[Eduard van Valkenburg (eavanvalkenburg)]

Motivation and Context

Consolidates the currently open Python Dependabot updates into one reviewable pull request while preserving the compatibility fixes already applied to those PRs.

Supersedes #14463, #14462, #14456, #14393, #14392, #14391, #14336, and #14256.

Description

• Updates the root Python dependency ranges for google-genai and websockets.
• Keeps mistralai on its compatible 1.x API and retains the existing mcp<2.0 bound because both 2.x updates break current connectors.
• Updates onnxruntime-genai to 0.15.2 for Python 3.11+ while retaining 0.9.0 for Python 3.10.
• Updates the root lockfile to anyio 4.14.2, soupsieve 2.9, google-genai 1.75.0, websockets 16.1.1, and the compatible ONNX GenAI pins.
• Updates the OAuth server lockfile to anyio 4.14.2 and removes its obsolete sniffio dependency.
• Regenerates and validates the lockfiles with the CI-pinned uv 0.5.31.

Validation:

• uvx --from 'uv==0.5.31' uv lock --check passed for both lockfiles.
• uvx --from 'uv==0.5.31' uv sync --all-extras --dev --frozen --quiet passed.
• uvx --from 'uv==0.5.31' uv run --frozen pytest ./tests/unit --ignore=tests/unit/processes/dapr_runtime passed.
• The OAuth server dependency environment resolves with uv sync --frozen --no-install-project; its editable package build remains blocked by the sample's pre-existing missing README.md.

Contribution Checklist

• The code builds clean without any errors or warnings
• The PR follows the SK Contribution Guidelines and the pre-submission formatting script raises no violations
• All unit tests pass, and I have added new tests where possible
• I didn't break anyone 😄

[Copilot]

Copilot review overview

🟢 Approval recommended

Dependency constraints and generated lockfiles are consistent with the stated compatibility requirements and validation.

Review effort: Balanced
Findings: None

What changed in this PR

Consolidates Python dependency updates while preserving compatibility bounds for breaking major versions.

Changes:

• Updates dependency ranges and Python-version-specific ONNX pins.
• Regenerates root and OAuth sample lockfiles.
• Marks uv.lock files as generated.

File	Description
.gitattributes	Marks uv lockfiles as generated.
python/​pyproject.toml	Updates dependency constraints.
python/​uv.lock	Locks updated dependency versions.
python/​samples/​demos/​mcp_with_oauth/​server/​uv.lock	Updates AnyIO and removes obsolete Sniffio.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[semantic-kernel-automation]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (2 commit(s)): ac5e9c0424fc, f040c3556b06
Model: gpt-5.6-sol

Overview

The PR consistently updates dependency bounds and regenerated lockfiles while preserving explicit compatibility caps for MCP, Mistral, WebSockets, Google GenAI, and Python 3.10 ONNX users. The strongest guardrails are matching lock metadata, Python-version markers, modern WebSockets call sites, and frozen cross-platform unit-test coverage. Both lockfiles pass uv lock --check, and no publishable correctness, architecture, or security defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.