[vvillait88]

Summary

Release 2.8.1. certifi below 2026.10.19 trusts emSign root certificates whose intermediate CA keys were compromised (GHSA-6q48-6c7w-9gw2). Someone holding one of those keys can issue a valid-looking certificate for any hostname, so a client that trusts them can have its TLS traffic intercepted by an on-path attacker. The SDK reaches certifi only through httpx, and httpx accepts any certifi, so an install could still resolve an affected version.

This release declares certifi>=2026.10.19 as a direct dependency. Any environment that installs 2.8.1 gets a certifi without the compromised roots. The lockfile moves certifi to 2026.10.19.

Worked with Varun.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

Unchanged. The one new runtime requirement is certifi>=2026.10.19, which httpx already pulls in.

Test plan

• uv sync --frozen --all-extras --all-groups, then uv run pytest (172 passed, 2 skipped), uv run ruff check . (clean); ruff format, ty and vulture ran green in CI.
• osv-scanner on uv.lock: no issues found. Before this change it reported the certifi advisory.

Checklist

• Tests cover the new behavior, and the suite passes locally (a dependency floor adds no behavior to test; the existing suite passes, 172 tests)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review of 52d4fe8: approve. No blocking defects; two small notes on the PR body.

Diff scope. Only pyproject.toml (+4/-1) and uv.lock (+6/-4). Every changed lock line read: agentscore-py 2.8.0 to 2.8.1, certifi added to its dependencies, { name = "certifi", specifier = ">=2026.10.19" } added to [package.metadata] requires-dist, and the certifi package entry moved 2026.10.18 to 2026.10.19. No other package moved. uv lock --check at the head sha: exit 0, 24 packages resolved.

certifi 2026.10.19 is the fix. GHSA-6q48-6c7w-9gw2 (critical, published 2026-10-20): pip certifi, vulnerable >= 2019.03.09, < 2026.10.19, first patched 2026.10.19. The floor matches. PyPI JSON lists 2026.10.19 as latest, not yanked; both lock hashes match PyPI exactly (wheel 42d35340...0e1b, 136464 bytes; sdist 035c1e85...a1ae, 137598 bytes; uploaded 2026-10-20T02:24Z).

Version elsewhere. None to move. agentscore/__init__.py __version__ and the client User-Agent both read importlib.metadata.version("agentscore-py"), and publish.yml rewrites pyproject.toml's version from the tag anyway. Grepped the head tree for 2.8.0/2.8.1/__version__: only pyproject.toml.

Release state. Tags top out at v2.8.0; PyPI agentscore-py latest is 2.8.0 and has no 2.8.1. Clear to tag after merge.

CI. All 13 rows pass (ci, test 3.11 through 3.15, Python Audit, Dependency Scan, CodeQL).

PR body notes (non-blocking).

1. Wording nuance: per the advisory, 2026.10.18 removed every emSign root and 2026.10.19 restored the unaffected ones, so 2026.10.18 itself trusts none of the compromised roots. The floor at 2026.10.19 is still right (it is the advisory's patched version and scanners key on it); "below 2026.10.19" in the body and the pyproject comment is the advisory's own framing, so fine to keep.
2. Checklist: "Tests cover the new behavior" is ticked, but no test was added; a dependency floor has no behavior a test here could pin, so either leave it unticked with that reason or say so beside the tick. "Lint, format, and type checks pass" is true (CI's ci job runs ruff format --check, ty check and vulture and is green), but the test plan lists only ruff check; worth naming the rest or pointing at CI.

Template headings all present, no em-dashes, no ticket ids, no session links.

[vvillait88]

Notes answered. Checklist: the tests box is now unticked with its reason (a dependency floor adds no behavior to test). Test plan now names ruff format, ty and vulture as run in CI. Wording: kept, since it follows the advisory's own affected range and the floor is its patched version.