[vvillait88]

Summary

Release 2.8.2. This publishes the 2026-10-22 maintenance sweep (#112):

• ty 0.0.90
• setup-uv v10.3.2
• uv 0.13.5
• pypi-publish v1.14.3

Two of those are security fixes:

• pypi-publish 1.14.3: fixes GHSA-5xjx-3w67-w9x9, a critical CA problem in the Sigstore chain that Trusted Publishing relies on. This release is the first one published with it.
• uv 0.13.4 and later: fixes GHSA-hq85-5cpj-mr62, the compromised emSign roots.

The source and runtime dependencies are unchanged, including the certifi>=2026.10.19 floor.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged.

Test plan

• uv lock moves only the project's own version.
• Sweep: ty 0.0.90, setup-uv v10.3.2, uv 0.13.5, pypi-publish v1.14.3 #112's gates ran on the same tree: ruff check, ruff format, ty, vulture, pytest (172 passed) and osv-scanner all pass.

Checklist

• Tests cover the new behavior, and the suite passes locally (no new behavior)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review: no blocking findings

Read at head cc00c42, which is one commit on top of main 813b899 (#112).

The diff is only the version. Two files, one line each.

• pyproject.toml: version 2.8.1 to 2.8.2.
• uv.lock: the [[package]] name = "agentscore-py" entry's version 2.8.1 to 2.8.2, the project's own version. No other line changes.
• uv lock --check with uv 0.13.5 passes on the head (24 packages).
• The certifi>=2026.10.19 floor is untouched.

2.8.2 is not taken yet.

• The tags matching v2.8 are v2.8.0 and v2.8.1.
• https://pypi.org/pypi/agentscore-py/2.8.2/json returns 404.
• Positive control: the same URL for 2.8.1 returns 200.

Publish workflow. publish.yml triggers on push: tags: ["v*"]. It runs on setup-uv v10.3.2 with uv 0.13.5 and sets the version from the tag with sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml. Exactly one line in pyproject.toml matches ^version = (line 7), so the sed rewrites only the project version. After that, uv build runs and pypa/gh-action-pypi-publish@v1.14.3 publishes. So a v2.8.2 tag on the squash commit publishes 2.8.2, and this is the first release to go out with the GHSA-5xjx-3w67-w9x9 fix in the publish action.

CI. gh pr checks 113 shows 13 rows, all pass, exit 0. The required ci, Dependency Scan and Python Audit checks are present and green.

Non-blocking. The source and runtime dependencies are the same as 2.8.1, so the 2.8.2 wheel will match 2.8.1 except for its version. That is the intent of cutting a release for this sweep, not a code fix consumers need.