Skip to content

chore(deps): bump the pip group across 2 directories with 3 updates#13

Open
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/contributing/samples/authn-adk-all-in-one/pip-32b341076e
Open

chore(deps): bump the pip group across 2 directories with 3 updates#13
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/contributing/samples/authn-adk-all-in-one/pip-32b341076e

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 24, 2026

Bumps the pip group with 3 updates in the /contributing/samples/authn-adk-all-in-one directory: google-adk, python-dotenv and requests.
Bumps the pip group with 1 update in the /contributing/samples/authn-adk-all-in-one/adk_agents directory: google-adk.

Updates google-adk from 1.12 to 1.28.1

Release notes

Sourced from google-adk's releases.

v1.28.1

1.28.1 (2026-04-02)

Features

  • live: support live for gemini-3.1-flash-live-preview model (ee69661)

Bug Fixes

  • Disallow args on /builder and Add warning about Web UI usage to CLI help (f037f68)
  • live: Buffer tool calls and emit them together upon turn completion (081adbd)

v1.28.0

1.28.0 (2026-03-26)

Features

  • a2a: add lifespan parameter to to_a2a() (0f4c807), closes #4701
  • Add a new extension for the new version of ADK-A2A integration (6f0dcb3)
  • Add ability to run individual unit tests to unittests.sh (b3fcd8a)
  • Add database_role property to SpannerToolSettings and use it in execute_sql to support fine grained access controls (360e0f7)
  • Add index to events table and update dependencies (3153e6d), closes #4827
  • Add MultiTurn Task success metric (9a75c06)
  • Add MultiTurn Task trajectory and tool trajectory metrics (38bfb44)
  • Add slack integration to ADK (6909a16)
  • Add Spanner Admin Toolset (28618a8)
  • Add SSE streaming support to conformance tests (c910961)
  • Add support for Anthropic's thinking_blocks format in LiteLLM integration (fc45fa6), closes #4801
  • Add support for timeout to UnsafeLocalCodeExecutor (71d26ef)
  • auth: Integrate GCP IAM Connectors (Noop implementation) (78e5a90)
  • bigquery: Migrate 1P BQ Toolset (08be442) (7aa1f52) (d112131) (166ff99)
  • enable suppressing A2A experimental warnings (fdc2b43)
  • Enhance AgentEngineSandboxCodeExecutor sample to automatically provision an Agent Engine if neither agent_engine_resource_name nor sandbox_resource_name is provided (6c34694)
  • Extract and merge EventActions from A2A metadata (4b677e7), closes #3968
  • mcp: add sampling callback support for MCP sessions (8f82697)
  • Optional GCP project and credential for GCS access (2f90c1a)
  • Support new embedding model in files retrieval (faafac9)

Bug Fixes

  • add agent name validation to prevent arbitrary module imports (116f75d)
  • add protection for arbitrary module imports (995cd1c), closes #4947
  • Add read-only session support in DatabaseSessionService (f6ea58b), closes #4771
  • Allow snake case for skill name (b157276)
  • bigquery: use valid dataplex OAuth scope (4010716)
  • Default to ClusterIP so GKE deployment isn't publicly exposed by default (f7359e3)

... (truncated)

Changelog

Sourced from google-adk's changelog.

Changelog

1.31.0 (2026-04-16)

Features

  • Add "google-adk" user agent to Parameter Manager and Secret Manager clients (b8e8f6b)
  • Add support for memories.ingest_events in VertexAiMemoryBankService (d69477f)
  • Add Vertex AI Agent Engine Sandbox integration for computer use (7686848)
  • Firestore support (1a9df8f)
  • live: Add live_session_id to LlmResponse (bf84e2c)

Bug Fixes

  • Bump minimum mcp version from 1.23.0 to 1.24.0 (494c360)
  • cli: correct console URL path after adk deploy agent_engine (64ed1a6), closes #5336
  • execute on_event_callback before append_event to persist plugin modifications (454188d), closes #3990
  • make _EvalMetricResultWithInvocation.expected_invocation Optional for conversation_scenario support (#5215) (a4c9387)
  • Pass in auth headers with header provider instead of connection params (e12b0af)
  • populate required fields in FunctionDeclaration json_schema fallback (9b9faa4)
  • Resolve BigQuery plugin issues with A2A transfers, spans, and metadata (9ca8c38)
  • upgrade google-genai lower bound (8bc5728)

Code Refactoring

  • live: Use send_client_content to send conversation history (67dc2eb)
  • live: Use send_tool_response for function responses (70c5fc8)

Documentation

  • update MCP Toolbox branding, binary version, and asset references (47fa7b7)

1.30.0 (2026-04-13)

Features

  • Add Auth Provider support to agent registry (f2c68eb)
  • Add Parameter Manager integration to ADK (b0715d7)
  • Add support for Gemma 4 models in ADK (9d4ecbe), closes #5156
  • allow users to include artifacts from artifact_service in A2A events using provided interceptor (e63d991)
  • emit a TaskStatusUpdateEvent for ADK events with no output parts but with event.actions (dcc485b)
  • Live avatar support in ADK (a64a8e4)
  • live: expose live_session_resumption_update as Event in BaseLlmFlow (2626ad7), closes #4357
  • Promote BigQuery tools to Stable (abcf14c)
  • samples: add sample for skill activation via environment tools (2cbb523)

... (truncated)

Commits
  • 0d48362 chore(release/candidate): release 1.28.1 (#5121)
  • f037f68 fix: Disallow args on /builder and Add warning about Web UI usage to CLI help
  • 081adbd fix(live): Buffer tool calls and emit them together upon turn completion
  • ee69661 feat(live): support live for gemini-3.1-flash-live-preview model
  • 4e05efb chore: update last-release-sha for next release
  • c57d000 chore(release/candidate): release 1.28.0 (#5014)
  • 5020954 fix: Update list_agents to only list directories, not validate agent definitions
  • f7359e3 fix: Default to ClusterIP so GKE deployment isn't publicly exposed by default
  • ab9ae0f ADK changes
  • 08be442 feat(bigquery): Migrate 1P BQ Toolset
  • Additional commits viewable in compare view

Updates python-dotenv from 1.1.1 to 1.2.2

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

  • The dotenv run command now forwards flags directly to the specified command by @​bbc2 in theskumar/python-dotenv#607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Support for Python 3.9.

Fixed

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

New Contributors

Full Changelog: theskumar/python-dotenv@v1.2.1...v1.2.2

v1.2.1

What's Changed

... (truncated)

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

  • The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Dropped Support for Python 3.9.

Fixed

  • Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
  • Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

[1.2.1] - 2025-10-26

  • Move more config to pyproject.toml, removed setup.cfg
  • Add support for reading .env from FIFOs (Unix) by [@​sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

Commits

Updates requests from 2.32.4 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.
Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.
Commits
  • bc04dfd v2.33.0
  • 66d21cb Merge commit from fork
  • 8b9bc8f Move badges to top of README (#7293)
  • e331a28 Remove unused extraction call (#7292)
  • 753fd08 docs: fix FAQ grammar in httplib2 example
  • 774a0b8 docs(socks): same block as other sections
  • 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
  • ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
  • 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
  • d568f47 docs: clarify Quickstart POST example (#6960)
  • Additional commits viewable in compare view

Updates google-adk from 1.12 to 1.28.1

Release notes

Sourced from google-adk's releases.

v1.28.1

1.28.1 (2026-04-02)

Features

  • live: support live for gemini-3.1-flash-live-preview model (ee69661)

Bug Fixes

  • Disallow args on /builder and Add warning about Web UI usage to CLI help (f037f68)
  • live: Buffer tool calls and emit them together upon turn completion (081adbd)

v1.28.0

1.28.0 (2026-03-26)

Features

  • a2a: add lifespan parameter to to_a2a() (0f4c807), closes #4701
  • Add a new extension for the new version of ADK-A2A integration (6f0dcb3)
  • Add ability to run individual unit tests to unittests.sh (b3fcd8a)
  • Add database_role property to SpannerToolSettings and use it in execute_sql to support fine grained access controls (360e0f7)
  • Add index to events table and update dependencies (3153e6d), closes #4827
  • Add MultiTurn Task success metric (9a75c06)
  • Add MultiTurn Task trajectory and tool trajectory metrics (38bfb44)
  • Add slack integration to ADK (6909a16)
  • Add Spanner Admin Toolset (28618a8)
  • Add SSE streaming support to conformance tests (c910961)
  • Add support for Anthropic's thinking_blocks format in LiteLLM integration (fc45fa6), closes #4801
  • Add support for timeout to UnsafeLocalCodeExecutor (71d26ef)
  • auth: Integrate GCP IAM Connectors (Noop implementation) (78e5a90)
  • bigquery: Migrate 1P BQ Toolset (08be442) (7aa1f52) (d112131) (166ff99)
  • enable suppressing A2A experimental warnings (fdc2b43)
  • Enhance AgentEngineSandboxCodeExecutor sample to automatically provision an Agent Engine if neither agent_engine_resource_name nor sandbox_resource_name is provided (6c34694)
  • Extract and merge EventActions from A2A metadata (4b677e7), closes #3968
  • mcp: add sampling callback support for MCP sessions (8f82697)
  • Optional GCP project and credential for GCS access (2f90c1a)
  • Support new embedding model in files retrieval (faafac9)

Bug Fixes

  • add agent name validation to prevent arbitrary module imports (116f75d)
  • add protection for arbitrary module imports (995cd1c), closes #4947
  • Add read-only session support in DatabaseSessionService (f6ea58b), closes #4771
  • Allow snake case for skill name (b157276)
  • bigquery: use valid dataplex OAuth scope (4010716)
  • Default to ClusterIP so GKE deployment isn't publicly exposed by default (f7359e3)

... (truncated)

Changelog

Sourced from google-adk's changelog.

Changelog

1.31.0 (2026-04-16)

Features

  • Add "google-adk" user agent to Parameter Manager and Secret Manager clients (b8e8f6b)
  • Add support for memories.ingest_events in VertexAiMemoryBankService (d69477f)
  • Add Vertex AI Agent Engine Sandbox integration for computer use (7686848)
  • Firestore support (1a9df8f)
  • live: Add live_session_id to LlmResponse (bf84e2c)

Bug Fixes

  • Bump minimum mcp version from 1.23.0 to 1.24.0 (494c360)
  • cli: correct console URL path after adk deploy agent_engine (64ed1a6), closes #5336
  • execute on_event_callback before append_event to persist plugin modifications (454188d), closes #3990
  • make _EvalMetricResultWithInvocation.expected_invocation Optional for conversation_scenario support (#5215) (a4c9387)
  • Pass in auth headers with header provider instead of connection params (e12b0af)
  • populate required fields in FunctionDeclaration json_schema fallback (9b9faa4)
  • Resolve BigQuery plugin issues with A2A transfers, spans, and metadata (9ca8c38)
  • upgrade google-genai lower bound (8bc5728)

Code Refactoring

  • live: Use send_client_content to send conversation history (67dc2eb)
  • live: Use send_tool_response for function responses (70c5fc8)

Documentation

  • update MCP Toolbox branding, binary version, and asset references (47fa7b7)

1.30.0 (2026-04-13)

Features

  • Add Auth Provider support to agent registry (f2c68eb)
  • Add Parameter Manager integration to ADK (b0715d7)
  • Add support for Gemma 4 models in ADK (9d4ecbe), closes #5156
  • allow users to include artifacts from artifact_service in A2A events using provided interceptor (e63d991)
  • emit a TaskStatusUpdateEvent for ADK events with no output parts but with event.actions (dcc485b)
  • Live avatar support in ADK (a64a8e4)
  • live: expose live_session_resumption_update as Event in BaseLlmFlow (2626ad7), closes #4357
  • Promote BigQuery tools to Stable (abcf14c)
  • samples: add sample for skill activation via environment tools (2cbb523)

... (truncated)

Commits
  • 0d48362 chore(release/candidate): release 1.28.1 (#5121)
  • f037f68 fix: Disallow args on /builder and Add warning about Web UI usage to CLI help
  • 081adbd fix(live): Buffer tool calls and emit them together upon turn completion
  • ee69661 feat(live): support live for gemini-3.1-flash-live-preview model
  • 4e05efb chore: update last-release-sha for next release
  • c57d000 chore(release/candidate): release 1.28.0 (#5014)
  • 5020954 fix: Update list_agents to only list directories, not validate agent definitions
  • f7359e3 fix: Default to ClusterIP so GKE deployment isn't publicly exposed by default
  • ab9ae0f ADK changes
  • 08be442 feat(bigquery): Migrate 1P BQ Toolset
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump the pip group across 2 directories with 3 updates
6fd7c1b 
Bumps the pip group with 3 updates in the /contributing/samples/authn-adk-all-in-one directory: [google-adk](https://github.com/google/adk-python), [python-dotenv](https://github.com/theskumar/python-dotenv) and [requests](https://github.com/psf/requests).
Bumps the pip group with 1 update in the /contributing/samples/authn-adk-all-in-one/adk_agents directory: [google-adk](https://github.com/google/adk-python).


Updates `google-adk` from 1.12 to 1.28.1
- [Release notes](https://github.com/google/adk-python/releases)
- [Changelog](https://github.com/google/adk-python/blob/main/CHANGELOG.md)
- [Commits](google/adk-python@v1.12.0...v1.28.1)

Updates `python-dotenv` from 1.1.1 to 1.2.2
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.1.1...v1.2.2)

Updates `requests` from 2.32.4 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.4...v2.33.0)

Updates `google-adk` from 1.12 to 1.28.1
- [Release notes](https://github.com/google/adk-python/releases)
- [Changelog](https://github.com/google/adk-python/blob/main/CHANGELOG.md)
- [Commits](google/adk-python@v1.12.0...v1.28.1)

---
updated-dependencies:
- dependency-name: google-adk
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: python-dotenv
  dependency-version: 1.2.2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: google-adk
  dependency-version: 1.28.1
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants