[Eduard van Valkenburg (eavanvalkenburg)]

Motivation & Context

Consolidate the 13 Python Dependabot PRs into one dependency update. Resolve overlapping manifest and lockfile edits together, and keep the standalone Lab environment on a supported dependency combination.

Description & Review Guide

• What are the major changes? Update FastAPI to 0.162.0, azure-ai-projects to 2.9.0, pydantic-monty and its runtime/client to 1.4.0, pytest-asyncio to 1.4.1, Ruff to 0.17.3, and ty to 0.0.92. Update Lab's uv pin to 0.13.6 and released agent-framework-core lock entry to 1.23.0. Refresh both independent uv lockfiles. Include two import-spacing fixes required by Ruff in the Monty tests. Raise the Monty minimum to 1.0, as agreed during review, and preserve the documented max_duration_secs configuration by translating it to max_feed_duration_secs. Add local real-runtime regression tests to the default unit suite and update package and consumer-skill documentation.
• What is the impact of these changes? Runtime upper bounds accept the new versions. Monty now requires pydantic-monty>=1.0,<1.5; other dependency lower bounds are unchanged. Existing Monty duration configurations remain valid. Supplying both legacy max_duration_secs and canonical max_feed_duration_secs is rejected as ambiguous; caller configuration and serialized state remain unchanged. Root uv remains pinned to 0.13.5. Lab uses LiteLLM 1.108.0 with huggingface-hub 1.33.0. LiteLLM requires huggingface-hub >=0.34.0,<2.0, so the proposed huggingface-hub 2.3.0 upgrade is incompatible. Following the maintainer's direction, this PR selects the newest supported combination instead. This shared lockfile does not constrain consumers installing only the GAIA extra: its published huggingface-hub requirement has no upper bound. LiteLLM enterprise/proxy extras advance with LiteLLM.
• What do you want reviewers to focus on? The dependency bounds, regenerated lockfiles, Monty timeout compatibility, and Lab compatibility decision. All affected package unit suites and Pyright checks pass. Monty's full local suite also passes against both 1.0.0 and 1.4.0. External-service integration tests, the full workspace test suite, and exhaustive dependency-bound matrices were not run.

Checks run (from the repository root unless noted):

• uv lock --directory python --check and uv lock --directory python/packages/lab --check: passed.

• uv run --directory python --frozen --no-sync pytest packages/monty/tests: passed, 261 tests and 2 skipped, on Monty 1.4.0. This includes the existing local integration tests and 10 new default-suite runtime regressions covering successful execution, actual timeout enforcement, legacy/canonical keys, unchanged caller configuration, and ambiguous settings.

• uv run --directory python --frozen --no-sync --with pydantic-monty==1.0.0 python - with the following stdin: passed, 261 tests and 2 skipped on the new lower bound.

  import sys
  from importlib.metadata import version
  import pytest
  print('pydantic-monty:', version('pydantic-monty'))
  assert version('pydantic-monty') == '1.0.0'
  sys.exit(pytest.main(['packages/monty/tests']))
  

• From python/, uv run --frozen poe test -P foundry: passed, 516 tests; uv run --frozen poe test -P ag-ui: passed, 1,780 tests; uv run --frozen poe test -P devui: passed, 235 tests; uv run --frozen poe test -P hosting-responses: passed, 152 tests.

• uv run --directory python/packages/lab --frozen --no-sync poe test: passed, 43 tests.

• From python/, for package in monty foundry ag-ui devui hosting-responses; do uv run --frozen poe syntax -P "$package" -C && uv run --frozen poe pyright -P "$package"; done: passed. Ruff applied the two import-spacing fixes; all five Pyright runs reported zero errors or warnings.

• After the review fix, uv run --directory python --frozen poe syntax -P monty and uv run --directory python --frozen poe pyright -P monty: passed.

• uv run --directory python/packages/lab --frozen --no-sync poe pyright: passed, zero errors or warnings.

• for package in monty foundry ag-ui devui hosting-responses; do uv build --directory python --package "agent-framework-$package" --quiet || exit; done && uv build --directory python/packages/lab --quiet: passed. uv build --directory python --package agent-framework-monty --quiet also passed after the review fix.

• git diff --check: passed before both commits.

• Initial direct aggregate pytest command, uv run --directory python --frozen --no-sync pytest --import-mode=importlib -m 'not integration' packages/monty/tests packages/foundry/tests packages/ag-ui/tests packages/devui/tests packages/hosting-responses/tests, failed with 14 cross-package AG-UI conftest import collisions. The isolated package commands above all passed; no test behavior was changed to address that invocation issue. Initial new timeout assertions were too specific for Monty's feed/turn error messages; corrected scope-specific assertions pass on both supported versions.

Related Issue

N/A - repository automation. Consolidates the scheduled Python pip/uv Dependabot updates configured in .github/dependabot.yml, at the maintainer's request.

Supersedes #10049, #10050, #10051, #10052, #10053, #10054, #10055, #10056, #10057, #10058, #10059, #10060, and #10061. Unlike the independent source PRs, this PR resolves all overlapping updates together and keeps Lab's LiteLLM/huggingface-hub combination compatible. All 13 source PRs have been closed with links to this replacement.

AI Assistance

• No material AI assistance was used.
• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: Copilot consolidated dependency changes, resolved the Lab dependency conflict, implemented Monty duration compatibility and regression tests, updated documentation, regenerated lockfiles, ran package checks, and drafted this PR description.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-code-quality]

Code coverage overview

Languages: Python

Python / code-coverage/python

main ad15f10	python-dependency-co... c488c1c	+/-
92%	92%	0%

View coverage of the 1 most impacted file.

File	main ad15f10	python-dependency-co... c488c1c	+/-
packages/monty/...monty_bridge.py	76%	77%	+1%

ℹ️ Calculations represent line coverage. Results may change as calculations are updated.

---

_{Updated November 04, 2026 15:12 UTC}

[Copilot]

🟡 Changes recommended

The Monty upgrade breaks executions using the documented max_duration_secs option because 1.4.0 rejects the unchanged key, requiring compatible limit handling with a real-runtime regression test or deferring the upgrade and regenerating the lockfile.

1 open issue

• Upgrade breaks executions using the documented max_duration_secs limit · New

What changed in this PR

Consolidates 13 Python Dependabot updates into one coordinated dependency refresh for the Agent Framework workspace and standalone Lab environment.

Changes:

• Widens FastAPI, Azure AI Projects, and Monty dependency bounds and refreshes both lockfiles.
• Updates development tools and Lab’s Core/LiteLLM dependencies while retaining a compatible Hugging Face Hub version.
• Adds two import-spacing fixes in Monty tests without changing test behavior.

File	Description
python/​uv.lock	Refreshes workspace dependency versions and metadata.
python/​tooling/​requirements-typing.txt	Updates ty to 0.0.92.
python/​tooling/​requirements-quality.txt	Updates Ruff to 0.17.3.
python/​pyproject.toml	Updates pytest-asyncio; retains the root uv pin.
python/​packages/​monty/​tests/​monty/​test_monty_codeact.py	Adjusts import spacing only.
python/​packages/​monty/​tests/​monty/​test_monty_codeact_integration.py	Adjusts import spacing only.
python/​packages/​monty/​pyproject.toml	Allows Monty versions through 1.4.x.
python/​packages/​lab/​uv.lock	Refreshes Lab dependencies, including Core and LiteLLM.
python/​packages/​lab/​pyproject.toml	Updates uv, Ruff, and pytest-asyncio pins.
python/​packages/​hosting-responses/​pyproject.toml	Widens the FastAPI test dependency bound.
python/​packages/​foundry/​pyproject.toml	Allows Azure AI Projects 2.9.x.
python/​packages/​devui/​pyproject.toml	Allows FastAPI 0.162.x.
python/​packages/​ag-ui/​pyproject.toml	Allows FastAPI 0.162.x.

_{Review effort: Balanced}

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): e8bcdd94c734
Model: gpt-5.6-sol

Overview

This PR widens selected Python dependency upper bounds, refreshes the root and standalone Lab lockfiles, and applies Ruff-required import spacing. The resolved locks select the intended releases, affected FastAPI and real Monty runtime suites exercise the new top versions, and Lab remains isolated on a compatible LiteLLM/huggingface-hub combination. No concrete runtime, compatibility, architectural, or security defect was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.