Skip to content

ci: update Python dependencies across root and Lab projects - #28

Closed
eavanvalkenburg wants to merge 26 commits into
mainfrom
centralize-labs-dev-dependencies
Closed

ci: update Python dependencies across root and Lab projects#28
eavanvalkenburg wants to merge 26 commits into
mainfrom
centralize-labs-dev-dependencies

Conversation

@eavanvalkenburg

@eavanvalkenburg eavanvalkenburg commented Sep 18, 2026

Copy link
Copy Markdown
Owner

Motivation & Context

Python development dependencies are pinned independently in the root project and the standalone Lab project. The current Dependabot configuration scans them in separate jobs, producing separate pull requests for the same shared tooling updates.

This change lets the existing pip Dependabot job discover both projects so grouped updates can keep their manifests and lockfiles aligned in one pull request while preserving Lab's standalone uv resolution boundary.

Description & Review Guide

  • What are the major changes? Replaced the pip updater's single directory with directories covering python/ and python/packages/lab/.
  • What is the impact of these changes? Future grouped Python development-dependency updates can update both standalone projects together, reducing duplicate Dependabot pull requests. Runtime behavior and dependency resolution boundaries are unchanged.
  • What do you want reviewers to focus on? Confirm that both Python project paths should be handled by the pip updater while the existing uv updater entries remain as transitional coverage.

Related Issue

None. This is a configuration-only maintenance change requested directly without a tracking issue.

Contribution Checklist

  • The code builds clean without any errors or warnings
  • All unit tests pass, and I have added new tests where possible
  • The PR follows the Contribution Guidelines
  • This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
  • This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

Lubaoshuai and others added 26 commits September 17, 2026 08:15
@Lubaoshuai @moonbox3
Python: exclude encrypted reasoning payloads from compaction token co…
d90355f 
…unts (microsoft#8354)

* Python: exclude encrypted reasoning payloads from compaction token counts

The compaction token counter serialises each message and tokenises the JSON.
Content.protected_data (OpenAI encrypted_content, Anthropic thinking
signature, Gemini thought_signature, OpenAI reasoning_details) is opaque
ciphertext the model replays but never tokenises, so counting it inflated
every token-aware compaction decision. The same blob can also ride in
additional_properties as encrypted_content.

Both are now excluded from serialised content, matching the existing
exclusions for raw_representation and mirrored items.

Fixes microsoft#8348

* fix(compaction): count clear-text reasoning details and invalidate stale token caches

Review follow-up for the protected-data token exclusion:

- reasoning_details stored in protected_data are JSON-serialised and
  replayed to the provider as clear text (summary, reasoning_text and
  nested reasoning.text), so only opaque members (encrypted_content) are
  excluded from the estimate; non-JSON payloads (Anthropic signature,
  Responses API encrypted blobs) are still dropped entirely.
- group token counts are stamped with a serialization basis version;
  counts cached under an older basis (e.g. sessions annotated before a
  serialization change) are recomputed instead of reused.

* fix(compaction): resolve pyright/mypy typing errors in token estimation

- annotate the recursive reasoning-payload filter with explicit
  dict[Any, Any] / list[Any] casts so iterating the narrowed Any dict
  does not leak Unknown types under pyright strict
- cast additional_properties before the encrypted_content filter
- assert non-None token counts in the clear-text regression test so the
  ordering comparison does not involve optional integers

---------

Co-authored-by: Evan Mattson <35585003+moonbox3@users.noreply.github.com>
@eavanvalkenburg
Python: preserve approval context across resume paths (microsoft#8433)
f187b68 
* Python: fix mixed function-call batch classification

* Python: scope mixed pause correlation

* Python: preserve streaming approval updates

* Python: preserve approval resume context

* Python: address approval resume review feedback

* Python: harden mixed approval replay

* Python: keep stateless mixed approvals inert
@FOWEPJF255 @lhl-lhi
@ktz03 @eavanvalkenburg
Python: include checkpoint_id on AG-UI interrupt metadata (microsoft#…
3b110ad 
…8150) (microsoft#8163)

* Python: include checkpoint_id on AG-UI interrupt metadata (microsoft#8150)

Attach the pause workflow checkpoint id to RUN_FINISHED interrupt
metadata.agent_framework so multi-worker clients can resume via
forwardedProps.checkpoint_id without a side channel.

* Python: Prefer runner pause checkpoint over shared get_latest (microsoft#8150)

* Python: Fix ag-ui lint and ty ignores for microsoft#8150 tests

* Python: Core resolve_pause_checkpoint_id for AG-UI (microsoft#8150)

Move pause-checkpoint selection into Workflow and require a run-scoped
baseline so leftover runner ids are not advertised across runs.

* fix(python): resolve pyright failures in pause checkpoint lookup

Unblocks Package Checks / merge-gatekeeper on PR microsoft#8163.

* fix(ag-ui): address microsoft#8163 review on pause checkpoint ownership (#2)

- Workflow captures run baseline / restored id inside run(); resolve uses them
  so callers need not thread baseline_checkpoint_id.
- Exclude restored checkpoint from pause candidates after resume.
- Drop issue reference in docstring; emit RUN_FINISHED via existing
  _build_run_finished_event after attaching pause id.
- Move core pause-resolve coverage into test_workflow.py (no new test file).

* fix(ag-ui): resume builder-storage pause IDs without AG-UI storage

When checkpoint_id+resume is supplied, load pending requests from the workflow's effective builder/runtime storage if AG-UI was not given an explicit checkpoint_storage, so emitted pause IDs remain round-trippable.

* fix(ag-ui): silence ty invalid-argument-type on builder-storage resume test

Match existing yield_output ignore markers so Test Typing Checks accept the new resume round-trip coverage.

* fix(ag-ui): resume builder storage via AgentFrameworkWorkflow.run()

Allow forwardedProps.checkpoint_id when only WorkflowBuilder storage is configured, so wrapper/endpoint hosts round-trip pause ids without duplicating checkpoint_storage.

---------

Co-authored-by: minelhi <3417378192@qq.com>
Co-authored-by: LI <2484593937@qq.com>
Co-authored-by: Eduard van Valkenburg <eavanvalkenburg@users.noreply.github.com>
@SergeyMenshykh @moonbox3
.NET/Python: Refine skill frontmatter parsing (microsoft#8430)
52e03cb 
* Reject ambiguous skill frontmatter fields in Python and .NET

Validate recognized top-level field casing and uniqueness while preserving existing scalar parsing and nested metadata behavior. Add file and MCP archive regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Keep first duplicate skill metadata value in Python and .NET

Warn on duplicate metadata entries without rejecting skills, preserve existing key comparison rules, and expand scalar and archive regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Preserve unset optional skill frontmatter fields

Keep bare empty optional fields null while retaining duplicate and casing validation in Python and .NET. Add file and MCP archive regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Support quoted skill frontmatter property names

Normalize single- and double-quoted root names before existing field validation in Python and .NET. Support quoted metadata headers and expand scalar and archive regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Use PyYAML for Python skill frontmatter parsing

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Evan Mattson <35585003+moonbox3@users.noreply.github.com>
@westey-m @eoindoherty1
.NET/Python: Add more content types to purview handling (microsoft#8370)
a3fc29d 
* Add more content types to purview handling

* Address PR comments

* Split Purview content processing requests

Create one processContent request per content entry in both .NET and Python while preserving the Graph contentEntries array contract.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Skip empty Purview content

Avoid sending empty text or binary data to Graph processContent APIs in both .NET and Python.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Address PR comments

---------

Co-authored-by: Eoin Doherty <eoindoherty@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@eavanvalkenburg
Python: Add per-tool AgentModeProvider exposure controls (microsoft#8450
0c07eb6 
)

* Python: Add mode tool exposure controls

* Python: Support replacement mode state updates

* Python: Clear stale mode notifications
@eavanvalkenburg
Python: expose instrumentation message event control (microsoft#8451)
63aacbb
@jpalvarezl
.NET: [BREAKING] Scope provider-backed MCP sessions per invocation (m…
0275ebf 
…icrosoft#8425)

* Scope provider-backed MCP sessions to each invocation

Create and clean up separate MCP sessions for custom client-provider calls in .NET and Python. Preserve default session caching and caller-owned HTTP clients, and add lifecycle coverage and compatibility guidance.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Make cleanup cancellation test compatible with Python 3.10

Assert cancellation and resource cleanup without depending on a cancellation message that older asyncio task implementations may consume.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Handle reentrant MCP shutdown and cleanup failures

Reject self-draining shutdown across inherited invocation contexts. Preserve invocation outcomes when session or transport cleanup fails, report non-cancellation cleanup failures separately, and add lifecycle regression coverage.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@westey-m
Allow disabling function tools on ModeProvider (microsoft#8458)
dcd2c4d
@SergeyMenshykh
Clarify Agent Skills caching behavior (microsoft#8474)
81c47e2 
Document the default shared cache behavior for custom skill sources and point callers to the existing caching controls.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@baywet
docs: clarifies the additional languages policy (microsoft#8477)
6817fbd
@baywet
ci: excludes samples from dotnet dependabot because they are causing …
3c83441 
…a timeout (microsoft#8476)

* ci: excludes samples from dotnet dependabot because they are causing a timeout

* ci: aligns path specification
@rogerbarreto
.NET: Make Foundry user identity session sticky (microsoft#8434)
d188e8e
@dependabot
Build(deps): Bump azure/login (microsoft#8485)
8559a7b 
Bumps [azure/login](https://github.com/azure/login) from 3.0.2 to 3.1.0.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@7ddb5af...a641126)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump astral-sh/setup-uv from 10.0.1 to 10.1.0 (microsoft…
5e0f3a5 
…#8482)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.1 to 10.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@20cfd1b...bec219d)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump astral-sh/setup-uv in /.github/actions/python-setup (…
200b787 
…microsoft#8484)

Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.1 to 10.1.0.
- [Release notes](https://github.com/astral-sh/setup-uv/releases)
- [Commits](astral-sh/setup-uv@20cfd1b...bec219d)

---
updated-dependencies:
- dependency-name: astral-sh/setup-uv
  dependency-version: 10.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump azure/login in /.github/actions/github-app-token (m…
3b45c56 
…icrosoft#8483)

Bumps [azure/login](https://github.com/azure/login) from 3.0.2 to 3.1.0.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@7ddb5af...a641126)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump azure/login from 3.0.2 to 3.1.0 (microsoft#8481)
bc57ce8 
Bumps [azure/login](https://github.com/azure/login) from 3.0.2 to 3.1.0.
- [Release notes](https://github.com/azure/login/releases)
- [Commits](Azure/login@7ddb5af...a641126)

---
updated-dependencies:
- dependency-name: azure/login
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump the codeql-actions group across 1 directory with 3 …
459fe6e 
…updates (microsoft#8480)

Bumps the codeql-actions group with 3 updates in the / directory: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/autobuild](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).


Updates `github/codeql-action/init` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `github/codeql-action/autobuild` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

Updates `github/codeql-action/analyze` from 4.37.9 to 4.38.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@cdf488f...b96794f)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/autobuild
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: codeql-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps-dev): Bump agent-framework-openai in /python/packages/lab (m…
7a5acf1 
…icrosoft#8473)

Bumps [agent-framework-openai](https://github.com/microsoft/agent-framework) from 1.14.2 to 1.14.3.
- [Release notes](https://github.com/microsoft/agent-framework/releases)
- [Commits](https://github.com/microsoft/agent-framework/commits)

---
updated-dependencies:
- dependency-name: agent-framework-openai
  dependency-version: 1.14.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump huggingface-hub in /python/packages/lab (microsoft#…
12603b6 
…8472)

Bumps [huggingface-hub](https://github.com/huggingface/huggingface_hub) from 1.30.0 to 1.31.0.
- [Release notes](https://github.com/huggingface/huggingface_hub/releases)
- [Commits](huggingface/huggingface_hub@v1.30.0...v1.31.0)

---
updated-dependencies:
- dependency-name: huggingface-hub
  dependency-version: 1.31.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps): Bump agent-framework-core in /python/packages/lab (micro…
06f7909 
…soft#8471)

Bumps [agent-framework-core](https://github.com/microsoft/agent-framework) from 1.17.0 to 1.18.0.
- [Release notes](https://github.com/microsoft/agent-framework/releases)
- [Commits](microsoft/agent-framework@dotnet-1.17.0...dotnet-1.18.0)

---
updated-dependencies:
- dependency-name: agent-framework-core
  dependency-version: 1.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps-dev): Bump pyright (microsoft#8470)
5494410 
Bumps the python-type-checkers group with 1 update in the /python/packages/lab directory: [pyright](https://github.com/RobertCraigie/pyright-python).


Updates `pyright` from 1.1.411 to 1.1.414
- [Release notes](https://github.com/RobertCraigie/pyright-python/releases)
- [Commits](RobertCraigie/pyright-python@v1.1.411...v1.1.414)

---
updated-dependencies:
- dependency-name: pyright
  dependency-version: 1.1.414
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-type-checkers
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
Build(deps-dev): Bump uv (microsoft#8469)
fa359ab 
Bumps the basics group with 1 update in the /python/packages/lab directory: [uv](https://github.com/astral-sh/uv).


Updates `uv` from 0.12.9 to 0.12.12
- [Release notes](https://github.com/astral-sh/uv/releases)
- [Changelog](https://github.com/astral-sh/uv/blob/main/CHANGELOG.md)
- [Commits](astral-sh/uv@0.12.9...0.12.12)

---
updated-dependencies:
- dependency-name: uv
  dependency-version: 0.12.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: basics
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@eavanvalkenburg
Python: fix Cosmos memory retrieval compatibility (microsoft#8460)
a08534c
@eavanvalkenburg
ci: update Python dependencies across projects
2e06531
@eavanvalkenburg

eavanvalkenburg commented Sep 18, 2026

Copy link
Copy Markdown
Owner Author

Closing this fork-targeted PR because the change has been opened against microsoft/agent-framework instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@eavanvalkenburg @Lubaoshuai @FOWEPJF255 @SergeyMenshykh @westey-m @jpalvarezl @baywet @rogerbarreto