chore(deps): update all non-major dependencies - #89
Conversation
There was a problem hiding this comment.
Pull request overview
Note
Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.
Updates Python dependency versions across the A2A IAG demo agents to keep SDK/tooling and LangChain components current.
Changes:
- Bump
a2a-sdk[http-server,sql]from1.1.0to1.1.2across multiple agents. - Bump
mcp[cli]to1.29.0iniag-mcp-demoagents. - Bump
langchain-core/langchain-google-genaiinanalyst_agentandretriever_agentunderiag-mcp-demo.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| a2a/iag-mcp-demo/weather_agent/requirements.txt | Bumps a2a-sdk and mcp[cli] pins |
| a2a/iag-mcp-demo/retriever_agent/requirements.txt | Bumps a2a-sdk, mcp[cli], and LangChain pins |
| a2a/iag-mcp-demo/orchestrator_agent/requirements.txt | Bumps a2a-sdk pin |
| a2a/iag-mcp-demo/analyst_agent/requirements.txt | Bumps a2a-sdk, mcp[cli], and LangChain pins |
| a2a/iag-demo/weather_agent/requirements.txt | Bumps a2a-sdk pin |
| a2a/iag-demo/retriever_agent/requirements.txt | Bumps a2a-sdk pin |
| a2a/iag-demo/orchestrator_agent/requirements.txt | Bumps a2a-sdk pin |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| @@ -1,6 +1,6 @@ | |||
| a2a-sdk[http-server,sql]==1.1.0 | |||
| a2a-sdk[http-server,sql]==1.1.2 | |||
There was a problem hiding this comment.
we choose the version intentionally. Bugs in these libraries are very difficult to spot and have dire consequences
| langchain-core==1.5.3 | ||
| langchain-google-genai==4.3.2 | ||
| langchain-ollama>=1.0.0 | ||
| mcp[cli]==1.28.1 | ||
| mcp[cli]==1.29.0 |
There was a problem hiding this comment.
we choose the version intentionally. Bugs in these libraries are very difficult to spot and have dire consequences
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Secrets |  |
Aug 13, 2026 4:59a.m. | Review ↗ |
| Python | |
Aug 13, 2026 4:59a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
DO NOT MERGE - VERY IMPORTANT: These dependencies MUST be tested with the current demos first: demos CANNOT be broken |
c48c8ab to
b52598e
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Suppressed comments (2)
a2a/iag-demo/weather_agent/requirements.txt:4
- In this repo,
mcp[cli]is pinned to an exact version (==1.29.0) ina2a/iag-mcp-demo/*but is left as a broad range here (>=1.0.0). This can lead to non-reproducible environments and hard-to-debug differences between the demo variants depending on when installs happen. Consider aligning the versioning strategy (e.g., pinmcp[cli]here as well, or centralize MCP constraints in a shared constraints/lock file used by both demos).
mcp[cli]>=1.0.0
a2a/iag-mcp-demo/retriever_agent/requirements.txt:6
- This mixes strict pins (
langchain-core==...,langchain-google-genai==...) with a floating dependency (langchain-ollama>=1.0.0). With a pinned core, allowing the integration package to float can cause dependency resolution churn or unexpected upgrades that may not have been validated with the pinned versions. Consider either pinninglangchain-ollamato a tested version range compatible withlangchain-core==1.5.3, or relaxing the pins consistently (and managing exact versions via a lock/constraints file).
langchain-core==1.5.3
langchain-google-genai==4.3.3
langchain-ollama>=1.0.0
b52598e to
6c78f55
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Suppressed comments (1)
a2a/iag-mcp-demo/orchestrator_agent/requirements.txt:1
- The same
a2a-sdkpin is duplicated across multiple agentrequirements.txtfiles in this PR. Consider centralizing shared pins in a single constraints file (e.g.,constraints.txtreferenced via-c) to prevent version drift and reduce future maintenance overhead when bumping dependencies.
a2a-sdk[http-server,sql]==1.1.2
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Suppressed comments (3)
a2a/iag-mcp-demo/retriever_agent/requirements.txt:3
grpciois left unpinned while other dependencies here are tightly pinned. This can reduce build reproducibility and may cause unexpected resolver outcomes whengrpcioreleases a breaking/ABI-incompatible wheel. Consider pinninggrpcioto a tested version (or introducing a shared constraints/lock file used by all agents) so installs are deterministic.
grpcio
httpx>=0.27.0
a2a/iag-mcp-demo/analyst_agent/requirements.txt:5
- These are exact pins, but other deps in the same file use lower bounds (e.g.,
langchain-ollama>=...,pydantic>=...). Mixed pinning strategies make upgrades harder to reason about across agents. Consider standardizing on either (a) a lock/constraints file with full pins, or (b) consistent ranges with an upper bound policy, applied uniformly across the agent requirements.
langchain-core==1.5.3
langchain-google-genai==4.3.3
a2a/iag-mcp-demo/weather_agent/requirements.txt:4
- The same dependency versions (e.g.,
a2a-sdkandmcp[cli]) are being duplicated across multiple agent-specificrequirements.txtfiles. To reduce the chance of version drift and simplify future upgrades, consider extracting shared pins into a commonconstraints.txt(or a shared base requirements file) that each agent references.
a2a-sdk[http-server,sql]==1.1.2
grpcio
httpx>=0.27.0
mcp[cli]==1.29.0
6c78f55 to
a57fcf5
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Suppressed comments (3)
a2a/iag-mcp-demo/retriever_agent/requirements.txt:7
- These dependency versions are duplicated and pinned in multiple agent-specific
requirements.txtfiles, which makes version drift likely over time (e.g., updatinga2a-sdk/mcprequires touching many files). Consider introducing a shared constraints file (e.g.,constraints.txt) or a shared base requirements file that each agent references (via-c/-r), so version bumps happen in one place.
a2a-sdk[http-server,sql]==1.1.2
grpcio
httpx>=0.27.0
langchain-core==1.5.4
langchain-google-genai==4.3.3
langchain-ollama>=1.0.0
mcp[cli]==1.29.0
a2a/iag-mcp-demo/weather_agent/requirements.txt:4
- In
iag-mcp-demothe MCP CLI is now strictly pinned (==1.29.0), while ina2a/iag-demo/weather_agent/requirements.txtit remains a broad range (mcp[cli]>=1.0.0). This can lead to different MCP behavior between the demo variants and make issues hard to reproduce. Recommend aligning the versioning strategy across these demos (either pin both, or use a shared constraint) to keep environments consistent.
mcp[cli]==1.29.0
a2a/iag-mcp-demo/analyst_agent/requirements.txt:5
- These packages are pinned exactly, but the surrounding stack still includes unpinned / ranged dependencies in other files and agents. If the goal is reproducibility, consider adding a lock/constraints mechanism (e.g., generated
requirements.lock/constraints) so transitive dependencies are stabilized as well; otherwise upgrades of transitive deps may change runtime behavior even when these top-level pins stay the same.
langchain-core==1.5.4
langchain-google-genai==4.3.3
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Suppressed comments (2)
a2a/iag-mcp-demo/orchestrator_agent/requirements.txt:3
grpciois left unpinned. Sincegrpciofrequently publishes wheels tied to specific Python/OS/ABI combinations, leaving it unconstrained can cause non-reproducible builds or sudden breakages when new releases land. Consider pinning to a known-good version (or at least adding an upper bound), or managing it via a shared constraints/lock file used by all agents.
grpcio
a2a/iag-demo/weather_agent/requirements.txt:4
- Within this PR,
iag-mcp-demopinsmcp[cli]to an exact version (==1.29.0), butiag-demoleavesmcp[cli]as a wide range (>=1.0.0). This makes the two demos behave differently and reduces reproducibility foriag-demo. Recommend aligning the versioning strategy (either pin both to the same tested version, or use consistent bounded ranges across both demos).
mcp[cli]>=1.0.0
a57fcf5 to
6520b48
Compare
6520b48 to
05321b9
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This PR contains the following updates:
==1.1.0→==1.1.2==1.5.3→==1.5.4==4.3.2→==4.3.3Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
a2aproject/a2a-python (a2a-sdk)
v1.1.2Compare Source
Features
Bug Fixes
v1.1.1Compare Source
Bug Fixes
Miscellaneous Chores
Configuration
📅 Schedule: (UTC)
* 0-3 * * 1)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.