chore(deps): bump the all-dependencies group across 1 directory with 7 updates by dependabot[bot] · Pull Request #2316 · google/adk-samples

dependabot · 2026-07-27T21:55:33Z

Bumps the all-dependencies group with 7 updates in the /core/python/ambient-expense-agent directory:

Package	From	To
google-adk	`2.0.0a3`	`2.5.0`
uvicorn	`0.44.0`	`0.51.0`
pytest	`9.0.3`	`9.1.1`
pytest-asyncio	`1.3.0`	`1.4.0`
ruff	`0.15.9`	`0.16.0`
mypy	`1.20.0`	`2.3.0`
codespell	`2.4.2`	`2.4.3`

Updates google-adk from 2.0.0a3 to 2.5.0

Release notes

Sourced from google-adk's releases.

v2.5.0

2.5.0 (2026-07-16)

Breaking Changes

Update GCP Skill Registry to use agentregistry/skill endpoint (fa884e3): Existing users of GCP Skill Registry should note that the underlying endpoint is now AgentRegistry, so users will need to migrate their data and enable the Agent Registry API if not yet enabled.

Features

add Cloud Run sandbox option in code executors (5b1088a)

Add search agents and search MCP severs to agent registry (ed579c1)

add skill to verify markdown code snippets (c0fa51b)

Add strict input schema validation for LlmAgent workflow nodes (6f66814)

add to_mcp_server to serve an ADK agent over MCP (50ff37f)

agents: add single_turn mode field to ManagedAgent (da50578)

agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)

agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)

agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)

bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)

enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)

live: allow Voice activity detection (VAD) events to be returned (820a910)

live: Run non-blocking tools in a background task (5620d8f)

plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)

Support HITL resumption for standalone nodes and NodeTool (00760f8)

Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)

Validate that no old orchestrators are used inside Workflow graphs (7e245c4)

Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)

workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

Add mTLS support for for API registry (41693dc)

Add mtls support for gcp_utils (3fa993b)

Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)

avoid crash on first turn with empty user content (c9bacd4)

Avoid shell execution in ReadFileTool ranged reads (1ac6875)

block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)

cli: Block special internal agents in ApiServer mode (3f6eb1f)

confine docs-agent file tools to the managed repos directory (f00fc5a)

decode shell skill output as UTF-8 (b7ad76a)

environment: add integer validation in ReadFileTool (3c0fb65)

exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164

exclude rewound invocations from event compaction (0d4d378)

explicitly preserve language and tools during event compaction (b44d2c9), closes #6273

Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)

Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)

GitHub CI for the verify-snippets skill (ccc8ab4)

grow eligible Gemini cache prefixes (98fc036)

guard decode_model against non-dict session values (8c60d99), closes #6348

handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352

... (truncated)

Changelog

Sourced from google-adk's changelog.

2.5.0 (2026-07-16)

Features

add Cloud Run sandbox option in code executors (5b1088a)

Add search agents and search MCP severs to agent registry (ed579c1)

add skill to verify markdown code snippets (c0fa51b)

Add strict input schema validation for LlmAgent workflow nodes (6f66814)

add to_mcp_server to serve an ADK agent over MCP (50ff37f)

agents: add single_turn mode field to ManagedAgent (da50578)

agents: bridge node_input to user_content for ManagedAgent nodes (a680cea)

agents: support remote MCP servers for ManagedAgent with runtime header callbacks (2e2ec09)

agents: wrap single_turn non-LlmAgent sub-agents as inline tools (fc98549)

bigquery: log tool descriptions and parameter schemas in LLM_REQUEST (ecef5f8)

enable a2a-sdk 1.x by widening the dependency constraint (b46dd13)

live: allow Voice activity detection (VAD) events to be returned (820a910)

live: Run non-blocking tools in a background task (5620d8f)

plugins: add on_agent_error_callback and on_run_error_callback (7d0ae63)

Support HITL resumption for standalone nodes and NodeTool (00760f8)

Support LoadArtifacts parsing for binary text documents (e.g., DOCX) (ccbedd8)

Validate that no old orchestrators are used inside Workflow graphs (7e245c4)

Validate that no old orchestrators are used inside Workflow graphs (eaffb0e)

workflow: Support state-based resumption for task-mode agent workflow nodes (9d306f5)

Bug Fixes

Add mTLS support for for API registry (41693dc)

Add mtls support for gcp_utils (3fa993b)

Add support for list_artifact_versions and get_artifact_version to ForwardingArtifactService (61ba59a)

avoid crash on first turn with empty user content (c9bacd4)

Avoid shell execution in ReadFileTool ranged reads (1ac6875)

block posix, nt, _posixsubprocess, and _socket modules in agent config validation (faa1744)

cli: Block special internal agents in ApiServer mode (3f6eb1f)

confine docs-agent file tools to the managed repos directory (f00fc5a)

decode shell skill output as UTF-8 (b7ad76a)

environment: add integer validation in ReadFileTool (3c0fb65)

exclude LiteLlm llm_client from JSON serialization (ecbefd9), closes #6164

exclude rewound invocations from event compaction (0d4d378)

explicitly preserve language and tools during event compaction (b44d2c9), closes #6273

Fix InputTokensDetails validation in OpenAI responses test and formatting in a2a_agent_executor (99ea228)

Fix sub-branch event routing for nested sub-agents and tools in InvocationContext (3cdc102)

GitHub CI for the verify-snippets skill (ccc8ab4)

grow eligible Gemini cache prefixes (98fc036)

guard decode_model against non-dict session values (8c60d99), closes #6348

handle sqlite float timestamps in PreciseTimestamp (2da09e6), closes #6352

honor server-reported Gemini cache expiry (4fdc94c)

litellm: preserve reasoning replay and optionally share agent thoughts (6290aec)

litellm: preserve signature-only blocks for Anthropic streaming thinking aggregation (78d1957)

... (truncated)

Commits

1e93d82 chore: update last-release-sha for next main release
5e3b6f1 chore(release/candidate): release 2.5.0 (#6411)
c9bacd4 fix: avoid crash on first turn with empty user content
c03f333 fix: Prevent continuation forgery in tool confirmation
2da09e6 fix: handle sqlite float timestamps in PreciseTimestamp
065234e fix: preserve non-image file MIME type in LiteLlm content conversion
ecbefd9 fix: exclude LiteLlm llm_client from JSON serialization
98fc036 fix: grow eligible Gemini cache prefixes
221bad9 fix: require starlette>=1.3.1 to clear known CVEs
8eb8348 test: re-enable finish_reason unknown-maps-to-other litellm test
Additional commits viewable in compare view

Updates uvicorn from 0.44.0 to 0.51.0

Release notes

Sourced from uvicorn's releases.

Version 0.51.0

What's Changed

Restart workers with overlap on SIGHUP for near-zero-downtime reloads by @Kludex in Kludex/uvicorn#3025

Remove colorama from the standard extra by @Kludex in Kludex/uvicorn#3027

Full Changelog: Kludex/uvicorn@0.50.2...0.51.0

Version 0.50.1

What's Changed

Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation by @Aayush7352 in Kludex/uvicorn#3019

New Contributors

@Aayush7352 made their first contribution in Kludex/uvicorn#3019

Full Changelog: Kludex/uvicorn@0.50.0...0.50.1

Version 0.50.0

What's Changed

Memoize trusted host checks to avoid re-parsing the client IP per request by @Kludex in Kludex/uvicorn#2970

Cache the asgi scope sub-dict per connection by @Kludex in Kludex/uvicorn#2976

Build a fresh asgi scope dict per request by @Kludex in Kludex/uvicorn#2977

Replace click.style with an internal ANSI style helper by @Kludex in Kludex/uvicorn#2981

Avoid copying single-frame WebSocket payloads in websockets-sansio by @Kludex in Kludex/uvicorn#2983

Deprecate the legacy websockets implementation and default auto to websockets-sansio by @Kludex in Kludex/uvicorn#2985

Exit with a dedicated code on startup failure and stop the supervisor when a worker can't boot by @Kludex in Kludex/uvicorn#3001

Skip the eager app import in the parent when spawning workers by @Kludex in Kludex/uvicorn#3012

Full Changelog: Kludex/uvicorn@0.49.0...0.50.0

Version 0.49.0

What's Changed

Bump httptools minimum version to 0.8.0 by @Kludex in Kludex/uvicorn#2962

Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) by @Kludex in Kludex/uvicorn#2971

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Version 0.48.0

What's Changed

Default ssl_ciphers to None and use OpenSSL defaults by @Kludex in Kludex/uvicorn#2940

Ignore duplicate forwarding headers in ProxyHeadersMiddleware by @Kludex in Kludex/uvicorn#2944

Full Changelog: Kludex/uvicorn@0.47.0...0.48.0

Version 0.47.0

What's Changed

Eagerly import the ASGI app in the parent process by @Kludex in Kludex/uvicorn#2919

Add ssl_context_factory for custom SSLContext configuration by @Kludex in Kludex/uvicorn#2920

Treat fd=0 as a valid file descriptor with reload/workers by @eltoder in Kludex/uvicorn#2927

... (truncated)

Changelog

Sourced from uvicorn's changelog.

0.51.0 (July 8, 2026)

Added

Restart workers one at a time on SIGHUP, bringing each replacement up before retiring the old worker, so reloads no longer drop requests (#3025)

Removed

Remove colorama from the standard extra (#3027)

0.50.2 (July 6, 2026)

Fixed

Require websockets>=13.0, which the default websockets-sansio implementation needs (#3021)

0.50.1 (July 6, 2026)

Fixed

Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansio implementation (#3019)

0.50.0 (July 4, 2026)

If you use WebSockets, note that --ws auto now picks the websockets-sansio implementation. You shouldn't need it, but you can pin --ws websockets to get the deprecated legacy one back.

Changed

Exit with the dedicated code 3 on any startup failure: app loading, socket bind and lifespan startup errors previously exited with a mix of 0, 1 and 3 (#3001)

Stop the multiprocess supervisor when a worker exits with code 3 instead of restarting it forever (#3001)

Default --ws auto to websockets-sansio when websockets is installed (#2985)

Skip the eager app import in the parent process with --reload or --workers, fixing a memory regression introduced in 0.47.0 (#3012)

Build a fresh asgi scope dict per request (#2977)

Cache the asgi scope sub-dict per connection (#2976)

Avoid copying single-frame WebSocket payloads in websockets-sansio (#2983)

Memoize trusted host checks in ProxyHeadersMiddleware (#2970)

Replace click.style with an internal ANSI style helper (#2981)

Deprecated

Deprecate the legacy websockets implementation; use websockets-sansio or wsproto instead (#2985)

0.49.0 (June 3, 2026)

Changed

Bump httptools minimum version to 0.8.0 (#2962)

Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)

0.48.0 (May 24, 2026)

... (truncated)

Commits

e4d0b05 Version 0.51.0 (#3028)
944e43d Remove colorama from the standard extra (#3027)
2e78770 Restart workers with overlap on SIGHUP for near-zero-downtime reloads (#3025)
a1b570c Version 0.50.2 (#3022)
83c7da7 Require websockets>=13.0 for the default sansio implementation (#3021)
b4d0116 Version 0.50.1 (#3020)
2a9151d Split comma-separated Sec-WebSocket-Protocol values in the websockets-sansi...
1bf3ab4 Cover the excluded-directory branch in FileFilter with a direct test (#3014)
837b5f9 Deflake multiprocess, reload, and signal supervisor tests (#2975)
21d2c16 Version 0.50.0 (#3013)
Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

See dynamic-fixture-request-during-teardown for details.

#13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

See parametrize-iterators for details and suggestions.

#13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

See config-inicfg for more details.

#14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

cf470ec Prepare release version 9.1.1
e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
501c4bc Merge pull request #14596 from bluetech/doc-classmethod
b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
9a567e0 [automated] Update plugin list (#14617) (#14618)
ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
Additional commits viewable in compare view

Updates pytest-asyncio from 1.3.0 to 1.4.0

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged.

Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)

Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)

Updated minimum supported pytest version to v8.4.0. (#1397)

Fixed

Fixed a ResourceWarning: unclosed event loop warning that could occur when a synchronous test called asyncio.run() or otherwise unset the current event loop after pytest-asyncio had run an async test or fixture. (#724)

Notes for Downstream Packagers

Added dependency on sphinx-tabs >= 3.5 to organize documentation examples into tabs. (#1395)

pytest-asyncio v1.4.0a2

1.4.0a2 - 2026-05-02

Deprecated

Overriding the event_loop_policy fixture is deprecated. Use the pytest_asyncio_loop_factories hook instead. (#1419)

Added

Added the pytest_asyncio_loop_factories hook to parametrize asyncio tests with custom event loop factories.

The hook returns a mapping of factory names to loop factories, and pytest.mark.asyncio(loop_factories=[...]) selects a subset of configured factories per test. When a single factory is configured, test names are unchanged on pytest 8.4+.

Synchronous @pytest_asyncio.fixture functions now see the correct event loop when custom loop factories are configured, even when test code disrupts the current event loop (e.g., via asyncio.run() or asyncio.set_event_loop(None)). (#1164)

Changed

Improved the readability of the warning message that is displayed when asyncio_default_fixture_loop_scope is unset (#1298)

Only import asyncio.AbstractEventLoopPolicy for type checking to avoid raising a DeprecationWarning. (#1394)

... (truncated)

Commits

6e14cd2 chore: Prepare release of v1.4.0.
4b900fb Build(deps): Bump codecov/codecov-action from 6.0.0 to 6.0.1
ab9f632 Build(deps): Bump zipp from 3.23.1 to 4.1.0
a56fc77 Build(deps): Bump hypothesis from 6.152.6 to 6.152.8
e8bae9b Build(deps): Bump requests from 2.34.0 to 2.34.2
fc43340 Build(deps): Bump idna from 3.14 to 3.15
762eaf5 Build(deps): Bump jaraco-functools from 4.4.0 to 4.5.0
b62e222 Build(deps): Bump click from 8.3.3 to 8.4.0
9190447 Build(deps): Bump pydantic from 2.13.3 to 2.13.4
82a393c ci: Remove unnecessary debug output.
Additional commits viewable in compare view

Updates ruff from 0.15.9 to 0.16.0

Release notes

Sourced from ruff's releases.

0.16.0

Release Notes

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:
❯ ruff format --check --output-format github .
::error title=ruff (unformatted),file=try.md,line=2,col=8,endLine=2,endColumn=10::try.md:2:8: unformatted: File would be reformatted
See the CLI help or documentation for the full list of supported formats.
The filename, location, end_location, fix.edits[].location, and fix.edits[].end_location fields in the JSON output format may now be null rather than defaulting to the empty string and row 1, column 1, respectively.

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.0

Released on 2026-07-23.

Check out the blog post for a migration guide and overview of the changes!

Breaking changes
Ruff now enables a much larger set of rules by default (413, up from 59). See the blog post for more details and the new Default Rules page for a full listing of the enabled rules. Note that this is primarily an expansion, but 18 of the more opinionated pycodestyle (E) and pyflakes (F) rules have been removed from the default set: E401, E402, E701, E702, E703, E711, E712, E713, E714, E721, E731, E741, E742, E743, F403, F405, F406, and F722.

Ruff can now format Python code blocks in Markdown files and will do this by default. See the documentation for more details.
Ruff now supports ruff: ignore comments at the ends of lines, like noqa comments, or on the line preceding a diagnostic. For example, these both suppress an unused-import (F401) diagnostic:
import math  # ruff: ignore[F401]
ruff: ignore[F401]
import os
Fixes are now shown in check and format --check output:
❯ ruff format --check .
unformatted: File would be reformatted
 --> try.md:1:1
  |
1 | ```python
  - import   math
2 + import math
3 | ```
  |
1 file would be reformatted
This example also shows off the Markdown formatting.
format --check now supports the same output formats as the linter, including the github and gitlab outputs for rendering annotations in CI:

... (truncated)

Commits

a2635fd Bump 0.16.0 (#27136)
3433449 [ty] Reuse full call diagnostics for implicit setter calls (#27115)
2240070 Reflect ruff: ignore and --add-ignore stabilization in documentation (#27...
17ef711 Stabilize --add-ignore (#27125)
ef912bb Add newly stabilized rules to defaults (#27055)
b30f040 Stabilize new default rules (#27035)
bcd70c5 Exclude Markdown files from format-dev runs (#27052)
87e51e2 Fix format --check spans for syntax errors (#27045)
afe2723 [flake8-gettext] Stabilize qualified-name and built-in binding resolution (...
a9702d8 [flake8-bandit] Stabilize string literal binding resolution (S310) (#26944)
Additional commits viewable in compare view

Updates mypy from 1.20.0 to 2.3.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Packaging changes

No longer provide mypyc-accelerated wheels for macOS x86_64 [mypyc-wheels #119](mypyc/mypy_mypyc-wheels#119)

Mypy 2.3

We've just uploaded mypy 2.3.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:
python3 -m pip install -U mypy
You can read the full documentation for this release on Read the Docs.

The Upcoming Switch to the New Native Parser

We are planning to enable the new native parser (--native-parser) by default soon. We recommend that you test the native parser in your projects and report any issues in the mypy issue tracker.

Mypyc Free-threading Memory Safety

Free-threaded Python builds that don't have the GIL require additional synchronization primitives or lock-free algorithms to ensure memory safety when there are race conditions (for example, when a thread reads a list item while another thread writes the same list item concurrently). This release greatly improves memory safety of free threading.

List operations are now memory-safe on free threaded Python builds, even in the presence of race conditions. This has some performance cost. For list-heavy workloads, using librt.vecs.vec instead of list is often significantly faster, but note that vec is not (and likely won't be) fully memory safe, and the user is expected to avoid race conditions. The newly introduced librt.threading.Lock helps with this. Using variable-length tuples can also be more efficient than lists, since tuples are immutable and don't require expensive synchronization to ensure memory safety.

Instance attribute access is also (mostly) memory safe now on free-threaded builds in the presence of race conditions. We are planning to fix the remaining unsafe cases in a future release.

Full list of changes:

Make attribute access memory safe on free-threaded builds (Jukka Lehtosalo, PR 21705)

Fix unsafe borrowing of instance attributes with free-threading (Jukka Lehtosalo, PR 21688)

Make list get/set item more memory safe on free-threaded builds (Jukka Lehtosalo, PR 21683)

Don't borrow list items on free-threaded builds (Jukka Lehtosalo, PR 21679)

Make multiple assignment from list memory-safe on free-threaded builds (Jukka Lehtosalo, PR 21684)

... (truncated)

Commits

8aabf84 Drop +dev from version
4d8ad2a Update changelog for 2.3 release (#21728)
2c21546 [mypyc] Update documentation of race conditions under free threading (#21726)
a9f62a3 [mypyc] Make attribute access memory safe on free-threaded builds (#21705)
0faa413 Use PYODIDE environment variable for Emscripten cross-compilation detection...
3d75cdb [mypyc] Borrow final attributes more aggressively (#21702)
24c237d [mypyc] Improve documentation of Final (#21713)
b5be217 [mypyc] Update free threading Python compatibility docs (#21711)
cbcb51a Narrow for frozendict membership check (#21709)
af2bc0f Sync typeshed (#21707)
Additional commits viewable in compare view

Updates codespell from 2.4.2 to 2.4.3

Release notes

Sourced from codespell's releases.

v2.4.3

What's Changed

Add 'radback' to dictionary with correction by @Flo3561 in codespell-project/codespell#3883

Add 'repetirion' to dictionary corrections by @Flo3561 in codespell-project/codespell#3885

Need to specify a version of Python version after all by @DimitriPapadopoulos in codespell-project/codespell#3887

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3889

Add cases for "modulle" -> "module" by @utzcoz in codespell-project/codespell#3888

Add case "auido" -> "audio" by @utzcoz in codespell-project/codespell#3890

Add credentilas->credentials and friends by @peternewman in codespell-project/codespell#3895

Add the case "cubid" -> "cubic" by @utzcoz in codespell-project/codespell#3891

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3897

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3900

Bump codecov/codecov-action from 5 to 6 by @dependabot[bot] in codespell-project/codespell#3902

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3904

Add magntiude->magnitude by @nathanjmcdougall in codespell-project/codespell#3899

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3909

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in codespell-project/codespell#3912

Add the case "instanc" -> "instance" by @utzcoz in codespell-project/codespell#3896

gampad -> gamepad (and plural) by @julianstirling in codespell-project/codespell#3906

Add typos of monotonic and monotonicity by @nathanjmcdougall in codespell-project/codespell#3898

Add spelling correction for multipile(s)/vulnerabities. by @cfi-gb in codespell-project/codespell#3905

Add 'simpilfy -> simplify' by @... Description has been truncated

…7 updates Bumps the all-dependencies group with 7 updates in the /core/python/ambient-expense-agent directory: | Package | From | To | | --- | --- | --- | | [google-adk](https://github.com/google/adk-python) | `2.0.0a3` | `2.5.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.44.0` | `0.51.0` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | | [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.3.0` | `1.4.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.9` | `0.16.0` | | [mypy](https://github.com/python/mypy) | `1.20.0` | `2.3.0` | | [codespell](https://github.com/codespell-project/codespell) | `2.4.2` | `2.4.3` | Updates `google-adk` from 2.0.0a3 to 2.5.0 - [Release notes](https://github.com/google/adk-python/releases) - [Changelog](https://github.com/google/adk-python/blob/main/CHANGELOG.md) - [Commits](google/adk-python@v2.0.0a3...v2.5.0) Updates `uvicorn` from 0.44.0 to 0.51.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.44.0...0.51.0) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) Updates `pytest-asyncio` from 1.3.0 to 1.4.0 - [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases) - [Commits](pytest-dev/pytest-asyncio@v1.3.0...v1.4.0) Updates `ruff` from 0.15.9 to 0.16.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.9...0.16.0) Updates `mypy` from 1.20.0 to 2.3.0 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v1.20.0...v2.3.0) Updates `codespell` from 2.4.2 to 2.4.3 - [Release notes](https://github.com/codespell-project/codespell/releases) - [Commits](codespell-project/codespell@v2.4.2...v2.4.3) --- updated-dependencies: - dependency-name: codespell dependency-version: 2.4.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-dependencies - dependency-name: google-adk dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: mypy dependency-version: 2.3.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: all-dependencies - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: pytest-asyncio dependency-version: 1.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: ruff dependency-version: 0.16.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-dependencies - dependency-name: uvicorn dependency-version: 0.51.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 27, 2026

dependabot Bot requested a review from eliasecchig as a code owner July 27, 2026 21:55

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 27, 2026

github-actions Bot previously approved these changes Jul 27, 2026

View reviewed changes

dependabot Bot changed the title ~~chore(deps): bump the all-dependencies group in /core/python/ambient-expense-agent with 7 updates~~ chore(deps): bump the all-dependencies group across 1 directory with 7 updates Jul 28, 2026

dependabot Bot dismissed github-actions[bot]’s stale review via c9828c8 July 28, 2026 22:54

dependabot Bot force-pushed the dependabot/uv/core/python/ambient-expense-agent/all-dependencies-9959ec6201 branch from b545d40 to c9828c8 Compare July 28, 2026 22:54

github-actions Bot approved these changes Jul 28, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/uv/core/python/ambient-expense-agent/all-dependencies-9959ec6201 branch from c9828c8 to 1d80c03 Compare July 29, 2026 20:13

github-actions Bot previously approved these changes Jul 29, 2026

View reviewed changes

dependabot Bot dismissed github-actions[bot]’s stale review via d840bf4 August 3, 2026 02:10

dependabot Bot force-pushed the dependabot/uv/core/python/ambient-expense-agent/all-dependencies-9959ec6201 branch from 1d80c03 to d840bf4 Compare August 3, 2026 02:10

github-actions Bot approved these changes Aug 3, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/uv/core/python/ambient-expense-agent/all-dependencies-9959ec6201 branch from d840bf4 to 4940829 Compare August 3, 2026 16:46

github-actions Bot approved these changes Aug 3, 2026

View reviewed changes

dependabot Bot force-pushed the dependabot/uv/core/python/ambient-expense-agent/all-dependencies-9959ec6201 branch from 4940829 to 3377339 Compare August 4, 2026 20:40

github-actions Bot approved these changes Aug 4, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore(deps): bump the all-dependencies group across 1 directory with 7 updates - #2316

chore(deps): bump the all-dependencies group across 1 directory with 7 updates#2316
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/core/python/ambient-expense-agent/all-dependencies-9959ec6201

dependabot Bot commented on behalf of github Jul 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.5.0

2.5.0 (2026-07-16)

Breaking Changes

Features

Bug Fixes

2.5.0 (2026-07-16)

Features

Bug Fixes

Version 0.51.0

What's Changed

Version 0.50.1

What's Changed

New Contributors

Version 0.50.0

What's Changed

Version 0.49.0

What's Changed

Version 0.48.0

What's Changed

Version 0.47.0

What's Changed

0.51.0 (July 8, 2026)

Added

Removed

0.50.2 (July 6, 2026)

Fixed

0.50.1 (July 6, 2026)

Fixed

0.50.0 (July 4, 2026)

Changed

Deprecated

0.49.0 (June 3, 2026)

Changed

0.48.0 (May 24, 2026)

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

pytest-asyncio v1.4.0

1.4.0 - 2026-05-26

Deprecated

Added

Changed

Fixed

Notes for Downstream Packagers

pytest-asyncio v1.4.0a2

1.4.0a2 - 2026-05-02

Deprecated

Added

Changed

0.16.0

Release Notes

Breaking changes

0.16.0

Breaking changes

Mypy Release Notes

Next Release

Packaging changes

Mypy 2.3

The Upcoming Switch to the New Native Parser

Mypyc Free-threading Memory Safety

v2.4.3

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 27, 2026 •

edited

Loading