Skip to content

chore(deps): bump the pip group across 1 directory with 3 updates#5748

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/contributing/samples/integrations/authn-adk-all-in-one/pip-34b5800231
Open

chore(deps): bump the pip group across 1 directory with 3 updates#5748
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/contributing/samples/integrations/authn-adk-all-in-one/pip-34b5800231

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps the pip group with 3 updates in the /contributing/samples/integrations/authn-adk-all-in-one directory: google-adk, python-dotenv and requests.

Updates google-adk from 1.12 to 1.28.1

Release notes

Sourced from google-adk's releases.

v1.28.1

1.28.1 (2026-04-02)

Features

  • live: support live for gemini-3.1-flash-live-preview model (ee69661)

Bug Fixes

  • Disallow args on /builder and Add warning about Web UI usage to CLI help (f037f68)
  • live: Buffer tool calls and emit them together upon turn completion (081adbd)

v1.28.0

1.28.0 (2026-03-26)

Features

  • a2a: add lifespan parameter to to_a2a() (0f4c807), closes #4701
  • Add a new extension for the new version of ADK-A2A integration (6f0dcb3)
  • Add ability to run individual unit tests to unittests.sh (b3fcd8a)
  • Add database_role property to SpannerToolSettings and use it in execute_sql to support fine grained access controls (360e0f7)
  • Add index to events table and update dependencies (3153e6d), closes #4827
  • Add MultiTurn Task success metric (9a75c06)
  • Add MultiTurn Task trajectory and tool trajectory metrics (38bfb44)
  • Add slack integration to ADK (6909a16)
  • Add Spanner Admin Toolset (28618a8)
  • Add SSE streaming support to conformance tests (c910961)
  • Add support for Anthropic's thinking_blocks format in LiteLLM integration (fc45fa6), closes #4801
  • Add support for timeout to UnsafeLocalCodeExecutor (71d26ef)
  • auth: Integrate GCP IAM Connectors (Noop implementation) (78e5a90)
  • bigquery: Migrate 1P BQ Toolset (08be442) (7aa1f52) (d112131) (166ff99)
  • enable suppressing A2A experimental warnings (fdc2b43)
  • Enhance AgentEngineSandboxCodeExecutor sample to automatically provision an Agent Engine if neither agent_engine_resource_name nor sandbox_resource_name is provided (6c34694)
  • Extract and merge EventActions from A2A metadata (4b677e7), closes #3968
  • mcp: add sampling callback support for MCP sessions (8f82697)
  • Optional GCP project and credential for GCS access (2f90c1a)
  • Support new embedding model in files retrieval (faafac9)

Bug Fixes

  • add agent name validation to prevent arbitrary module imports (116f75d)
  • add protection for arbitrary module imports (995cd1c), closes #4947
  • Add read-only session support in DatabaseSessionService (f6ea58b), closes #4771
  • Allow snake case for skill name (b157276)
  • bigquery: use valid dataplex OAuth scope (4010716)
  • Default to ClusterIP so GKE deployment isn't publicly exposed by default (f7359e3)

... (truncated)

Changelog

Sourced from google-adk's changelog.

Changelog

1.34.0 (2026-05-18)

Features

  • a2a: add support for persistent task stores (cd78d87)
  • add general support for Gemini Live API in ADK evaluate (790c9be)
  • Add mTLS support to Google Cloud Telemetry exporter (cfe8d2c)
  • add support for A2aAgentExecutor factory in to_a2a() function (115124c)
  • add support for non-ADK produced input-required events (6e53472)
  • Added config option to include tool calls/responses in conversation history passed to user simulator (baf7efb)
  • ci: add Gemini auto review and invoke workflows (fd8b492)
  • Implement GCPSkillRegistry in ADK (88ebd42)
  • Implement Skill Registry in ADK (380d261)
  • Make Agent Skill description validation more informative (9f38973)
  • Simplify data retrieved handling of ask_data_agent tool and ask_data_insights tool (48f1b30)
  • Support OAuth PKCE in McpToolset (e7316dc)

Bug Fixes

  • agents: fix visibility of output_key state delta in callbacks (0524797)
  • anthropic: map negative thinking_budget to adaptive thinking (03b915b)
  • auth: persist refreshed OAuth2 credentials to store (218ea76), closes #5329
  • auth: remove unneeded OAuth flows (c35a579)
  • avoid pre-serializing dict values in Interactions API to prevent double-escaping (85f397d)
  • cache: enforce CacheMetadata active-state invariant (76b9f0b)
  • cache: handle fingerprint-only metadata in performance analyzer (9c5de58)
  • Catch OSError when importing AnthropicLlm (91cb5c6)
  • evaluation: handle none config in per_turn_user_simulator_quality (eed9bd3), closes #5677
  • fallback to project id if crendetials don't contain quota project (e377cb5)
  • Fix missing dynamically loaded tools in SkillToolset during the same invocation (f9097cb)
  • live: ensure sub live agent doesn't inherit session resumption handle from parent live agent to avoid interrupting the conversation (8dd9147)
  • models: preserve string content in Anthropic tool_result blocks (9a1e75f), closes #5358
  • models: preserve tool_use IDs for Anthropic models on session resume (327c45f), closes #5074
  • models: treat empty GenerateContentResponse without prompt feedback as successful (0cb9ae9)
  • only serialize llm_response to json if it will be included in the trace (1284493)
  • Preserve live_session_id in function call handling (07a9a01)
  • Prevent compaction of events involved in Human-in-the-Loop interactions (bb2efb6)
  • raise eagerly on importing AgentRegistry if a2a-sdk is missing (33cf6cb)
  • small: Convert events to the A2A format while respecting user vs agent role (59f7347)
  • tools: preserve code_execution_result and executable_code in AgentTool (7e61b51), closes #5481
  • tools: Prevent AnyIO CancelScope task boundary violations during MCP session creation failure (4309159)
  • Update model name in hello_world agent (192f19d)
  • Update model to gemini-3-flash-preview in hello word agent sample (6d89d21)
  • Update model to gemini-3-flash-preview in session state agent sample (2d423e8)
  • use tool_responses role for gemma4 models in LiteLLM integration (3d07960), closes #5650

... (truncated)

Commits
  • 0d48362 chore(release/candidate): release 1.28.1 (#5121)
  • f037f68 fix: Disallow args on /builder and Add warning about Web UI usage to CLI help
  • 081adbd fix(live): Buffer tool calls and emit them together upon turn completion
  • ee69661 feat(live): support live for gemini-3.1-flash-live-preview model
  • 4e05efb chore: update last-release-sha for next release
  • c57d000 chore(release/candidate): release 1.28.0 (#5014)
  • 5020954 fix: Update list_agents to only list directories, not validate agent definitions
  • f7359e3 fix: Default to ClusterIP so GKE deployment isn't publicly exposed by default
  • ab9ae0f ADK changes
  • 08be442 feat(bigquery): Migrate 1P BQ Toolset
  • Additional commits viewable in compare view

Updates python-dotenv from 1.1.1 to 1.2.2

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

  • The dotenv run command now forwards flags directly to the specified command by @​bbc2 in theskumar/python-dotenv#607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Support for Python 3.9.

Fixed

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

New Contributors

Full Changelog: theskumar/python-dotenv@v1.2.1...v1.2.2

v1.2.1

What's Changed

... (truncated)

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

  • The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Dropped Support for Python 3.9.

Fixed

  • Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
  • Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

[1.2.1] - 2025-10-26

  • Move more config to pyproject.toml, removed setup.cfg
  • Add support for reading .env from FIFOs (Unix) by [@​sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

Commits

Updates requests from 2.32.4 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.
Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.
Commits
  • bc04dfd v2.33.0
  • 66d21cb Merge commit from fork
  • 8b9bc8f Move badges to top of README (#7293)
  • e331a28 Remove unused extraction call (#7292)
  • 753fd08 docs: fix FAQ grammar in httplib2 example
  • 774a0b8 docs(socks): same block as other sections
  • 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
  • ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
  • 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
  • d568f47 docs: clarify Quickstart POST example (#6960)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the pip group across 1 directory with 3 updates
be03a4d 
Bumps the pip group with 3 updates in the /contributing/samples/integrations/authn-adk-all-in-one directory: [google-adk](https://github.com/google/adk-python), [python-dotenv](https://github.com/theskumar/python-dotenv) and [requests](https://github.com/psf/requests).


Updates `google-adk` from 1.12 to 1.28.1
- [Release notes](https://github.com/google/adk-python/releases)
- [Changelog](https://github.com/google/adk-python/blob/main/CHANGELOG.md)
- [Commits](v1.12.0...v1.28.1)

Updates `python-dotenv` from 1.1.1 to 1.2.2
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.1.1...v1.2.2)

Updates `requests` from 2.32.4 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.4...v2.33.0)

---
updated-dependencies:
- dependency-name: google-adk
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: python-dotenv
  dependency-version: 1.2.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels May 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants