asap-protocol 2.5.8__tar.gz → 2.5.9__tar.gz

{asap_protocol-2.5.8 → asap_protocol-2.5.9}/CHANGELOG.md

@@ -16,6 +16,66 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [2.5.9] - 2026-10-23
+
+**Security & CI patch** — promote `development` onto `main` after v2.5.8.
+Dependency floors, the `security (web)` job, and regression fences. This is
+**not** Formal Spec & Interop. npm `@asap-protocol/*` packages remain at
+**2.4.1**. PyPI `asap-compliance` remains **1.3.0**.
+Tag [`v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9)
+· PyPI `asap-protocol==2.5.9`.
+
+### Security
+
+- **Direct floors** — `brotli>=1.2.1` (PYSEC-2026-4322 / GHSA-9v8h-qqgm-4m35)
+  and `opentelemetry-api>=1.45.1` (CVE-2026-114603), with the matching SDK,
+  exporter, and instrumentation releases. These are published requirements.
+- **Repository uv overrides** — `fastmcp>=3.4.10,<4` (lock 3.4.11,
+  GHSA-7xgj-8392-5q4r) and `setuptools>=84.1.0` (lock 84.2.1,
+  GHSA-xmj3-9gf7-h52w). Another project's `pip install asap-protocol==2.5.9`
+  does not apply these pins.
+- **`apps/web` `fast-uri`** — override `^3.1.9` (GHSA-w74x-v6f9-j3xg and the other 3.1.8 advisories).
+- **`apps/web`** — Next.js and `eslint-config-next` **16.4.3**
+  (GHSA-2464-fhr4-w9xw, GHSA-p3m5-59mp-jv5r, GHSA-673q-mjm6-r5xr), `zod`
+  **4.6.7** (GHSA-mrhx-c7xc-m3w5), `shadcn` **4.22.1**, and `body-parser`
+  **^2.4.0** (GHSA-27r3-jxmh-p828). These pins are this repository's web
+  app, not PyPI requirements
+  ([#425](https://github.com/asap-protocol/asap-protocol/pull/425),
+  [#426](https://github.com/asap-protocol/asap-protocol/pull/426)).
+
+### CI
+
+- **One diff base** — the path filter and Prettier share `base_sha`. Pull
+  requests use `merge-base`. `quality (web)` checks out the pull-request
+  head. An empty base fails the format step
+  ([#425](https://github.com/asap-protocol/asap-protocol/pull/425)).
+- **Stack jobs** — unchanged stacks are skipped; a failed `changes` job
+  still runs the suite
+  ([#420](https://github.com/asap-protocol/asap-protocol/pull/420)).
+- **Coverage** — collected in the parallel test run. `serial_mcp` stays out
+  of xdist and is appended with `--cov-append`. The coverage job enforces
+  `--fail-under=85`
+  ([#419](https://github.com/asap-protocol/asap-protocol/pull/419)).
+- **`security (web)`** — npm audits for `apps/web` live in their own job.
+  Protect main requires it.
+
+### Quality
+
+- **Auth, billing, and registry fences (#423)** — identity binding, keys,
+  delegation allow-list and reissue, metering windows, usage intervals,
+  registry IO, batch, auth helpers, and circuit-open refresh.
+- **SLA and JWT fences (#426)** — oldest SLA timestamp on memory and SQLite,
+  legacy `alg: EdDSA` plus a real signature flip, and host/agent
+  `alg: Ed25519`.
+
+### Migration
+
+- **v2.5.8 → v2.5.9**: See [migration guide](docs/migration.md#upgrading-from-v258-to-v259).
+  No wire-protocol or manifest schema breaking changes. Installs pick up
+  `brotli>=1.2.1` and `opentelemetry-api>=1.45.1`.
+
+---
+
 ## [2.5.8] - 2026-10-21
 
 **Security & coverage patch** — record the repository dependency overrides

{asap_protocol-2.5.8 → asap_protocol-2.5.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: asap-protocol
-Version: 2.5.8
+Version: 2.5.9
 Summary: Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication
 Project-URL: Homepage, https://github.com/asap-protocol/asap-protocol
 Project-URL: Documentation, https://asap-protocol.github.io/asap-protocol
@@ -22,7 +22,7 @@ Classifier: Typing :: Typed
 Requires-Python: >=3.13
 Requires-Dist: aiosqlite>=0.20
 Requires-Dist: authlib<2,>=1.6.12
-Requires-Dist: brotli>=1.2.0
+Requires-Dist: brotli>=1.2.1
 Requires-Dist: cryptography<51,>=50.0.0
 Requires-Dist: fastapi>=0.136.1
 Requires-Dist: httpx[http2]>=0.28.1
@@ -30,11 +30,11 @@ Requires-Dist: jcs>=0.2.0
 Requires-Dist: joserfc<2,>=1.6.7
 Requires-Dist: jsonschema>=4.23.0
 Requires-Dist: limits>=3.0
-Requires-Dist: opentelemetry-api>=1.20
-Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.20
-Requires-Dist: opentelemetry-instrumentation-fastapi>=0.41
-Requires-Dist: opentelemetry-instrumentation-httpx>=0.41
-Requires-Dist: opentelemetry-sdk>=1.20
+Requires-Dist: opentelemetry-api>=1.45.1
+Requires-Dist: opentelemetry-exporter-otlp-proto-grpc>=1.45.1
+Requires-Dist: opentelemetry-instrumentation-fastapi>=0.66b1
+Requires-Dist: opentelemetry-instrumentation-httpx>=0.66b1
+Requires-Dist: opentelemetry-sdk>=1.45.1
 Requires-Dist: packaging>=25.0
 Requires-Dist: pydantic<3,>=2.12.5
 Requires-Dist: python-ulid>=3.0
@@ -47,7 +47,7 @@ Provides-Extra: crewai
 Requires-Dist: crewai>=0.80; extra == 'crewai'
 Provides-Extra: dev
 Requires-Dist: asgi-lifespan>=2.1.0; extra == 'dev'
-Requires-Dist: brotli>=1.1.0; extra == 'dev'
+Requires-Dist: brotli>=1.2.1; extra == 'dev'
 Requires-Dist: fakeredis>=2.26.0; extra == 'dev'
 Requires-Dist: mypy>=1.19.1; extra == 'dev'
 Requires-Dist: pip-audit>=2.7; extra == 'dev'
@@ -99,9 +99,9 @@ Description-Content-Type: text/markdown
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.8** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.9** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -156,16 +156,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.8)
+uv add asap-protocol  # latest on PyPI (currently 2.5.9)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.8
+pip install asap-protocol==2.5.9
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.8; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.9; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -177,7 +177,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.8** (security & coverage patch) is **shipped** — see [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.9** (security & CI patch) is **shipped** — see [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -193,15 +193,7 @@ uv run python -m asap.examples.run_demo
 
 ## Testing
 
-```bash
-uv run pytest -n auto --tb=short
-```
-
-With coverage (separate run — do not combine with `-n auto`):
-
-```bash
-uv run pytest --tb=short --cov=asap --cov-report=term-missing --cov-fail-under=85
-```
+Fast loop, local coverage floor, and the CI argv are the [canonical commands](.cursor/README.md#canonical-commands).
 
 [Testing Guide](https://github.com/asap-protocol/asap-protocol/blob/main/docs/testing.md) (structure, fixtures, property/load/chaos tests). [Contributing](https://github.com/asap-protocol/asap-protocol/blob/main/CONTRIBUTING.md) (dev setup, CI).
 
@@ -265,6 +257,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.9** | **Security & CI patch** — **[GitHub Release `v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9)** · `brotli` 1.2.1, OpenTelemetry 1.45.1, `security (web)`, and regression fences ([#419](https://github.com/asap-protocol/asap-protocol/pull/419)–[#426](https://github.com/asap-protocol/asap-protocol/pull/426)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#259---2026-10-23) and [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259) |
 | **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
 | **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
@@ -292,7 +285,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.8** is the security/coverage patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.9** is the security/CI patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.8 → asap_protocol-2.5.9}/README.md

@@ -7,9 +7,9 @@
 
 > A production-ready protocol for agent-to-agent communication and task coordination.
 
-**Quick Info**: [`v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
+**Quick Info**: [`v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9) · PyPI [`asap-protocol`](https://pypi.org/project/asap-protocol/) | `Apache 2.0` | `Python 3.13+` | [Documentation](docs/index.md) | [Changelog](CHANGELOG.md)
 
-> 📦 **Install** — [`asap-protocol` **2.5.8** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
+> 📦 **Install** — [`asap-protocol` **2.5.9** on PyPI](https://pypi.org/project/asap-protocol/) (Python) · [`@asap-protocol/client` on npm](https://www.npmjs.com/package/@asap-protocol/client) (TypeScript)
 
 🚀 **Live now** our [**agentic marketplace**](https://asap-protocol.com/) — browse agents, register yours, request verification.
 
@@ -64,16 +64,16 @@ ASAP meets agents where they run — optional Python extras, npm tool bridges, a
 We recommend using [uv](https://github.com/astral-sh/uv) for dependency management:
 
 ```bash
-uv add asap-protocol  # latest on PyPI (currently 2.5.8)
+uv add asap-protocol  # latest on PyPI (currently 2.5.9)
 ```
 
 Or with pip:
 
 ```bash
-pip install asap-protocol==2.5.8
+pip install asap-protocol==2.5.9
 ```
 
-**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.8; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
+**TypeScript** (npm, **`2.4.1`** — unchanged for v2.5.9; `@asap-protocol/mcp-auth` HTTP middleware still deferred):
 
 - [`@asap-protocol/client`](https://www.npmjs.com/package/@asap-protocol/client) — [SDK docs](docs/sdks/typescript.md)
 - [`@asap-protocol/mastra`](https://www.npmjs.com/package/@asap-protocol/mastra) — [docs](docs/integrations/mastra.md) · [demo](apps/example-mastra/README.md)
@@ -85,7 +85,7 @@ npm install @asap-protocol/mastra@2.4.1 @asap-protocol/client @mastra/core zod
 npm install @asap-protocol/openai-agents@2.4.1 @asap-protocol/client @openai/agents zod
 ```
 
-**Python v2.5.8** (security & coverage patch) is **shipped** — see [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
+**Python v2.5.9** (security & CI patch) is **shipped** — see [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259). Dist Loop starters remain: [Build for agents](docs/guides/build-for-agents.md) · [starters](examples/starters/README.md).
 
 ## Quick Start
 
@@ -101,15 +101,7 @@ uv run python -m asap.examples.run_demo
 
 ## Testing
 
-```bash
-uv run pytest -n auto --tb=short
-```
-
-With coverage (separate run — do not combine with `-n auto`):
-
-```bash
-uv run pytest --tb=short --cov=asap --cov-report=term-missing --cov-fail-under=85
-```
+Fast loop, local coverage floor, and the CI argv are the [canonical commands](.cursor/README.md#canonical-commands).
 
 [Testing Guide](https://github.com/asap-protocol/asap-protocol/blob/main/docs/testing.md) (structure, fixtures, property/load/chaos tests). [Contributing](https://github.com/asap-protocol/asap-protocol/blob/main/CONTRIBUTING.md) (dev setup, CI).
 
@@ -173,6 +165,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 | Version | What shipped |
 | :-- | :-- |
+| **v2.5.9** | **Security & CI patch** — **[GitHub Release `v2.5.9`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.9)** · `brotli` 1.2.1, OpenTelemetry 1.45.1, `security (web)`, and regression fences ([#419](https://github.com/asap-protocol/asap-protocol/pull/419)–[#426](https://github.com/asap-protocol/asap-protocol/pull/426)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#259---2026-10-23) and [Migration (v2.5.8 → v2.5.9)](docs/migration.md#upgrading-from-v258-to-v259) |
 | **v2.5.8** | **Security & coverage patch** — **[GitHub Release `v2.5.8`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.8)** · repository uv overrides (`aiohttp`, `certifi`, `pillow`), optional `[mcp]` extra `mcp>=1.30.0,<2`, `apps/web` Vite `8.1.6`, and regression tests ([#413](https://github.com/asap-protocol/asap-protocol/pull/413)–[#417](https://github.com/asap-protocol/asap-protocol/pull/417)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#258---2026-10-21) and [Migration (v2.5.7 → v2.5.8)](docs/migration.md#upgrading-from-v257-to-v258) |
 | **v2.5.7** | **Quality & coverage patch** — **[GitHub Release `v2.5.7`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.7)** · batch rate-limit `check_n` fix, CI security gate deps + `apps/web` audit-ci, consolidated regression tests ([#394](https://github.com/asap-protocol/asap-protocol/pull/394)–[#399](https://github.com/asap-protocol/asap-protocol/pull/399)). npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#257---2026-10-11) and [Migration (v2.5.6 → v2.5.7)](docs/migration.md#upgrading-from-v256-to-v257) |
 | **v2.5.6** | **Security & quality patch** — **[GitHub Release `v2.5.6`](https://github.com/asap-protocol/asap-protocol/releases/tag/v2.5.6)** · Lite Registry IssueOps envelope + endpoint SSRF, compliance open-redirect SSRF, constrained capability execute, rotate-key lifecycle race, deps + regression tests. npm `@asap-protocol/*` remain **2.4.1**. See [CHANGELOG](CHANGELOG.md#256---2026-10-01) and [Migration (v2.5.5 → v2.5.6)](docs/migration.md#upgrading-from-v255-to-v256) |
@@ -200,7 +193,7 @@ High-level only — see **[Changelog](https://github.com/asap-protocol/asap-prot
 
 The [agentic marketplace](https://asap-protocol.com/) and Lite Registry are live. The **v2.5.x train** focuses on interop and adoption:
 
-- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.8** is the security/coverage patch above)
+- **Formal Spec & Interop** — RFC, introspection, privacy (PRD [prd-v2.5.5-formal-spec-interop.md](product/prd/prd-v2.5.5-formal-spec-interop.md); library **2.5.9** is the security/CI patch above)
 - **`@asap-protocol/mcp-auth`** (npm) — HTTP/SSE MCP middleware
 - **Formal spec track** — introspection, privacy, cross-protocol interop on the path to v3.0 economy
 

{asap_protocol-2.5.8 → asap_protocol-2.5.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "asap-protocol"
-version = "2.5.8"
+version = "2.5.9"
 description = "Async Simple Agent Protocol - A streamlined protocol for agent-to-agent communication"
 authors = [
     {name = "ASAP Protocol Contributors"}
@@ -39,18 +39,21 @@ dependencies = [
     "typer>=0.21.1",
     "watchfiles>=0.21.0",
     "websockets>=12.0",
-    "brotli>=1.2.0",
-    "opentelemetry-api>=1.20",
-    "opentelemetry-sdk>=1.20",
-    "opentelemetry-instrumentation-fastapi>=0.41",
-    "opentelemetry-instrumentation-httpx>=0.41",
-    "opentelemetry-exporter-otlp-proto-grpc>=1.20",
+    # Floor 1.2.1 for PYSEC-2026-4322 / GHSA-9v8h-qqgm-4m35 (decoder OOB write).
+    "brotli>=1.2.1",
+    # Floor 1.45.1 for CVE-2026-114603. SDK 1.45.1 requires this API;
+    # instrumentation 0.66b1 is the matching release.
+    "opentelemetry-api>=1.45.1",
+    "opentelemetry-sdk>=1.45.1",
+    "opentelemetry-instrumentation-fastapi>=0.66b1",
+    "opentelemetry-instrumentation-httpx>=0.66b1",
+    "opentelemetry-exporter-otlp-proto-grpc>=1.45.1",
 ]
 
 [project.optional-dependencies]
 dev = [
     "asgi-lifespan>=2.1.0",
-    "brotli>=1.1.0",
+    "brotli>=1.2.1",
     "pytest>=9.0.3",
     "pytest-asyncio>=0.24",
     "pytest-cov>=6.0",
@@ -84,7 +87,8 @@ webauthn = [
 ]
 # Framework integration extras.
 mcp = [
-    # Floor 1.30.0 for CVE-2026-59951 (prior: 1.28.1 for CVE-2026-52869 / 52870 / 59950).
+    # Floor 1.30.0 for CVE-2026-59951 (also covers CVE-2026-52869 / CVE-2026-52870 /
+    # CVE-2026-59950). Stay on 1.x: mcp 2.x replaces mcp.server.fastmcp and depends on httpx2.
     "mcp>=1.30.0,<2",
 ]
 langchain = [
@@ -124,14 +128,15 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # Override transitive dependencies for security fixes:
 # - pyjwt>=2.14.0 for PYSEC-2026-4140–4152 (prior: CVE-2026-32597 baseline at 2.12.0)
 # - anyio>=4.14.2 for PYSEC-2026-4024 / PYSEC-2026-4025
-# - aiohttp>=3.14.4,<4 for CVE-2026-111063/111064/111065/111066/111748/111749/111750 and GHSA-2g87-pp6c-29x5 (prior: PYSEC-2026-3545/3546/3547 at >=3.14.3)
+# - aiohttp>=3.14.4,<4 for CVE-2026-111063–111066 / CVE-2026-111748–111750 / GHSA-2g87-pp6c-29x5 (prior: PYSEC-2026-3545/3546/3547 at >=3.14.3)
 # - zeroconf>=0.149.5 for CVE-2026-47180/47183/47184 ([dns-sd] extra)
 # - pyasn1>=0.6.4 for CVE-2026-30922 / CVE-2026-59885 / CVE-2026-59886 / PYSEC-2026-3455/3456/3457 (transitive, auth/JWT stack)
 # - tinytag>=2.2.1 for CVE-2026-32889
 # - cryptography>=50.0.0 for PYSEC-2026-3552 (PKCS7 Bleichenbacher; 3553/3554 fixed in 49.0.0; prior GHSA-537c-gmf6-5ccf at >=48.0.1)
 # - requests>=2.33.0 for CVE-2026-25645 (extract_zipped_paths temp file)
-# - pillow>=13.0.0 for CVE-2026-112395/112397/112400/112404/112895/112896/112897/112899 (prior: PYSEC-2026-2253–2257 at >=12.3.0; transitive, e.g. pdf/vision stacks)
-# - certifi>=2026.10.19 for PYSEC-2026-4320 (transitive via requests/httpx)
+# - certifi>=2026.10.19 for PYSEC-2026-4320 (transitive via requests / httpx)
+# - pillow>=13.0.0 for the Pillow 12.3.0 advisories fixed in 13.0.0 (CVE-2026-112390 and related; prior: PYSEC-2026-2253–2257 at >=12.3.0)
+# - mcp>=1.30.0,<2 for CVE-2026-59951 (2.2.0+ also fixes it; 2.x breaks FastMCP — see SECURITY.md)
 # - click>=8.3.3 for PYSEC-2026-2132 (transitive, e.g. typer / uvicorn / mkdocs stacks)
 # - pytest>=9.0.3 for CVE-2025-71176 (dev)
 # - python-multipart>=0.0.31 for CVE-2026-53538–53540 (FastAPI stack; prior floor 0.0.27)
@@ -151,13 +156,16 @@ Issues = "https://github.com/asap-protocol/asap-protocol/issues"
 # - joserfc>=1.6.7 for CVE-2026-48990 (JWT/JWS primitives; direct + override)
 # - python-engineio>=4.13.2 for CVE-2026-48802 / CVE-2026-48809 (transitive, locust stack)
 # - python-socketio>=5.16.2 for CVE-2026-48804 (transitive, locust stack)
-# - setuptools>=83.0.0 for PYSEC-2026-3447 (transitive build/tooling path)
+# - setuptools>=84.1.0 for GHSA-xmj3-9gf7-h52w (also covers PYSEC-2026-3447)
+# - fastmcp>=3.4.10,<4 for GHSA-7xgj-8392-5q4r (transitive via pydantic-ai)
 # - pyopenssl>=26.4.0 for cryptography 50 ABI (webauthn extra; GEN_EMAIL / PKCS7)
 # - mkdocs-material>=9.7.7 for PYSEC-2026-3864 / CVE-2026-73295 (DOM XSS in search.suggest)
 # - multidict>=6.9.1 for CVE-2026-104874
 # - pydantic-ai>=1.107.7,<2 for CVE-2026-107287–107291
 # - werkzeug>=3.1.9 for CVE-2026-102598
 # - fsspec>=2026.6.0 for CVE-2026-104851
+# - opentelemetry-api>=1.45.1 for CVE-2026-114603 (SDK and instrumentation move with it)
+# - brotli>=1.2.1 for PYSEC-2026-4322 / GHSA-9v8h-qqgm-4m35 (direct dependency)
 [tool.uv]
 override-dependencies = [
     "aiohttp>=3.14.4,<4",
@@ -169,6 +177,7 @@ override-dependencies = [
     "cryptography>=50.0.0,<51",
     "requests>=2.33.0",
     "pillow>=13.0.0",
+    "mcp>=1.30.0,<2",
     "click>=8.3.3",
     "pytest>=9.0.3",
     "python-multipart>=0.0.31",
@@ -188,7 +197,8 @@ override-dependencies = [
     "joserfc>=1.6.7,<2",
     "python-engineio>=4.13.2",
     "python-socketio>=5.16.2",
-    "setuptools>=83.0.0",
+    "setuptools>=84.1.0",
+    "fastmcp>=3.4.10,<4",
     "h2>=4.4.1",
     "pyopenssl>=26.4.0",
     "mkdocs-material>=9.7.7",
@@ -196,6 +206,8 @@ override-dependencies = [
     "pydantic-ai>=1.107.7,<2",
     "werkzeug>=3.1.9",
     "fsspec>=2026.6.0",
+    "opentelemetry-api>=1.45.1",
+    "brotli>=1.2.1",
 ]
 
 [project.scripts]
@@ -349,8 +361,11 @@ addopts = [
     "--strict-markers",
     "--strict-config",
 ]
-# Coverage options: use explicitly when needed (e.g., pytest --tb=short --cov=asap --cov-report=xml --cov-fail-under=85)
-# NOT included in addopts to avoid conflicts with pytest-xdist (-n auto)
+# Coverage flags stay out of addopts: a partial run would fail the project-wide floor.
+# Commands: .cursor/README.md#canonical-commands
+markers = [
+    "serial_mcp: MCP example server started as a subprocess. Keep the test out of pytest-xdist; CI runs pytest for it outside xdist with --cov-append.",
+]
 testpaths = ["tests"]
 # Note: benchmarks/ excluded from testpaths - Locust monkey-patches gevent/ssl which
 # conflicts with pytest-xdist. Run benchmarks separately: uv run pytest benchmarks/
@@ -368,6 +383,9 @@ filterwarnings = [
 [tool.coverage.run]
 source = ["asap"]
 branch = true
+# The CI coverage job reads the data file on another runner. Relative paths
+# still resolve after checkout; absolute workspace paths would not.
+relative_files = true
 omit = [
     "src/asap/examples/*",  # Runnable examples and demos; tested via tests/examples/
     "src/asap/discovery/dnssd.py",  # P3 optional, deferred to v1.1.1+

{asap_protocol-2.5.8 → asap_protocol-2.5.9}/src/asap/__init__.py

@@ -8,7 +8,7 @@ from __future__ import annotations
 
 from typing import Any
 
-__version__ = "2.5.8"
+__version__ = "2.5.9"
 
 __all__ = ["__version__", "create_from_openapi"]