From 6d49122238a5e7d497c5d002792732446071dcb2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?G=C3=A1bor=20Feh=C3=A9r?= Date: Mon, 23 Mar 2026 16:15:55 +0100 Subject: [PATCH 1/7] chore: remove the use of deprecated types from VertexTaskStore (#889) * vertexai.Part & co. will be replaced soon by genai.Part & co. * It's better to use the more specifically named variants of `Task` and `Status`: `A2aTask` and `A2aTaskStatus`. For #751 --- .../contrib/tasks/vertex_task_converter.py | 49 ++++++------ .../tasks/test_vertex_task_converter.py | 74 +++++++++++-------- 2 files changed, 69 insertions(+), 54 deletions(-) diff --git a/src/a2a/contrib/tasks/vertex_task_converter.py b/src/a2a/contrib/tasks/vertex_task_converter.py index eac15e2c6..5015211c7 100644 --- a/src/a2a/contrib/tasks/vertex_task_converter.py +++ b/src/a2a/contrib/tasks/vertex_task_converter.py @@ -1,4 +1,5 @@ try: + from google.genai import types as genai_types from vertexai import types as vertexai_types except ImportError as e: raise ImportError( @@ -25,40 +26,40 @@ _TO_SDK_TASK_STATE = { - vertexai_types.State.STATE_UNSPECIFIED: TaskState.unknown, - vertexai_types.State.SUBMITTED: TaskState.submitted, - vertexai_types.State.WORKING: TaskState.working, - vertexai_types.State.COMPLETED: TaskState.completed, - vertexai_types.State.CANCELLED: TaskState.canceled, - vertexai_types.State.FAILED: TaskState.failed, - vertexai_types.State.REJECTED: TaskState.rejected, - vertexai_types.State.INPUT_REQUIRED: TaskState.input_required, - vertexai_types.State.AUTH_REQUIRED: TaskState.auth_required, + vertexai_types.A2aTaskState.STATE_UNSPECIFIED: TaskState.unknown, + vertexai_types.A2aTaskState.SUBMITTED: TaskState.submitted, + vertexai_types.A2aTaskState.WORKING: TaskState.working, + vertexai_types.A2aTaskState.COMPLETED: TaskState.completed, + vertexai_types.A2aTaskState.CANCELLED: TaskState.canceled, + vertexai_types.A2aTaskState.FAILED: TaskState.failed, + vertexai_types.A2aTaskState.REJECTED: TaskState.rejected, + vertexai_types.A2aTaskState.INPUT_REQUIRED: TaskState.input_required, + vertexai_types.A2aTaskState.AUTH_REQUIRED: TaskState.auth_required, } _SDK_TO_STORED_TASK_STATE = {v: k for k, v in _TO_SDK_TASK_STATE.items()} -def to_sdk_task_state(stored_state: vertexai_types.State) -> TaskState: +def to_sdk_task_state(stored_state: vertexai_types.A2aTaskState) -> TaskState: """Converts a proto A2aTask.State to a TaskState enum.""" return _TO_SDK_TASK_STATE.get(stored_state, TaskState.unknown) -def to_stored_task_state(task_state: TaskState) -> vertexai_types.State: +def to_stored_task_state(task_state: TaskState) -> vertexai_types.A2aTaskState: """Converts a TaskState enum to a proto A2aTask.State enum value.""" return _SDK_TO_STORED_TASK_STATE.get( - task_state, vertexai_types.State.STATE_UNSPECIFIED + task_state, vertexai_types.A2aTaskState.STATE_UNSPECIFIED ) -def to_stored_part(part: Part) -> vertexai_types.Part: +def to_stored_part(part: Part) -> genai_types.Part: """Converts a SDK Part to a proto Part.""" if isinstance(part.root, TextPart): - return vertexai_types.Part(text=part.root.text) + return genai_types.Part(text=part.root.text) if isinstance(part.root, DataPart): data_bytes = json.dumps(part.root.data).encode('utf-8') - return vertexai_types.Part( - inline_data=vertexai_types.Blob( + return genai_types.Part( + inline_data=genai_types.Blob( mime_type='application/json', data=data_bytes ) ) @@ -66,14 +67,14 @@ def to_stored_part(part: Part) -> vertexai_types.Part: file_content = part.root.file if isinstance(file_content, FileWithBytes): decoded_bytes = base64.b64decode(file_content.bytes) - return vertexai_types.Part( - inline_data=vertexai_types.Blob( + return genai_types.Part( + inline_data=genai_types.Blob( mime_type=file_content.mime_type or '', data=decoded_bytes ) ) if isinstance(file_content, FileWithUri): - return vertexai_types.Part( - file_data=vertexai_types.FileData( + return genai_types.Part( + file_data=genai_types.FileData( mime_type=file_content.mime_type or '', file_uri=file_content.uri, ) @@ -81,14 +82,14 @@ def to_stored_part(part: Part) -> vertexai_types.Part: raise ValueError(f'Unsupported part type: {type(part.root)}') -def to_sdk_part(stored_part: vertexai_types.Part) -> Part: +def to_sdk_part(stored_part: genai_types.Part) -> Part: """Converts a proto Part to a SDK Part.""" if stored_part.text: return Part(root=TextPart(text=stored_part.text)) if stored_part.inline_data: - encoded_bytes = base64.b64encode(stored_part.inline_data.data).decode( - 'utf-8' - ) + encoded_bytes = base64.b64encode( + stored_part.inline_data.data or b'' + ).decode('utf-8') return Part( root=FilePart( file=FileWithBytes( diff --git a/tests/contrib/tasks/test_vertex_task_converter.py b/tests/contrib/tasks/test_vertex_task_converter.py index d054b10cb..de6ae8cd6 100644 --- a/tests/contrib/tasks/test_vertex_task_converter.py +++ b/tests/contrib/tasks/test_vertex_task_converter.py @@ -7,7 +7,7 @@ 'vertexai', reason='Vertex Task Converter tests require vertexai' ) from vertexai import types as vertexai_types - +from google.genai import types as genai_types from a2a.contrib.tasks.vertex_task_converter import ( to_sdk_artifact, to_sdk_part, @@ -34,29 +34,39 @@ def test_to_sdk_task_state() -> None: assert ( - to_sdk_task_state(vertexai_types.State.STATE_UNSPECIFIED) + to_sdk_task_state(vertexai_types.A2aTaskState.STATE_UNSPECIFIED) == TaskState.unknown ) assert ( - to_sdk_task_state(vertexai_types.State.SUBMITTED) == TaskState.submitted + to_sdk_task_state(vertexai_types.A2aTaskState.SUBMITTED) + == TaskState.submitted + ) + assert ( + to_sdk_task_state(vertexai_types.A2aTaskState.WORKING) + == TaskState.working ) - assert to_sdk_task_state(vertexai_types.State.WORKING) == TaskState.working assert ( - to_sdk_task_state(vertexai_types.State.COMPLETED) == TaskState.completed + to_sdk_task_state(vertexai_types.A2aTaskState.COMPLETED) + == TaskState.completed ) assert ( - to_sdk_task_state(vertexai_types.State.CANCELLED) == TaskState.canceled + to_sdk_task_state(vertexai_types.A2aTaskState.CANCELLED) + == TaskState.canceled ) - assert to_sdk_task_state(vertexai_types.State.FAILED) == TaskState.failed assert ( - to_sdk_task_state(vertexai_types.State.REJECTED) == TaskState.rejected + to_sdk_task_state(vertexai_types.A2aTaskState.FAILED) + == TaskState.failed ) assert ( - to_sdk_task_state(vertexai_types.State.INPUT_REQUIRED) + to_sdk_task_state(vertexai_types.A2aTaskState.REJECTED) + == TaskState.rejected + ) + assert ( + to_sdk_task_state(vertexai_types.A2aTaskState.INPUT_REQUIRED) == TaskState.input_required ) assert ( - to_sdk_task_state(vertexai_types.State.AUTH_REQUIRED) + to_sdk_task_state(vertexai_types.A2aTaskState.AUTH_REQUIRED) == TaskState.auth_required ) assert to_sdk_task_state(999) == TaskState.unknown # type: ignore @@ -65,35 +75,39 @@ def test_to_sdk_task_state() -> None: def test_to_stored_task_state() -> None: assert ( to_stored_task_state(TaskState.unknown) - == vertexai_types.State.STATE_UNSPECIFIED + == vertexai_types.A2aTaskState.STATE_UNSPECIFIED ) assert ( to_stored_task_state(TaskState.submitted) - == vertexai_types.State.SUBMITTED + == vertexai_types.A2aTaskState.SUBMITTED ) assert ( - to_stored_task_state(TaskState.working) == vertexai_types.State.WORKING + to_stored_task_state(TaskState.working) + == vertexai_types.A2aTaskState.WORKING ) assert ( to_stored_task_state(TaskState.completed) - == vertexai_types.State.COMPLETED + == vertexai_types.A2aTaskState.COMPLETED ) assert ( to_stored_task_state(TaskState.canceled) - == vertexai_types.State.CANCELLED + == vertexai_types.A2aTaskState.CANCELLED + ) + assert ( + to_stored_task_state(TaskState.failed) + == vertexai_types.A2aTaskState.FAILED ) - assert to_stored_task_state(TaskState.failed) == vertexai_types.State.FAILED assert ( to_stored_task_state(TaskState.rejected) - == vertexai_types.State.REJECTED + == vertexai_types.A2aTaskState.REJECTED ) assert ( to_stored_task_state(TaskState.input_required) - == vertexai_types.State.INPUT_REQUIRED + == vertexai_types.A2aTaskState.INPUT_REQUIRED ) assert ( to_stored_task_state(TaskState.auth_required) - == vertexai_types.State.AUTH_REQUIRED + == vertexai_types.A2aTaskState.AUTH_REQUIRED ) @@ -155,15 +169,15 @@ class BadPart: def test_to_sdk_part_text() -> None: - stored_part = vertexai_types.Part(text='hello back') + stored_part = genai_types.Part(text='hello back') sdk_part = to_sdk_part(stored_part) assert isinstance(sdk_part.root, TextPart) assert sdk_part.root.text == 'hello back' def test_to_sdk_part_inline_data() -> None: - stored_part = vertexai_types.Part( - inline_data=vertexai_types.Blob( + stored_part = genai_types.Part( + inline_data=genai_types.Blob( mime_type='application/json', data=b'{"key": "val"}', ) @@ -177,8 +191,8 @@ def test_to_sdk_part_inline_data() -> None: def test_to_sdk_part_file_data() -> None: - stored_part = vertexai_types.Part( - file_data=vertexai_types.FileData( + stored_part = genai_types.Part( + file_data=genai_types.FileData( mime_type='image/jpeg', file_uri='gs://bucket/image.jpg', ) @@ -191,7 +205,7 @@ def test_to_sdk_part_file_data() -> None: def test_to_sdk_part_unsupported() -> None: - stored_part = vertexai_types.Part() + stored_part = genai_types.Part() with pytest.raises(ValueError, match='Unsupported part:'): to_sdk_part(stored_part) @@ -210,7 +224,7 @@ def test_to_stored_artifact() -> None: def test_to_sdk_artifact() -> None: stored_artifact = vertexai_types.TaskArtifact( artifact_id='art-456', - parts=[vertexai_types.Part(text='part_2')], + parts=[genai_types.Part(text='part_2')], ) sdk_artifact = to_sdk_artifact(stored_artifact) assert sdk_artifact.artifact_id == 'art-456' @@ -236,7 +250,7 @@ def test_to_stored_task() -> None: stored_task = to_stored_task(sdk_task) assert stored_task.context_id == 'ctx-1' assert stored_task.metadata == {'foo': 'bar'} - assert stored_task.state == vertexai_types.State.WORKING + assert stored_task.state == vertexai_types.A2aTaskState.WORKING assert stored_task.output is not None assert stored_task.output.artifacts is not None assert len(stored_task.output.artifacts) == 1 @@ -247,13 +261,13 @@ def test_to_sdk_task() -> None: stored_task = vertexai_types.A2aTask( name='projects/123/locations/us-central1/agentEngines/456/tasks/task-2', context_id='ctx-2', - state=vertexai_types.State.COMPLETED, + state=vertexai_types.A2aTaskState.COMPLETED, metadata={'a': 'b'}, output=vertexai_types.TaskOutput( artifacts=[ vertexai_types.TaskArtifact( artifact_id='art-2', - parts=[vertexai_types.Part(text='result')], + parts=[genai_types.Part(text='result')], ) ] ), @@ -275,7 +289,7 @@ def test_to_sdk_task_no_output() -> None: stored_task = vertexai_types.A2aTask( name='tasks/task-3', context_id='ctx-3', - state=vertexai_types.State.SUBMITTED, + state=vertexai_types.A2aTaskState.SUBMITTED, metadata=None, ) sdk_task = to_sdk_task(stored_task) From 0b38305e64275303e629b6f4371d497d3c463929 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 1 Apr 2026 11:27:28 -0500 Subject: [PATCH 2/7] chore(deps): bump the github-actions group with 4 updates (#917) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the github-actions group with 4 updates: [actions/download-artifact](https://github.com/actions/download-artifact), [actions/upload-artifact](https://github.com/actions/upload-artifact), [actions/github-script](https://github.com/actions/github-script) and [actions/checkout](https://github.com/actions/checkout). Updates `actions/download-artifact` from 4 to 8
Release notes

Sourced from actions/download-artifact's releases.

v8.0.0

v8 - What's new

[!IMPORTANT] actions/download-artifact@v8 has been migrated to an ESM module. This should be transparent to the caller but forks might need to make significant changes.

[!IMPORTANT] Hash mismatches will now error by default. Users can override this behavior with a setting change (see below).

Direct downloads

To support direct uploads in actions/upload-artifact, the action will no longer attempt to unzip all downloaded files. Instead, the action checks the Content-Type header ahead of unzipping and skips non-zipped files. Callers wishing to download a zipped file as-is can also set the new skip-decompress parameter to true.

Enforced checks (breaking)

A previous release introduced digest checks on the download. If a download hash didn't match the expected hash from the server, the action would log a warning. Callers can now configure the behavior on mismatch with the digest-mismatch parameter. To be secure by default, we are now defaulting the behavior to error which will fail the workflow run.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

Full Changelog: https://github.com/actions/download-artifact/compare/v7...v8.0.0

v7.0.0

v7 - What's new

[!IMPORTANT] actions/download-artifact@v7 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v6 had preliminary support for Node 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

New Contributors

Full Changelog: https://github.com/actions/download-artifact/compare/v6.0.0...v7.0.0

v6.0.0

... (truncated)

Commits

Updates `actions/upload-artifact` from 4 to 7
Release notes

Sourced from actions/upload-artifact's releases.

v7.0.0

v7 What's new

Direct Uploads

Adds support for uploading single files directly (unzipped). Callers can set the new archive parameter to false to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The name parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.

ESM

To support new versions of the @actions/* packages, we've upgraded the package to ESM.

What's Changed

New Contributors

Full Changelog: https://github.com/actions/upload-artifact/compare/v6...v7.0.0

v6.0.0

v6 - What's new

[!IMPORTANT] actions/upload-artifact@v6 now runs on Node.js 24 (runs.using: node24) and requires a minimum Actions Runner version of 2.327.1. If you are using self-hosted runners, ensure they are updated before upgrading.

Node.js 24

This release updates the runtime to Node.js 24. v5 had preliminary support for Node.js 24, however this action was by default still running on Node.js 20. Now this action by default will run on Node.js 24.

What's Changed

Full Changelog: https://github.com/actions/upload-artifact/compare/v5.0.0...v6.0.0

v5.0.0

What's Changed

BREAKING CHANGE: this update supports Node v24.x. This is not a breaking change per-se but we're treating it as such.

... (truncated)

Commits

Updates `actions/github-script` from 6 to 8
Release notes

Sourced from actions/github-script's releases.

v8.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

New Contributors

Full Changelog: https://github.com/actions/github-script/compare/v7.1.0...v8.0.0

v7.1.0

What's Changed

New Contributors

Full Changelog: https://github.com/actions/github-script/compare/v7...v7.1.0

... (truncated)

Commits

Updates `actions/checkout` from 4 to 6
Release notes

Sourced from actions/checkout's releases.

v6.0.0

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v5.0.0...v6.0.0

v6-beta

What's Changed

Updated persist-credentials to store the credentials under $RUNNER_TEMP instead of directly in the local git config.

This requires a minimum Actions Runner version of v2.329.0 to access the persisted credentials for Docker container action scenarios.

v5.0.1

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v5...v5.0.1

v5.0.0

What's Changed

⚠️ Minimum Compatible Runner Version

v2.327.1
Release Notes

Make sure your runner is updated to this version or newer to use this release.

Full Changelog: https://github.com/actions/checkout/compare/v4...v5.0.0

v4.3.1

What's Changed

Full Changelog: https://github.com/actions/checkout/compare/v4...v4.3.1

v4.3.0

What's Changed

... (truncated)

Changelog

Sourced from actions/checkout's changelog.

Changelog

v6.0.2

v6.0.1

v6.0.0

v5.0.1

v5.0.0

v4.3.1

v4.3.0

v4.2.2

v4.2.1

v4.2.0

v4.1.7

v4.1.6

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/coverage-comment.yaml | 6 +++--- .github/workflows/unit-tests.yml | 8 ++++---- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/workflows/coverage-comment.yaml b/.github/workflows/coverage-comment.yaml index a6b6001d2..2421f6e38 100644 --- a/.github/workflows/coverage-comment.yaml +++ b/.github/workflows/coverage-comment.yaml @@ -18,7 +18,7 @@ jobs: github.event.workflow_run.conclusion == 'success' steps: - name: Download Coverage Artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: run-id: ${{ github.event.workflow_run.id }} github-token: ${{ secrets.A2A_BOT_PAT }} @@ -26,14 +26,14 @@ jobs: - name: Upload Coverage Report id: upload-report - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: coverage-report path: coverage/ retention-days: 14 - name: Post Comment - uses: actions/github-script@v6 + uses: actions/github-script@v8 env: ARTIFACT_URL: ${{ steps.upload-report.outputs.artifact-url }} with: diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml index 6cc79e5f9..32094eff6 100644 --- a/.github/workflows/unit-tests.yml +++ b/.github/workflows/unit-tests.yml @@ -60,7 +60,7 @@ jobs: # Coverage comparison for PRs (only on Python 3.13 to avoid duplicate work) - name: Checkout Base Branch if: github.event_name == 'pull_request' && matrix.python-version == '3.13' - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: ref: ${{ github.event.pull_request.base.ref || 'main' }} clean: true @@ -73,7 +73,7 @@ jobs: - name: Checkout PR Branch (Restore) if: github.event_name == 'pull_request' && matrix.python-version == '3.13' - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: clean: true @@ -91,7 +91,7 @@ jobs: echo ${{ github.event.pull_request.base.ref || 'main' }} > ./BASE_BRANCH - name: Upload Coverage Artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 if: github.event_name == 'pull_request' && matrix.python-version == '3.13' with: name: coverage-data @@ -109,7 +109,7 @@ jobs: run: uv run pytest --cov=a2a --cov-report term --cov-fail-under=88 - name: Upload Artifact (base) - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 if: github.event_name != 'pull_request' && matrix.python-version == '3.13' with: name: coverage-report From 629078f891be42dce3914283b931e0f8df3e3e00 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Apr 2026 10:18:40 +0200 Subject: [PATCH 3/7] chore(deps): bump the all group with 19 updates (#918) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps the all group with 19 updates: | Package | From | To | | --- | --- | --- | | [google-api-core](https://github.com/googleapis/google-cloud-python) | `2.30.0` | `2.30.1` | | [fastapi](https://github.com/fastapi/fastapi) | `0.135.1` | `0.135.2` | | [sse-starlette](https://github.com/sysid/sse-starlette) | `3.3.2` | `3.3.4` | | [starlette](https://github.com/Kludex/starlette) | `0.52.1` | `1.0.0` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.5` | `46.0.6` | | [grpcio](https://github.com/grpc/grpc) | `1.78.0` | `1.80.0` | | [grpcio-tools](https://github.com/grpc/grpc) | `1.78.0` | `1.80.0` | | [grpcio-reflection](https://grpc.io) | `1.78.0` | `1.80.0` | | [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python) | `1.39.1` | `1.40.0` | | [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python) | `1.39.1` | `1.40.0` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.11.0` | `2.12.1` | | [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) | `1.140.0` | `1.144.0` | | [datamodel-code-generator](https://github.com/koxudaxi/datamodel-code-generator) | `0.54.0` | `0.55.0` | | [mypy](https://github.com/python/mypy) | `1.19.1` | `1.20.0` | | [pytest-cov](https://github.com/pytest-dev/pytest-cov) | `7.0.0` | `7.1.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.4` | `0.15.8` | | [uv-dynamic-versioning](https://github.com/ninoseki/uv-dynamic-versioning) | `0.13.0` | `0.14.0` | | [types-requests](https://github.com/python/typeshed) | `2.32.4.20260107` | `2.33.0.20260327` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.41.0` | `0.42.0` | Updates `google-api-core` from 2.30.0 to 2.30.1
Release notes

Sourced from google-api-core's releases.

grpc-google-iam-v1: v0.14.4

v0.14.4 (2026-03-31)

google-cloud-compute-v1beta: v0.10.0

v0.10.0 (2026-03-26)

Commits
  • 4e80530 chore: create a release (#16193)
  • 0f8d933 chore: add gapic-generator integration test presubmit (#16465)
  • ab44f7e chore(deps): update dependency requests to v2.33.0 [security] (#16464)
  • 943a979 chore(migration): Migrate code from googleapis/sphinx-docfx-yaml into package...
  • 8c6703d chore(migration): Migrate code from googleapis/gapic-generator-python into pa...
  • e3731d5 Merge branch 'main' into migration.gapic-generator-python.migration.2026-03-2...
  • 20f5724 Trigger CI
  • 76a8b58 chore: skip spanner django presubmits using dorny filter (#16196)
  • 7a05a34 chore: create a release (#16191)
  • 46ee8a0 fix presubmit
  • Additional commits viewable in compare view

Updates `fastapi` from 0.135.1 to 0.135.2
Release notes

Sourced from fastapi's releases.

0.135.2

Upgrades

  • ⬆️ Increase lower bound to pydantic >=2.9.0. and fix the test suite. PR #15139 by @​svlandeg.

Docs

Translations

Internal

... (truncated)

Commits
  • 25a3697 🔖 Release version 0.135.2
  • ab125da 📝 Update release notes
  • 122b6d4 📝 Add missing last release notes dates (#15202)
  • 68ac0ab 📝 Update release notes
  • ea6e287 📝 Update docs for contributors and team members regarding translation PRs (#1...
  • d0a6f20 📝 Update release notes
  • fd9e192 💄 Fix code blocks in reference docs overflowing table width (#15094)
  • fce9460 📝 Update release notes
  • 0227991 🔨 Exclude spam comments from statistics in scripts/people.py (#15088)
  • cbd64b0 📝 Update release notes
  • Additional commits viewable in compare view

Updates `sse-starlette` from 3.3.2 to 3.3.4
Release notes

Sourced from sse-starlette's releases.

v3.3.4

What's Changed

Full Changelog: https://github.com/sysid/sse-starlette/compare/v3.3.3...v3.3.4

v3.3.3

What's Changed

Full Changelog: https://github.com/sysid/sse-starlette/compare/v0.0.0...v3.3.3

Commits
  • c938db3 Bump version to 3.3.4
  • eefd6dc Merge pull request #179 from sysid/dependabot/uv/cryptography-46.0.6
  • d9e9b82 chore(deps): bump cryptography from 46.0.5 to 46.0.6
  • 28cd775 Merge pull request #178 from sysid/dependabot/uv/requests-2.33.0
  • 2e52732 Merge pull request #176 from sysid/dependabot/uv/ujson-5.12.0
  • bac335e Merge pull request #177 from sysid/dependabot/uv/cbor2-5.9.0
  • d465468 chore(deps): bump requests from 2.32.5 to 2.33.0
  • 7434cd3 chore(deps): bump cbor2 from 5.8.0 to 5.9.0
  • fc2455a chore(deps): bump ujson from 5.11.0 to 5.12.0
  • 5f84539 Bump version to 3.3.3
  • Additional commits viewable in compare view

Updates `starlette` from 0.52.1 to 1.0.0
Release notes

Sourced from starlette's releases.

Version 1.0.0

Starlette 1.0 is here! 🎉

After nearly eight years since its creation, Starlette has reached its first stable release.

A special thank you to @​lovelydinosaur, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏

Thank you to @​adriangb, @​graingert, @​agronholm, @​florimondmanca, @​aminalaee, @​tiangolo, @​alex-oleshkevich, @​abersheeran, and @​uSpike for helping make Starlette what it is today. And to all my sponsors - especially @​tiangolo, @​huggingface, and @​elevenlabs - thank you for your support!

Thank you to all 290+ contributors who have shaped Starlette over the years! ❤️

Read more on the blog post.

Check out the full release notes at https://www.starlette.io/release-notes/#100-march-22-2026

Full Changelog: https://github.com/encode/starlette/compare/1.0.0rc1...1.0.0

Version 1.0.0rc1

We're ready! 🚀

The first release candidate for Starlette 1.0 is here! After years on ZeroVer, we're finally making the jump.

This release removes all deprecated features marked for 1.0.0, along with some last-minute bug fixes.

A special thank you to @​lovelydinosaur, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏

Thank you to @​adriangb, @​graingert, @​agronholm, @​florimondmanca, @​aminalaee, @​tiangolo, @​alex-oleshkevich, and @​abersheeran for helping make Starlette what it is today. And to all my sponsors - especially @​tiangolo, @​huggingface, and @​elevenlabs - thank you for your support!

Thank you to all 290+ contributors who have shaped Starlette over the years!

Check out the full release notes at https://www.starlette.io/release-notes/#100rc1-february-23-2026

Full Changelog: https://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1

Changelog

Sourced from starlette's changelog.

1.0.0 (March 22, 2026)

Starlette 1.0 is here!

After nearly eight years since its creation, Starlette has reached its first stable release. Thank you to everyone who tested the release candidate and reported issues.

You can read more on the blog post.

Added

  • Track session access and modification in SessionMiddleware #3166.

Fixed

  • Handle websocket denial responses in StreamingResponse and FileResponse #3189.
  • Use bytearray for field accumulation in FormParser #3179.
  • Move parser.finalize() inside try/except in MultiPartParser.parse() #3153.

1.0.0rc1 (February 23, 2026)

We're ready! I'm thrilled to announce the first release candidate for Starlette 1.0.

Starlette was created in June 2018 by Tom Christie, and has been on ZeroVer for years. Today, it's downloaded almost 10 million times a day, serves as the foundation for FastAPI, and has inspired many other frameworks. In the age of AI, Starlette continues to play an important role as a dependency of the Python MCP SDK.

This release focuses on removing deprecated features that were marked for removal in 1.0.0, along with some last minute bug fixes. It's a release candidate, so we can gather feedback from the community before the final 1.0.0 release soon.

A huge thank you to all the contributors who have helped make Starlette what it is today. In particular, I'd like to recognize:

  • Kim Christie - The original creator of Starlette, Uvicorn, and MkDocs, and the current maintainer of HTTPX. Kim's work helped lay the foundation for the modern async Python ecosystem.
  • Adrian Garcia Badaracco - One of the smartest people I know, whom I have the pleasure of working with at Pydantic.
  • Thomas Grainger - My async teacher, always ready to help with questions.
  • Alex Grönholm - Another async mentor, always prompt to help with questions.
  • Florimond Manca - Always present in the early days of both Starlette and Uvicorn, and helped a lot in the ecosystem.
  • Amin Alaee - Contributed a lot with file-related PRs.
  • Sebastián Ramírez - Maintains FastAPI upstream, and always in contact to help with upstream issues.
  • Alex Oleshkevich - Helped a lot on templates and many discussions.
  • abersheeran - My go-to person when I need help on many subjects.

I'd also like to thank my sponsors for their support. A special thanks to @​tiangolo, @​huggingface, and @​elevenlabs for their generous sponsorship, and to all my other sponsors:

... (truncated)

Commits
  • 0e88e92 Version 1.0.0 (#3178)
  • 9ee9519 Handle websocket denial responses in streaming and file responses (#3189)
  • a0bcc26 chore(deps-dev): bump black from 26.1.0 to 26.3.1 (#3183)
  • 79b3f26 chore(deps-dev): bump the python-packages group with 7 updates (#3168)
  • 789b926 Use bytearray for field accumulation in FormParser (#3179)
  • a1fd9d8 docs: fix typo in routing.md (#3176)
  • c14d0f7 Document session cookie security flags (#3169)
  • c2e2878 Move parser.finalize() inside try/except in MultiPartParser.parse() (#3153)
  • 89630a8 chore(deps): bump the github-actions group with 3 updates (#3167)
  • 4647e53 Track session access and modification in SessionMiddleware (#3166)
  • Additional commits viewable in compare view

Updates `cryptography` from 46.0.5 to 46.0.6
Changelog

Sourced from cryptography's changelog.

46.0.6 - 2026-03-25


* **SECURITY ISSUE**: Fixed a bug where name constraints were not
applied
  to peer names during verification when the leaf certificate contains a
wildcard DNS SAN. Ordinary X.509 topologies are not affected by this
bug,
including those used by the Web PKI. Credit to **Oleh Konko (1seal)**
for
  reporting the issue. **CVE-2026-34073**

.. _v46-0-5:

Commits

Updates `grpcio` from 1.78.0 to 1.80.0
Release notes

Sourced from grpcio's releases.

Release v1.80.0

This is release 1.80.0 (glimmering) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [ssl] Implement TLS private key signer in Python. (#41701)
  • [TLS Credentials]: Private Key Offload Implementation. (#41606)
  • Fix max sockaddr struct size on OpenBSD. (#40454)
  • [core] Enable EventEngine for Python by default, and EventEngine fork support in Python and Ruby. (#41432)
  • [TLS Credentials]: Create InMemoryCertificateProvider to update certificates independently. (#41484)
  • [Ruby] Build/test ruby 4.0 and build native gems with Ruby 4.0 support. (#41324)
  • [EventEngine] Remove an incorrect std::move in DNSServiceResolver constructor. (#41502)
  • [RR and WRR] enable change to connect from a random index. (#41472)
  • [xds] Implement gRFC A101. (#41051)

C++

  • [C++] Add SNI override option to C++ channel credentials options API. (#41460)

C#

  • [C# tools] Option to append Async to server side method names #39010. (#39797)
  • [C# tools] Fix Grpc.Tools 2.69.0 stops working on ARM64 (#41543)

Objective-C

  • [Fix][Compiler] Plugins fall back to the edition 2023 for older protobuf. (#41357)

PHP

  • [PHP] Disable php infinite recursion check for callback from Core to PHP. (#41835)
  • [PHP] Fix runtime error with PHp8.5 alpha because zend_exception_get_defaul…. (#40337)

Python

  • [Python] Fix GRPC_TRACE not working when absl log initialized in cython. (#41814)
  • Revert "[Python] Align GRPC_ENABLE_FORK_SUPPORT env defaults in core and python (#41455)". (#41769)
  • [Python] Fix AsyncIO Server maximum_concurrent_rpcs enforcement preventing negative active_rpcs count. (#41532)
  • [Python] Docs: correct grpc.Compression references. (#41705)

... (truncated)

Commits
  • f5e2d6e [Release] Bump version to 1.80.0 (on v1.80.x branch) (#41857)
  • 938cfec [subchannel connection scaling] fix when we reset backoff (#41935)
  • 91778be [Backport][v1.80.x][Python] New _create method for aio.Metadata (#41888)
  • f10b9f2 [bzlmod] upgrade rules_swift to avoid BCR CI breakage on Windows with bazel 7...
  • be4c1c5 [subchannel] fix crash in connection scaling code (#41853)
  • a71df73 [Release] Bump version to 1.80.0-pre1 (on v1.80.x branch) (#41844)
  • 3ca09e4 [Python] Fix GRPC_TRACE and add test to check the GRPC_TRACE logs print (#41814)
  • 260c6fd [PHP] Disable php infinite recursion check for callback from Core to PHP (#41...
  • 50957c5 [Flakiness] Delete flaky iomgr fd_conservation_posix_test and create an Event...
  • e1e1d0a [Bzlmod] Turn off bzlmod for PSM python tests. (#41810)
  • Additional commits viewable in compare view

Updates `grpcio-tools` from 1.78.0 to 1.80.0
Release notes

Sourced from grpcio-tools's releases.

Release v1.80.0

This is release 1.80.0 (glimmering) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [ssl] Implement TLS private key signer in Python. (#41701)
  • [TLS Credentials]: Private Key Offload Implementation. (#41606)
  • Fix max sockaddr struct size on OpenBSD. (#40454)
  • [core] Enable EventEngine for Python by default, and EventEngine fork support in Python and Ruby. (#41432)
  • [TLS Credentials]: Create InMemoryCertificateProvider to update certificates independently. (#41484)
  • [Ruby] Build/test ruby 4.0 and build native gems with Ruby 4.0 support. (#41324)
  • [EventEngine] Remove an incorrect std::move in DNSServiceResolver constructor. (#41502)
  • [RR and WRR] enable change to connect from a random index. (#41472)
  • [xds] Implement gRFC A101. (#41051)

C++

  • [C++] Add SNI override option to C++ channel credentials options API. (#41460)

C#

  • [C# tools] Option to append Async to server side method names #39010. (#39797)
  • [C# tools] Fix Grpc.Tools 2.69.0 stops working on ARM64 (#41543)

Objective-C

  • [Fix][Compiler] Plugins fall back to the edition 2023 for older protobuf. (#41357)

PHP

  • [PHP] Disable php infinite recursion check for callback from Core to PHP. (#41835)
  • [PHP] Fix runtime error with PHp8.5 alpha because zend_exception_get_defaul…. (#40337)

Python

  • [Python] Fix GRPC_TRACE not working when absl log initialized in cython. (#41814)
  • Revert "[Python] Align GRPC_ENABLE_FORK_SUPPORT env defaults in core and python (#41455)". (#41769)
  • [Python] Fix AsyncIO Server maximum_concurrent_rpcs enforcement preventing negative active_rpcs count. (#41532)
  • [Python] Docs: correct grpc.Compression references. (#41705)

... (truncated)

Commits
  • f5e2d6e [Release] Bump version to 1.80.0 (on v1.80.x branch) (#41857)
  • a71df73 [Release] Bump version to 1.80.0-pre1 (on v1.80.x branch) (#41844)
  • 1299baa [Python] Add language features to exported proto files (#41501)
  • 522dbbb [Release] Bump version to 1.79.0-dev (on master branch) (#41291)
  • See full diff in compare view

Updates `grpcio-reflection` from 1.78.0 to 1.80.0 Updates `opentelemetry-api` from 1.39.1 to 1.40.0
Changelog

Sourced from opentelemetry-api's changelog.

Version 1.40.0/0.61b0 (2026-03-04)

  • opentelemetry-sdk: deprecate LoggingHandler in favor of opentelemetry-instrumentation-logging, see opentelemetry-instrumentation-logging documentation (#4919)
  • opentelemetry-sdk: Clarify log processor error handling expectations in documentation (#4915)
  • bump semantic-conventions to v1.40.0 (#4941)
  • Add stale PR GitHub Action (#4926)
  • opentelemetry-sdk: Drop unused Jaeger exporter environment variables (exporter removed in 1.22.0) (#4918)
  • opentelemetry-sdk: Clarify timeout units in environment variable documentation (#4906)
  • opentelemetry-exporter-otlp-proto-grpc: Fix re-initialization of gRPC channel on UNAVAILABLE error (#4825)
  • opentelemetry-exporter-prometheus: Fix duplicate HELP/TYPE declarations for metrics with different label sets (#4868)
  • Allow loading all resource detectors by setting OTEL_EXPERIMENTAL_RESOURCE_DETECTORS to * (#4819)
  • opentelemetry-sdk: Fix the type hint of the _metrics_data property to allow None (#4837).
  • Regenerate opentelemetry-proto code with v1.9.0 release (#4840)
  • Add python 3.14 support (#4798)
  • Silence events API warnings for internal users (#4847)
  • opentelemetry-sdk: make it possible to override the default processors in the SDK configurator (#4806)
  • Prevent possible endless recursion from happening in SimpleLogRecordProcessor.on_emit, (#4799) and (#4867).
  • Implement span start/end metrics (#4880)
  • Add environment variable carriers to API (#4609)
  • Add experimental composable rule based sampler (#4882)
  • Make ConcurrentMultiSpanProcessor fork safe (#4862)
  • opentelemetry-exporter-otlp-proto-http: fix retry logic and error handling for connection failures in trace, metric, and log exporters (#4709)
  • opentelemetry-sdk: avoid RuntimeError during iteration of view instrument match dictionary in MetricReaderStorage.collect() (#4891)
  • Implement experimental TracerConfigurator (#4861)
  • opentelemetry-sdk: Fix instrument creation race condition (#4913)
  • bump semantic-conventions to v1.39.0 (#4914)

... (truncated)

Commits

Updates `opentelemetry-sdk` from 1.39.1 to 1.40.0
Changelog

Sourced from opentelemetry-sdk's changelog.

Version 1.40.0/0.61b0 (2026-03-04)

  • opentelemetry-sdk: deprecate LoggingHandler in favor of opentelemetry-instrumentation-logging, see opentelemetry-instrumentation-logging documentation (#4919)
  • opentelemetry-sdk: Clarify log processor error handling expectations in documentation (#4915)
  • bump semantic-conventions to v1.40.0 (#4941)
  • Add stale PR GitHub Action (#4926)
  • opentelemetry-sdk: Drop unused Jaeger exporter environment variables (exporter removed in 1.22.0) (#4918)
  • opentelemetry-sdk: Clarify timeout units in environment variable documentation (#4906)
  • opentelemetry-exporter-otlp-proto-grpc: Fix re-initialization of gRPC channel on UNAVAILABLE error (#4825)
  • opentelemetry-exporter-prometheus: Fix duplicate HELP/TYPE declarations for metrics with different label sets (#4868)
  • Allow loading all resource detectors by setting OTEL_EXPERIMENTAL_RESOURCE_DETECTORS to * (#4819)
  • opentelemetry-sdk: Fix the type hint of the _metrics_data property to allow None (#4837).
  • Regenerate opentelemetry-proto code with v1.9.0 release (#4840)
  • Add python 3.14 support (#4798)
  • Silence events API warnings for internal users (#4847)
  • opentelemetry-sdk: make it possible to override the default processors in the SDK configurator (#4806)
  • Prevent possible endless recursion from happening in SimpleLogRecordProcessor.on_emit, (#4799) and (#4867).
  • Implement span start/end metrics (#4880)
  • Add environment variable carriers to API (#4609)
  • Add experimental composable rule based sampler (#4882)
  • Make ConcurrentMultiSpanProcessor fork safe (#4862)
  • opentelemetry-exporter-otlp-proto-http: fix retry logic and error handling for connection failures in trace, metric, and log exporters (#4709)
  • opentelemetry-sdk: avoid RuntimeError during iteration of view instrument match dictionary in MetricReaderStorage.collect() (#4891)
  • Implement experimental TracerConfigurator (#4861)
  • opentelemetry-sdk: Fix instrument creation race condition (#4913)
  • bump semantic-conventions to v1.39.0 (#4914)

... (truncated)

Commits

Updates `pyjwt` from 2.11.0 to 2.12.1
Release notes

Sourced from pyjwt's releases.

2.12.1

What's Changed

Full Changelog: https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1

2.12.0

Security

What's Changed

New Contributors

Full Changelog: https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0

Changelog

Sourced from pyjwt's changelog.

v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>__

Fixed


- Add missing ``typing_extensions`` dependency for Python < 3.11 in
`[#1150](https://github.com/jpadilla/pyjwt/issues/1150)
<https://github.com/jpadilla/pyjwt/issues/1150>`__

v2.12.0
&lt;https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0&gt;__


Fixed