Release 3.2.1: keep the signing key out of the malformed-JWK error

.github/workflows/ci.yml

@@ -24,10 +24,10 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set up Python
-        run: uv python install 3.12
+        run: uv python install 3.15
 
       - uses: actions/cache@v6
         with:
@@ -38,7 +38,7 @@ jobs:
           restore-keys: ${{ runner.os }}-uv-
 
       - name: Install dependencies
-        run: uv sync --frozen --all-extras
+        run: uv sync --frozen --all-extras --python 3.15
 
       - name: Ruff check
         run: uv run ruff check .
@@ -71,7 +71,7 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set up Python
         run: uv python install ${{ matrix.python }}

.github/workflows/publish.yml

@@ -21,7 +21,7 @@ jobs:
 
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
 
       - name: Set version from tag
         run: sed -i "s/^version = .*/version = \"${GITHUB_REF_NAME#v}\"/" pyproject.toml

.github/workflows/security.yml

@@ -41,10 +41,10 @@ jobs:
       - uses: useblacksmith/checkout@v1
       - uses: astral-sh/setup-uv@v10.3.0
         with:
-          version: "0.13.0"
+          version: "0.13.1"
       - uses: actions/setup-python@v7
         with:
-          python-version: "3.14"
+          python-version: "3.15"
 
       - name: Install pip-audit
         run: pip install pip-audit

agentscore_commerce/identity/ucp_jwks.py

@@ -583,9 +583,11 @@ def _build_env_signing_key(
 
         try:
             jwk_dict = json.loads(env_jwk)
-        except json.JSONDecodeError as exc:
-            msg = f"{env_jwk_var} is not valid JSON: {exc}"
-            raise ValueError(msg) from exc
+        except json.JSONDecodeError:
+            # The decode error holds the whole value in ``.doc``, which here is
+            # private key material, so it is not chained onto what is raised.
+            msg = f"{env_jwk_var} is not valid JSON."
+            raise ValueError(msg) from None
 
         if not isinstance(jwk_dict, dict) or not jwk_dict:
             msg = f"{env_jwk_var} must be a non-empty JWK object; got {type(jwk_dict).__name__}."

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-commerce"
-version = "3.2.0"
+version = "3.2.1"
 description = "Agentic commerce SDK for Python: identity middleware (FastAPI, Flask, Django, AIOHTTP, Sanic, ASGI) + payment helpers + 402 builders + discovery + Stripe multichain. The full merchant-side toolkit for AgentScore-powered agentic commerce."
 readme = "README.md"
 license = "MIT"

tests/test_load_ucp_signing_key_from_env.py

@@ -191,6 +191,15 @@ def test_malformed_json_raises_naming_env_var(monkeypatch) -> None:
         load_ucp_signing_key_from_env()
 
 
+def test_malformed_json_keeps_env_value_out_of_the_error(monkeypatch) -> None:
+    monkeypatch.setenv("UCP_SIGNING_KEY_JWK_PRIVATE", '{"secret":SENSITIVEBYTES}')
+    with pytest.raises(ValueError) as info:
+        load_ucp_signing_key_from_env()
+    assert "SENSITIVE" not in str(info.value)
+    assert info.value.__cause__ is None
+    assert info.value.__suppress_context__ is True
+
+
 def test_unsupported_kty_crv_raises_naming_actual(monkeypatch) -> None:
     monkeypatch.setenv(
         "UCP_SIGNING_KEY_JWK_PRIVATE",