Sweep dependencies, pin uv in CI, and bump to 2.9.1 (#136)

## Summary

Dependency sweep for python-commerce, plus the release bump to 2.9.1.

- `agentscore-py` floor `>=2.6.9` to `>=2.6.10`, the release published
earlier in this sweep, so merchants installing 2.9.1 get it.
- `uv lock --upgrade`: uvicorn 0.52.4 to 0.53.0, pyjwt 2.13.0 to 2.14.0,
httpx2/httpcore2 2.12.0 to 2.13.0, multidict 6.7.1 to 6.8.0, coverage,
fastapi-cloud-cli, lefthook, regex and tzdata. No prereleases in the
lock.
- uv is pinned in CI: every `astral-sh/setup-uv` step (ci, security,
publish) passes `version: "0.12.13"`, the org's CI standard for Python
repos, matching python-sdk.
- The osv-scanner binary the Dependency Scan job downloads moves from
v2.5.1 to v2.6.0.
- Hook and CI parity: the pre-push hook ran `vulture . --exclude .venv`
while CI ran `vulture agentscore_commerce/`, so CI never ran the check
the hook runs over `tests/` and `examples/`. CI now runs the hook's
scope; it passes today.
- Version 2.9.0 to 2.9.1, with `uv.lock` re-locked so its embedded
version matches.

Checked and found current: every bounded dependency sits at its PyPI
latest (`x402` 2.22.0, `pympp` 0.11.0, `cdp-sdk` 1.48.1, `stripe`
15.6.1, `redis` 8.1.0, `joserfc` 1.7.5, `httpx` 0.28.1), so no upper
bound is holding back a release. `pympp` and `x402` did not move, so
neither needs the registry's move checks. Actions: `setup-uv@v10.1.0`,
`pypa/gh-action-pypi-publish@v1.14.2`, `actions/setup-python@v7`,
`actions/checkout@v7`, `actions/cache@v6`, `useblacksmith/checkout@v1`
are all current. Dependabot covers uv and actions.

Not taken: `web3` stays on 7.16.0 though 8.0.0 is out and stable.
Nothing bounds it directly (cdp-sdk, x402 and pytempo all declare
`web3>=7.x`), but forcing `web3>=8` makes the resolver downgrade `pympp`
from 0.11.0 to 0.9.1, since pympp 0.11's tree does not accept web3 8.
The newest pympp on the payment path outranks a transitive web3 major,
so the resolver's choice is the right one; it moves when pympp's tree
allows it.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None.

## Test plan

From `uv sync --frozen --all-extras --all-groups`: `ruff check`, `ruff
format --check`, `ty check agentscore_commerce/`, `ty check` on
examples, `vulture . --min-confidence 80 --exclude .venv`, and `pytest`
(1869 passed, 4 skipped, 95.37% coverage against the 95% bar), all exit
0; `uv build` exit 0. `osv-scanner` 2.6.0 over `uv.lock`: 144 packages,
no issues. `pip-audit` over the exported requirements: exit 0.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Worked with Varun. The tag follows the merge.

Author: vvillait88

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v10.1.0
+        with:
+          version: "0.12.13"
 
       - name: Set up Python
         run: uv python install 3.12
@@ -51,7 +53,7 @@ jobs:
         run: uv run ty check -c 'src.include=["examples"]'
 
       - name: Vulture
-        run: uv run vulture agentscore_commerce/ --min-confidence 80
+        run: uv run vulture . --min-confidence 80 --exclude .venv
 
       - name: Tests
         run: uv run pytest tests/ -v --cov=agentscore_commerce --cov-report=term-missing

.github/workflows/publish.yml

@@ -20,6 +20,8 @@ jobs:
       - uses: actions/checkout@v7
 
       - uses: astral-sh/setup-uv@v10.1.0
+        with:
+          version: "0.12.13"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Install osv-scanner
         run: |
-          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_arm64 -o osv-scanner
+          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64 -o osv-scanner
           chmod +x osv-scanner
 
       - name: Scan dependencies
@@ -40,6 +40,8 @@ jobs:
     steps:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.1.0
+        with:
+          version: "0.12.13"
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"

pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "2.9.0"
+version = "2.9.1"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
 keywords = ["agentscore", "agent-commerce", "agentic-payments", "402", "x402", "mpp", "machine-payments-protocol", "fastapi", "starlette", "flask", "django", "aiohttp", "sanic", "middleware", "trust", "reputation", "kyc", "identity", "stripe", "tempo", "solana", "base", "ai-agent"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
-    "agentscore-py>=2.6.9",
+    "agentscore-py>=2.6.10",
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",