[vvillait88]

Summary

Maintenance sweep: uv lock --upgrade moves x402 2.25.0 to 2.26.0, a2a-sdk 1.2.3 to 1.3.0, stripe 16.0.0 to 16.0.1, pytempo 0.6.1 to 0.6.2, google-api-core, pyasn1, pydantic-settings, tzdata, and the dev tools (pytest 9.2.0, ruff 0.17.3, ty 0.0.94). pyproject.toml is unchanged.

Worked with: Varun.

No release: only the lock moved, so the wheel and sdist are unchanged. Merchants resolve within the declared ranges on their own.

x402 2.26 was read against the code before taking it, since the JS and Python packages version independently:

• FacilitatorConfig.create_headers is now typed as headers keyed by facilitator path ("verify", "settle", "supported"). That is the shape this library's Coinbase facilitator already builds and passes through CreateHeadersAuthProvider, which still exists, so nothing changes here.
• The new AfterSettleAbortError and the builder-code and paywall changes are additive on paths this library does not import. It imports x402.schemas (PaymentPayload, PaymentPayloadV1, ResourceConfig), x402.http, the EVM exact and upto schemes (identical across the two versions, as is Base USDC's EIP-712 name), and x402.extensions.bazaar when create_x402_server(bazaar=True). In 2.26 the bazaar extension requires the advertised HTTP method to fit the declared input (a body means POST, PUT or PATCH), so a correctly declared route advertises the same method as before.

Spec check: the A2A card's protocol version 1.0 matches upstream's latest release (v1.0.1), UCP's 2026-08-25 matches, and MPP payment discovery changed only an example's line wrapping since our last update.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

As CI runs them: ruff check ., ruff format --check ., ty check agentscore_commerce/, ty over examples, vulture (min confidence 80) and pytest tests/ (1674 passed, 4 skipped), all exit 0. OSV over uv.lock reports no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally (no behavior change; suite passes)
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (no public surface change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review (fresh context, read-only)

Verdict: approve. One correction to the PR body, no defect.

Lock-only, no release. Only uv.lock changes and pyproject.toml is untouched, so wheel and sdist metadata (including x402[evm,fastapi]>=2.9,<3 and a2a-sdk>=1.2.1) are identical; merchants resolve within the declared ranges themselves.

x402 2.25.0 to 2.26.0 on the paths this library imports.

• create_headers: FacilitatorConfig.create_headers is now typed Callable[[], dict[str, dict[str, str]]], and CreateHeadersAuthProvider.get_auth_headers now raises ValueError on a flat headers dict. _create_headers in payment/x402_server.py returns the path-keyed shape (verify, settle, supported), so it passes the new check.
• EVM exact and upto: mechanisms/evm/exact/server.py and mechanisms/evm/upto/server.py are byte-identical across versions. default_assets.py (where Base mainnet USDC's EIP-712 name: "USD Coin" lives) is byte-identical. evm/constants.py only adds two error codes.
• schemas: PaymentPayload.network now validates CAIP-2 format; v2 payloads are CAIP-2 already, PaymentPayloadV1 is unchanged in shape. ResourceConfig unchanged apart from the create_headers typing.
• server_base.py: adds AfterSettleAbortError handling, and an invalid facilitator verify result no longer runs on_verify_failure hooks (it flows through after_verify hooks and returns is_valid=False as before). This library registers no x402 server hooks, so neither change reaches it.
• New 1 MiB cap on facilitator control-plane response bodies (ResponseBodyTooLargeError); facilitator verify, settle and supported responses are far below that.

Correction: bazaar is on an imported path. The body says the bazaar changes are on paths this library does not import, but create_x402_server(..., bazaar=True) imports x402.extensions.bazaar and registers it. What changed there: the advertised HTTP method now has to fit the declared input (a declaration with a bodyType advertises POST, PUT or PATCH, otherwise GET, HEAD or DELETE, falling back to POST or GET), the input schema's method enum is narrowed to that method, and MCP inputs are left alone. For a correctly declared route the advertised method is unchanged, so this is a behavior refinement rather than a break, but it is a 2.26 change on our path and worth stating accurately.

Spec claims. A2A latest release is v1.0.1 (2026-05-28), matching the card's 1.0. UCP latest release is v2026-08-25, matching _DEFAULT_VERSION and the A2A extension URI. I did not re-read the MPP discovery diff.

Gates I ran on the PR head: installed x402 reads 2.26.0; pytest tests/ exit 0, 1674 passed, 4 skipped, coverage 97.44%.