[dependabot]

Bumps the python group with 15 updates:

Package	From	To
agent-manifest	0.12.0	0.15.0
agentrust-trace	0.10.0	0.11.0
pydantic	2.13.5	2.14.1
pydantic-ai-slim	2.49.0	2.55.0
cryptography	50.0.1	50.0.2
numpy	2.5.3	2.5.4
python-dotenv	1.2.3	1.2.4
uvicorn	0.52.4	0.54.0
openai	3.24.0	3.29.0
openai-agents	0.22.3	0.23.1
ruff	0.16.9	0.17.0
langchain-core	1.6.3	1.6.9
langgraph	1.2.12	1.2.14
chap-coordinator	0.2.13	0.3.1
agent-passport-system	4.2.0	4.2.1

Updates agent-manifest from 0.12.0 to 0.15.0

Release notes

Sourced from agent-manifest's releases.

python-v0.15.0

What's Changed

• fix(sdk): attach_receipt refuses a non-array receipts value instead of corrupting it by @​rajnisht7 in agentrust-io/agent-manifest#469
• docs(changelog): file the attach_receipt fix under Unreleased by @​imran-siddique in agentrust-io/agent-manifest#478
• feat(sdk): add opt-in experimental evidence-requirements profile by @​imran-siddique in agentrust-io/agent-manifest#479
• fix(attestation): refuse debug guests and non-VMPL0 SNP reports, release 0.15.0 by @​imran-siddique in agentrust-io/agent-manifest#480

Full Changelog: agentrust-io/agent-manifest@python-v0.14.0...python-v0.15.0

python-v0.14.0

What's Changed

• fix: enforce strict HashValue format when parsing checkpoint roots by @​rajnisht7 in agentrust-io/agent-manifest#465
• docs(api): mark signing_pre_image() as v0.1-only by @​litzki-systems in agentrust-io/agent-manifest#460
• chore(deps): bump the codeql-action group with 4 updates by @​dependabot[bot] in agentrust-io/agent-manifest#467
• docs(spec): publish the two-tool catalog_hash vector in Appendix D by @​imran-siddique in agentrust-io/agent-manifest#470
• docs(spec): correct identity framing, container-digest binding and Blackwell SPDM by @​imran-siddique in agentrust-io/agent-manifest#471
• chore(deps): bump urllib3 to 2.8.0 by @​rajnisht7 in agentrust-io/agent-manifest#475
• fix(attestation): read verdicts from signed evidence, pin the AMD root (0.14.0) by @​imran-siddique in agentrust-io/agent-manifest#476

Full Changelog: agentrust-io/agent-manifest@python-v0.13.1...python-v0.14.0

python-v0.13.1

agent-manifest 0.13.1

pip install agent-manifest==0.13.1

Behaviour change

verify_evidence_pack() now reads the verdict inside the pack. A pack whose embedded section 5.2 verification_result says REVOKED, EXPIRED, MISMATCH or anything other than VALID returns FAILED. Under 0.13.0 the same pack returned VERIFIED. If you accepted those packs, they will now be rejected.

Fixed

• [SDK] verify_evidence_pack() only checked that the embedded verification_result carried a known enum value, and never read its verification_signature. Now a non-VALID result fails the pack, a manifest_id that differs from the pack's manifest fails it, and a result with no manifest_id is MALFORMED. New keyword arguments result_key_id and result_algorithm check verification_signature over the new verification_result_pre_image(). Leave out result_key_id and the result reports verification_result_signature_verified=False with a verification_result_signature_not_appraised warning. signature_verified still covers the outer pack_signature only. (#463)
• [SDK] verify_evidence_pack() and verify_trace_envelope() raised TypeError or ValueError on some untrusted input: a non-string verification_result.result or pack_signature.key_id, or a value RFC 8785 cannot represent (NaN, Infinity, a lone surrogate, an integer beyond 2^53, nesting deeper than 64). They now return MALFORMED. (#463)

Changed

• [CI] CodeQL runs on every pull request and every push to main, with the python/** path filter and the Dependabot skip removed (#463). Write permissions in codeql.yml and docs.yml moved from workflow level to the job that needs them (#464). New ClusterFuzzLite target fuzz_trace.py covers both verifiers (#463).

Full changelog: agentrust-io/agent-manifest@python-v0.13.0...python-v0.13.1

agent-manifest 0.13.0 is on PyPI: pip install agent-manifest==0.13.0.

Compatibility: canonicalize() now follows RFC 8785 exactly (#404, closes #322). It no longer NFC-normalizes strings, no longer escapes U+2028, U+2029 or U+007F to U+009F, and refuses integers above 2**53 - 1. A signature that 0.12.0 made over a document containing any of those will not verify. Every other document canonicalizes to the same bytes as before.

Security fixes

• #404: two distinct strings could share one signature, and two keys that normalized alike produced invalid JSON that silently dropped a signed field.
• #450: verify_revocation_signature() compares signer_key_id in constant time.

... (truncated)

Changelog

Sourced from agent-manifest's changelog.

[0.15.0] - 2026-09-30

Security

• [SDK] verify_attestation_chain() refuses debug guests. The SEV-SNP path never read the signed guest policy and the TDX path never parsed TDATTRIBUTES, so a debug-enabled guest with an allow-listed measurement returned passed=True. A debug guest's memory is readable and writable by the host, so its REPORT_DATA and the code that chose it are the host's to set. The verdict now fails when SNP guest policy DEBUG (bit 19, AMD 56860) or TDX TDATTRIBUTES.DEBUG (bit 0, TD report body offset 120) is set, read from the signed bytes after the signature verifies. SNP reports must also carry VMPL 0, the level both of this package's SNP producers request at (SEVSNPProvider through configfs-TSM, and the Azure paravisor). verify_runtime_report() and verify_runtime_freshness() apply the same checks with no opt-in. ChainVerificationResult gains debug and vmpl, read from the signed report (None without a verified signature, and for platforms with no such field). verify_attestation_chain(allow_debug=True) accepts a debug guest for development and records it in reasons; it does not relax VMPL. SnpReport.debug, TdxQuote.td_attributes and TdxQuote.debug expose the parsed state. Behaviour change: a debug guest, or an SNP report at VMPL 1 to 3, that previously verified now fails.

Added

• [SDK] Experimental, opt-in evidence-requirements-experimental-v1 profile. A v0.2 manifest that declares it may carry a signed evidence_requirements block (components, required relationships, combination policy reference), and agent_manifest.evidence_requirements.verify_evidence_manifest() returns it only after verify_manifest() is VALID. Without the profile the block is still rejected as an unknown field, so existing manifests verify as before. Under the profile every 0.14.0 check still applies, including the signed audit_key_sealed rule under enforce_attestation. Not part of the specification; see docs/evidence-requirements-experimental.md. Consumer: agentrust-io/trace-spec#439.

Fixed

• [SDK] attach_receipt() corrupted or crashed when the envelope's receipts header (label 394) wasn't already an array - a map became its keys, a string its characters, and null/0/false/"" were silently replaced with []. attach_approvals() was already fixed for the same issue in 0.13.0; attach_receipt() now works the same way: a non-array existing value raises CoseStructureError instead of being coerced or overwritten, and receipt itself must be bytes or bytearray. To replace the array, use attach_unprotected(envelope, HDR_RECEIPTS, receipts). Behaviour change: a bad receipt, or a non-array receipts value, now raises instead of being silently coerced.

... (truncated)

Commits

• 2f1b9f5 fix(attestation): refuse debug guests and non-VMPL0 SNP reports, release 0.15...
• 7466b3d feat(sdk): add opt-in experimental evidence-requirements profile (#479)
• 7a28a4b docs(changelog): file the attach_receipt fix under Unreleased (#478)
• d3ed22e fix attach receipt (#469)
• 3c3f5a5 fix(attestation): read verdicts from signed evidence, pin the AMD root (0.14....
• d991472 bump-urllib3-2.8.0 (#475)
• 025247a docs(spec): correct identity framing, container-digest binding and Blackwell ...
• 539c24c docs(spec): publish the two-tool catalog_hash vector in Appendix D (#470)
• 2f54af9 chore(deps): bump the codeql-action group with 4 updates (#467)
• 3c12491 docs(api): mark signing_pre_image() as v0.1-only (#460)
• Additional commits viewable in compare view

Updates agentrust-trace from 0.10.0 to 0.11.0

Release notes

Sourced from agentrust-trace's releases.

agentrust-trace 0.11.0

Breaking

• TraceAGTAdapter and TraceSandboxAdapter require enforcement_mode. They used to default to enforce, which signed a claim that a policy was evaluated when nothing evaluated it. Callers pass the mode their runtime ran under, or declared when no engine evaluated the policy (#416, #419; diagnosis and first fix by @​solloek369-arch in #417).
• Signatures accept only canonical unpadded base64url, so one signature has one spelling. A padded or non-canonical signature that used to decode is refused (#418).

Added

• verify_record() reports whether the objects a record cites resolve (#374).
• Verifiers declare accepted_profiles, and VerificationResult records the profile it verified under (#347, for #116).
• The reproducibility claim and its re-execution appraisal in the schema and models, with 21 signed vectors (#364, #370).
• condition-appraisal is a registered references relation (#389).
• MCP Server Provenance v2 binds behavioral hints (#409).
• intent_bridge binds a successor observation by digest (#340).
• provenance.verify_record() takes now to replay a freshness decision (#411).

Fixed

• Schema patterns follow ECMA-262, so a trailing \n, \r, U+2028 or U+2029 no longer passes subject or URI checks (#388). The Pydantic models share the same patterns (#412).
• A malformed signature is reported as malformed, not missing (#390).
• Revocation bundles with no RFC 8785 form are unverified_for_revocation rather than an exception (#386).
• Non-ASCII challenge nonces raise the documented ValueError (#383).
• The AGT adapter no longer stamps appraisal.status: affirming on every record (#336), and both adapters check iat before signing (#343).
• The v0.3 draft schema refused neither a private cnf.jwk nor an RSA key with no key material (#372, #311).
• Input validation across content_marking, provenance, intent_bridge, revocation, the sandbox adapter and sign.verify_record() freshness bounds (#239, #282, #284, #287, #288, #290, #300, #305, #318, #322, #333, #334, #335, #339, #387, #410).
• The PyPI description named TrustRecord.sign(), record.anchor() and record.verify(), none of which exist. It now shows sign_record and verify_record (#309).

Full list in CHANGELOG.md.

Changelog

Sourced from agentrust-trace's changelog.

[0.11.0] - 2026-09-25

• Breaking: TraceSandboxAdapter and TraceAGTAdapter require enforcement_mode; it no longer defaults to "enforce". An evidence constructor that fills in "enforce" signs a claim that a policy was evaluated when nothing observed an evaluation (#416), and the first fix, a "declared" default (#417), is ruled out by spec section 4.3: declared MUST NOT be a default. Callers that omitted the argument now get a TypeError and must pass the mode their runtime actually ran under, or "declared" when no policy engine evaluated the policy. Runtime enforcement defaults are unchanged. Diagnosis and first fix by @​solloek369-arch.

• Signatures accept one spelling. sign._b64url_decode accepts only canonical unpadded base64url, so a Trust Record, JWK x, provenance, intent-bridge or revocation-bundle signature carrying padding or non-canonical trailing bits is refused instead of decoding to the same bytes. content_marking refuses served record bytes with duplicate members. Deeply nested cnf.jwk, tool calls and provenance records raise each module's documented error type instead of RecursionError, and tool_catalog_hash raises ProvenanceError for a catalog with no anchor form. ClusterFuzzLite now covers the record, bundle, provenance, bridge, content-marking and canonicalization paths (#418).

• Correct regulatory context in the published v0.1/v0.2 introductions and LIMITATIONS.md (#328, following #314). Separate Article 12 logging capability from TRACE tamper-evidence, identify Article 11 / Annex IV as documentation context, correct the applicability dates and remove unsupported TRACE-level compliance claims. Editorial only; reported by @​ioanavalea with review context from @​lywinged.

• Propose v0.3 MCP profile requirements for producer-defined attempts, signed full declaration snapshots and explicit retry outcomes (#324). Clarify existing session wording without changing v0.2 validation. Proposed by @​madeinplutofabio with declaration-binding refinements from @​Mayur021; maintainer-carried proposal, not adopted or implemented.

• Propose MCP Server Provenance v2 with normalized behavioral-hint binding (#406). Preserve v1 hashes and producer defaults; add explicit v2 production and consumer format requirements. Reported by @​altrudev.

• Compare challenge nonces as UTF-8 bytes so non-ASCII mismatches raise the documented ValueError instead of TypeError (#381). Matching strings remain accepted without Unicode normalization. Invalid non-string expected_nonce settings raise a clear ValueError. Reported by @​chernistry; follow-up review by @​lywinged.

• Report revocation bundles without an RFC 8785 form as unverified_for_revocation with cause bundle_malformed, while continuing record verification (#382). The direct bundle-digest API still refuses such input. Reported by @​chernistry.

• Regenerate the v0.3 draft after canonical reproducibility additions and make the schema inventory test use portable repository paths on Windows.

• Keep untrusted input on each verifier's documented error type. Nesting a few hundred levels deep in cnf.jwk, a tool call, a provenance record or served content-marking bytes raised RecursionError; a 4,400 digit URL port raised Python's integer-string ValueError; a float or unsafe integer in an offered tool's input_schema raised UnanchorableValue from check_tool_catalog. All were refusals already, none was an acceptance. Found by the new ClusterFuzzLite targets in .clusterfuzzlite/; regression tests in tests/test_untrusted_input_stays_on_the_documented_error.py.

• Decode signatures and JWK x as canonical unpadded base64url only. The decoder took the standard alphabet, = padding and stray characters, and ignored the unused bits of the last character, so one signature had several spellings that all verified, and a revocation bundle's bundle_digest (which covers sig.value) gave one bundle several identities. The record-level rule

... (truncated)

Commits

• 7d8df34 chore(release): agentrust-trace 0.11.0 (#420)
• 3d7c90f fix(adapters): require enforcement_mode in the AGT and sandbox adapters (supe...
• 5d9cf72 fix(security): strict signature decoding, documented refusals, ClusterFuzzLit...
• 9fd79b6 fix(provenance): allow an explicit verification instant (#411)
• 761783a docs(spec): name the instrument that set the Chapter III application dates (#...
• e3111c7 docs: separate regulatory logging duties from TRACE properties (#414)
• 9d303c5 docs: propose stateless MCP transcript profile requirements (#413)
• b217e60 fix(validation): share schema regex semantics across Python surfaces (#412)
• 0cbb72c fix(content-marking): require a textual profile identifier (#410)
• 7d3f8ac feat(provenance): bind behavioral hints in explicit v2 format (#409)
• Additional commits viewable in compare view

Updates pydantic from 2.13.5 to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

• Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
• Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

• Fix arguments-v3 schema with variadic keywords by @​Viicos in #13954
• Fix TypeError on ForwardRef on Python 3.10.0 by @​Viicos in #13964
• Support closed and extra_items via inheritance in TypedDict by @​Viicos in #13967
• Enforce the max_digits whole-digits limit in the Python Decimal validator by @​Viicos in #13972
• Reject out-of-range int inputs for timedelta by @​Viicos in #13973
• Support named tuples in Sequence validation by @​Viicos in #13978

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

v2.14.0 2026-10-08

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893

... (truncated)

Changelog

Sourced from pydantic's changelog.

v2.14.0 (2026-10-08)

GitHub release

What's Changed

The highlights of the v2.14 release are available in the blog post. Several minor changes (considered non-breaking changes according to our versioning policy) are also included in this release. Make sure to look into them before upgrading.

This release drops support for Python 3.9 and adds support for Python 3.15.

New Features

• Add support for multiple_of constraint in fraction and timedelta core schemas by @​Viicos in #13873
• Add __namespace__ parameter to create_model() by @​Viicos in #13895

Changes

• Add an ordered-dict core schema by @​Viicos in #13796
• Add a counter core schema by @​Viicos in #13824
• Do not mutate model_config attribute by @​Viicos in #13825
• Reject newlines in NameEmail validation by @​Viicos in #13897

Fixes

• Call enum constructors in both validation modes by @​Viicos in #13792
• Fix documentation examples not raising and remove unused string_sub_type unused error code by @​Viicos in #13821
• Catch OverflowError during ByteSize validation by @​Viicos in #13850
• Require multiple_of constraints to be positive by @​Viicos in #13862
• Always pop field name and model type stacks during schema generation by @​saquibjawedbit in #13859
• Handle TypeError gracefully during docstring extraction by @​Viicos in #13874
• Fix config propagation of stdlib dataclasses and TypedDicts in JSON Schema by @​Viicos in #13891
• Don't apply ser_json_timedelta to all datetime types in serialization inference by @​Viicos in #13892
• Encode JSON Schema defaults with a consistent configuration by @​Viicos in #13893
• Propagate init and kw_only=False from Field() to stdlib dataclass fields by @​Viicos in #13898
• Respect propagated extra config in the JSON Schema of stdlib dataclasses by @​Viicos in #13899
• Handle OS errors during ZoneInfo validation by @​Viicos in #13912
• Handle exceptions during Decimal validation by @​Viicos in #13940
• Rebuild incomplete types during serialization inference by @​Viicos in #13922
• Reject large exponents in Fraction validation by @​Viicos in #13944
• Avoid validating URL prefix multiple times in multi host URLs by @​Viicos in #13945

New Contributors

• @​saquibjawedbit made their first contribution in #13859

... (truncated)

Commits

• b2212c7 Prepare release v2.14.1
• 968fb2b Fix docs conversion table
• 6adc8b3 Support named tuples in Sequence validation
• 7637fbc Reject out-of-range int inputs for timedelta
• dfdbfcb Enforce the max_digits whole-digits limit in the Python Decimal validator
• e2456d3 Support closed and extra_items via inheritance in TypedDict
• 317655d Harden CI security
• 3ba1dd4 Fix TypeError on ForwardRef on Python 3.10.0
• 43681ab Bump samuelcolvin/check-python-version action to v5.1
• d6bc53a Avoid unnecessary extra dict allocation in model validation
• Additional commits viewable in compare view

Updates pydantic-ai-slim from 2.49.0 to 2.55.0

Release notes

Sourced from pydantic-ai-slim's releases.

v2.55.0 (2026-10-09)

What's Changed

⚠️ Compatibility Notes

• Require Python 3.11 or newer in every package; Python 3.10 installs resolve to 2.54.0 and earlier by @​Kludex in pydantic/pydantic-ai#9526
• Record the tool requests of ExaSearch, YouSearch, LocalStack and other harness capabilities under durable execution by @​DouweM in pydantic/pydantic-ai#9705
• Bound retained realtime audio like retained images with retain_audio_max_seconds by @​DouweM in pydantic/pydantic-ai#9702
• Prefix LogfireMCP tool names with logfire_ by @​mpfaffenberger in pydantic/pydantic-ai#9868
• Serialize FileUrl.media_type as null for extensionless URLs instead of raising by @​pydanty in pydantic/pydantic-ai#8405
• Take realtime history, usage, and reply waits from the session core on OpenAI, Azure OpenAI, and xAI by @​DouweM in pydantic/pydantic-ai#9612
• Keep default run_id and conversation_id stable when a durable run is re-executed by @​DouweM in pydantic/pydantic-ai#9701
• Record each failed FallbackModel attempt with its model, timing, error and usage, and count rejected responses in RunUsage by @​DouweM in pydantic/pydantic-ai#8745

🚀 Features

• Add an OpenAIDecisionsModel backend with image input by @​DenysMoskalenko in pydantic/pydantic-ai#9634
• Halve import pydantic_ai time by loading pydantic_ai.mcp only when an MCP capability needs it by @​DouweM in pydantic/pydantic-ai#10046
• Add Conversation to carry and store a conversation between runs, accepted as conversation= by every entry point by @​DouweM in pydantic/pydantic-ai#8337
• Record prompt cache diagnostics in provider_details: on by default for OpenAI Responses, anthropic_cache_diagnostics opt-in by @​DouweM in pydantic/pydantic-ai#9406
• Report prompt-cache health per conversation via pydantic_ai.cache.* span attributes and collapse events by @​DouweM in pydantic/pydantic-ai#6534
• Default Azure AI Voice Live to API version 2026-07-15 and apply parallel_tool_calls=False there by @​DouweM in pydantic/pydantic-ai#9409
• Raise Azure AI Voice Live warning events as Python warnings instead of dropping them by @​DouweM in pydantic/pydantic-ai#9420
• Add openai_cache_instructions to place a prompt cache breakpoint on the instructions by @​adtyavrdhn in pydantic/pydantic-ai#7559
• Add hang_up() to end a WebRTC call from the server on gpt-realtime and GPT-Live by @​DouweM in pydantic/pydantic-ai#9342
• Add PostgresStepStore and PostgresMediaStore, the hosted Postgres backends for messages and media by @​rscholz98 in pydantic/pydantic-ai#9899
• Add unified cache setting and Caching capability for cross-provider prompt caching by @​adtyavrdhn in pydantic/pydantic-ai#7560
• Add support for claude-haiku-5-5 by @​dsfaccini in pydantic/pydantic-ai#9998
• Seed message_history into a WebRTC call through answer_webrtc_offer by @​DouweM in pydantic/pydantic-ai#9338
• Configure Azure AI Voice Live semantic VAD, end-of-utterance detection, noise suppression and echo cancellation by @​DouweM in pydantic/pydantic-ai#9414
• Cache the instructions and tool definitions too when cache=True uses Anthropic's automatic caching by @​DouweM in pydantic/pydantic-ai#10047
• Turn on prompt caching by default in harness Coder by @​DouweM in pydantic/pydantic-ai#10040
• Add openai_live_idle_audio so text-only GPT-Live sessions work without a microphone by @​DouweM in pydantic/pydantic-ai#9295

🐛 Bug Fixes

• Read Codex CLI auth.json as UTF-8 regardless of platform locale by @​pydanty in pydantic/pydantic-ai#8254
• Avoid false WarnOnCacheBusts warnings after native tool calls by @​aweis89 in pydantic/pydantic-ai#9746
• Run a capability durable_operation inline when it is called from inside a durable unit by @​DouweM in pydantic/pydantic-ai#9700
• End an xAI realtime session on a max_duration error instead of reconnecting into the same limit by @​DouweM in pydantic/pydantic-ai#9415
• Attach a leading CachePoint to the previous message on OpenAI instead of raising by @​DouweM in pydantic/pydantic-ai#9582
• Keep the run state recoverable when Ctrl-C interrupts run_stream_sync() mid-output by @​DouweM in pydantic/pydantic-ai#9709
• Raise BedrockEmbeddingModel errors as ModelHTTPError/ModelAPIError instead of an ExceptionGroup, and map botocore transport errors by @​DouweM in pydantic/pydantic-ai#9314
• Record GPT-Live's final usage on close by ending the session with session.close by @​DouweM in pydantic/pydantic-ai#9403
• Stop a numeric request timeout from lengthening the connect and pool timeouts of Pydantic AI-created HTTP clients by @​DouweM in pydantic/pydantic-ai#9599
• Don't record an OpenAI realtime idle_timeout_ms follow-up as an empty user turn by @​DouweM in pydantic/pydantic-ai#9396
• Close out interrupted tool calls when resuming a sub-agent with delegate_task(resume=...) by @​DouweM in pydantic/pydantic-ai#9783
• Publish AgentRunResult's public shape in its validation JSON schema by @​DouweM in pydantic/pydantic-ai#9791
• Record Planning's plan store calls under durable execution, so recovery doesn't repeat its writes by @​DouweM in pydantic/pydantic-ai#9789
• Report malformed GPT-Live events as recoverable errors instead of dropping them by @​DouweM in pydantic/pydantic-ai#9393
• Record each Memory tool call under durable execution, so a forked DBOS workflow doesn't repeat its writes by @​DouweM in pydantic/pydantic-ai#9832
• Replay a spoken realtime turn without a transcript as a marker on reconnect instead of dropping it by @​DouweM in pydantic/pydantic-ai#9782
• Don't let openai_prompt_cache_retention widen the cache-health window on GPT-5.6+ by @​DouweM in pydantic/pydantic-ai#9851
• Hide MCP Apps tools whose _meta.ui.visibility leaves out "model" from the model in MCPToolset by @​adtyavrdhn in pydantic/pydantic-ai#9862

... (truncated)

Commits

• 7db7a4d Add an OpenAIDecisionsModel backend with image input (#9634)
• 4e9d555 Raise earlier Anthropic cache breakpoints to a later, longer TTL so requests ...
• 352b198 Raise ModelAPIError for transport errors that escaped Google, Mistral, Cohe...
• 1040a5a Charge FallbackModel attempts once in SpendLimits when a failed continuat...
• 3bcf631 Record errors clai2 handles as exceptions in Logfire (#9797)
• 3742e5c Fix TextOutput JSON schema to infer the wrapped function's return annotatio...
• 943ade7 Add openai_live_idle_audio so text-only GPT-Live sessions work without a mi...
• a24f76e Turn on prompt caching by default in harness Coder (#10040)
• 299bd60 Charge SpendLimits budgets for responses a FallbackModel rejected (#9792)
• 90051ef Fix merge_json_schema_defs corrupting branch schemas on transitive def-name...
• Additional commits viewable in compare view

Updates cryptography from 50.0.1 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• See full diff in compare view

Updates numpy from 2.5.3 to 2.5.4

Release notes

Sourced from numpy's releases.

v2.5.4 (Oct 10, 2026)

NumPy 2.5.4 Release Notes

Released on 2026-10-10.

NumPy 2.5.4 is a patch release that fixes bugs discovered after the 2.5.3 release. Highlights are:

• Many typing fixes and improvements,
• A workaround for the MSVC 19.51 bug, see below.

This release supports Python versions 3.12-3.15.

Improvements

• numpy.linalg.svd and numpy.linalg.lstsq now raise for inputs containing infinities instead of returning garbage results.

• Fixed hangs in numpy.linalg.svd and numpy.linalg.lstsq for certain inputs containing infinities for recent versions of some LAPACK implementations.

• numpy.linalg.cond now handles non-finite inputs more consistently.

(gh-32593)

StringDType hashing with NaN sentinels

StringDType instances with equivalent floating-point NaN sentinels now have equal hashes. Previously, distinct NaN objects could produce equal dtype instances with different hashes, causing dictionary lookups and set deduplication to fail.

(gh-32563)

Changes

MaskedArray resets a fill_value that cannot be represented in a new dtype

A fill_value copied from a source array is now reset to the default fill_value for the new dtype when it cannot be represented in that dtype. Previously the copied value could be stale: ufuncs that change dtype left the result holding a fill_value typed for the old dtype, which raised a TypeError only when something later validated it (such as .view()), and a floating point fill_value that overflows an integer dtype was kept as an out-of-range value together with a RuntimeWarning. Both now fall back to the default, including when a masked array is passed to MaskedArray with a different dtype. A fill_value given explicitly by the user is still validated and raises as before. This can now raise a ComplexWarning if the fill_value is complex and the new dtype is real.

... (truncated)

Commits

• a3d0ef1 Merge pull request #32969 from charris/prepare-2.5.4
• 087b536 MAINT: Make OpenBLAS version check use 2.5.x branch.
• 91acd87 REL: Prepare for the NumPy 2.5.4 release.

[imran-siddique]

Closing: this group raises sentinel's floor to numpy>=2.5.4, which has no Python 3.11 build, and moves agent-manifest and agentrust-trace past the versions each integration declares in tested_against. Those move per integration on purpose instead.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml