Sweep dependencies, take agentscore-py 2.6.11 and x402 2.23.0, and bump to 2.9.2 (#137)

## Summary

Dependency sweep for python-commerce, plus the release bump to 2.9.2.
The `agentscore-py` floor moves to 2.6.11 (released today). The lock
upgrade takes x402 2.23.0, sentry-sdk 2.69.2, urllib3 2.8.0, yarl
1.25.1, propcache 0.5.4, idna 3.20, ruff 0.16.8 and ty 0.0.82, and scans
clean for prereleases. x402 2.23.0 was read from the sdist rather than
its version, per the holds registry: the EVM constants block (the Base
USDC domain we depend on) is byte-identical to 2.22.0; the facilitator
client's default timeout rises from 30s to 90s; the FastAPI and Flask
middleware now initialize at construction when
`sync_facilitator_on_start` is set and exit the process on a fatal
capability mismatch, which does not reach this library because it uses
only x402's schemas and settle types; the bazaar route template decodes
to a fixed point. The uv version the three workflows pass as a setup-uv
input moves from 0.12.13 to 0.12.16.

Worked with: Varun.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

none

## Test plan

Run locally on this branch after `uv lock --upgrade` and `uv sync
--all-extras --all-groups`: `ruff check`, `ruff format --check`, `ty
check agentscore_commerce/`, `ty check` over `examples`, `vulture`, and
`pytest tests/ --cov=agentscore_commerce` (1869 passed, 4 skipped, 95%
coverage). Nothing runtime changed on our side, so no new tests.
Release: tag v2.9.2 after merge and watch the publish run; core's store
takes it next.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.github/workflows/ci.yml

@@ -24,7 +24,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v10.1.0
         with:
-          version: "0.12.13"
+          version: "0.12.16"
 
       - name: Set up Python
         run: uv python install 3.12

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v10.1.0
         with:
-          version: "0.12.13"
+          version: "0.12.16"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -41,7 +41,7 @@ jobs:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.1.0
         with:
-          version: "0.12.13"
+          version: "0.12.16"
       - uses: actions/setup-python@v7
         with:
           python-version: "3.13"

pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "2.9.1"
+version = "2.9.2"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.11"
 keywords = ["agentscore", "agent-commerce", "agentic-payments", "402", "x402", "mpp", "machine-payments-protocol", "fastapi", "starlette", "flask", "django", "aiohttp", "sanic", "middleware", "trust", "reputation", "kyc", "identity", "stripe", "tempo", "solana", "base", "ai-agent"]
 dependencies = [
     "httpx>=0.25.0,<1.0.0",
-    "agentscore-py>=2.6.10",
+    "agentscore-py>=2.6.11",
 ]
 classifiers = [
     "Development Status :: 5 - Production/Stable",