chore(deps): uv: bump the all-python group across 1 directory with 9 updates - #828
chore(deps): uv: bump the all-python group across 1 directory with 9 updates#828dependabot[bot] wants to merge 1 commit into
Conversation
…updates Bumps the all-python group with 9 updates in the /agent directory: | Package | From | To | | --- | --- | --- | | [bedrock-agentcore](https://github.com/aws/bedrock-agentcore-sdk-python) | `1.18.1` | `1.22.0` | | [claude-agent-sdk](https://github.com/anthropics/claude-agent-sdk-python) | `0.2.110` | `0.2.144` | | [fastapi](https://github.com/fastapi/fastapi) | `0.139.0` | `0.141.1` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.50.0` | `0.52.4` | | [aws-opentelemetry-distro](https://github.com/aws-observability/aws-otel-python-instrumentation) | `0.18.0` | `0.19.0` | | [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.28.1` | `2.0.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.20` | `0.16.4` | | [ty](https://github.com/astral-sh/ty) | `0.0.56` | `0.0.73` | | [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` | Updates `bedrock-agentcore` from 1.18.1 to 1.22.0 - [Release notes](https://github.com/aws/bedrock-agentcore-sdk-python/releases) - [Changelog](https://github.com/aws/bedrock-agentcore-sdk-python/blob/main/CHANGELOG.md) - [Commits](aws/bedrock-agentcore-sdk-python@v1.18.1...v1.22.0) Updates `claude-agent-sdk` from 0.2.110 to 0.2.144 - [Release notes](https://github.com/anthropics/claude-agent-sdk-python/releases) - [Changelog](https://github.com/anthropics/claude-agent-sdk-python/blob/main/CHANGELOG.md) - [Commits](anthropics/claude-agent-sdk-python@v0.2.110...v0.2.144) Updates `fastapi` from 0.139.0 to 0.141.1 - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.139.0...0.141.1) Updates `uvicorn` from 0.50.0 to 0.52.4 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.50.0...0.52.4) Updates `aws-opentelemetry-distro` from 0.18.0 to 0.19.0 - [Release notes](https://github.com/aws-observability/aws-otel-python-instrumentation/releases) - [Changelog](https://github.com/aws-observability/aws-otel-python-instrumentation/blob/main/CHANGELOG.md) - [Commits](aws-observability/aws-otel-python-instrumentation@v0.18.0...v0.19.0) Updates `mcp` from 1.28.1 to 2.0.0 - [Release notes](https://github.com/modelcontextprotocol/python-sdk/releases) - [Changelog](https://github.com/modelcontextprotocol/python-sdk/blob/main/RELEASE.md) - [Commits](modelcontextprotocol/python-sdk@v1.28.1...v2.0.0) Updates `ruff` from 0.15.20 to 0.16.4 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.20...0.16.4) Updates `ty` from 0.0.56 to 0.0.73 - [Release notes](https://github.com/astral-sh/ty/releases) - [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md) - [Commits](astral-sh/ty@0.0.56...0.0.73) Updates `pygments` from 2.20.0 to 2.21.0 - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.20.0...2.21.0) --- updated-dependencies: - dependency-name: bedrock-agentcore dependency-version: 1.22.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: claude-agent-sdk dependency-version: 0.2.144 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-python - dependency-name: fastapi dependency-version: 0.141.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: uvicorn dependency-version: 0.52.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: aws-opentelemetry-distro dependency-version: 0.19.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: all-python - dependency-name: mcp dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: all-python - dependency-name: ruff dependency-version: 0.16.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python - dependency-name: ty dependency-version: 0.0.73 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: all-python - dependency-name: pygments dependency-version: 2.21.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: all-python ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
scottschreckengaust
left a comment
scottschreckengaust
left a comment
There was a problem hiding this comment.
1. Verdict — Request changes
Request changes. Three of the nine bumps are load-bearing and unsafe as shipped: mcp 1.28.1 → 2.0.0 is a major release that renames or deletes every symbol agent/src/gateway_tools.py uses (and swaps httpx for httpx2, so import httpx no longer resolves at all); claude-agent-sdk 0.2.110 → 0.2.144 breaks the #215 SDK↔CLI lockstep the repo explicitly documents; and ty 0.0.56 → 0.0.73 re-runs the exact regression that killed #626 and #590. build (agentcore) is RED with 14 ty diagnostics — this is not a flake, it is the diff.
The other six bumps (bedrock-agentcore, fastapi, uvicorn, aws-opentelemetry-distro, pygments, ruff) look clean and I would take them today.
2. Vision alignment
Keeping the runtime patched serves bounded blast radius — stale transports and CVE-bearing pins are exactly the drift ABCA's own dogfooding is supposed to catch. But as assembled this PR works against the tenet: it lands a silent, total loss of the AgentCore Gateway tool bridge (repo_config) behind a broad except Exception that converts the breakage into a per-call log_error_cw line and an isError tool result. The agent keeps running, tells the model "Error calling repo_config: ModuleNotFoundError…", and the operator gets a CloudWatch error on every invocation. That is the plausible-default / silent-degradation failure mode docs/design/VISION.md and the AI004 heuristic exist to prevent. No ADR covers trading the Gateway bridge away, and none should — the fix is code, not a tenet trade.
Correctly, cedarpy did not move: .github/dependabot.yml:47-54 ignores it for all update types, so the Cedar parity contract (cedarpy 4.8.4 / @cedar-policy/cedar-wasm 4.8.2) is intact. No cedar finding. That ignore-list pattern is also the template for fixing findings B1 and B2 below.
3. Blocking issues
B1 — mcp==2.0.0 breaks the AgentCore Gateway bridge in four independent ways (agent/pyproject.toml:24)
agent/src/gateway_tools.py is the only consumer of mcp, and every symbol it touches changed in 2.0.0. I read the upstream v2.0.0 tag to confirm each one:
gateway_tools.py |
mcp 1.28.1 | mcp 2.0.0 (verified at tag v2.0.0) |
|---|---|---|
:161 from mcp.client.streamable_http import streamablehttp_client |
exists | renamed streamable_http_client (src/mcp/client/streamable_http.py:640) |
:163 streamablehttp_client(url=…, auth=…, timeout=…) |
accepts auth, timeout |
signature is (url, *, http_client: httpx2.AsyncClient | None = None, terminate_on_close: bool = True) — auth and timeout are gone; auth/timeout must ride on a caller-supplied httpx2.AsyncClient |
:164-168 unpack as (read, write, _get_session_id) |
3-tuple | yields TransportStreams = tuple[ReadStream, WriteStream] (src/mcp/client/_transport.py:13) — 2-tuple; the 3-way unpack raises ValueError |
:178 read_timeout_seconds=timedelta(seconds=…) |
timedelta |
float | None (ty flagged this directly) |
:212 from mcp.shared.exceptions import McpError |
exists | renamed MCPError (src/mcp/shared/exceptions.py:20) |
:46, :85, :206 import httpx |
present transitively via mcp | mcp 2.0.0 depends on httpx2 (module name httpx2); the httpx entry is deleted from agent/uv.lock entirely |
Risk, concretely. With enableToolGateway=true, every mcp__abca_gateway__repo_config call now:
- raises
ImportErroratgateway_tools.py:161before the transport is ever opened; - falls through
except _expected_gateway_errors()— because_expected_gateway_errors()at:196-217also silently loses bothhttpx.HTTPErrorandMcpErrorto its bareexcept ImportError: pass, collapsing the expected-error tuple to(OSError, TimeoutError); - lands in
except Exception→log_error_cw(...)→ an operator-visible APPLICATION_LOGS error per tool call, plus a bogusisErrorresult telling the model the Gateway is down.
So the feature is 100% dead and the diagnostics are actively misleading: a routine HTTP hiccup and a total import failure now produce the same loud line, and genuine MCP protocol errors that used to be classified as expected also go loud. This is the silent-failure pattern the module's own docstrings claim to defend against.
Suggested fix — do it in a dedicated, reviewed PR, not a grouped bump:
# agent/src/gateway_tools.py
import httpx2 # and declare httpx2 in pyproject
from mcp.client.streamable_http import streamable_http_client
...
auth = _sigv4_auth(region) # returns httpx2.Auth
async with (
httpx2.AsyncClient(auth=auth, timeout=_GATEWAY_TIMEOUT_S) as http_client,
streamable_http_client(url, http_client=http_client) as (read, write),
ClientSession(read, write) as session,
):
...
return await session.call_tool(remote_name, arguments,
read_timeout_seconds=_GATEWAY_TIMEOUT_S) # float, not timedeltaand rename McpError → MCPError at :212.
Related root cause, worth fixing in the same change: httpx is used in src/gateway_tools.py (3 sites) and tests/test_gateway_tools.py:270 but is not declared in agent/pyproject.toml — it free-rode on mcp's transitive pin, which is precisely the trap the file's own comment at agent/pyproject.toml:44-48 says was fixed for pyyaml/jsonschema ("previously only transitively present; declared directly so the workflow loader does not depend on another package's transitive pin"). Declare httpx2 explicitly so the next transport shuffle is a resolver error, not a runtime one.
Also: .github/dependabot.yml:44-46 groups patterns: ["*"] with no update-types split, so a runtime-transport major rides in the same PR as a pygments patch. Either add mcp to the existing ignore: block for version-update:semver-major (mirroring the cedarpy precedent at :47-54), or split majors into their own group, so a breaking transport change gets its own reviewable PR.
B2 — claude-agent-sdk==0.2.144 breaks the #215 SDK↔CLI lockstep; comment and docs are now false (agent/pyproject.toml:19)
I read the upstream _cli_version.py at both tags:
v0.2.110→__cli_version__ = "2.1.191"v0.2.144→__cli_version__ = "2.1.246"
agent/Dockerfile:90 still installs @anthropic-ai/claude-code@2.1.191. The image therefore ships an SDK that expects CLI 2.1.246 next to an on-PATH CLI at 2.1.191 — and agent/Dockerfile:76-80 states the invariant in its own words: "the SDK and the on-PATH CLI must agree on the control protocol." A control-protocol mismatch surfaces as opaque subprocess/transport failures deep in a long-running task, i.e. the worst possible place.
Three stale-comment/doc sites make this worse than a bare version skew, because they now assert something untrue:
agent/pyproject.toml:19— comment still links the v0.2.110 release tag and claims "(bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215)". Both clauses are now false, and the comment is the primary documentation of the invariant this PR broke. (comment-analyzer dimension)agent/Dockerfile:76— "Pinned 2.1.191 to match the CLI bundled by claude-agent-sdk 0.2.110".docs/design/BEDROCK_COST_ATTRIBUTION.md:89(+ generated mirrordocs/src/content/docs/architecture/Bedrock-cost-attribution.md:93) — "Both are pinned in lockstep —claude-agent-sdk==0.2.110(bundles CLI 2.1.191) and npm@anthropic-ai/claude-code@2.1.191."
Suggested fix: bump agent/Dockerfile to @anthropic-ai/claude-code@2.1.246, re-verify the install.cjs/claude --version shim guard at :88-94 still passes on that build, update all three prose sites, and re-run mise //docs:sync for the mirror. Then close the loop structurally: claude-agent-sdk belongs in the .github/dependabot.yml ignore: list alongside cedarpy (dependabot's uv ecosystem cannot see the npm pin in the Dockerfile, so it cannot keep this lockstep — the config is guaranteed to reopen this PR), or add a check:claude-cli-lockstep guard to mise run drift-prevention that diffs the installed claude_agent_sdk._cli_version.__cli_version__ against the Dockerfile pin. #215 has now drifted twice; the third time should be caught by a script, not a reviewer.
B3 — ty 0.0.73 regresses the typecheck gate on 7 deliberate frozen-model negative tests (agent/pyproject.toml:88)
build (agentcore) failed with 14 diagnostics (job 99062295464). Seven are the #626/#590 pattern, verbatim:
error[invalid-assignment]: Property `filename` defined in `PreparedAttachment` is read-only
--> tests/test_attachments.py:46:13
error[invalid-assignment]: Property `author` defined in `IssueComment` is read-only
--> tests/test_models.py:30:13
... also test_models.py:63, :140, :170, :431, :462
Every one of those lines is inside with pytest.raises(ValidationError): — the tests are asserting runtime immutability of frozen Pydantic models and are correct as written. ty 0.0.73 has simply started reporting statically what the tests deliberately do at runtime. Deleting or weakening the assertions would trade real coverage for a green tool; the right move is a targeted # ty: ignore[invalid-assignment] on each of the 7 lines (or a scoped [tool.ty.rules] override for tests/), landed as its own reviewed change with a comment explaining why — exactly the shape of the existing deprecated = "ignore" entry at agent/pyproject.toml:180-181.
This is the third time a 0.0.x ty bump has flipped this build red (#590, #626, now #828). Given ty is pre-1.0 and its gate is uv run ty check (agent/mise.toml:45), it is worth deciding as a team whether ty should be pinned-and-bumped deliberately (dependabot ignore, like cedarpy) rather than weekly. That is a judgement call for the maintainer, not a blocker on its own — but B3 as it stands is a blocker because the gate is red.
4. Non-blocking suggestions / nits
ruff 0.15.20 → 0.16.4is cosmetic in the lock.agent/mise.toml:29/33/37/41runsuvx ruff …, which resolves the latest ruff from PyPI at task time, not the[dev]pin. The CI log confirms it ("Downloading ruff (9.8MiB)" → "All checks passed!"), so the lint gate was already effectively on a floating ruff before this PR. Worth either pinning theuvxinvocation (uvx ruff@0.16.4 …) or droppingrufffrom[dev]so the pin isn't misleading. Same applies tobanditat:59.- Six bumps are genuinely clean.
bedrock-agentcore 1.22.0,fastapi 0.141.1,uvicorn 0.52.4,aws-opentelemetry-distro 0.19.0,pygments 2.21.0,ruff 0.16.4produced zero diagnostics. If you split this PR, those can merge immediately. - Dropped transitives are safe.
pydantic-settings,python-dotenv,httpx-sse,httpcore, andopentelemetry-instrumentation-elasticsearchall disappear fromagent/uv.lock; I greppedagent/srcandagent/testsfor each and found no importers. truststore 0.10.4(new transitive viahttpx2/httpcore2) is fine here.httpx2replacescertifiwith the OS trust store;agent/Dockerfile:52already installsca-certificates, so TLS verification will resolve. Flagging only so it isn't a surprise later.- Branch name
dependabot/uv/agent/all-python-c138f6a181does not match(feat|fix|chore|docs)/<issue>-…. Waived — automated PR.
Supply chain (I checked, since three of the new distributions look alarming)
httpx2, httpcore2, httpx2-jsfetch, mcp-types, truststore are all new names in agent/uv.lock. I queried PyPI metadata for each: httpx2/httpcore2 → github.com/pydantic/httpx2 (the next-gen httpx line), httpx2-jsfetch → its Emscripten/Pyodide transport, mcp-types → github.com/modelcontextprotocol/python-sdk (official), truststore → github.com/sethmlarson/truststore. All are pulled in by mcp==2.0.0's own declared metadata, not injected by dependabot, and all sdist/wheel URLs are files.pythonhosted.org with plausible upload timestamps. No evidence of typosquatting or a hijacked release — the version jumps are surprising but legitimate. Secrets, deps, and workflow scan is green.
5. Documentation
- Required and missing:
docs/design/BEDROCK_COST_ATTRIBUTION.md:89pins the SDK↔CLI lockstep in prose as0.2.110/2.1.191. This PR falsifies it. The generated mirrordocs/src/content/docs/architecture/Bedrock-cost-attribution.md:93carries the same sentence and must be regenerated viamise //docs:sync— never hand-edited. - Also stale:
agent/pyproject.toml:19andagent/Dockerfile:76(see B2). - Mirror sync status: currently consistent (neither source nor mirror was touched), so
docs:syncis not failing — but fixing B2 will require the regen. - Issue tracking: no backing issue, which is correct for a dependabot PR — ADR-003 governs contributor work and the repo has explicit automation for dependency PRs (
dependencies/python:uvlabels,.github/workflows/auto-approve.yml). No governance finding. That said, B1 and B3 each deserve a tracked issue with a priority label, since neither is a one-line pin edit: "migrategateway_tools.pyto the mcp 2.x transport API" and "ty ≥0.0.73 flags frozen-Pydantic negative tests" (a follow-up to the closed #626).
6. Tests & CI
build (agentcore): FAILURE. 14tydiagnostics;miseaborted at//agent:typecheck, so//agent:testnever ran. There is no pytest evidence for any of these nine bumps.- Statically (unverified — I did not run pytest; see the honesty note in §7),
agent:testwould also fail once typecheck is satisfied:tests/test_gateway_tools.py:271doesmonkeypatch.setattr("mcp.client.streamable_http.streamablehttp_client", _fake_transport), andmonkeypatch.setattrraisesAttributeErroron a missing attribute by default — that symbol no longer exists in mcp 2.0.0.tests/test_gateway_tools.py:270'simport httpxwould raiseModuleNotFoundError. So at least two test classes (TestCallGateway,TestSigV4Auth) are broken, and the--cov-fail-under=72floor atagent/mise.toml:53is at risk. - Credit where due: the test suite would have caught B1 even without
ty, precisely because it monkeypatches by string path rather than accepting whatever the module exposes. That is the AI001 "verify against real API behavior" discipline working as intended. - No new tests are needed for a pin bump, but the migration in B1 must land with the
TestCallGatewaytransport double updated to the 2-tupleTransportStreamsshape and thehttp_client=kwarg — otherwise the mock will keep asserting the old contract (AI005). - Bootstrap synth-coverage: not applicable. No CDK constructs, stacks, handlers, or CFN resource types changed;
cdk/src/bootstrap/**andBOOTSTRAP_VERSIONare correctly untouched. Dead-code detection (advisory),Validate PR title,Secrets, deps, and workflow scangreen;CodeQLneutral.
Base freshness: the PR is behind origin/main (merge-base 780161b9, tip 4da0a1fa, 31 files changed on main since). I diffed agent/pyproject.toml and agent/Dockerfile across that range — untouched on main, so nothing main-side invalidates the analysis above, and none of the three blockers is a stale-base artifact.
7. Review agents run
Nested agent dispatch was unavailable in this run — this review executed as a subagent inside a batch fan-out, which cannot spawn the pr-review-toolkit agents that Stage 3 names. I therefore applied each rubric dimension inline, by hand, one at a time. Everything below is rubric-applied-inline, not agent-dispatched. I did not run mise run build, pytest, ty, jest, tsc, or cdk synth — the worktree has no agent/.venv. All execution evidence cited is from the CI job log (job 99062295464) plus read-only queries against upstream repos/PyPI; anything I could not execute is labelled unverified above.
| Dimension | Applied inline | Result |
|---|---|---|
code-reviewer (guidelines/style/conventions) |
Yes | B2 (repo's own documented #215 lockstep violated); nit on the uvx ruff pin fiction; dependabot grouping/ignore conventions vs the cedarpy precedent |
silent-failure-hunter (error handling, swallowed exceptions, plausible defaults) |
Yes | Primary finding. gateway_tools.py:196-217 except ImportError: pass silently drops both httpx.HTTPError and McpError from the expected-error tuple; :243-264's broad except Exception converts a total feature outage into a per-call log_error_cw + isError result. Feature dead, no build/deploy signal. |
comment-analyzer (comment accuracy vs code) |
Yes | agent/pyproject.toml:19 asserts sdk 0.2.110 / CLI 2.1.191 next to a 0.2.144 pin and links the wrong release tag; agent/Dockerfile:76; BEDROCK_COST_ATTRIBUTION.md:89 + mirror. Four false statements. |
pr-test-analyzer (failure-path coverage) |
Yes | agent:test never ran (build aborted at typecheck); statically ≥2 test classes in tests/test_gateway_tools.py break under mcp 2.0.0; coverage floor at risk. See §6. |
type-design-analyzer (new types: encapsulation, invariants) |
Out of scope | The diff introduces no new types — it is two dependency-manifest files. The consumers of changed upstream types are covered under B1. |
security-review skill |
Out of scope as a code review, replaced by a targeted manual supply-chain check | No IAM, Cedar, network, secrets, or input-validation code changed. The security-relevant surface here is provenance of the five new distributions and the certifi → truststore TLS-trust shift, which I verified by hand against PyPI metadata and agent/Dockerfile:52 — see the Supply chain subsection in §4. |
8. Human heuristics
- Proportionality — concern. A single grouped PR carrying one major runtime-transport break, one control-protocol lockstep break, and one pre-1.0 type-checker regression is disproportionate to its reviewability.
.github/dependabot.yml:44-46(patterns: ["*"], noupdate-typessplit) is the mechanism; thecedarpyignore:block at:47-54is the proven fix pattern. - Coherence — concern. The repo has a well-articulated "these two pins move together" doctrine (Cedar parity banner at
agent/pyproject.toml:25-42,cdk/package.json:7, #215 atagent/Dockerfile:76) and enforces it for Cedar via dependabotignore+ parity fixtures. The same doctrine is stated forclaude-agent-sdk↔ the npm CLI pin but is enforced by nothing — so it drifts. Same concept, unequal enforcement. - Clarity — concern.
agent/pyproject.toml:19now says the opposite of what the code does (B2), andgateway_tools.py's error-classification docstrings promise a distinction between "routine hiccup" and "loud bug" that mcp 2.0.0 quietly erases (B1). Both are cases of comments/architecture describing an invariant that the pins no longer satisfy. - Appropriateness — pass, with one note. The bumps are the right kind of maintenance and the six clean ones are ready. The note:
tests/test_gateway_tools.pymonkeypatches by string path, which is exactly why the mocked test would surface an upstream rename instead of hiding it (AI001) — good existing practice that must be preserved when B1's migration updates the transport double to the new 2-tuple shape.
Recommended path forward
- Split this PR. Keep
bedrock-agentcore,fastapi,uvicorn,aws-opentelemetry-distro,pygments,ruff→ green, merge. mcp2.x → its own issue + PR, migratinggateway_tools.pytostreamable_http_client/httpx2/MCPError/floattimeout / 2-tuple unpack, declaringhttpx2directly, and updatingtests/test_gateway_tools.py.claude-agent-sdk→ its own PR paired withagent/Dockerfileat CLI2.1.246, all four prose sites corrected,mise //docs:syncre-run, plus adrift-preventionguard so #215 cannot drift a fourth time.ty0.0.73 → its own PR adding the 7 targeted# ty: ignore[invalid-assignment]suppressions with a rationale comment; consider a dependabotignorefortywhile it is pre-1.0.- Add
mcp(major) andclaude-agent-sdkto the.github/dependabot.ymlignore:block so the grouped weekly PR stops re-proposing coordinated changes it structurally cannot make.
| "fastapi==0.141.1", #https://pypi.org/project/fastapi/ | ||
| "uvicorn==0.52.4", #https://pypi.org/project/uvicorn/ | ||
| "aws-opentelemetry-distro==0.19.0", #https://pypi.org/project/aws-opentelemetry-distro/ | ||
| "mcp==2.0.0", #https://pypi.org/project/mcp/ |
There was a problem hiding this comment.
BLOCKING (B1) — mcp 1.28.1 → 2.0.0 is a major release that renames or deletes every symbol agent/src/gateway_tools.py uses. Verified against upstream tag v2.0.0:
streamablehttp_client→streamable_http_client(src/mcp/client/streamable_http.py:640)- that function no longer accepts
auth=ortimeout=— signature is(url, *, http_client: httpx2.AsyncClient | None = None, terminate_on_close: bool = True); SigV4 auth and the timeout must now ride on a caller-suppliedhttpx2.AsyncClient - it yields
TransportStreams = tuple[ReadStream, WriteStream](src/mcp/client/_transport.py:13) — a 2-tuple, sogateway_tools.py:164-168'sas (read, write, _get_session_id)raisesValueError ClientSession.call_tool(read_timeout_seconds=…)is nowfloat | None, nottimedelta(gateway_tools.py:178)mcp.shared.exceptions.McpError→MCPError(gateway_tools.py:212)- mcp 2.0.0 depends on
httpx2(modulehttpx2), and thehttpxentry is deleted fromagent/uv.lock— soimport httpxatgateway_tools.py:46/85/206no longer resolves
Net effect: with enableToolGateway=true, every repo_config call raises ImportError at line 161, _expected_gateway_errors() silently loses both httpx.HTTPError and McpError to its except ImportError: pass, and the failure lands in the broad except Exception → a log_error_cw operator error per tool call plus a bogus isError result to the model. Feature 100% dead, diagnostics actively misleading.
Also: httpx is used in src/gateway_tools.py and tests/test_gateway_tools.py:270 but never declared here — it free-rode on mcp's transitive pin, the exact trap the comment at lines 44-48 says was fixed for pyyaml/jsonschema. Declare httpx2 explicitly.
Suggested: split mcp 2.x into its own issue + PR with the migration, and add mcp version-update:semver-major to the .github/dependabot.yml ignore: block (mirroring the cedarpy precedent at :47-54) so a breaking transport change gets its own reviewable PR.
| "bedrock-agentcore==1.18.1", #https://pypi.org/project/bedrock-agentcore/ | ||
| "claude-agent-sdk==0.2.110", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215) | ||
| "bedrock-agentcore==1.22.0", #https://pypi.org/project/bedrock-agentcore/ | ||
| "claude-agent-sdk==0.2.144", #https://github.com/anthropics/claude-agent-sdk-python/releases/tag/v0.2.110 (bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215) |
There was a problem hiding this comment.
BLOCKING (B2) — this bump breaks the #215 SDK↔CLI lockstep, and the trailing comment now asserts the opposite of the pin.
I read _cli_version.py at both upstream tags:
v0.2.110→__cli_version__ = "2.1.191"v0.2.144→__cli_version__ = "2.1.246"
agent/Dockerfile:90 still installs @anthropic-ai/claude-code@2.1.191, so the image ships an SDK expecting CLI 2.1.246 beside an on-PATH CLI at 2.1.191 — against the invariant agent/Dockerfile:76-80 states in its own words ("the SDK and the on-PATH CLI must agree on the control protocol"). A control-protocol mismatch surfaces as opaque subprocess failures deep in a long-running task.
The comment on this line is now doubly false: it links the v0.2.110 release tag and claims "(bundles claude CLI 2.1.191; kept in lockstep with the npm CLI pin in the Dockerfile, #215)". Two more sites repeat it: agent/Dockerfile:76 and docs/design/BEDROCK_COST_ATTRIBUTION.md:89 (+ generated mirror docs/src/content/docs/architecture/Bedrock-cost-attribution.md:93).
Fix: bump the Dockerfile to 2.1.246, re-verify the install.cjs / claude --version shim guard at Dockerfile:88-94, correct all four prose sites, re-run mise //docs:sync. Then close the loop structurally — dependabot's uv ecosystem cannot see the npm pin in the Dockerfile, so it structurally cannot keep this lockstep and will reopen this PR forever. Either add claude-agent-sdk to the ignore: list alongside cedarpy, or add a check:claude-cli-lockstep guard to mise run drift-prevention that diffs claude_agent_sdk._cli_version.__cli_version__ against the Dockerfile pin. #215 has drifted twice now; the third time should be caught by a script, not a reviewer.
| @@ -87,7 +87,7 @@ dev = [ | |||
| "ruff", | |||
| "ty", | |||
There was a problem hiding this comment.
BLOCKING (B3) — the lock moves ty 0.0.56 → 0.0.73, which re-runs the exact regression that killed #626 and #590. build (agentcore) is RED with 14 diagnostics (job 99062295464); 7 are the frozen-Pydantic pattern:
error[invalid-assignment]: Property `filename` defined in `PreparedAttachment` is read-only
--> tests/test_attachments.py:46:13
error[invalid-assignment]: Property `author` defined in `IssueComment` is read-only
--> tests/test_models.py:30:13
... also test_models.py:63, :140, :170, :431, :462
Every one of those lines sits inside with pytest.raises(ValidationError): — the tests assert runtime immutability of frozen models and are correct as written. ty 0.0.73 has simply started reporting statically what the tests deliberately do at runtime. Weakening the assertions would trade real coverage for a green tool.
Fix: targeted # ty: ignore[invalid-assignment] on each of the 7 lines (or a scoped [tool.ty.rules] override for tests/), landed as its own reviewed change with a rationale comment — the same shape as the existing deprecated = "ignore" entry at line 180-181.
Standing suggestion: this is the third 0.0.x ty bump to flip the build red. Since the gate is uv run ty check (agent/mise.toml:45) and ty is pre-1.0, consider a dependabot ignore for ty so it is bumped deliberately rather than weekly.
1 participant
Bumps the all-python group with 9 updates in the /agent directory:
1.18.11.22.00.2.1100.2.1440.139.00.141.10.50.00.52.40.18.00.19.01.28.12.0.00.15.200.16.40.0.560.0.732.20.02.21.0Updates
bedrock-agentcorefrom 1.18.1 to 1.22.0Release notes
Sourced from bedrock-agentcore's releases.
... (truncated)
Changelog
Sourced from bedrock-agentcore's changelog.
Commits
b981f7echore: bump version to 1.22.0 (#644)66a68e3feat(payments): add MPP, x402 upto, and Quick Create support (#643)5d4ca0dchore: bump version to 1.21.0 (#623)439d788feat(memory): add AgentCoreMemoryStore Strands integration (#588)01d3800feat(runtime): propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound cal...9195576chore: bump version to 1.20.0 (#619)703ccfdfix(test): pin autoevals judge to the OpenAI API (#617)207adb7fix(a2a): bind the A2A contract port, ignore generic PORT (#615)9d8cc26fix(test): repair eval adapter integ fixture and wire LLM judge key (#614)528471efix: validate sample agent inputs (#612)Updates
claude-agent-sdkfrom 0.2.110 to 0.2.144Release notes
Sourced from claude-agent-sdk's releases.
... (truncated)
Changelog
Sourced from claude-agent-sdk's changelog.
... (truncated)
Commits
24956bbdocs: update changelog for v0.2.144f8d0152chore: release v0.2.144a4c72e4chore: bump bundled CLI version to 2.1.24615af77cchore: bump bundled CLI version to 2.1.24521b93c1chore: bump bundled CLI version to 2.1.241d867f48chore: bump bundled CLI version to 2.1.243542fefbchore: bump bundled CLI version to 2.1.241e8bde60chore: bump bundled CLI version to 2.1.240bc0c9afchore: bump bundled CLI version to 2.1.23922795fedocs: update changelog for v0.2.143Updates
fastapifrom 0.139.0 to 0.141.1Release notes
Sourced from fastapi's releases.
... (truncated)
Commits
95f8322🔖 Release version 0.141.1 (#16106)f137944📝 Update release notesd623544🐛 Fix support for background tasks and headers from dependencies in `app.fron...1d211b9📝 Update release notes8a1f876📝 DocumentFASTAPI_ENVin FastAPI CLI guide (#16104)c7e7b65🔖 Release version 0.141.0 (#16103)6bceb84📝 Update release notes5429fed✨ Addapp.frontend(check_dir="auto"), to make local development more conven...628663f🔖 Release version 0.140.13 (#16096)0b54fd0📝 Update release notesUpdates
uvicornfrom 0.50.0 to 0.52.4Release notes
Sourced from uvicorn's releases.
... (truncated)
Changelog
Sourced from uvicorn's changelog.
... (truncated)
Commits
8988c23Stabilize macOS Python 3.13 signal shutdown tests (#3084)898ddcaUpdate PyPI publish action to version 1.14.2 (#3083)3869f8aRestore Mermaid diagram rendering (#3080)64148a9Version 0.52.4 (#3079)9e9e569docs: correct release example PR number (#3072)b783dacRemove duplicate Date header from SansIO WebSocket handshakes (#3078)27019b2chore(deps): bump the python-packages group across 1 directory with 11 update...1b64273Fix a typo in index.md (#3006)a68da60Version 0.52.3 (#3068)6e3bb4cUse zttp 0.0.24 fast receive path (#3067)Updates
aws-opentelemetry-distrofrom 0.18.0 to 0.19.0Release notes
Sourced from aws-opentelemetry-distro's releases.
... (truncated)
Changelog
Sourced from aws-opentelemetry-distro's changelog.
Commits
821465aPre-release: Update version to 0.19.0 (#834)ed8782fBackport #797 to release/v0.19.x: add Python 3.14 Lambda runtime (#835)4dcbf60test(e2e): wire Python Lambda Lite SDK test into Application Signals E2E (#833)315bdddfix(mcp): extract server-side trace context from HTTP headers when _meta is a...76f8f2dNightly dependency update: OpenTelemetry 1.44.0/0.65b0 (#799)ffa8c72fix(mcp-instrumentation): inject W3C trace context into outbound HTTP headers...d7e49b5Revert "feat(genai): extract gen_ai.tool.call.arguments/result as LLO content...f9bb4f5feat(genai): capture user input and agent output on llama_index invoke_agent ...2b43f03Add best-effort public ECR image signing to release workflow (#828)9356e72Key incident-snapshot dedup hash on operation + throw-site origin (#825)Updates
mcpfrom 1.28.1 to 2.0.0Release notes
Sourced from mcp's releases.
... (truncated)
Commits
6f69a37Present v2 as the stable release across the README, docs, and policies (#3178)78e6fbbServe v2 docs at the site root, with permanent per-major paths (#3176)af06330Remove unused StreamableHTTPTransport.get_session_id() (#3205)68ca87eDocument the two-line release process for stable v2 (#3179)c9c431bExpose the middleware chain on MCPServer and stop sending unrequested change ...528e366Fail fast on server-to-client requests in JSON-response mode instead of hangi...27f5cc7Remove unused mcpserver.exceptions.ValidationError (#3199)89c5e70Gate log notifications on the per-request log-level opt-in at 2026-07-28 (#3198)b61ce38docs: fix off-by-one hl_lines in apps.md (#3196)b7c9a91Add mcp.types as a permanent alias for mcp_types (#3190)Updates
rufffrom 0.15.20 to 0.16.4Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
... (truncated)
Commits
11c76bfBump 0.16.4 (#27937)d53c8c5Isolate playground builds from deployment credentials (#27839)cab001eDisable uv preview for releases and pre-commit hooks (#27939)f8d575f[ty] Clarify writing guidance for human readers (#27912)ca45faeSet--previewand--default-indexfor theuv-lockhook (#27935)4827bf7ExportUV_DEFAULT_INDEXinrelease.sh(#27934)d1087a4[ty] Handle assignment expressions in string annotations (#27921)