[SergeyMenshykh]

Summary

• update Transformers and related Hugging Face packages
• refresh Python dependencies used by the MCP OAuth demo
• regenerate the affected uv lockfiles
• adapt the Hugging Face text completion connector to Transformers 5
• temporarily disable live tests that depend on the retired Assistants API

Hugging Face connector

Transformers 5 removes the text2text-generation, summarization and translation pipeline tasks, so HuggingFaceTextCompletion raised KeyError: Unknown task text2text-generation on construction.

Those two tasks now use a small adapter built on AutoModelForSeq2SeqLM and AutoTokenizer that preserves what the removed pipelines did:

• the same output keys (summary_text for summarization, generated_text otherwise), so the content mapping is unchanged
• the model's task specific prefix (e.g. summarize: ) is still prepended before tokenization
• one record per generated sequence when num_return_sequences > 1
• model_kwargs are shared with the tokenizer load, as pipeline() did
• pipeline only options are dropped with a warning instead of reaching generate()

text-generation keeps using pipeline(). There is no public API change.

The previous unit tests mocked pipeline() and so did not catch the incompatibility. New tests cover the adapter, option routing, device placement, output mapping and prefix resolution.

Temporarily disabled tests

The OpenAI and Azure OpenAI Assistants API has been retired. Live requests now return HTTP 410 (assistants_api_deprecated) on Azure OpenAI and HTTP 404 on OpenAI, so these tests cannot exercise a functioning service.

• all 30 parametrized cases in tests/integration/agents/openai_assistant_agent/test_openai_assistant_agent_integration.py are skipped at module level, before the live-service fixture runs
• the step1_openai_assistant case in tests/samples/test_concepts.py is skipped unconditionally
• the other concept samples are unchanged
• all 103 tests under tests/unit/agents/openai_assistant remain enabled and passing

The skips are intentionally limited to live tests for the retired API. Comments next to each skip include the migration guide and state that the skip should be removed after the agents and sample move to the replacement API.

Validation

• uv lock consistency checks
• 35 Hugging Face unit tests pass
• all 12 deliberate connector mutations used to assess regression coverage were detected by the unit tests
• all 103 Assistants agent unit tests pass
• 30 live Assistants integration cases and the one retired-API concept sample report as skipped before making service requests
• the three text completion services used by the integration suite were exercised against their real models on Transformers 5, for both completion and streaming
• Ruff check and formatting pass

[Copilot]

🟢 Approval recommended

The changes are limited to dependency/version updates with consistent constraints and regenerated lockfiles aligning with the updated dependency declarations.

Pull request overview

This pull request refreshes Python dependencies for the MCP OAuth demo and the repo’s Hugging Face extra set, updating versions and regenerating the corresponding uv.lock files to keep dependency resolution reproducible.

Changes:

• Bump the MCP OAuth demo server to mcp>=1.28.1 and explicitly declare python-multipart and starlette as direct dependencies.
• Regenerate the demo uv.lock files, including updating aiohttp (client demo) and adding new transitive packages in the server lock (e.g., cryptography, pyjwt, pywin32).
• Update the repo-level hugging_face extra to require transformers[torch] >= 5.5.0,< 6.0.

File summaries

File	Description
python/samples/demos/mcp_with_oauth/uv.lock	Regenerated lockfile; updates aiohttp to 3.14.3 and refreshes resolved artifacts.
python/samples/demos/mcp_with_oauth/server/uv.lock	Regenerated server lockfile for mcp 1.28.1 and newly resolved transitive dependencies.
python/samples/demos/mcp_with_oauth/server/pyproject.toml	Updates demo server dependency constraints (notably mcp>=1.28.1, plus python-multipart/starlette).
python/pyproject.toml	Raises the minimum transformers[torch] version in the hugging_face optional dependency group.

Review details

• Files reviewed: 2/5 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): bf5bfea23820
Model: claude-opus-4.8

Overview

This is a focused dependency-bump PR: it raises the hugging_face extra's transformers[torch] lower bound from >= 4.28 to >= 5.5.0 in python/pyproject.toml, adds explicit mcp>=1.28.1, python-multipart>=0.0.30, and starlette>=1.1.0 floors to the standalone mcp_with_oauth sample, and regenerates three uv.lock files. No source or test code changes. The strongest guardrails are the machine-verified lock resolutions (transformers 5.5.0's torch extra is unversioned, so the pre-existing torch==2.13.0 pin still satisfies it; wheels exist across the supported platform matrix; both sample lockfiles agree on mcp==1.28.1) and the fact that all bumped packages resolve to files.pythonhosted.org with sha256 pins. The residual risk is that the connector's transformers/sentence-transformers call sites are exercised only by mocked unit tests, so runtime API parity against the 5.x major is unverified — a validation gap in unchanged code, not a defect anchored to this diff.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
connectors/ai/hugging_face/services
hf_text_completion.py	109	1	99%	242
TOTAL	29033	5597	80%

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
4113	22 💤	0 ❌	0 🔥	1m 36s ⏱️