 (DOM XSS in search.suggest)
 # - multidict>=6.9.1 for CVE-2026-104874
 # - pydantic-ai>=1.107.7,<2 for CVE-2026-107287–107291
 # - werkzeug>=3.1.9 for CVE-2026-102598
 # - fsspec>=2026.6.0 for CVE-2026-104851
+# - opentelemetry-api>=1.45.1 for CVE-2026-114603 (SDK and instrumentation move with it)
+# - brotli>=1.2.1 for PYSEC-2026-4322 / GHSA-9v8h-qqgm-4m35 (direct dependency)
 [tool.uv]
 override-dependencies = [
-    "aiohttp>=3.14.3,<4",
+    "aiohttp>=3.14.4,<4",
+    "certifi>=2026.10.19",
     "anyio>=4.14.2",
     "pyjwt>=2.14.0,<3",
     "pyasn1>=0.6.4",
     "tinytag>=2.2.1",
     "cryptography>=50.0.0,<51",
     "requests>=2.33.0",
-    "pillow>=12.3.0",
+    "pillow>=13.0.0",
+    "mcp>=1.30.0,<2",
     "click>=8.3.3",
     "pytest>=9.0.3",
     "python-multipart>=0.0.31",
@@ -186,7 +197,8 @@ override-dependencies = [
     "joserfc>=1.6.7,<2",
     "python-engineio>=4.13.2",
     "python-socketio>=5.16.2",
-    "setuptools>=83.0.0",
+    "setuptools>=84.1.0",
+    "fastmcp>=3.4.10,<4",
     "h2>=4.4.1",
     "pyopenssl>=26.4.0",
     "mkdocs-material>=9.7.7",
@@ -194,6 +206,8 @@ override-dependencies = [
     "pydantic-ai>=1.107.7,<2",
     "werkzeug>=3.1.9",
     "fsspec>=2026.6.0",
+    "opentelemetry-api>=1.45.1",
+    "brotli>=1.2.1",
 ]
 
 [project.scripts]
@@ -347,8 +361,11 @@ addopts = [
     "--strict-markers",
     "--strict-config",
 ]
-# Coverage options: use explicitly when needed (e.g., pytest --tb=short --cov=asap --cov-report=xml --cov-fail-under=85)
-# NOT included in addopts to avoid conflicts with pytest-xdist (-n auto)
+# Coverage flags stay out of addopts: a partial run would fail the project-wide floor.
+# Commands: .cursor/README.md#canonical-commands
+markers = [
+    "serial_mcp: MCP example server started as a subprocess. Keep the test out of pytest-xdist; CI runs pytest for it outside xdist with --cov-append.",
+]
 testpaths = ["tests"]
 # Note: benchmarks/ excluded from testpaths - Locust monkey-patches gevent/ssl which
 # conflicts with pytest-xdist. Run benchmarks separately: uv run pytest benchmarks/
@@ -366,6 +383,9 @@ filterwarnings = [
 [tool.coverage.run]
 source = ["asap"]
 branch = true
+# The CI coverage job reads the data file on another runner. Relative paths
+# still resolve after checkout; absolute workspace paths would not.
+relative_files = true
 omit = [
     "src/asap/examples/*",  # Runnable examples and demos; tested via tests/examples/
     "src/asap/discovery/dnssd.py",  # P3 optional, deferred to v1.1.1+

{asap_protocol-2.5.7 → asap_protocol-2.5.9}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.5.7"
+__version__ = "2.5.9"
 
 __all__ = ["__version__", "create_from_openapi"]