[vvillait88]

Summary

Maintenance sweep, lock-only: anyio 4.15.1 to 4.16.0, pytest-asyncio 1.4.1 to 1.4.1.post1, ty 0.0.94 to 0.0.95. No manifest change. Requested by Varun as part of the weekly sweep.

No release: the wheel is byte-identical to main's build, and the sdist differs only in the bundled uv.lock (extracted and diffed), which installs never read.

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

none

Test plan

Ran locally after uv sync --all-extras --all-groups: ruff check, ruff format --check, ty, vulture and pytest (172 passed, coverage 99.81%) all exit 0.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed (nothing public changed)
• No secrets, credentials, or personal data in the diff or the tests

🤖 Generated with Claude Code

[vvillait88]

Review: lock-only sweep refresh

Verdict: safe to merge, and no release is needed. I found no defects.

• Diff: uv.lock only, with three version moves: anyio 4.15.1 to 4.16.0, pytest-asyncio 1.4.1 to 1.4.1.post1, and ty 0.0.94 to 0.0.95. pyproject.toml is untouched. The head is d894bae, branched from current main 4ae9a40.
• Gates on the head, each exit code read separately, invoked exactly as ci.yml runs them:
  • uv sync --all-extras --all-groups --locked: 0
  • ruff check .: 0
  • ruff format --check .: 0 (21 files)
  • ty check agentscore/: 0
  • vulture . vulture_whitelist.py --min-confidence 80 --exclude .venv: 0
  • pytest: 0, with 172 passed, 2 skipped, and coverage at 99.81% against the 95% floor
• The no-release claim holds. I ran uv build on main and on the head in separate worktrees.
  • The wheel shasums are identical (214d7f9c...), and diff -r of the unpacked wheels (10 files) exits 0.
  • In the sdist (33 files), diff -rq reports exactly one differing file, the bundled uv.lock. Installs never read it.
  • anyio is a runtime transitive (through httpx), but the wheel's metadata does not pin it, so a consumer resolves it independently of this lock.
• Nothing else to take:
  • uv lock --upgrade on the head produces no diff.
  • On PyPI, every direct and dev dependency is locked at its latest: ruff 0.17.3, ty 0.0.95, vulture 2.16, pytest-cov 7.1.0, respx 0.23.1, pytest-asyncio 1.4.1.post1, python-dotenv 1.2.4, lefthook 2.2.2, httpx 0.28.1, certifi 2026.10.23, anyio 4.16.0, pytest 9.2.0.
  • No holds registry entry applies. requires-python >=3.11 respects the 3.14-or-lower floor rule.
• CI: gh pr checks 117 exits 0, and all 12 rows pass: ci, test 3.11 through 3.15, Dependency Scan, Python Audit, and CodeQL.