From 9c7834abaf1faabb221ee605cd130cff28f9105c Mon Sep 17 00:00:00 2001
From: FanouZeng-TT <18280587072@163.com>
Date: Sun, 16 Aug 2026 12:24:28 +0800
Subject: [PATCH 1/2] fix: validate the published SDK dependency

---
 .github/workflows/conformance-tests.yml | 3 +++
 pyproject.toml                          | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/conformance-tests.yml b/.github/workflows/conformance-tests.yml
index cdd5424..a82547d 100644
--- a/.github/workflows/conformance-tests.yml
+++ b/.github/workflows/conformance-tests.yml
@@ -62,6 +62,9 @@ jobs:
       - name: Set up Python
         run: uv python install 3.12
 
+      - name: Validate published SDK dependency
+        run: uv sync --directory conformance/ --no-sources --no-install-project
+
       - name: Sync dependencies
         run: |
           uv sync --directory python-sdk/
diff --git a/pyproject.toml b/pyproject.toml
index 2270208..1eca52d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -11,7 +11,7 @@ dependencies = [
     "absl-py>=1.0.0",
     "httpx>=0.26.0",
     "pydantic>=2.12.0",
-    "ucp-sdk==0.3.0",
+    "ucp-sdk==0.4.4",
     "fastapi>=0.109.0",
     "uvicorn[standard]>=0.38.0",
     "ruff>=0.14.11",

From a21cd74712c966d76d8c54ffbd27b2892d98f4b6 Mon Sep 17 00:00:00 2001
From: FanouZeng-TT <18280587072@163.com>
Date: Sun, 16 Aug 2026 14:00:57 +0800
Subject: [PATCH 2/2] ci: pin conformance workflow actions

---
 .github/workflows/conformance-tests.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/conformance-tests.yml b/.github/workflows/conformance-tests.yml
index a82547d..6633449 100644
--- a/.github/workflows/conformance-tests.yml
+++ b/.github/workflows/conformance-tests.yml
@@ -38,24 +38,24 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out conformance repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           path: conformance
 
       - name: Check out samples repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           repository: Universal-Commerce-Protocol/samples
           path: samples
 
       - name: Check out SDK repo
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
         with:
           repository: Universal-Commerce-Protocol/python-sdk
           path: python-sdk
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
         with:
           prune-cache: false