[dependabot]

Review before merging: this is no longer a routine bump

This PR started as a Dependabot bump and now carries production changes: VertexClaude, the exported plot.py and how float totals are computed. The owner reviews it before it merges. The original Dependabot text follows below the line.

The other lock PRs have merged, and this branch holds main and a fresh lock: main's lock with this PR's nine versions applied, no package older than on either side. The eight packages it drops (keyring and what only it pulled in) are also absent from Dependabot's own lock for this bump.

ADK 2.13: the cause of the failing tests

ADK 2.13 delivers a response schema to Claude as a structured_output tool (anthropic_llm._OutputSchemaTool, upstream 97af1ff), forced with thinking off and only offered with thinking on. VertexClaude still added output_config.format, so adapter and reviewer calls carried a tool and a format together.

VertexClaude now drops ADK's tool before ADK builds the request and keeps the format, so constrained decoding stays and a thinking model still thinks before it answers.

ADK's one declared breaking change, telemetry schema v2, does not reach this service: content capture resolves to NO_CONTENT, also with a hostile environment set, and no tracer provider is configured.

pandas 3.1: changes no test caught

Group float sums changed. pandas 3.1 dropped its compensated group sum for sorted keys (pandas issue 65103). The same code on pandas 3.0.6 and 3.1.0, over 411 datasets and 3,494 operations:

• Parsing is byte-identical.
• Only group sum, group mean and share within a group changed: 179 operations, 2,993 cells, at most 6e-14 relative.
• Some of it is visible. A monthly total of 4024.2 became 4024.2000000000003, in data.csv and in anything drawn from it. The data-fidelity rule treats silent precision loss as corruption.

The fix adds float totals in decimals, from each float's shortest form, which is the text data.csv holds. math.fsum was tried and rejected: its exact sum of the binary values gives 377.78000000000003 for cells that add up to 377.78. Int64 means stay on pandas: 0 of 52 differ.

Result against production (the old code on pandas 3.0.6), over 416 datasets and 3,524 operations. Parsing is byte-identical, and 540 operations differ:

Operations	Cells changed	Effect
Group sum and mean: 345	1,347	614 shorter and cleaner (0.11999999999999034 to 0.12), 732 in the last digits, at most 8e-14 relative. One overflowing mean is now correct instead of inf. No cell got noisier.
share: 195	71,680	At most 2 units in the last place (5e-16 relative). 72 % are closer to the exact ratio, 28 % further from it.

A share is a quotient, so it has no short form to recover, and one total moving by a unit in the last place shifts every share in that column. Grouped and ungrouped shares now use the same total. The ungrouped share had not changed between pandas versions, so that part is for consistency rather than a regression fix.

float_precision is gone. pandas 3.1 deprecated it because all modes now share one exact converter, and a later version removes it, which would break every exported plot.py with a number column. The loader, _read and the stress harness no longer set it.

Smaller items. Series.dt.weekday became day_of_week. The new parallel read_csv cannot trigger here: it needs a local file of at least 5 MB, and the data caps are 1 and 2 MiB.

Decision: keep the second commit

The pandas commit (44086229d) stays in this PR. Without it, the bump puts float noise into user data, which the fidelity rule forbids. It is a separate commit so that it can be reviewed on its own.

Deploy window

• Renderer: it stays on pandas 3.0.6 until it redeploys from this lock. In that window a plot reads data.csv without float_precision on the old reader, which misses about one in four 17-digit numbers by one unit in the last place. The difference does not show in a plot, and it ends with the renderer deploy.
• Users below pandas 3.1: an exported plot.py run on an older pandas gets the same one-unit difference. Keeping the argument would instead have broken those files on the pandas version that removes it.

Raised floor

pandas>=3.1.0 in the main dependencies and all nine lib-* extras. The floor is required: without float_precision, the fidelity test test_numbers_pass_untouched_operations_with_every_digit fails on pandas 3.0.6.

Verification

On the merged tree (commit 4697280d4):

• ruff, ruff format, mypy (193 files), uv lock --check and the changelog check pass.
• pytest: 26,091 passed, 157 skipped, with Pandas4Warning as an error, so no deprecated pandas call remains on a tested path.
• Live, on Claude Haiku 5.5 in eu with the deployed renderer: scatter-basic-matplotlib ended reviewer_ok with a score of 84 after one repair round, at $0.0320.

The renderer's plotting stack on pandas 3.1.0 (plotnine 0.15.8, seaborn 0.13.2), which CI skips: 4,479 passed, 4 failed in the pygal and lets-plot paths. The same 4 fail on main's own code and lock (pandas 3.0.6, ADK 2.11), so this PR did not cause them.

---

Bumps the python-minor group with 9 updates in the / directory:

Package	From	To
fastmcp	4.1.1	4.1.4
alembic	1.20.0	1.20.1
pandas	3.0.6	3.1.0
pydantic-settings	2.16.0	2.16.1
cachetools	7.2.3	7.2.5
pytest-asyncio	1.4.0	1.4.1
ruff	0.17.1	0.17.2
plotnine	0.15.7	0.15.8
google-adk	2.11.0	2.13.0

Updates fastmcp from 4.1.1 to 4.1.4

Release notes

Sourced from fastmcp's releases.

v4.1.4: Token Gesture

Generated CLIs now preserve remote transports, empty arrays, and parameters whose names collide with their own helpers; mounted servers honor session visibility and mounted_components_raise_on_load_error, a stale client context no longer closes a newer session, and OAuth provider wrappers accept identity assertions. Tasks accept a redis-py credential provider that returns current credentials for each new connection (streaming providers such as redis-entraid's are rejected until Docket can refresh them safely), Redis 8.1.0 is excluded, and custom KeyringStore users must now install py-key-value-aio[keyring] explicitly. Thanks to our 16 contributors, including 9 first-time contributors.

What's Changed

Enhancements ✨

• Add server authoring guidance through the docs site by @​zzstoatzz in PrefectHQ/fastmcp#5703
• Support rotating Redis credentials for tasks by @​zzstoatzz and @​nazarii-plebanskyi-rf in PrefectHQ/fastmcp#5970
• fix(client): forward max_sse_event_size through StreamableHttpTransport by @​PrathmeshPawar2110 in PrefectHQ/fastmcp#6016
• Add a downstream smoke for Redis credential providers by @​zzstoatzz in PrefectHQ/fastmcp#6044

Security 🔒

• Bump certifi to 2026.10.19 by @​jakekaplan in PrefectHQ/fastmcp#5989
• Let configured proxy headers replace forwarded ones regardless of case by @​leopranzl in PrefectHQ/fastmcp#5972

Fixes 🐞

• Fix maintained skill discovery on the docs site by @​zzstoatzz in PrefectHQ/fastmcp#5954
• Publish regular skill files for Mintlify discovery by @​zzstoatzz in PrefectHQ/fastmcp#5956
• Serialize HTTP and SSE transports in generate-cli by @​asasemahmed in PrefectHQ/fastmcp#5891
• fix(cli): preserve empty arrays in generated commands by @​dailyun in PrefectHQ/fastmcp#5961
• Fix session visibility lookups through mounted servers by @​HootRock and @​leopranzl in PrefectHQ/fastmcp#5966
• Fix generated CLI JSON parameter name collisions by @​Vittuu in PrefectHQ/fastmcp#5959
• Escape server text in the fastmcp call elicitation prompt by @​asasemahmed in PrefectHQ/fastmcp#5909
• Map common audio extensions when Audio is given a path by @​asasemahmed in PrefectHQ/fastmcp#5919
• Drop clamped log records the logger is not enabled for by @​asasemahmed in PrefectHQ/fastmcp#5915
• Omit the output schema when an OpenAPI success response has no body by @​asasemahmed in PrefectHQ/fastmcp#5913
• Create the MCP config file on install when it is missing or empty by @​asasemahmed in PrefectHQ/fastmcp#5887
• Preserve credential providers when cloning task extensions by @​zzstoatzz and @​nazarii-plebanskyi-rf in PrefectHQ/fastmcp#5984
• Exclude Redis 8.1.0 to preserve task reconnection by @​zzstoatzz and @​nazarii-plebanskyi-rf in PrefectHQ/fastmcp#5985
• Remove unused keyring dependency by @​zzstoatzz and @​tom42-otera in PrefectHQ/fastmcp#5987
• Fix static checks broken by ty 0.0.89 and pydantic 2.14 by @​zzstoatzz in PrefectHQ/fastmcp#6001
• Run dev inspector servers over stdio and stop mapping the deployment port to the proxy by @​asasemahmed in PrefectHQ/fastmcp#6029
• fix(json-schema): apply a Draft-4 boolean exclusive bound to its sibling by @​kbkb628 in PrefectHQ/fastmcp#5234
• Strip a URL scheme from a Clerk domain by @​asasemahmed in PrefectHQ/fastmcp#5921
• Fix generate-cli commands for tools with a json parameter by @​andreivince in PrefectHQ/fastmcp#6032
• Honor mounted_components_raise_on_load_error in AggregateProvider by @​asasemahmed in PrefectHQ/fastmcp#6026
• Reject streaming credential providers in TasksExtension by @​zzstoatzz in PrefectHQ/fastmcp#6043
• fix(client): keep stale contexts from closing newer sessions by @​mikamikasuki in PrefectHQ/fastmcp#6018
• fix(auth): expose identity assertions on OAuth provider wrappers by @​computeaholic and @​jonaseck2 in PrefectHQ/fastmcp#6006
• Measure blocking duration with perf_counter in transform_fn generator test by @​Lokeshrao69 in PrefectHQ/fastmcp#6014

Docs 📚

• Clarify request state across mounted servers by @​HootRock and @​leopranzl in PrefectHQ/fastmcp#5967
• Pass mcp_path through the remote OAuth custom routes example by @​asasemahmed in PrefectHQ/fastmcp#5925

New Contributors

• @​dailyun made their first contribution in PrefectHQ/fastmcp#5961
• @​Vittuu made their first contribution in PrefectHQ/fastmcp#5959
• @​leopranzl made their first contribution in PrefectHQ/fastmcp#5966
• @​nazarii-plebanskyi-rf made their first contribution in PrefectHQ/fastmcp#5970
• @​tom42-otera made their first contribution in PrefectHQ/fastmcp#5987
• @​computeaholic made their first contribution in PrefectHQ/fastmcp#6006

... (truncated)

Changelog

Sourced from fastmcp's changelog.

---

title: "Changelog" icon: "list-check" rss: true tag: NEW

v4.2.0a1: Skill Issue

FastMCP 4.2's first alpha brings code-defined skills, discovery through mounted and proxied servers, and verified downloads into one workflow. Build a Skill in Python or load one from a folder or package, publish it through SkillCatalogProvider, and let clients discover its metadata or download and export its files. Proxy discovery is opt-in with skills=True. Skills support remains experimental; this prerelease is intended for integration testing. It also includes lazy, shared Prefab renderer resources and backend-addressing fixes. Migration: Skill now represents file contents; the wire metadata model is named MCPSkill. Whole-skill downloads require a standard SKILL.md with a name matching its URI and a description. Exports with overwrite=True replace the installed folder, including locally added files. Ordinary resource providers still support their existing document formats. Thanks to our 8 contributors, including 3 first-time contributors.

Breaking Changes ⚠️

• Make Skill a storage-neutral object with folders as one loader by @​zzstoatzz in #6065

Enhancements ✨

• Rename the resource-era list_skills helper to list_skill_summaries by @​zzstoatzz in #6051
• Discover skills through mounted servers by @​zzstoatzz in #6067
• Share Prefab renderer resources across equivalent tools by @​jlowin, @​fprieto14, and @​keremoktener in #6077
• Export Skill from fastmcp by @​zzstoatzz in #6071
• Add skills discovery to ClientGroup by @​zzstoatzz in #6072
• Add --skills to fastmcp list by @​zzstoatzz in #6073
• Add Client.read_skill and tighten skills docs by @​zzstoatzz in #6087
• Verify and export skills with resource-manifest fallback by @​zzstoatzz in #6086
• Forward Skills discovery through proxies by @​jakekaplan in #5788
• Share strict skill snapshot projection by @​zzstoatzz in #6089
• Use scoped local tests and leave full suites to CI by @​zzstoatzz in #6094
• Share ClientGroup skill client lookup by @​zzstoatzz in #6101
• Share filesystem skill supporting-file reads by @​zzstoatzz in #6102

Security 🔒

• Verify advertised skill frontmatter when reading content by @​zzstoatzz in #6090
• Check skill limits before reading directory and remote files by @​zzstoatzz in #6092

Fixes 🐞

• Make the version-check InvalidURL regression independent of proxy parsing by @​HootRock in #6048
• Build the Prefab renderer page on read, not on resources/list by @​adam-zovos in #6039
• Install mounted skills under their own name in sync_skills by @​zzstoatzz in #6078
• Stage skill exports before replacing installed files by @​zzstoatzz in #6091
• fix: Prefix backend hash addresses with double underscores by @​jlowin and @​BlueX888 in #6100

Docs 📚

• Consolidate skills docs into one Skills over MCP page by @​zzstoatzz in #6049
• Rewrite skills docs around Skill and SkillCatalogProvider by @​zzstoatzz in #6066
• Tighten skills docs examples by @​zzstoatzz in #6070
• Shorten the skills docs page by @​zzstoatzz in #6079
• Badge the skills page as 4.2.0 by @​zzstoatzz in #6083
• Consolidate skills examples around verified Skill values by @​zzstoatzz in #6093

New Contributors

• @​fprieto14 made their first contribution in #6077
• @​keremoktener made their first contribution in #6077
• @​adam-zovos made their first contribution in #6039

... (truncated)

Commits

• 26bf908 docs: add v4.1.4 changelog entries (#6046)
• d720db2 Measure blocking duration with perf_counter in transform_fn generator test (#...
• d4af9a8 Add a downstream smoke for Redis credential providers (#6044)
• eeb6e93 fix(client): forward max_sse_event_size through StreamableHttpTransport (#6016)
• 4f40ac0 fix(auth): expose identity assertions on OAuth provider wrappers (#6006)
• de37675 fix(client): keep stale contexts from closing newer sessions (#6018)
• cb11052 Reject streaming credential providers in TasksExtension (#6043)
• 4c7cf2b Honor mounted_components_raise_on_load_error in AggregateProvider (#6026)
• 2ae660a Fix generate-cli commands for tools with a json parameter (#6032)
• a9a41eb Strip a URL scheme from a Clerk domain (#5921)
• Additional commits viewable in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Updates pandas from 3.0.6 to 3.1.0

Release notes

Sourced from pandas's releases.

pandas 3.1.0

We are pleased to announce the release of pandas 3.1.0. This release includes some new features, bug fixes, and performance improvements. We recommend that all users upgrade to this version.

Highlights include:

• New DataFrame.select() and updated DataFrame.filter() method
• Faster pd.read_csv(), with parallel reads of large files

See the detailed release notes for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade pandas

Or from conda-forge

conda install -c conda-forge pandas

Please report any issues with the release on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

pandas 3.1.0rc0

We are pleased to announce a release candidate for pandas 3.1.0.

See the whatsnew for a list of all the changes.

The release can be installed from PyPI:

python -m pip install --upgrade --pre pandas==3.1.0rc0

Or from conda-forge

conda install -c conda-forge/label/pandas_rc pandas==3.1.0rc0

Please report any issues with the release candidate on the pandas issue tracker.

Thanks to all the contributors who made this release possible.

Commits

• c6f4676 RLS: 3.1.0
• dd69475 Backport PR #71468 on branch 3.1.x (DOC: 3.1 whatsnew: add some structure to ...
• 4ccc19a Backport PR #71465 on branch 3.1.x (DOC: update announce (contributor listing...
• 24dae63 [backport 3.1.x] DOC: cleanup 3.1.0 whatsnew (#71408) (#71466)
• 8519ca6 [backport 3.1.x] CI: temporary pin dateutil to <3 (#71461) (#71464)
• 2126193 Backport PR #71387 on branch 3.1.x (BUG: fix string regex operations with $ e...
• 4700f5d Backport PR #71442 on branch 3.1.x (BUG: parallel read_csv raising released m...
• 08efb14 Backport PR #71456 on branch 3.1.x (TST: Fix test_reduce_array until reduct...
• ee8dcb7 Backport PR #71429 on branch 3.1.x (DOC: add dedicated 3.1 whatsnew section f...
• d93e32c Backport PR #71383 on branch 3.1.x (BUG: fix string regex operations with Pyt...
• Additional commits viewable in compare view

Updates pydantic-settings from 2.16.0 to 2.16.1

Release notes

Sourced from pydantic-settings's releases.

v2.16.1

Highlights

This patch release fixes two CLI regressions introduced in 2.16.0.

Bug fixes

CLI

• Fixed-length tuple positionals such as CliPositionalArg[tuple[int, int]] and NamedTuples are single-valued again (#1069). Since 2.16.0 they were treated as variadic, so a CLI either refused to start with a SettingsError or put the wrong argument into the tuple. Variable-length tuples (tuple[int, ...] and bare Tuple) are still variadic.
• A field typed as an alias of a list of dicts, e.g. type ListOfDict = list[dict[str, int]], accepts a JSON list again (#1049). Since 2.16.0, --xx '[{"a":1},{"b":2}]' was merged into the single dict {"a": 1, "b": 2} and failed validation.

What's Changed

• Harden CI by @​Viicos in pydantic/pydantic-settings#1044
• Keep list of dicts CLI values as lists by @​hramezani in pydantic/pydantic-settings#1049
• Keep fixed-length tuple CLI positionals single-valued by @​hramezani in pydantic/pydantic-settings#1069
• Prepare release 2.16.1 by @​hramezani in pydantic/pydantic-settings#1087
• build(deps): bump the python-packages group with 3 updates by @​dependabot[bot] in pydantic/pydantic-settings#1056

Full Changelog: pydantic/pydantic-settings@v2.16.0...v2.16.1

Commits

• 4e286e2 Prepare release 2.16.1 (#1087)
• 993b59e Keep fixed-length tuple CLI positionals single-valued (#1069)
• f651a7a Keep list of dicts CLI values as lists (#1049)
• ecf7d90 Harden CI (#1044)
• See full diff in compare view

Updates cachetools from 7.2.3 to 7.2.5

Changelog

Sourced from cachetools's changelog.

v7.2.5 (2026-10-25)

• Fix @cachedmethod with condition for decorated methods taking a pending keyword argument (broken since v7.0.0).

• Fix pickling and deep-copying of instances using @cachedmethod (broken since v7.0.0).

• Fix calling @cachedmethod decorated methods through the class with the receiver (self) passed as a keyword argument (broken since v7.2.4).

• Various documentation improvements.

v7.2.4 (2026-10-19)

• Restore autospec calls to @cachedmethod decorated methods.

• Improve branch coverage of unit tests.

• Minor type stub improvements.

Commits

• a2d411e Release v7.2.5.
• 354c075 Various documentation corrections and improvements.
• 2609f06 Fix #417: Re-enable pickling of objects with cached methods.
• b34643f Fix @​cachedmethod class access with receiver as keyword argument.
• 36d4e87 Forward "pending" keyword argument in cached methods.
• 6f23e2a Release v7.2.4.
• 2be4254 Clarify _AbstractCondition's wait() and notify() are reserved for future use.
• eb84481 Improve branch coverage of unit tests.
• 95e6add Fix #443: Restore autospec calls to @​cachedmethod decorated methods
• See full diff in compare view

Updates pytest-asyncio from 1.4.0 to 1.4.1

Release notes

Sourced from pytest-asyncio's releases.

pytest-asyncio v1.4.1

1.4.1 - 2026-10-25

Added

• Declared support for Python 3.15 (#1588)

Fixed

• Allow AsyncIterable as a return type for asynchronous generator fixtures decorated with pytest_asyncio.fixture (#1090)

Notes for Downstream Packagers

• Source-tree development dependencies now use PEP 735 dependency groups and uv.lock. (#1518)

Commits

• 6af7f5c chore: Prepare release of v1.4.1.
• 32ccf64 Support 3.15 (#1588)
• 9830071 Build(deps): Bump certifi from 2026.6.17 to 2026.10.19 (#1590)
• 0238023 Build(deps): Bump virtualenv from 21.7.13 to 21.14.13 (#1589)
• 93893ec Build(deps): Bump astral-sh/setup-uv from 10.2.0 to 10.3.0 (#1583)
• f287e5e Build(deps): Bump actions/download-artifact from 8.0.1 to 8.0.2 (#1581)
• b71da4f Build(deps-dev): Bump hypothesis from 6.168.3 to 6.168.5 (#1582)
• d8c51d8 Build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#1580)
• b12808b Build(deps): Bump virtualenv from 21.7.12 to 21.7.13 (#1578)
• e0601f0 Build(deps-dev): Bump coverage from 7.16.1 to 7.16.2 (#1577)
• Additional commits viewable in compare view

Updates ruff from 0.17.1 to 0.17.2

Release notes

Sourced from ruff's releases.

0.17.2

Release Notes

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

Install ruff 0.17.2

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.2/ruff-installer.sh | sh
</tr></table> 

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.2

Released on 2026-10-22.

Preview features

• [complexity] Add unnecessary-regular-expression-compile (#25533)

Bug fixes

• Avoid syntax errors for type variables with starred constraints (UP040, UP046, UP047, RUF053) (#28362)
• [pydocstyle] Treat backslash-escaped *args and **kwargs as documented (D417) (#29536)
• [pylint] Avoid false positive on starred elements (PLE0643) (#29483)
• [pylint] Mark fixes unsafe when deleting comments (PLR5501, PLW0120) (#29414)
• [pyupgrade] Mark fix unsafe when deleting comments (UP035) (#29413)

Performance

• Avoid intermediate names in lint name resolution (#29506)
• Prefilter bidirectional Unicode checks by UTF-8 leading bytes (#29561)
• Share postfix parsing and reduce expression copies (#29480)

Configuration

• [pylint] Add a configurable allowlist for magic-value-comparison (PLR2004) (#18961)

Documentation

• Clarify documentation and correct stale guidance (#29374)
• [pyupgrade] Remove mentions of variance related to fix safety (UP040, UP047) (#29592)

Contributors

• @​fixfon
• @​MichaReiser
• @​zaniebot
• @​FrancescoPezzella
• @​anishgirianish
• @​rajveer3x
• @​charliermarsh
• @​LckyLike
• @​DaniBodor

Commits

• 30516b4 Bump version to 0.17.2 (#29637)
• 59a9e85 [ty] Generalize nested types in inferred return types (#29488)
• 0d562aa [ty] Check inherited attribute conflicts (#28559)
• 48dcdd0 [ty] Restrict range implications from gradual equivalence (#29577)
• 734d75a [ty] Check for unsatisfiable bodies before existentially quantifying (#29504)
• b0f9526 [ty] Preserve checks for recursive descriptor setter types (#29148)
• 32869b4 Avoid creating deployments for automation jobs (#29626)
• ec891ba Link the commit in pull request report footers (#29621)
• 8958748 [ty] Publish ecosystem reports from GitHub Actions (#29609)
• 01f5394 [ty] Publish typing conformance reports from GitHub Actions (#29608)
• Additional commits viewable in compare view

Updates plotnine from 0.15.7 to 0.15.8

Release notes

Sourced from plotnine's releases.

v0.15.8

Bug Fixes

• plotnine can be installed under Pyodide 314 again. Pyodide 314 vendors statsmodels 0.14.6 and builds it itself, so the requirement that held statsmodels at 0.14.4 under Pyodide left micropip with no wheel to install and it failed with Can't find a pure Python 3 wheel for 'statsmodels<=0.14.4; sys_platform == "emscripten"'. The requirement now admits 0.14.6 there, and still holds at 0.14.4 for the older Pyodide that vendors that version.

Changelog

Sourced from plotnine's changelog.

v0.15.8

(2026-08-14)

Bug Fixes

• plotnine can be installed under Pyodide 314 again. Pyodide 314 vendors statsmodels 0.14.6 and builds it itself, so the requirement that held statsmodels at 0.14.4 under Pyodide left micropip with no wheel to install and it failed with Can't find a pure Python 3 wheel for 'statsmodels<=0.14.4; sys_platform == "emscripten"'. The requirement now admits 0.14.6 there, and still holds at 0.14.4 for the older Pyodide that vendors that version. ({{< issue 1106 >}})

Commits

• 3bb7732 fix: install under Pyodide 314
• See full diff in compare view

Updates google-adk from 2.11.0 to 2.13.0

Release notes

Sourced from google-adk's releases.

v2.13.0

2.13.0 (2026-10-22)

Highlights

This release stabilizes core features while introducing TypeSafe workflow classification, live audio interactions, MongoDB integrations, and execution performance improvements.

• Stability: Access 12 mature experimental features now promoted to stable status. See the unit guide for more details. (ea298d4)
• Classifiers: Route workflows with TypeSafe's Jev models via the new TypesafeClassifier and ClassifierNode. Jev returns calibrated probabilities in a single forward pass, much faster than an LLM. See the unit guide for more details. (ddf8c55, e8c4bac)
• Live Audio: Enable natural real-time voice interactions with barge-in support alongside Gemini speech-to-text and text-to-speech integration. See the unit guide for more details. (2e7ef92)
• MongoDB Sessions & Memory: Persist sessions in MongoDB and share them across runner replicas with the new MongoDbSessionService. Add long-term memory without an embedding model using MongoDbMemoryService, which recalls past turns by keyword match on any MongoDB deployment, with no vector index needed. Both are experimental. See the session service and memory service guides for more details. (0df43f5, e40e349)
• MongoDB: Deploy MongoDbToolset to Agent Engine without packaging your connection string, and let Atlas Automated Embedding embed search queries server-side, with no Google embedding call or credentials needed. See the unit guide for more details. (bc3773f, 2f6c666, 8bbfc33)
• Performance: Enjoy up to 8x faster execution turns for string-model agents and reduced event-loading overhead. (772f139)

Breaking changes

• Telemetry: Defaults to OpenTelemetry GenAI v2 (otel_semconv_1_44, removing call_llm); set ADK_TELEMETRY_SCHEMA_VERSION_OPT_IN=otel_semconv_1_36 to keep the legacy v1 schema. See the unit guide for more details. (7838488)

⚠ BREAKING CHANGES

• telemetry: deprecate call_llm span and OpenTelemetry 1.36 GenAI semconv

Features

• add delete_memory api to BaseMemoryService (41e5c7b), closes #6949
• add MongoDB-backed memory service (e40e349)
• add MongoDB-backed session service (0df43f5)
• add OpenSandbox environment (69d1c90), closes #6758
• classifiers: add BaseClassifier and typed question/answer types (773418f)
• classifiers: add ClassifierNode for workflow routing (e8c4bac)
• classifiers: add LlmClassifier (772b577)
• eval: split invocation duration into model, tool and framework time (e3797a4)
• features: promote 12 mature experimental features to stable (ea298d4)
• honor ADK_SUPPRESS_EXPERIMENTAL_FEATURE_WARNINGS (b592dee), closes #5114
• integrations: add TypesafeClassifier for TypeSafe's Jev models (ddf8c55)
• integrations: keep MongoDB credentials out of Agent Engine packages (ab5cb45)
• live: add barge-in support to CascadeLiveConnection (2e7ef92)
• live: add Gemini speech-to-text and text-to-speech for CascadeLive (f78149a)
• live: add ZIP_STORED visual frame pack and unpack helpers (17d8a5a)
• make MongoDbToolset picklable for Agent Engine (2f6c666)
• plugins: add agent evaluation session and turn trace views (ab9c994)
• plugins: classify error-bearing tool results and extract shared callback helpers (a4b8ee9), closes #7112
• plugins: classify write-time 403 and 404 drops in BigQueryAgentAnalyticsPlugin (d5c87a6)
• plugins: log terminations, node results and tool result errors in the logging plugins (6a77d48)
• record google_search grounding on LLM spans (ead208a), closes #7345
• samples: add Secret Manager and Parameter Manager integration samples (7391411), closes #7582

... (truncated)

Changelog

Sourced from google-adk's changelog.

2.13.0 (2026-10-22)

Highlights

This release stabilizes core features while introducing TypeSafe workflow classification, live audio interactions, MongoDB integrations, and execution performance improvements.

• Stability: Access 12 mature experimental features now promoted to stable status. See the unit guide for more details. (ea298d4)
• Classifiers: Route workflows with TypeSafe's Jev models via the new TypesafeClassifier and ClassifierNode. Jev returns calibrated probabilities in a single forward pass, much faster than an LLM. See the unit guide for more details. (ddf8c55, e8c4bac)
• Live Audio: Enable natural real-time voice interactions with barge-in support alongside Gemini speech-to-text and text-to-speech integration. See the unit guide for more details. (2e7ef92)
• MongoDB Sessions & Memory: Persist sessions in MongoDB and share them across runner replicas with the new MongoDbSessionService. Add long-term memory without an embedding model using MongoDbMemoryService, which recalls past turns by keyword match on any MongoDB deployment, with no vector index needed. Both are experimental. See the session service and memory service guides for more details. (0df43f5, e40e349)
• MongoDB: Deploy MongoDbToolset to Agent Engine without packaging your connection string, and let Atlas Automated Embedding embed search queries server-side,...

  Description has been truncated