Skip to content

Bump the python group across 1 directory with 6 updates - #17

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/app/python-c9602adcc7
Open

Bump the python group across 1 directory with 6 updates#17
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/app/python-c9602adcc7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python group with 6 updates in the /app directory:

Package From To
google-adk 2.9.0 2.11.0
google-genai 2.23.0 2.28.0
fastapi 0.141.1 0.142.2
uvicorn 0.52.4 0.54.0
python-dotenv 1.2.3 1.2.4
numpy 2.4.6 2.5.3

Updates google-adk from 2.9.0 to 2.11.0

Release notes

Sourced from google-adk's releases.

v2.11.0

2.11.0 (2026-10-01)

Highlights

This release adds graceful cancellation and tool confirmation to workflows, a tool for consulting another model mid-task, and a built-in SQLite memory service.

  • Execution cancellation: Pass an abort_signal to Runner, Workflow, and nodes to stop a run gracefully; /run_sse now cancels the run when the client disconnects. See the unit guide for more details. (ef5bbcf, 3d73603)
  • Tool confirmation in workflows: Tool nodes now pause for user approval via RequestInput, the same way an LlmAgent does, instead of passing an error downstream. (ce132b9)
  • ModelConsultTool: Let an agent consult another model mid-task, capped by per-turn and per-session budgets. See the unit guide for more details. (84cc99a)
  • SQLite memory service: Keep agent memory in a local SQLite database, selected with a sqlite:// memory service URI. (9625b06)
  • MCP SDK 2.x: Connect to MCP servers over the modern protocol through a new opt-in path. (e738c26)

Breaking changes

  • Dev UI runtime config is served by the server: The web server now serves /dev-ui/assets/config/runtime-config.json per request and no longer writes runtime-config.json into the installed package. If you edited or read that file, set the logo with --logo-text and --logo-image-url and fetch the config from the server instead. (3722746)

⚠ BREAKING CHANGES

  • serve the dev UI runtime config from the server instead of a file

Features

  • add a sample preloading memory profiles into the instruction (fdf1b7f)
  • add avatar configuration to server commands (e4c0d94), closes #5435
  • add max llm calls to server commands (14f4154), closes #5434
  • add optional abort_signal support to Runner, Workflow, and Nodes (ef5bbcf), closes #4796
  • add pagination to list_accessible_data_agents in data_agent toolset (46d5a2d)
  • add sqlite memory service (9625b06)
  • add the model consult session context handover layer (b2da4c6)
  • cli: wire abort_signal to /run_sse on client disconnect (3d73603)
  • default Vertex project from GCP metadata (8d8bbd2)
  • events: add internal metadata for ADK events (8e29f16)
  • honor tool_thread_pool_config for sync tools outside live mode (c50ade3)
  • let BigQuery tools run where CMEK is required (4d06641), closes #3931
  • live: default to a pre-built avatar for VIDEO live sessions (d5c9b11)
  • mark spans whose response came from a callback (9633ab9)
  • mcp: add an opt-in modern-protocol connect path for MCP SDK 2.x (e738c26)
  • plugins: add optional ToolCallIntegrityPlugin (b7efc4e)
  • propagate grounding metadata from MCP _meta (0960104), closes #6081
  • skip init.py for config-based adk create (d594b69), closes #6753
  • synthesize abort event and function response on cancellation (da65851)
  • telemetry: move skill telemetry span attributes out of experimental (e0f4c97)
  • tools: add ModelConsultTool with turn and session budgets (84cc99a)
  • tools: invoke advisor models without tools for model_consult (28c47b5)
  • workflow: pause tool nodes for tool confirmation via RequestInput (ce132b9)

... (truncated)

Changelog

Sourced from google-adk's changelog.

2.11.0 (2026-10-01)

Highlights

This release adds graceful cancellation and tool confirmation to workflows, a tool for consulting another model mid-task, and a built-in SQLite memory service.

  • Execution cancellation: Pass an abort_signal to Runner, Workflow, and nodes to stop a run gracefully; /run_sse now cancels the run when the client disconnects. See the unit guide for more details. (ef5bbcf, 3d73603)
  • Tool confirmation in workflows: Tool nodes now pause for user approval via RequestInput, the same way an LlmAgent does, instead of passing an error downstream. (ce132b9)
  • ModelConsultTool: Let an agent consult another model mid-task, capped by per-turn and per-session budgets. See the unit guide for more details. (84cc99a)
  • SQLite memory service: Keep agent memory in a local SQLite database, selected with a sqlite:// memory service URI. (9625b06)
  • MCP SDK 2.x: Connect to MCP servers over the modern protocol through a new opt-in path. (e738c26)

Breaking changes

  • Dev UI runtime config is served by the server: The web server now serves /dev-ui/assets/config/runtime-config.json per request and no longer writes runtime-config.json into the installed package. If you edited or read that file, set the logo with --logo-text and --logo-image-url and fetch the config from the server instead. (3722746)

⚠ BREAKING CHANGES

  • serve the dev UI runtime config from the server instead of a file

Features

  • add a sample preloading memory profiles into the instruction (fdf1b7f)
  • add avatar configuration to server commands (e4c0d94), closes #5435
  • add max llm calls to server commands (14f4154), closes #5434
  • add optional abort_signal support to Runner, Workflow, and Nodes (ef5bbcf), closes #4796
  • add pagination to list_accessible_data_agents in data_agent toolset (46d5a2d)
  • add sqlite memory service (9625b06)
  • add the model consult session context handover layer (b2da4c6)
  • cli: wire abort_signal to /run_sse on client disconnect (3d73603)
  • default Vertex project from GCP metadata (8d8bbd2)
  • events: add internal metadata for ADK events (8e29f16)
  • honor tool_thread_pool_config for sync tools outside live mode (c50ade3)
  • let BigQuery tools run where CMEK is required (4d06641), closes #3931
  • live: default to a pre-built avatar for VIDEO live sessions (d5c9b11)
  • mark spans whose response came from a callback (9633ab9)
  • mcp: add an opt-in modern-protocol connect path for MCP SDK 2.x (e738c26)
  • plugins: add optional ToolCallIntegrityPlugin (b7efc4e)
  • propagate grounding metadata from MCP _meta (0960104), closes #6081
  • skip init.py for config-based adk create (d594b69), closes #6753
  • synthesize abort event and function response on cancellation (da65851)
  • telemetry: move skill telemetry span attributes out of experimental (e0f4c97)
  • tools: add ModelConsultTool with turn and session budgets (84cc99a)
  • tools: invoke advisor models without tools for model_consult (28c47b5)
  • workflow: pause tool nodes for tool confirmation via RequestInput (ce132b9)
  • workflow: propagate skip_summarization from node tools to tool response (5a0421c)

... (truncated)

Commits
  • 9f7965e chore: update last-release-sha for next main release
  • 37327df chore(release/candidate): release 2.11.0 (#7373)
  • f1b0fb5 chore: drop the 2.11.0 release-as pin
  • adff14a chore: pin this release to 2.11.0
  • 731ea30 fix: dump validated schemas in JSON mode
  • 22df082 chore: update compiled adk web assets
  • 3e59f4d docs: add unit guide for Node and @​node
  • 0dd69ce test: stop the MCP no-streams test from depending on test order
  • ce132b9 feat(workflow): pause tool nodes for tool confirmation via RequestInput
  • 2daa303 fix: propagate url_prefix to FastAPI root_path
  • Additional commits viewable in compare view

Updates google-genai from 2.23.0 to 2.28.0

Release notes

Sourced from google-genai's releases.

v2.28.0

2.28.0 (2026-10-02)

Features

  • Add lyria-3.5, gemini-omni-1.1-flash, and gemini-omni-flash-preview to Interactions Model enum (1e8c0cc)
  • Support continuation_token in Interactions (d40ca70)

v2.27.0

2.27.0 (2026-10-01)

Features

  • Support continuation_token in GenerateContent (3931b29)

Documentation

v2.26.0

2.26.0 (2026-09-30)

Features

  • Add gcs_metrics_uri for exporting tuning job metrics. (b6535e8)
  • Add Gemini 3.8 Flash TTS and Gemini 3.8 Flash Lite TTS models to SDKs (0cad6ca)
  • genai-sdk: Add environments dedicated module and from_environment support (7672ff6)
  • Include labels for LiveClientSetup (4742c9a)
  • Support labels for Gemini API GenerateContent (81ffa26)

Bug Fixes

  • Build a model before reading its field annotations when pruning extra fields (7845acd)
  • cli: Include auto-assigned flag shorthands in --usage schema (2579b94)
  • Ensure Vertex AI interactions client uses default timeout=None instead of 5s. (feef230)
  • Reap aiohttp sessions and auth locks belonging to closed event loops (6d01288)
  • Use CreateAgentInteraction for Trigger.interaction and TriggerCreateParams.interaction (046ccfb)

Documentation

  • Clarify Voice expire_time and store TTL behavior in GAOS SDK (94b371d)
  • overlays: Describe environment and path on GetEnvironmentFiles and pin environment ID in environments get/delete examples (f15d148)
  • Regenerate docs for 1.2.0 (938dd73)

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.28.0 (2026-10-02)

Features

  • Add lyria-3.5, gemini-omni-1.1-flash, and gemini-omni-flash-preview to Interactions Model enum (1e8c0cc)
  • Support continuation_token in Interactions (d40ca70)

2.27.0 (2026-10-01)

Features

  • Support continuation_token in GenerateContent (3931b29)

Documentation

2.26.0 (2026-09-30)

Features

  • Add gcs_metrics_uri for exporting tuning job metrics. (b6535e8)
  • Add Gemini 3.8 Flash TTS and Gemini 3.8 Flash Lite TTS models to SDKs (0cad6ca)
  • genai-sdk: Add environments dedicated module and from_environment support (7672ff6)
  • Include labels for LiveClientSetup (4742c9a)
  • Support labels for Gemini API GenerateContent (81ffa26)

Bug Fixes

  • Build a model before reading its field annotations when pruning extra fields (7845acd)
  • cli: Include auto-assigned flag shorthands in --usage schema (2579b94)
  • Ensure Vertex AI interactions client uses default timeout=None instead of 5s. (feef230)
  • Reap aiohttp sessions and auth locks belonging to closed event loops (6d01288)
  • Use CreateAgentInteraction for Trigger.interaction and TriggerCreateParams.interaction (046ccfb)

Documentation

  • Clarify Voice expire_time and store TTL behavior in GAOS SDK (94b371d)
  • overlays: Describe environment and path on GetEnvironmentFiles and pin environment ID in environments get/delete examples (f15d148)
  • Regenerate docs for 1.2.0 (938dd73)

2.25.0 (2026-09-22)

... (truncated)

Commits
  • 6d13650 chore(main): release 2.28.0 (#3038)
  • d40ca70 feat: support continuation_token in Interactions
  • 1e8c0cc feat: add lyria-3.5, gemini-omni-1.1-flash, and `gemini-omni-flash-previe...
  • 2450847 chore: refresh docs
  • afd5e0d chore(main): release 2.27.0 (#3032)
  • 3931b29 feat: support continuation_token in GenerateContent
  • c6212e9 docs: Update docs
  • 41b1ea6 chore(main): release 2.26.0 (#3002)
  • feef230 fix: ensure Vertex AI interactions client uses default timeout=None instead o...
  • d0801cf chore: update easytemplate to v0.12.4 and regenerate SDKs
  • Additional commits viewable in compare view

Updates fastapi from 0.141.1 to 0.142.2

Release notes

Sourced from fastapi's releases.

0.142.2

Fixes

  • 🐛 Allow startup when automatic OpenTelemetry configuration fails. PR #16418 by @​tiangolo.

0.142.1

Fixes

0.142.0

Features

Refactors

Docs

Translations

Internal

... (truncated)

Commits

Updates uvicorn from 0.52.4 to 0.54.0

Release notes

Sourced from uvicorn's releases.

Version 0.54.0

📨 Send metadata after the response body

uvicorn 0.54.0 adds response trailers and 103 Early Hints to its experimental HTTP/2 implementation through zttp.

uv add uvicorn==0.54.0 "zttp>=0.0.34"
  • Send HTTP/2 response trailers (#3146). The ASGI http.response.trailers extension lets applications send metadata, such as checksums, after the response body. Clients must send TE: trailers to receive them. Multiple trailer messages are combined before completing the response.
  • HTTP/2 remains experimental and opt-in. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 remain unsupported.

💡 Hint at resources before the final response

  • Send 103 Early Hints over HTTP/2 (#3137). Applications can use the ASGI http.response.early_hint extension to send resource hints before the final response. Each supplied link becomes a separate Link header.

Full changelog: 0.53.0...0.54.0

Version 0.53.0

🌐 Opt-in HTTP/2 support

uvicorn 0.53.0 adds experimental HTTP/2 through zttp, alongside a new zuvloop integration and connection-handling improvements.

uv add uvicorn==0.53.0
  • Serve HTTP/1.1 and HTTP/2 with zttp (#2982, #3101). Install zttp, then enable HTTP/2 with --http zttp --http2. Uvicorn negotiates HTTP/2 over TLS with ALPN and supports cleartext prior knowledge.
  • HTTP/2 remains experimental. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

⚙️ More event loop choice

  • Run Uvicorn with zuvloop (#3104). Install zuvloop separately and select it explicitly with --loop zuvloop on CPython 3.14 or newer.

🛡️ More reliable connections and proxies

  • Honor Connection: close token lists (#3103). Uvicorn now parses comma-separated tokens case-insensitively across HTTP implementations.
  • Trust IPv6 loopback proxies by default (#3119). The default FORWARDED_ALLOW_IPS value now includes ::1.
  • Keep upgraded WebSockets alive (#3107). Uvicorn cancels the HTTP keep-alive timer when the connection becomes a WebSocket.

Full changelog: 0.52.4...0.53.0

Changelog

Sourced from uvicorn's changelog.

0.54.0 (September 24, 2026)

HTTP/2 support remains experimental. Install zttp>=0.0.34 and enable it with --http zttp --http2.

Added

  • Add HTTP/2 response trailers through the ASGI http.response.trailers extension. Clients must send TE: trailers to receive them (#3146)
  • Add HTTP/2 103 Early Hints through the ASGI http.response.early_hint extension (#3137)

0.53.0 (September 14, 2026)

This release adds experimental HTTP/2 support through zttp. Enable it with --http zttp --http2. Upgrade-based h2c and WebSockets over HTTP/2 are not supported.

Added

  • Add experimental HTTP/2 support through zttp (#2982, #3101)
  • Add support for zuvloop (#3104)

Fixed

  • Handle comma-separated, case-insensitive Connection: close tokens across HTTP implementations (#3103)
  • Trust IPv6 loopback in the default FORWARDED_ALLOW_IPS value (#3119)
  • Cancel the HTTP keep-alive timer when upgrading to WebSocket (#3107)
Commits

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • See full diff in compare view

Updates numpy from 2.4.6 to 2.5.3

Release notes

Sourced from numpy's releases.

v2.5.3 (Sep 6, 2026)

NumPy 2.5.3 Release Notes

The NumPy 2.5.3 is a patch release that fixes bugs discovered after the 2.5.2 release. Apart from the usual bug and maintenance work, there are a number of StringDType related fixes for problems discovered during the ongoing string work in the main branch.

This release supports Python versions 3.12-3.15

Changes

  • Casting a fixed-width byte string array (np.bytes_) to StringDType now raises TypeError when the bytes are not valid UTF-8. Previously the invalid bytes were stored as-is and later caused undefined behavior in string operations.

    (gh-32296)

  • MaskedArray._fill_value would become stale when ufuncs that change dtype left the result holding a fill_value typed for the old dtype. The mismatch was silent until something later called _check_fill_value, such as .view(), and then a TypeError would be raised. Now, when the copied fill_value is no longer valid for the new dtype, fall back to the default fill_value for that dtype instead of propagating the stale value. This may raise a ComplexWarning if the fill_value is complex and the new dtype is real.

    (gh-32423)

Contributors

A total of 9 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • Charles Harris
  • Iason Krommydas
  • James Davies +
  • Joren Hammudoglu
  • Maanas Arora
  • Matti Picus
  • Nathan Goldbaum
  • Shikhar Goel +
  • Yeonho Kim +

Pull requests merged

A total of 27 pull requests were merged for this release.

  • #32235: MAINT: Prepare 2.5.x for further development

... (truncated)

Commits
  • dd88c0c Merge pull request #32511 from charris/prepare-2.5.3
  • edcac6a REL: Prepare for the NumPy 2.5.3 release
  • fd4d908 Merge pull request #32509 from charris/backport-32496
  • 65bb1da BUG: fix crash in ufunc.resolve_dtypes with a Python scalar type (#32496)
  • 294956e Merge pull request #32506 from charris/backport-32503
  • 26428d9 DOC: fix scipy docs links in intersphinx mapping (#32507)
  • 5fab1cb DOC: use static scipy doc site for intershpinx (#32503)
  • 7beed2f Merge pull request #32481 from ngoldbaum/stringdtype-backport
  • 8972f70 Merge pull request #32478 from charris/backport-32466
  • ab1b589 Merge pull request #32477 from charris/backport-32423
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python group across 1 directory with 6 updates
9d21e25 
Bumps the python group with 6 updates in the /app directory:

| Package | From | To |
| --- | --- | --- |
| [google-adk](https://github.com/google/adk-python) | `2.9.0` | `2.11.0` |
| [google-genai](https://github.com/googleapis/python-genai) | `2.23.0` | `2.28.0` |
| [fastapi](https://github.com/fastapi/fastapi) | `0.141.1` | `0.142.2` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.52.4` | `0.54.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.3` | `1.2.4` |
| [numpy](https://github.com/numpy/numpy) | `2.4.6` | `2.5.3` |



Updates `google-adk` from 2.9.0 to 2.11.0
- [Release notes](https://github.com/google/adk-python/releases)
- [Changelog](https://github.com/google/adk-python/blob/main/CHANGELOG.md)
- [Commits](google/adk-python@v2.9.0...v2.11.0)

Updates `google-genai` from 2.23.0 to 2.28.0
- [Release notes](https://github.com/googleapis/python-genai/releases)
- [Changelog](https://github.com/googleapis/python-genai/blob/main/CHANGELOG.md)
- [Commits](googleapis/python-genai@v2.23.0...v2.28.0)

Updates `fastapi` from 0.141.1 to 0.142.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.141.1...0.142.2)

Updates `uvicorn` from 0.52.4 to 0.54.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.4...0.54.0)

Updates `python-dotenv` from 1.2.3 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.3...v1.2.4)

Updates `numpy` from 2.4.6 to 2.5.3
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.4.6...v2.5.3)

---
updated-dependencies:
- dependency-name: google-adk
  dependency-version: 2.11.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: google-genai
  dependency-version: 2.28.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: fastapi
  dependency-version: 0.142.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: uvicorn
  dependency-version: 0.54.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: numpy
  dependency-version: 2.5.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 5, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants