Sweep dependencies, pin uv in CI, and bump to 2.9.1

Raises the agentscore-py floor to 2.6.10, upgrades the lock, pins uv
0.12.13 on every setup-uv step, moves the osv-scanner binary to v2.6.0,
and runs vulture in CI over the same scope as the pre-push hook.

Author: vvillait88

.github/workflows/ci.yml

@@ -23,6 +23,8 @@ jobs:
 
       - name: Install uv
         uses: astral-sh/setup-uv@v10.1.0
+        with:
+          version: "0.12.13"
 
       - name: Set up Python
         run: uv python install 3.12
@@ -51,7 +53,7 @@ jobs:
         run: uv run ty check -c 'src.include=["examples"]'
 
       - name: Vulture
-        run: uv run vulture agentscore_commerce/ --min-confidence 80
+        run: uv run vulture . --min-confidence 80 --exclude .venv
 
       - name: Tests
         run: uv run pytest tests/ -v --cov=agentscore_commerce --cov-report=term-missing

.github/workflows/publish.yml

@@ -20,6 +20,8 @@ jobs:
       - uses: actions/checkout@v7
 
       - uses: astral-sh/setup-uv@v10.1.0
+        with:
+          version: "0.12.13"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -24,7 +24,7 @@ jobs:
 
       - name: Install osv-scanner
         run: |
-          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_arm64 -o osv-scanner
+          curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.6.0/osv-scanner_linux_arm64 -o osv-scanner
           chmod +x osv-scanner
 
       - name: Scan dependencies
@@ -40,6 +40,8 @@ jobs:
     steps:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.1.0
+        with:
+          version: "0.12.13"
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"

pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "2.9.0"
+version = "2.9.1"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
 keywords = ["agentscore", "agent-commerce", "agentic-payments", "402", "x402", "mpp", "machine-payments-protocol", "fastapi", "starlette", "flask", "django", "aiohttp", "sanic", "middleware", "trust", "reputation", "kyc", "identity", "stripe", "tempo", "solana", "base", "ai-agent"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
-    "agentscore-py>=2.6.9",
+    "agentscore-py>=2.6.10",
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",