[dependabot]

Bumps the python group with 16 updates:

Package	From	To
agent-manifest	0.12.0	0.15.0
agentrust-trace	0.10.0	0.11.0
pydantic	2.13.5	2.14.1
pydantic-ai-slim	2.53.0	2.57.0
cryptography	50.0.1	50.0.2
numpy	2.5.3	2.5.4
python-dotenv	1.2.3	1.2.4
uvicorn	0.52.4	0.54.0
openai	3.24.0	3.31.0
openai-agents	0.22.3	0.24.0
ruff	0.16.9	0.17.1
langchain-core	1.6.3	1.6.11
langgraph	1.2.12	1.2.15
google-adk	2.11.0	2.12.0
chap-coordinator	0.2.13	0.3.2
agent-passport-system	4.2.0	4.3.0

Updates agent-manifest from 0.12.0 to 0.15.0

Release notes

Sourced from agent-manifest's releases.

python-v0.15.0

What's Changed

• fix(sdk): attach_receipt refuses a non-array receipts value instead of corrupting it by @​rajnisht7 in agentrust-io/agent-manifest#469
• docs(changelog): file the attach_receipt fix under Unreleased by @​imran-siddique in agentrust-io/agent-manifest#478
• feat(sdk): add opt-in experimental evidence-requirements profile by @​imran-siddique in agentrust-io/agent-manifest#479
• fix(attestation): refuse debug guests and non-VMPL0 SNP reports, release 0.15.0 by @​imran-siddique in agentrust-io/agent-manifest#480

Full Changelog: agentrust-io/agent-manifest@python-v0.14.0...python-v0.15.0

python-v0.14.0

What's Changed

• fix: enforce strict HashValue format when parsing checkpoint roots by @​rajnisht7 in agentrust-io/agent-manifest#465
• docs(api): mark signing_pre_image() as v0.1-only by @​litzki-systems in agentrust-io/agent-manifest#460
• chore(deps): bump the codeql-action group with 4 updates by @​dependabot[bot] in agentrust-io/agent-manifest#467
• docs(spec): publish the two-tool catalog_hash vector in Appendix D by @​imran-siddique in agentrust-io/agent-manifest#470
• docs(spec): correct identity framing, container-digest binding and Blackwell SPDM by @​imran-siddique in agentrust-io/agent-manifest#471
• chore(deps): bump urllib3 to 2.8.0 by @​rajnisht7 in agentrust-io/agent-manifest#475
• fix(attestation): read verdicts from signed evidence, pin the AMD root (0.14.0) by @​imran-siddique in agentrust-io/agent-manifest#476

Full Changelog: agentrust-io/agent-manifest@python-v0.13.1...python-v0.14.0

python-v0.13.1

agent-manifest 0.13.1

pip install agent-manifest==0.13.1

Behaviour change

verify_evidence_pack() now reads the verdict inside the pack. A pack whose embedded section 5.2 verification_result says REVOKED, EXPIRED, MISMATCH or anything other than VALID returns FAILED. Under 0.13.0 the same pack returned VERIFIED. If you accepted those packs, they will now be rejected.

Fixed

• [SDK] verify_evidence_pack() only checked that the embedded verification_result carried a known enum value, and never read its verification_signature. Now a non-VALID result fails the pack, a manifest_id that differs from the pack's manifest fails it, and a result with no manifest_id is MALFORMED. New keyword arguments result_key_id and result_algorithm check verification_signature over the new verification_result_pre_image(). Leave out result_key_id and the result reports verification_result_signature_verified=False with a verification_result_signature_not_appraised warning. signature_verified still covers the outer pack_signature only. (#463)
• [SDK] verify_evidence_pack() and verify_trace_envelope() raised TypeError or ValueError on some untrusted input: a non-string verification_result.result or pack_signature.key_id, or a value RFC 8785 cannot represent (NaN, Infinity, a lone surrogate, an integer beyond 2^53, nesting deeper than 64). They now return MALFORMED. (#463)

Changed

• [CI] CodeQL runs on every pull request and every push to main, with the python/** path filter and the Dependabot skip removed (#463). Write permissions in codeql.yml and docs.yml moved from workflow level to the job that needs them (#464). New ClusterFuzzLite target fuzz_trace.py covers both verifiers (#463).

Full changelog: agentrust-io/agent-manifest@python-v0.13.0...python-v0.13.1

agent-manifest 0.13.0 is on PyPI: pip install agent-manifest==0.13.0.

Compatibility: canonicalize() now follows RFC 8785 exactly (#404, closes #322). It no longer NFC-normalizes strings, no longer escapes U+2028, U+2029 or U+007F to U+009F, and refuses integers above 2**53 - 1. A signature that 0.12.0 made over a document containing any of those will not verify. Every other document canonicalizes to the same bytes as before.

Security fixes

• #404: two distinct strings could share one signature, and two keys that normalized alike produced invalid JSON that silently dropped a signed field.
• #450: verify_revocation_signature() compares signer_key_id in constant time.

... (truncated)

Changelog

Sourced from agent-manifest's changelog.

[0.15.0] - 2026-09-30

Security

• [SDK] verify_attestation_chain() refuses debug guests. The SEV-SNP path never read the signed guest policy and the TDX path never parsed TDATTRIBUTES, so a debug-enabled guest with an allow-listed measurement returned passed=True. A debug guest's memory is readable and writable by the host, so its REPORT_DATA and the code that chose it are the host's to set. The verdict now fails when SNP guest policy DEBUG (bit 19, AMD 56860) or TDX TDATTRIBUTES.DEBUG (bit 0, TD report body offset 120) is set, read from the signed bytes after the signature verifies. SNP reports must also carry VMPL 0, the level both of this package's SNP producers request at (SEVSNPProvider through configfs-TSM, and the Azure paravisor). verify_runtime_report() and verify_runtime_freshness() apply the same checks with no opt-in. ChainVerificationResult gains debug and vmpl, read from the signed report (None without a verified signature, and for platforms with no such field). verify_attestation_chain(allow_debug=True) accepts a debug guest for development and records it in reasons; it does not relax VMPL. SnpReport.debug, TdxQuote.td_attributes and TdxQuote.debug expose the parsed state. Behaviour change: a debug guest, or an SNP report at VMPL 1 to 3, that previously verified now fails.

Added

• [SDK] Experimental, opt-in evidence-requirements-experimental-v1 profile. A v0.2 manifest that declares it may carry a signed evidence_requirements block (components, required relationships, combination policy reference), and agent_manifest.evidence_requirements.verify_evidence_manifest() returns it only after verify_manifest() is VALID. Without the profile the block is still rejected as an unknown field, so existing manifests verify as before. Under the profile every 0.14.0 check still applies, including the signed audit_key_sealed rule under enforce_attestation. Not part of the specification; see docs/evidence-requirements-experimental.md. Consumer: agentrust-io/trace-spec#439.

Fixed

• [SDK] attach_receipt() corrupted or crashed when the envelope's receipts header (label 394) wasn't already an array - a map became its keys, a string its characters, and null/0/false/"" were silently replaced with []. attach_approvals() was already fixed for the same issue in 0.13.0; attach_receipt() now works the same way: a non-array existing value raises CoseStructureError instead of being coerced or overwritten, and receipt itself must be bytes or bytearray. To replace the array, use attach_unprotected(envelope, HDR_RECEIPTS, receipts). Behaviour change: a bad receipt, or a non-array receipts value, now raises instead of being silently coerced.

... (truncated)

Commits

• 2f1b9f5 fix(attestation): refuse debug guests and non-VMPL0 SNP reports, release 0.15...
• 7466b3d feat(sdk): add opt-in experimental evidence-requirements profile (#479)
• 7a28a4b docs(changelog): file the attach_receipt fix under Unreleased (#478)
• d3ed22e fix attach receipt (#469)
• 3c3f5a5 fix(attestation): read verdicts from signed evidence, pin the AMD root (0.14....
• d991472 bump-urllib3-2.8.0 (#475)
• 025247a docs(spec): correct identity framing, container-digest binding and Blackwell ...
• 539c24c docs(spec): publish the two-tool catalog_hash vector in Appendix D (#470)
• 2f54af9 chore(deps): bump the codeql-action group with 4 updates (#467)
• 3c12491 docs(api): mark signing_pre_image() as v0.1-only (#460)
• Additional commits viewable in compare view

Updates agentrust-trace from 0.10.0 to 0.11.0

Release notes

Sourced from agentrust-trace's releases.

agentrust-trace 0.11.0

Breaking

• TraceAGTAdapter and TraceSandboxAdapter require enforcement_mode. They used to default to enforce, which signed a claim that a policy was evaluated when nothing evaluated it. Callers pass the mode their runtime ran under, or declared when no engine evaluated the policy (#416, #419; diagnosis and first fix by @​solloek369-arch in #417).
• Signatures accept only canonical unpadded base64url, so one signature has one spelling. A padded or non-canonical signature that used to decode is refused (#418).

Added

• verify_record() reports whether the objects a record cites resolve (#374).
• Verifiers declare accepted_profiles, and VerificationResult records the profile it verified under (#347, for #116).
• The reproducibility claim and its re-execution appraisal in the schema and models, with 21 signed vectors (#364, #370).
• condition-appraisal is a registered references relation (#389).
• MCP Server Provenance v2 binds behavioral hints (#409).
• intent_bridge binds a successor observation by digest (#340).
• provenance.verify_record() takes now to replay a freshness decision (#411).

Fixed

• Schema patterns follow ECMA-262, so a trailing \n, \r, U+2028 or U+2029 no longer passes subject or URI checks (#388). The Pydantic models share the same patterns (#412).
• A malformed signature is reported as malformed, not missing (#390).
• Revocation bundles with no RFC 8785 form are unverified_for_revocation rather than an exception (#386).
• Non-ASCII challenge nonces raise the documented ValueError (#383).
• The AGT adapter no longer stamps appraisal.status: affirming on every record (#336), and both adapters check iat before signing (#343).
• The v0.3 draft schema refused neither a private cnf.jwk nor an RSA key with no key material (#372, #311).
• Input validation across content_marking, provenance, intent_bridge, revocation, the sandbox adapter and sign.verify_record() freshness bounds (#239, #282, #284, #287, #288, #290, #300, #305, #318, #322, #333, #334, #335, #339, #387, #410).
• The PyPI description named TrustRecord.sign(), record.anchor() and record.verify(), none of which exist. It now shows sign_record and verify_record (#309).

Full list in CHANGELOG.md.

Changelog

Sourced from agentrust-trace's changelog.

[0.11.0] - 2026-09-25

• Breaking: TraceSandboxAdapter and TraceAGTAdapter require enforcement_mode; it no longer defaults to "enforce". An evidence constructor that fills in "enforce" signs a claim that a policy was evaluated when nothing observed an evaluation (#416), and the first fix, a "declared" default (#417), is ruled out by spec section 4.3: declared MUST NOT be a default. Callers that omitted the argument now get a TypeError and must pass the mode their runtime actually ran under, or "declared" when no policy engine evaluated the policy. Runtime enforcement defaults are unchanged. Diagnosis and first fix by @​solloek369-arch.

• Signatures accept one spelling. sign._b64url_decode accepts only canonical unpadded base64url, so a Trust Record, JWK x, provenance, intent-bridge or revocation-bundle signature carrying padding or non-canonical trailing bits is refused instead of decoding to the same bytes. content_marking refuses served record bytes with duplicate members. Deeply nested cnf.jwk, tool calls and provenance records raise each module's documented error type instead of RecursionError, and tool_catalog_hash raises ProvenanceError for a catalog with no anchor form. ClusterFuzzLite now covers the record, bundle, provenance, bridge, content-marking and canonicalization paths (#418).

• Correct regulatory context in the published v0.1/v0.2 introductions and LIMITATIONS.md (#328, following #314). Separate Article 12 logging capability from TRACE tamper-evidence, identify Article 11 / Annex IV as documentation context, correct the applicability dates and remove unsupported TRACE-level compliance claims. Editorial only; reported by @​ioanavalea with review context from @​lywinged.

• Propose v0.3 MCP profile requirements for producer-defined attempts, signed full declaration snapshots and explicit retry outcomes (#324). Clarify existing session wording without changing v0.2 validation. Proposed by @​madeinplutofabio with declaration-binding refinements from @​Mayur021; maintainer-carried proposal, not adopted or implemented.

• Propose MCP Server Provenance v2 with normalized behavioral-hint binding (#406). Preserve v1 hashes and producer defaults; add explicit v2 production and consumer format requirements. Reported by @​altrudev.

• Compare challenge nonces as UTF-8 bytes so non-ASCII mismatches raise the documented ValueError instead of TypeError (#381). Matching strings remain accepted without Unicode normalization. Invalid non-string expected_nonce settings raise a clear ValueError. Reported by @​chernistry; follow-up review by @​lywinged.

• Report revocation bundles without an RFC 8785 form as unverified_for_revocation with cause bundle_malformed, while continuing record verification (#382). The direct bundle-digest API still refuses such input. Reported by @​chernistry.

• Regenerate the v0.3 draft after canonical reproducibility additions and make the schema inventory test use portable repository paths on Windows.

• Keep untrusted input on each verifier's documented error type. Nesting a few hundred levels deep in cnf.jwk, a tool call, a provenance record or served content-marking bytes raised RecursionError; a 4,400 digit URL port raised Python's integer-string ValueError; a float or unsafe integer in an offered tool's input_schema raised UnanchorableValue from check_tool_catalog. All were refusals already, none was an acceptance. Found by the new ClusterFuzzLite targets in .clusterfuzzlite/; regression tests in tests/test_untrusted_input_stays_on_the_documented_error.py.

• Decode signatures and JWK x as canonical unpadded base64url only. The decoder took the standard alphabet, = padding and stray characters, and ignored the unused bits of the last character, so one signature had several spellings that all verified, and a revocation bundle's bundle_digest (which covers sig.value) gave one bundle several identities. The record-level rule

... (truncated)

Commits

• 7d8df34 chore(release): agentrust-trace 0.11.0 (#420)
• 3d7c90f fix(adapters): require enforcement_mode in the AGT and sandbox adapters (supe...
• 5d9cf72 fix(security): strict signature decoding, documented refusals, ClusterFuzzLit...
• 9fd79b6 fix(provenance): allow an explicit verification instant (#411)
• 761783a docs(spec): name the instrument that set the Chapter III application dates (#...
• e3111c7 docs: separate regulatory logging duties from TRACE properties (#414)
• 9d303c5 docs: propose stateless MCP transcript profile requirements (#413)
• b217e60 fix(validation): share schema regex semantics across Python surfaces (#412)
• 0cbb72c fix(content-marking): require a textual profile identifier (#410)
• 7d3f8ac feat(provenance): bind behavioral hints in explicit v2 format (#409)
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates pydantic-ai-slim from 2.53.0 to 2.57.0

Release notes

Sourced from pydantic-ai-slim's releases.

v2.57.0 (2026-10-15)

What's Changed

⚠️ Compatibility Notes

• Attach namespaced origin and tool_call_id metadata to BackgroundTools completions by @​michaeldunn9 in pydantic/pydantic-ai#10196
• Take GPT-Live realtime history, usage, and reply waits from the session core by @​DouweM in pydantic/pydantic-ai#10083
• Honour disable-model-invocation and user-invocable in Skills, and skip stray skill library paths by @​DouweM in pydantic/pydantic-ai#10378
• Take Gemini Live realtime history, usage, and reply waits from the session core by @​DouweM in pydantic/pydantic-ai#10082

🚀 Features

• Add MetaProvider for Meta Muse models, with meta: using the Responses API by @​mpfaffenberger in pydantic/pydantic-ai#10156
• Add Harness ApprovalReviewer to let a model approve low-risk tool calls before a person sees them by @​mpfaffenberger in pydantic/pydantic-ai#10143
• Price requests at their reported service tier by @​adtyavrdhn in pydantic/pydantic-ai#10244
• Add dataset_name to EvaluationReport by @​jirikuncar in pydantic/pydantic-ai#10307
• Forward MCP Apps tool results to AG-UI and Vercel AI frontends and add MCPToolset.read_resource_contents by @​adtyavrdhn in pydantic/pydantic-ai#10179
• Relay MCP Apps tool calls with MCPToolset.call_tool_for_app by @​adtyavrdhn in pydantic/pydantic-ai#10190

🐛 Bug Fixes

• Fix token-based compaction retaining too little recent history by @​AndrewTilson in pydantic/pydantic-ai#9784
• Record and stream one part per realtime output item when its transcript arrives late by @​pydanty in pydantic/pydantic-ai#10097
• Reference multimodal URL choices in the ToolReturnContent discriminator mapping by @​Kludex in pydantic/pydantic-ai#10239
• Stop OpenAIResponsesModel sending unavailable tool_choice names in allowed_tools by @​dsfaccini in pydantic/pydantic-ai#10232
• Send Gemini tool-call thought signatures (extra_content) back from OpenAIChatModel by @​dsfaccini in pydantic/pydantic-ai#10235
• Give a tool's prepare its own retry count under .prefixed(), .renamed() and PrefixTools by @​dsfaccini in pydantic/pydantic-ai#10219
• Support Gemini agentic media processing in GoogleModel by @​miguel-flowstate in pydantic/pydantic-ai#8028
• Stop granting native tool_search to gpt-5.4-nano by @​dsfaccini in pydantic/pydantic-ai#10272
• Omit unset optional fields from Vercel AI UIMessage JSON so the AI SDK accepts it by @​adtyavrdhn in pydantic/pydantic-ai#10175
• Keep Planning tool loops in the prompt cache, and attach a leading CachePoint to the previous user message on OpenRouterModel by @​mpfaffenberger in pydantic/pydantic-ai#10257
• Release concurrency slots after streamed request cleanup by @​dsfaccini in pydantic/pydantic-ai#10225
• Backfill an empty thinking field on current-turn tool calls in OpenAIChatModel's default 'auto' mode by @​dsfaccini in pydantic/pydantic-ai#10251
• Keep available_tool_names and active_capability_ids on run context copies inside Temporal activities and Render child tasks by @​dsfaccini in pydantic/pydantic-ai#10280
• Reconnect an xAI realtime session past max_duration when a reconnect policy is set by @​DouweM in pydantic/pydantic-ai#10056
• Await ProcessEventStream cleanup after early exit and cancellation by @​dsfaccini in pydantic/pydantic-ai#10341
• Count the request of a GPT-Live backend response that ends while the session closes by @​DouweM in pydantic/pydantic-ai#10084
• Warn when FallbackModel response handlers are skipped on a streamed request by @​DouweM in pydantic/pydantic-ai#10066
• Close the HTTP client of a model a run builds from a model name, and reuse one per name inside async with agent: by @​DouweM in pydantic/pydantic-ai#10067
• Make waits between continuation polls durable DBOS.sleep steps under DBOSDurability and DBOSAgent by @​DouweM in pydantic/pydantic-ai#10383
• Charge the partial response of an interrupted stream in SpendLimits by @​DouweM in pydantic/pydantic-ai#10069
• Stop WarnNearLimits from deleting user prompts that quote its [WarnNearLimits] marker by @​DouweM in pydantic/pydantic-ai#10391

New Contributors

• @​AndrewTilson made their first contribution in pydantic/pydantic-ai#9784
• @​miguel-flowstate made their first contribution in pydantic/pydantic-ai#8028
• @​jirikuncar made their first contribution in pydantic/pydantic-ai#10307
• @​michaeldunn9 made their first contribution in pydantic/pydantic-ai#10196

Full Changelog: pydantic/pydantic-ai@v2.56.0...v2.57.0

v2.56.0 (2026-10-13)

... (truncated)

Commits

• 54a31ab Make /theme work in the clai2 web UI (#10277)
• c318927 Add code mode and speculation toggles to the clai2 web UI, with a read-only...
• 1f034ef Remove pre-release Agent.connect() and Responses WebSocket APIs (#10370)
• 27b41ca Stream token counts in the clai2 web UI while a turn runs (#10275)
• 253240f Show the Pydantic logo in the clai2 web UI (#10274)
• 3650d9e Use Pydantic brand colours in the clai2 web UI, in dark and light mode (#10...
• 9fd6f67 Group tool calls and center the new-session composer in the clai2 web UI (#...
• d16c4a6 Add the clai2 web UI: a sessions sidebar, streaming chat, tool cards, and a...
• b210940 Add an opt-in web plugin to clai2 that serves the session to a browser, w...
• 2c3303c Let clai2 plugins drive the prompt with PluginHost.send_input, `interrupt...
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.
• 9cc555b Merge pull request #32956 from charris/backport-typing-1
• e04b972 TYP: dtype[void].names: allow setting with list (#32943)
• d929969 TYP: timedelta64: datetime.timedelta construction isn't deprecated (#...
• 839467f TYP: ma.getmaskarray: accept array-likes (#32934)
• 64b721b TYP: polynomial: accept scalar coef in the poly constructors (#32931)
• 06b7ad2 TYP: void: accept any dtype: str in constructor calls (#32928)
• c7bcd2c TYP: place: widen mask (#32926)
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.3 to 1.2.4

Release notes

Sourced from

[dinakarjs]

Reviewed exact head 60d84fc. This grouped update is not ready: changed dependency inputs/locks no longer agree with the repository's declared test contexts.

1. aeoess-aps and chap inputs/locks move agentrust-trace to 0.11.0 while integration.yaml tested_against still says 0.10.0. companyscope moves agent-manifest to 0.15.0 while its manifest still says 0.12.0. The fixed jobs fail their explicit installed-version/manifest comparison before testing (for example job 117896400742). Update the declared tested context only after rerunning and verifying it; do not remove the parity gate.
2. The capture-core lock still advertises a universal Python 3.9 compile but removes the Python-version markers and pins pytest 9.1.1 unconditionally. A fresh universal Python 3.9 resolution retains the older compatible pytest branch and supporting markers. Restore the supported-version closure rather than using a host-only resolution.
3. Sentinel's supported Python 3.11 fixed install fails on the unconditional numpy 2.5.3 pin (job 117896400596); the changed input now requires numpy>=2.5.4, itself a Python>=3.12 line. Preserve the declared Python support or make an explicit separately reviewed compatibility decision. The floating 3.11 failure is also visible; it is not a successful matrix.

Please regenerate the affected locks for the documented Python/platform matrix, reconcile all manifest/input/lock versions and rerun the four failing workflows on the final head. The current successful root workflows do not override these failures. DCO/whitespace checked. Bounded dependency/CI review with OpenAI Codex assistance; no live provider or hardware claim.

[dinakarjs]

Prepared a focused, DCO-signed author-adoption companion: fff55fae, directly atop reviewed head 60d84fcd71de81fc9093f8c50bbfb3cd82f2ffb3.

Aligns three tested_against declarations with the existing new fixed pins; regenerates the capture-core universal lock for Python 3.9 and Sentinel for Python 3.11. Preserves NumPy 2.4.6 on Python <3.12 and the proposed >=2.5.4 line on newer Python, with matching SciPy/platform branches. Fresh hash-locked runs: capture-core Python 3.9, 55 pass; Sentinel Python 3.11, 17 pass; APS 86, CHAP 19, companyscope 8 pass on Python 3.11. Installed package versions match all three manifests. Root 28 tests and marketplace --check pass; dependency checks pass. The pre-existing documented Python 3.9 pytest limitation is unchanged. No local Windows/3.13 or completed hosted matrix claim.

Reference: primary technical source. It informs the implementation/packaging boundary; it is not independent approval or a general security guarantee. The commit message retains the reference too.

For adoption: fetch https://github.com/dinakarjs/integrations.git branch fix/343-supported-dependency-contexts and cherry-pick fff55faef5ac3724eb1d4e1de7755eaec64b3c74. The published tree equals the tested tree f89ae853a354d2f34e47b1a5310d2c4b29eafe95.

I have not changed this PR's head or converted the existing changes request into approval. Please adopt or adjust the companion, run the original final-head checks and obtain independent review. Prepared with Codex; original ownership is retained.

[imran-siddique]

Closing: this bumps locks that must match each integration's tested_against (agentrust-trace 0.11 vs a declared 0.10, agent-manifest 0.15 vs 0.12), strips the Python 3.9 markers from capture-core, and pins numpy 2.5.3, which breaks Python 3.11. Those pinned locks should only move with a re-verified tested_against. Thanks @dinakarjs for the review.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml