[PATCH] chore: merge develop to main

docs/CHANGELOG.md

@@ -12,6 +12,21 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Changed
+
+- **`pyproject.toml` (since v1.3.0)** — Runtime lower bounds: FastAPI `>=0.139.0`, sse-starlette `>=3.4.5`, Typer `>=0.26.8`, Uvicorn `>=0.49.0`. **`deploy` extra:** boto3 `>=1.43.39`, google-cloud-run `>=0.16.1`, google-cloud-secret-manager `>=2.23.0`. **`dev` extra:** hatch `>=1.17.0`, pytest `>=9.1.1`, pytest-asyncio `>=1.4.0`, ruff `>=0.15.20`. Lock file refreshed via `uv lock`.
+
+### Fixed
+
+- **A2A event scope test** — `tests/test_a2a.py` now walks FastAPI included-router wrappers when locating `/a2a/events`, preserving the read-scope assertion under FastAPI `0.139.0`.
+
+| Status     | Count |
+| ---------- | ----- |
+| ✅ Passed  | 683   |
+| 🤔 Skipped | 0     |
+| 🔴 Failed  | 0     |
+| ⏱️ in      | 56s   |
+
 ## [1.3.0] - 2026-07-02
 
 ### Added

pyproject.toml

@@ -11,7 +11,7 @@ dependencies = [
     "cryptography>=49.0.0",
     "demjson3>=3.0.0",
     "deprecated>=1.3.0",
-    "fastapi>=0.136.3",
+    "fastapi>=0.139.0",
     "httpx>=0.28.1",
     "jinja2>=3.1.6",
     "loguru>=0.7.3",
@@ -23,10 +23,10 @@ dependencies = [
     "pyyaml>=6.0.0",
     "rich>=15.0.0",
     "shortuuid>=1.0.0",
-    "sse-starlette>=3.4.4",
+    "sse-starlette>=3.4.5",
     "tinydb>=4.8.2",
-    "typer>=0.25.1",
-    "uvicorn>=0.48.0",
+    "typer>=0.26.8",
+    "uvicorn>=0.49.0",
 ]
 license = "MPL-2.0"
 classifiers = [
@@ -50,32 +50,26 @@ supervaizer = "supervaizer.cli:app"
 
 [project.optional-dependencies]
 deploy = [
-    "boto3>=1.43.14",
+    "boto3>=1.43.39",
     "docker>=7.0.0",
-<<<<<<< Updated upstream
-    "google-cloud-artifact-registry>=1.21.0",
-    "google-cloud-run>=0.16.0",
-    "google-cloud-secret-manager>=2.28.0",
-=======
     "google-cloud-artifact-registry>=1.22.0",
     "google-cloud-run>=0.16.1",
     "google-cloud-secret-manager>=2.29.0",
->>>>>>> Stashed changes
 ]
 dev = [
     "boto3>=1.42.73",
     "docker>=7.0.0",
-    "hatch>=1.16.5",
+    "hatch>=1.17.0",
     "jsonschema>=4.26.0",
     "mypy>=2.1.0",
     "pre-commit>=4.6.0",
-    "pytest-asyncio>=1.3.0",
+    "pytest-asyncio>=1.4.0",
     "pytest-cov>=7.1.0",
     "pytest-mock>=3.15.1",
     "pytest-sugar>=1.1.1",
-    "pytest>=9.0.3",
+    "pytest>=9.1.1",
     "respx>=0.23.1",
-    "ruff>=0.15.14",
+    "ruff>=0.15.20",
     "yamllint>=1.38.0",
     "types-deprecated>=1.3.1",
     "types-PyYAML>=6.0.0",

tests/test_a2a.py

@@ -14,6 +14,8 @@
 import json
 import threading
 import time
+from collections.abc import Iterable
+from typing import Any
 
 import jsonschema
 import pytest
@@ -99,6 +101,15 @@ def _authorized_a2a_headers(
     return _a2a_workspace_headers(server, token)
 
 
+def _iter_routes(routes: Iterable[Any]) -> Iterable[Any]:
+    for route in routes:
+        yield route
+        original_router = getattr(route, "original_router", None)
+        nested_routes = getattr(original_router, "routes", None)
+        if nested_routes is not None:
+            yield from _iter_routes(nested_routes)
+
+
 def test_create_agent_card(agent_fixture: Agent) -> None:
     """Test the create_agent_card function."""
     base_url = "http://test.example.com"
@@ -430,7 +441,7 @@ def test_a2a_controller_requires_write_scope(server_fixture: Server) -> None:
 def test_a2a_events_remains_read_scoped(server_fixture: Server) -> None:
     route = next(
         route
-        for route in server_fixture.app.routes
+        for route in _iter_routes(server_fixture.app.routes)
         if getattr(route, "path", None) == "/a2a/events"
     )
     dependency = route.dependant.dependencies[0].call