[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
@modelcontextprotocol/sdk (source)	dependencies	patch	1.32.0 → 1.32.2
a2a-sdk (changelog)		minor	==1.2.1 → ==1.3.0
fastapi (changelog)		patch	==0.162.0 → ==0.162.4
indykite/agent-gateway		minor	2.0.3 → 2.70.2
langchain-core (changelog)		minor	==1.6.6 → ==1.7.7
langchain-google-genai (source, changelog)		patch	==4.4.0 → ==4.4.3
mcp		minor	==2.2.0 → ==2.3.0
nginx (source)		minor	1.29-alpine → 1.31-alpine
pdfjs-dist (source)	dependencies	minor	6.3.289 → 6.5.438
python (source)	final	minor	3.13-slim → 3.15-slim
python (source)	final	minor	3.14-slim → 3.15-slim
python-multipart (changelog)		patch	==0.0.31 → ==0.0.33

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.32.2

Compare Source

What's Changed

• fix: add explicit | undefined to Transport optional properties (v1.x backport of #​1766) by @​kishormorol in #​2814
• [v1.x] fix: allow registering after connect() when the capability was declared by @​claude[bot] in #​2958
• chore: bump version to 1.32.2 by @​claude[bot] in #​3089

New Contributors

• @​kishormorol made their first contribution in #​2814

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.1...1.32.2

v1.32.1

Compare Source

What's Changed

• [v1.x] docs: state the principles in CLAUDE.md by @​claude[bot] in #​2939
• [v1.x] docs: point the README at v2 and say what v1.x supports by @​claude[bot] in #​2942
• chore: bump version to 1.32.1 by @​claude[bot] in #​2954

Full Changelog: modelcontextprotocol/typescript-sdk@1.32.0...1.32.1

a2aproject/a2a-python (a2a-sdk)

v1.3.0

Compare Source

Features

• server: release parked interrupted tasks after a configurable timeout (#​1338) (b22a68d)

Bug Fixes

• client: Create separate httpx per client when none configured (#​1358) (d316d0e)
• client: raise A2A errors for malformed JSON-RPC responses (#​1375) (7e55413)
• client: rejections from unrecognized fields (#​1354) (91929cd)
• compat: keep an unset v0.3 status message and provider as None (#​1362) (cdb4799), closes #​1361
• compat: return A2A error codes from the v0.3 JSON-RPC adapter (#​1369) (8e32d53)
• compat: set last_updated when storing a task in v0.3 format (#​1372) (30b6d50), closes #​1371
• core: restore structured repr on A2A exceptions (#​1348) (79a6f45)
• server: allow recovery after status event validation fails (#​1365) (ca3ef0d)
• server: apply history_length to legacy streaming sends (#​1364) (261c074)
• server: include legacy task states in database list filters (#​1337) (e12d494)
• server: record executor failures through the event consumer (#​1366) (ad85806)
• server: reject boolean JSON-RPC request IDs (#​1350) (05392b3)
• skip malformed agent card signature headers (#​1335) (b21a144)

Documentation

• helpers: note that whole numbers in a data Part come back as floats (#​1373) (654774f)

Miscellaneous Chores

• release 1.3.0 (#​1389) (fb6373f)

v1.2.3

Compare Source

Bug Fixes

• client: ignore the patch version when preferring a 1.0 interface (#​1304) (cbb2d84)
• client: normalize malformed agent card parsing errors (#​1307) (486f0f6)
• compat: block on a v0.3 gRPC and REST send without configuration (#​1334) (8160310), closes #​1321
• compat: treat a v0.3 history_length of 0 as unlimited in JSON-RPC and REST (#​1312) (e86695c)
• jcs: count open containers for the nesting bound, so an empty container leaf is refused (#​1294) (5653daf)
• server: isolate push notification failures from the task lifecycle (#​1329) (0ee47d7)
• server: mark internal lifecycle events done so a cancelled stream frees its producer (#​1336) (a4c4fc9)
• server: reject push URLs in shared address space (#​1326) (01da00b)
• server: release the ActiveTask after a direct Message response (#​1297) (49ebce6)
• server: run follow-up messages in the sender's contextvars (#​1317) (a016002)
• server: warn when an AgentCard is missing required fields (#​1279) (4f4101c)
• telemetry: let trace_function alone decide a span's status (#​1309) (59dcbfb)

v1.2.2

Compare Source

Features

• allow configuring SSE shutdown grace periods (#​1222) (6ff0a82)

Bug Fixes

• client: handle REST error bodies that are not a google.rpc.Status (#​1300) (ee61dc1)
• compat: keep timestamp and three other fields in v0.3 gRPC conversion (#​1277) (fad0482), closes #​1276
• compat: treat an unset v0.3 history_length as unlimited (#​1306) (21fe836), closes #​1305
• server: name the task state in terminal-state errors (#​1302) (fdca1d0)
• server: return the stored id when creating a push notification config (#​1236) (dac7d9d), closes #​1237
• server: stop printing a traceback to stderr for malformed JSON-RPC bodies (#​1301) (5a1a004)

fastapi/fastapi (fastapi)

v0.162.4

Compare Source

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Fixes

• 🐛 Require AnyIO 4.1.0 or newer at runtime. PR #​16730 by @​tiangolo.

v0.162.3

Compare Source

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Upgrades

• ⬆️ Add support for Python 3.15. PR #​16727 by @​tiangolo.
• ⬆️ Update locked Pydantic to 2.14.3. PR #​16728 by @​tiangolo.
• ⬆️ Upgrade markdown-include-variants to 0.0.10. PR #​16705 by @​tiangolo.

Docs

• 📝 Adopt unversioned snippets and _non_an variants. PR #​16707 by @​tiangolo.
• 🎨 Use the Zensical modern theme for docs. PR #​16701 by @​tiangolo.
• 🐛 Fix AI coding agent notice links in previews. PR #​16700 by @​tiangolo.
• 📝 Add an AI coding agent notice to the docs. PR #​16699 by @​tiangolo.

Translations

• 🌐 Update Traditional Chinese translations. PR #​16719 by @​tiangolo.
• 🌐 Update Chinese translations. PR #​16718 by @​tiangolo.
• 🌐 Update Ukrainian translations. PR #​16717 by @​tiangolo.
• 🌐 Update Turkish translations. PR #​16716 by @​tiangolo.
• 🌐 Update Russian translations. PR #​16715 by @​tiangolo.
• 🌐 Update Portuguese translations. PR #​16714 by @​tiangolo.
• 🌐 Update Korean translations. PR #​16713 by @​tiangolo.
• 🌐 Update Japanese translations. PR #​16712 by @​tiangolo.
• 🌐 Update Hindi translations. PR #​16711 by @​tiangolo.
• 🌐 Update French translations. PR #​16710 by @​tiangolo.
• 🌐 Update Spanish translations. PR #​16709 by @​tiangolo.
• 🌐 Update German translations. PR #​16708 by @​tiangolo.
• 🌐 Update Korean translations to match the English docs. PR #​16706 by @​tiangolo.

Internal

• 🔥 Remove obsolete docs snippet commands. PR #​16724 by @​tiangolo.
• 🐛 Preserve snippet variants when cleaning up docs sources. PR #​16722 by @​tiangolo.

v0.162.2

Compare Source

FastAPI includes an official skill that helps coding agents use new features and recommended patterns for your installed version. Install it with uvx library-skills in your project. See Develop with AI.

Docs

• 📝 Add FastAPI Cloud guidance to the FastAPI skill. PR #​16697 by @​tiangolo.
• 📝 Add guidance for developing FastAPI apps with AI. PR #​16695 by @​tiangolo.

Internal

• 🔧 Add an agent skills note to GitHub releases. PR #​16696 by @​tiangolo.

v0.162.1

Compare Source

Docs

• 📝 Add parameter model guidance to the FastAPI skill. PR #​16693 by @​tiangolo.

Translations

• 🌐 Update translations for zh-hant (update-outdated). PR #​16654 by @​pr-submit[bot].
• 🌐 Update translations for uk (update-outdated). PR #​16655 by @​pr-submit[bot].
• 🌐 Update translations for de (update-outdated). PR #​16652 by @​pr-submit[bot].
• 🌐 Update translations for pt (update-outdated). PR #​16653 by @​pr-submit[bot].
• 🌐 Update translations for fr (update-outdated). PR #​16649 by @​pr-submit[bot].
• 🌐 Update translations for tr (update-outdated). PR #​16651 by @​pr-submit[bot].
• 🌐 Update translations for ja (update-outdated). PR #​16648 by @​pr-submit[bot].
• 🌐 Update translations for zh (update-outdated). PR #​16644 by @​pr-submit[bot].
• 🌐 Update translations for hi (update-outdated). PR #​16647 by @​pr-submit[bot].
• 🌐 Update translations for es (update-outdated). PR #​16645 by @​pr-submit[bot].
• 🌐 Update translations for ru (update-outdated). PR #​16650 by @​pr-submit[bot].

Internal

• ⬆️ Bump pillow to 13.0.0 and dnspython to 2.9.2. PR #​16685 by @​YuriiMotov.
• 📝 Update FastAPI Cloud docs banner for general availability. PR #​16684 by @​tiangolo.
• 🔧 Update sponsors: add Encore. PR #​16683 by @​tiangolo.
• 🔥 Remove conference rail component and related styles. PR #​16679 by @​alejsdev.
• 👥 Update FastAPI People - Sponsors. PR #​16656 by @​pr-submit[bot].
• 👥 Update FastAPI GitHub topic repositories. PR #​16660 by @​pr-submit[bot].
• ⬆ Bump the github-actions group with 7 updates. PR #​16658 by @​dependabot[bot].
• ⬆ Bump pre-commit hooks. PR #​16659 by @​pr-submit[bot].
• ⬆ Bump authlib from 1.7.2 to 1.9.1. PR #​16637 by @​dependabot[bot].
• 🔧 Update sponsors: add MicroAuth. PR #​16641 by @​tiangolo.
• 🔧 Pin pytest below 9.2 for pytest-xdist compatibility. PR #​16642 by @​tiangolo.
• ⬆ Bump graphql-core from 3.2.7 to 3.3.1. PR #​16613 by @​dependabot[bot].
• ⬆ Bump black from 26.5.1 to 26.10.1. PR #​16611 by @​dependabot[bot].
• ⬆ Bump gitpython from 3.1.62 to 3.2.1. PR #​16612 by @​dependabot[bot].
• ⬆ Bump opentelemetry-api from 1.44.0 to 1.45.1. PR #​16610 by @​dependabot[bot].

modelcontextprotocol/python-sdk (mcp)

v2.3.0

Compare Source

pip install -U mcp. Docs: https://py.sdk.modelcontextprotocol.io/

Mostly fixes, plus three new options. A few things behave differently, so skim these first:

Behaviour changes

httpx2>=2.10.0 is now required (#​3600)

• It was >=2.5.0. The new max_sse_event_size option needs it.
• Nothing to do unless you pin httpx2 below 2.10.

A tool with an invalid x-mcp-header annotation fails at registration (#​3620)

• @mcp.tool(), add_tool and Tool.from_function raise InvalidSignature, naming the tool and the problem.
• Until now the server started, and 2026-07-28 clients silently dropped the tool from their listing.
• Refused: anything other than a plain str, int or bool parameter (so also str | None, float, lists and enums), a header name that isn't a valid token, and two names that differ only by case.
• For an optional header parameter, give the schema directly: Annotated[str | None, WithJsonSchema({"type": "string", "x-mcp-header": "Region"})] = None.

Empty _meta and params are no longer sent (#​3628)

• On 2025-11-25 and earlier connections, 2.x sent "_meta": {} on every request. Some servers reject that. It is now left out, as in v1.
• ping and list requests without a cursor go out with no params member.
• On the receiving side ctx.meta is None rather than {}, and middleware sees ctx.params as None for a request without params.
• 2026-07-28 connections are unchanged.

initialize leaves out experimental when none is configured (#​3614)

• It used to send "experimental": {}. server/discover already left it out.
• Client code reading capabilities.experimental on a legacy connection should handle None.

Mcp-Param-* validation looks the tool up by name (#​3630)

• MCPServer no longer runs tools/list for every tools/call, so middleware no longer sees that extra request.
• The registered schema is what gets checked. Middleware that filters or rewrites tools/list no longer affects it.

An interactive OAuth login no longer counts against request timeouts (#​3635)

• The timeout pauses while OAuthClientProvider waits on redirect_handler and callback_handler.
• This fixes Client(mode="auto") settling on 2025-11-25 when the login took longer than 10 seconds.
• A request timeout no longer ends a login nobody finishes. Put a limit inside callback_handler if you need one.

New

• max_sse_event_size= on streamable_http_client and StreamableHttpParameters. The default stays 1 MiB per SSE event; raise it, or pass None, for larger tool results (#​3600).
• MCPServer(subscriptions=False) stops serving subscriptions/listen and advertises listChanged and subscribe as false (#​3626).
• Server(get_tool_input_schema=...) lets a low-level server supply a tool's schema for header validation without running its tools/list handler (#​3630).
• Client.call_tool re-lists the tools and retries once after a HeaderMismatch (-32020) rejection (#​3627).

Fixes

• ctx: Context[AppState] works on prompts and resource templates, not only on tools (#​3624).
• An explicit "structuredContent": null is checked against the output schema instead of being treated as missing (#​3621).
• A progress_callback that raises no longer fails the call on an in-process Client(server) (#​3623).
• Client OpenTelemetry spans record JSON-RPC error responses. With mode="auto", connecting to a server without server/discover now shows one ERROR span for the probe (#​3629).
• stdio_client resolves the executable off the event loop on Windows (#​3510).

Docs

• New pages: Cancellation and Header parameters, plus a middleware tutorial.
• All twelve translations are refreshed (#​3636).

What's Changed

• Detect event-loop blocking in tests by @​Kludex in #​3510
• Bump httpcore2 from 2.5.0 to 2.10.0 by @​dependabot[bot] in #​3482
• Ask cubic for a review when the intake gate lets a PR back in by @​maxisbey in #​3489
• docs: remove v2 notice from top of README by @​claude[bot] in #​3604
• Bump anyio from 4.10.0 to 4.14.2 by @​dependabot[bot] in #​3547
• Make the deeply nested body test independent of stack size by @​maxisbey in #​3610
• Fall back to an NTFS junction when the symlink escape test can't create a symlink by @​maxisbey in #​3609
• Group Dependabot security updates for uv dependencies by @​Kludex in #​3611
• Expose an SSE event size limit in Streamable HTTP clients by @​Kludex in #​3600
• Bump the github-actions group with 5 updates by @​dependabot[bot] in #​3612
• docs: add a middleware tutorial that refuses tool calls by @​maxisbey in #​3613
• Omit an unset experimental capability from the initialize result by @​maxisbey in #​3614
• Document when a caller-supplied request id can be minted again by @​maxisbey in #​3619
• Document the timeout a hand-built httpx2 client needs by @​maxisbey in #​3618
• Reject a tool with an invalid x-mcp-header annotation at registration by @​maxisbey in #​3620
• Validate an explicit null structuredContent against the output schema by @​maxisbey in #​3621
• Contain a raising progress callback on the in-process dispatcher by @​maxisbey in #​3623
• Keep the live Context when a prompt or template annotates Context[T] by @​maxisbey in #​3624
• Describe the ID-JAG confidential-client rule as SDK policy, not a SEP-990 requirement by @​maxisbey in #​3622
• Let MCPServer opt out of serving subscriptions/listen by @​maxisbey in #​3626
• Document how a handler deals with cancellation by @​maxisbey in #​3625
• Omit an empty _meta and empty params from outbound requests by @​maxisbey in #​3628
• Record JSON-RPC error responses on the client OpenTelemetry span by @​maxisbey in #​3629
• Retry a tool call once after a HeaderMismatch rejection by @​maxisbey in #​3627
• Look the tool schema up by name for Mcp-Param-* validation instead of running tools/list by @​maxisbey in #​3630
• Bump urllib3 from 2.7.0 to 2.8.0 by @​dependabot[bot] in #​3607
• Let a newer Deploy Docs run cancel the one in progress by @​maxisbey in #​3633
• Link What's new to the Header parameters page by @​maxisbey in #​3632
• Keep inline-snapshot disabled when pytest runs in a terminal by @​maxisbey in #​3634
• Stop counting an interactive OAuth login against request timeouts by @​maxisbey in #​3635
• docs: refresh translations for recent English changes by @​maxisbey in #​3636

Full Changelog: modelcontextprotocol/python-sdk@v2.2.0...v2.3.0

mozilla/pdf.js (pdfjs-dist)

v6.5.438

Compare Source

This release contains improvements for accessibility, annotation editing, annotation rendering, font conversion, image conversion, performance, scripting, tiling pattern rendering and the viewer.

Changes since v6.4.299

• Bump the stable version in pdfjs.config by @​timvandermeij in #​22066
• Fix a few edge cases when converting RGB images in convertRGBToRGBA and ImageResizer by @​calixteman in #​22046
• Directly call Set.prototype.delete in the ChunkedStreamManager code by @​Snuffleupagus in #​22065
• Don't stop at the first broken /Kids entry in Catalog.getAllPageDicts (issue 22011) by @​xjtu-ctgg in #​22013
• Keep the sign of negative numbers greater than -1 in util.printf by @​kwy404 in #​22017
• Downscale large images without a full-size RGBA buffer by @​calixteman in #​22067
• Create the LIGATURE_TO_UNICODE Map only once by @​Snuffleupagus in #​22068
• Replace gulp-replace with transform for the Chromium manifest by @​calixteman in #​22072
• [api-minor] Don't re-layout the textLayer on update (PR 20492 follow-up) by @​Snuffleupagus in #​22045
• Bump library version to 6.5 by @​Snuffleupagus in #​22073
• Remove the explicit gulp-cli dependency by @​calixteman in #​22077
• Replace ttest with a local Welch's t-test by @​calixteman in #​22075
• Add a reference test for issue 7802 by @​Snuffleupagus in #​22074
• Replace webpack-stream with the Webpack API by @​calixteman in #​22070
• Match the whole string in the getCharUnicodeCategory regular expression (issue 21890) by @​Om-singhaI in #​21960
• Add pull request viewer previews by @​calixteman in #​22090
• [api-minor] Offload canvas drawing operations to a worker by @​Aditi-1400 in #​21860
• Check preview deployment before posting links by @​calixteman in #​22093
• Bump source-map-js from 1.2.1 to 1.2.2 by @​dependabot[bot] in #​22091
• Bump github/codeql-action/init from 4.38.1 to 4.38.2 by @​dependabot[bot] in #​22084
• Bump github/codeql-action/analyze from 4.38.1 to 4.38.2 by @​dependabot[bot] in #​22085
• Bump github/codeql-action/autobuild from 4.38.1 to 4.38.2 by @​dependabot[bot] in #​22086
• Ensure that errors in the Optional Content won't prevent all rendering by @​Snuffleupagus in #​22082
• Replace Metalsmith with a docs gulp task by @​calixteman in #​22081
• Don't swallow postMessage errors when replying to sendWithPromise messages (issue 22079) by @​Snuffleupagus in #​22080
• Collect renderer worker coverage by @​calixteman in #​22094
• Extract viewer preview checks and preparation into scripts by @​calixteman in #​22095
• Use CharCodeMap for font character mappings (bug 2077176) by @​calixteman in #​22092
• Ensure that the RendererWorker version matches the API version, and reduce the size of the built pdf.renderer.mjs file (PR 21860 follow-up) by @​Snuffleupagus in #​22097
• Fix the DOMCanvasFactory import in the new debugger (PR 22097 follow-up) by @​Snuffleupagus in #​22098
• Resolve PDF.js aliases when linting imports by @​calixteman in #​22099
• A couple of RendererWorker improvements (PR 21860 follow-up) by @​Snuffleupagus in #​22103
• Move renderer worker support out of api.js (PR 21860 follow-up) by @​calixteman in #​22105
• Always check if crypto.randomUUID is available in the getUuid helper (issue 22107) by @​Snuffleupagus in #​22108
• Split the src/display/display_utils.js file into multiple ones (PR 21860 follow-up) by @​Snuffleupagus in #​22101
• Reduce duplication in the type1FontGlyphMapping function by [@&ci: SAST & linting #8

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​pdfjs-dist@​6.3.289 ⏵ 6.5.438	-4		+1	+2
	pypi/​langchain-core@​1.6.6 ⏵ 1.7.7	+1
	npm/​@​modelcontextprotocol/​sdk@​1.32.0 ⏵ 1.32.2	+1
	pypi/​mcp@​2.2.0 ⏵ 2.3.0	+1
	pypi/​langchain-google-genai@​4.4.0 ⏵ 4.4.3
	pypi/​a2a-sdk@​1.2.1 ⏵ 1.3.0	+1

View full report

[socket-security]

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

[deepsource-io]

DeepSource Code Review

We reviewed changes in 13d64df...40d012f on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Nov 10, 2026 11:23p.m.	Review ↗
Python		Nov 10, 2026 11:23p.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[cowan-macady]

DO NOT MERGE: need to be tested manually

[Copilot]

🔵 Needs a closer look

The Python 3.15 migration spans 15 containers with native dependencies, and compatibility remains unverified without container builds and A2A/MCP smoke tests.

No open issues 🎉

What changed in this PR

This PR refreshes dependencies and container images across the intent-agent, IAG MCP, and IAG token-exchange demos without changing application logic.

Changes:

• Updates Python dependencies, including A2A SDK, MCP, Google GenAI integration, and Pydantic packages.
• Updates the JavaScript MCP SDK and PDF.js dependencies in both Drive MCP services.
• Moves affected Python containers to 3.15-slim and the intent balancer to nginx 1.31-alpine, with updated digest pins.

File	Description
a2a/​intent-agent-demo/​docker-compose.yaml	Updates nginx image and digest.
a2a/​intent-agent-demo/​console/​requirements.txt	Updates Pydantic and pydantic-settings.
a2a/​intent-agent-demo/​console/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​weather_agent/​requirements.txt	Updates A2A SDK and MCP.
a2a/​iag-token-exchange/​weather_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​retriever_agent/​requirements.txt	Updates A2A SDK, Google GenAI, and MCP.
a2a/​iag-token-exchange/​retriever_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​orchestrator_agent/​requirements.txt	Updates A2A SDK and Google GenAI.
a2a/​iag-token-exchange/​orchestrator_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​erp_mcp/​requirements.txt	Updates MCP.
a2a/​iag-token-exchange/​erp_mcp/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​drive_mcp/​vendor/​package.json	Updates JavaScript MCP SDK and PDF.js.
a2a/​iag-token-exchange/​crm_agent/​requirements.txt	Updates A2A SDK.
a2a/​iag-token-exchange/​crm_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​chatbot/​requirements.txt	Updates A2A SDK.
a2a/​iag-token-exchange/​chatbot/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-token-exchange/​analyst_agent/​requirements.txt	Updates A2A SDK, Google GenAI, and MCP.
a2a/​iag-token-exchange/​analyst_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​weather_agent/​requirements.txt	Updates A2A SDK and MCP.
a2a/​iag-mcp-demo/​weather_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​retriever_agent/​requirements.txt	Updates A2A SDK, Google GenAI, and MCP.
a2a/​iag-mcp-demo/​retriever_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​orchestrator_agent/​requirements.txt	Updates A2A SDK and Google GenAI.
a2a/​iag-mcp-demo/​orchestrator_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​erp_mcp/​requirements.txt	Updates MCP.
a2a/​iag-mcp-demo/​erp_mcp/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​drive_mcp/​vendor/​package.json	Updates JavaScript MCP SDK and PDF.js.
a2a/​iag-mcp-demo/​crm_agent/​requirements.txt	Updates A2A SDK.
a2a/​iag-mcp-demo/​crm_agent/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​chatbot/​requirements.txt	Updates A2A SDK.
a2a/​iag-mcp-demo/​chatbot/​Dockerfile	Updates Python image to 3.15-slim.
a2a/​iag-mcp-demo/​analyst_agent/​requirements.txt	Updates A2A SDK, Google GenAI, and MCP.
a2a/​iag-mcp-demo/​analyst_agent/​Dockerfile	Updates Python image to 3.15-slim.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Python 3.15 upgrade spans 15 container images, and native-dependency and A2A/MCP compatibility remain unverified without container builds and smoke tests.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Python 3.15 migration and coordinated SDK upgrades span 24 service images, whose runtime compatibility requires container-build and cross-service smoke validation unavailable in this review environment.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Python 3.15 migration across 24 container builds and coordinated dependency upgrades leave runtime compatibility unverified, with only pre-commit CI evidence and no container-build or end-to-end integration validation.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Python 3.15 migration across 24 containers and A2A/MCP dependency changes require unavailable container builds and integration smoke tests to verify native-dependency and protocol compatibility.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Python 3.15 migration spans multiple service images with native dependencies, and compatibility requires container builds and A2A/MCP smoke tests unavailable in this review environment.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The cross-service Python 3.15 migration and A2A/MCP upgrades require container builds and end-to-end validation to confirm dependency compatibility and runtime behavior, but those checks could not be performed in this review environment.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The cross-service Python 3.15 and A2A/MCP SDK upgrades require container-build and end-to-end validation of dependency compatibility and runtime behavior that this offline, source-only review cannot provide.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Migrating 27 service images to Python 3.15 requires build and startup/integration smoke-test evidence to verify grpcio and psycopg compatibility, which is unavailable in this source-only review.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The Python 3.15 rollout and Agent Gateway 2.0.3→2.70.2 upgrade require container and authorization-flow compatibility validation that the offline snapshot and supplied release notes cannot establish.

2 open issues

• Update sample env override to the pinned intent-agent image
• Update sample env override to the new intent-agent image

_{Review effort: Balanced}