Release 3.2.1: keep the signing key out of the malformed-JWK error (#165)

## Summary

Maintenance sweep for python-commerce, released as 3.2.1 because it
carries one fix to shipped code (the Python mirror of node-commerce
3.1.2).

**Fix: the signing key no longer travels with the malformed-JWK error.**
`load_ucp_signing_key_from_env` raised its "is not valid JSON"
`ValueError` `from` the `JSONDecodeError`, and that error keeps the
whole input in `.doc`, which here is the private JWK. Anything that
records chained exceptions (an error tracker, a traceback with locals)
received the key. The error now names the variable only and raises `from
None`.

Sweep:
- Relocked to current: fastapi 0.146.0, starlette 1.9.0, cdp-sdk 1.50.0,
joserfc 1.7.7, pydantic-settings 2.16.0, httpx2 and httpcore2 2.14.0,
ruff 0.17.1, ty 0.0.89, plus certifi, pluggy, wrapt, truststore,
bitarray and lefthook. The only prereleases in the lock are the three
OpenTelemetry packages that have never shipped a stable release,
unchanged from main.
- The uv pin in ci, publish and security moves from 0.13.0 to 0.13.1.
- The lint and type gate job runs on Python 3.15 (`uv sync --python
3.15`, so the job uses that interpreter rather than whichever one uv
finds first), and so does the pip-audit job. The test matrix still
covers 3.11 through 3.15.

Worked with Varun, as part of a three-session maintenance sweep.

Not done, on purpose: the `web3<8` constraint stays. Its lift condition
was re-tested: pympp 0.14.0 still requires `eth-abi<6` in both its
`tempo` and `stripe` extras. Optional-extra floors are unchanged, since
the published ranges already admit the new versions.

## Type of change

- [x] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

The malformed-JWK error's message is now `UCP_SIGNING_KEY_JWK_PRIVATE is
not valid JSON.` (or the configured variable name) without the decoder's
position detail, and it no longer chains the `JSONDecodeError`. The
exception type is unchanged.

## Test plan

A new test feeds a malformed value and asserts the message carries no
part of it, `__cause__` is None and the context is suppressed. It fails
against the previous `ucp_jwks.py` and passes with the fix. Run locally
on Python 3.15: ruff check, ruff format --check, ty (package and
examples), vulture and pytest (1674 passed, 4 skipped), each exit 0.
osv-scanner 2.7.0 over uv.lock reports no issues across 164 packages.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install 3.15
 
       - uses: actions/cache@v6
         with:
@@ -38,7 +38,7 @@ jobs:
           restore-keys: ${{ runner.os }}-uv-
 
       - name: Install dependencies
-        run: uv sync --frozen --all-extras
+        run: uv sync --frozen --all-extras --python 3.15
 
       - name: Ruff check
         run: uv run ruff check .
@@ -71,7 +71,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set up Python
         run: uv python install ${{ matrix.python }}

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -41,10 +41,10 @@ jobs:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.14"
+          python-version: "3.15"
 
       - name: Install pip-audit
         run: pip install pip-audit

agentscore_commerce/identity/ucp_jwks.py

@@ -583,9 +583,11 @@ def _build_env_signing_key(
 
         try:
             jwk_dict = json.loads(env_jwk)
-        except json.JSONDecodeError as exc:
-            msg = f"{env_jwk_var} is not valid JSON: {exc}"
-            raise ValueError(msg) from exc
+        except json.JSONDecodeError:
+            # The decode error holds the whole value in ``.doc``, which here is
+            # private key material, so it is not chained onto what is raised.
+            msg = f"{env_jwk_var} is not valid JSON."
+            raise ValueError(msg) from None
 
         if not isinstance(jwk_dict, dict) or not jwk_dict:
             msg = f"{env_jwk_var} must be a non-empty JWK object; got {type(jwk_dict).__name__}."

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "3.2.0"
+version = "3.2.1"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"

tests/test_load_ucp_signing_key_from_env.py

@@ -191,6 +191,15 @@ def test_malformed_json_raises_naming_env_var(monkeypatch) -> None:
         load_ucp_signing_key_from_env()
 
 
+def test_malformed_json_keeps_env_value_out_of_the_error(monkeypatch) -> None:
+    monkeypatch.setenv("UCP_SIGNING_KEY_JWK_PRIVATE", '{"secret":SENSITIVEBYTES}')
+    with pytest.raises(ValueError) as info:
+        load_ucp_signing_key_from_env()
+    assert "SENSITIVE" not in str(info.value)
+    assert info.value.__cause__ is None
+    assert info.value.__suppress_context__ is True
+
+
 def test_unsupported_kty_crv_raises_naming_actual(monkeypatch) -> None:
     monkeypatch.setenv(
         "UCP_SIGNING_KEY_JWK_PRIVATE",