chore(deps): bump the python-deps group across 10 directories with 25 updates

[dependabot]

Updates the requirements on aws-cdk-lib, constructs, pyyaml, boto3, botocore, requests, pytest, strands-agents, bedrock-agentcore, mcp, langchain, langgraph, langchain-aws, langchain-mcp-adapters, langgraph-checkpoint-aws, urllib3, python-multipart, claude-agent-sdk, aws-opentelemetry-distro, pydantic, strands-agents-builder, copilotkit, langgraph-prebuilt, ag-ui-strands and pyjwt to permit the latest version.
Updates aws-cdk-lib to 2.265.0

Release notes

Sourced from aws-cdk-lib's releases.

v2.265.0

Features

• bedrock-agentcore: add StreamDeliveryResources support to Memory L2 Construct (#37527) (817c50b)
• cloudwatch: support AT_LEAST expression for composite alarm rules (#37693) (974e43b), closes #37692 #36100
• docdb: add managed password support (#35711) (fcf54bf)
• ec2: add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#37900) (000f532), closes #37883
• ec2: add volume initialization rate to ebs props for launchtemplate (#36451) (da4281e), closes #36374
• kinesisfirehose: add HTTP Endpoint and Datadog destination (#33657) (4c47171), closes #20354 #15502

Bug Fixes

• cloudwatch: make concrete widgets assignable to widget interface (#37695) (e322035), closes #37600
• core: cdk validate can hang indefinitely (#38510) (0a238f3), closes #38498 #38425
• secretsmanager: correct SAR rotation app versions for GovCloud (#38462) (a29b5c0)
• bump brace-expansion to 5.0.9 to address CVE-2026-69152 (#38520) (8764b7b), closes #38496 #38410

---

Alpha modules (2.265.0-alpha.0)

⚠ BREAKING CHANGES

• glue-alpha: PySparkFlexEtlJob and ScalaSparkFlexEtlJob now default to GlueVersion.V5_0 instead of V3_0. Set glueVersion explicitly to keep the previous behavior.
• glue-alpha: removal policy of existing Database resources will change to RETAIN.

Features

• glue-alpha: default Flex jobs to Glue 5.0 (#38543) (36d4976)
• glue-alpha: removal policy is RETAIN for Database by default (#38535) (9669928)
• glue-alpha: warn on plaintext secrets (#38538) (10bf0b5)

Bug Fixes

• glue-alpha: warn when S3Table grants cover a shared bucket (#38542) (d81d2d6)
• mediaconnect-alpha: update validation to allow adding an underscore to name (#38539) (7c85994)

Changelog

Sourced from aws-cdk-lib's changelog.

Changelog

All notable changes to this project will be documented in this file. See standard-version for commit guidelines.

2.265.0-alpha.0 (2026-08-13)

⚠ BREAKING CHANGES

• glue-alpha: PySparkFlexEtlJob and ScalaSparkFlexEtlJob now default to GlueVersion.V5_0 instead of V3_0. Set glueVersion explicitly to keep the previous behavior.
• glue-alpha: removal policy of existing Database resources will change to RETAIN.

Features

• glue-alpha: default Flex jobs to Glue 5.0 (#38543) (36d4976)
• glue-alpha: removal policy is RETAIN for Database by default (#38535) (9669928)
• glue-alpha: warn on plaintext secrets (#38538) (10bf0b5)

Bug Fixes

• glue-alpha: warn when S3Table grants cover a shared bucket (#38542) (d81d2d6)
• mediaconnect-alpha: update validation to allow adding an underscore to name (#38539) (7c85994)

2.264.0-alpha.0 (2026-08-10)

⚠ BREAKING CHANGES

• glue-alpha: IDatabase.catalogArn and IDatabase.catalogId were removed in factor of a type safe ICatalog, which has catalogArn and catalogId. Consumers and implementations were updated accordingly.

Features

• glue-alpha: new Catalog L2 (#38443) (6a8ba8e)
• glue-alpha: strengthen data encryption for S3Table (#38501) (eb81d5e), closes /docs.aws.amazon.com/securityhub/latest/userguide/s3-controls.html#s3-5

Bug Fixes

• glue-alpha: enable key rotation for security configuration encryption (#38512) (18560e0)
• mediaconnect-alpha: addOutput options and simplified VPC interface referencing (#38515) (3c71466), closes #38517

2.263.0-alpha.0 (2026-07-31)

⚠ BREAKING CHANGES

• mediaconnect: removalPolicy prop removed from FlowProps, GatewayProps, and BridgeProps. These resources now follow CloudFormation's default deletion behaviour (Delete).

... (truncated)

Commits

• 3ea03cf chore(deps): upgrade jsii packaging toolchain to 1.139.0 (#38560)
• 49d4eab chore(release): 2.265.0 (#38559)
• 3c8d99e chore: update analytics metadata blueprints
• 4009a44 chore(release): 2.265.0
• a29b5c0 fix(secretsmanager): correct SAR rotation app versions for GovCloud (#38462)
• 974e43b feat(cloudwatch): support AT_LEAST expression for composite alarm rules (#37693)
• e322035 fix(cloudwatch): make concrete widgets assignable to widget interface (#37695)
• b98477b chore(core): update feature flag documentation for @​aws-cdk/core:defaultCross...
• 000f532 feat(ec2): add ipAddressType and dnsRecordIpType to GatewayVpcEndpoint (#37900)
• 6e05a63 chore: yarn upgrade dependencies requiring intervention (#38125)
• Additional commits viewable in compare view

Updates constructs to 10.8.1

Release notes

Sourced from constructs's releases.

v10.8.1

10.8.1 (2026-08-03)

Bug Fixes

• dropping jsii.tsc.outDir breaks Java/Go transliteration for jsii-rosetta consumers (#2880) (740480f), closes aws/jsii-compiler#2740 #2879

Commits

• 740480f fix: dropping jsii.tsc.outDir breaks Java/Go transliteration for jsii-rosetta...
• 9f11c08 feat(constructs): restrict package exports to public API (#2878)
• 61a20b4 chore(deps): upgrade cdklabs-projen-project-types (#2877)
• 25edded fix: ids with a newline can produce duplicate addresses (#2876)
• b0d316d chore(deps): upgrade dev dependencies (#2875)
• 4756e27 chore(deps): upgrade dev dependencies (#2874)
• 857a94f fix: Node.path takes a lot of time on deep construct trees (#2873)
• 67495a0 feat: removeDependency (#2872)
• 34b862f chore(deps): upgrade dev dependencies (#2871)
• 9b63ef8 chore(deps): upgrade dev dependencies (#2870)
• Additional commits viewable in compare view

Updates pyyaml to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

6.0.2 (2024-08-06)

• yaml/pyyaml#808 -- Support for Cython 3.x and Python 3.13

6.0.1 (2023-07-18)

• yaml/pyyaml#702 -- pin Cython build dep to < 3.0

6.0 (2021-10-13)

• yaml/pyyaml#327 -- Change README format to Markdown
• yaml/pyyaml#483 -- Add a test for YAML 1.1 types
• yaml/pyyaml#497 -- fix float resolver to ignore . and ._
• yaml/pyyaml#550 -- drop Python 2.7
• yaml/pyyaml#553 -- Fix spelling of “hexadecimal”
• yaml/pyyaml#556 -- fix representation of Enum subclasses
• yaml/pyyaml#557 -- fix libyaml extension compiler warnings
• yaml/pyyaml#560 -- fix ResourceWarning on leaked file descriptors
• yaml/pyyaml#561 -- always require Loader arg to yaml.load()
• yaml/pyyaml#564 -- remove remaining direct distutils usage

5.4.1 (2021-01-20)

• yaml/pyyaml#480 -- Fix stub compat with older pyyaml versions that may unwittingly load it

5.4 (2021-01-19)

• yaml/pyyaml#407 -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA
• yaml/pyyaml#472 -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
• yaml/pyyaml#441 -- Fix memory leak in implicit resolver setup
• yaml/pyyaml#392 -- Fix py2 copy support for timezone objects
• yaml/pyyaml#378 -- Fix compatibility with Jython

5.3.1 (2020-03-18)

• yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor

5.3 (2020-01-06)

• yaml/pyyaml#290 -- Use is instead of equality for comparing with None
• yaml/pyyaml#270 -- Fix typos and stylistic nit
• yaml/pyyaml#309 -- Fix up small typo
• yaml/pyyaml#161 -- Fix handling of slots
• yaml/pyyaml#358 -- Allow calling add_multi_constructor with None
• yaml/pyyaml#285 -- Add use of safe_load() function in README
• yaml/pyyaml#351 -- Fix reader for Unicode code points over 0xFFFF

... (truncated)

Commits

• 49790e7 Release 6.0.3 (#889)
• 41309b0 Release 6.0.2 (#819)
• dd9f0e1 6.0.2rc1 (#809)
• f5527a2 disable CI trigger on PR edits
• b4d80a7 Python 3.12 + musllinux_1_1_x86_64 wheel support
• c42fa3b 6.0.1 release
• ae08bdc block Cython 3.0+ as a build dep (#702)
• f873cfe Add python 3.11 support (#663)
• See full diff in compare view

Updates boto3 to 1.43.72

Commits

• a3fc41f Merge branch 'release-1.43.72'
• 27a2636 Bumping version to 1.43.72
• 33a1671 Add changelog entries from botocore
• a0b0f50 Merge branch 'release-1.43.71'
• f1ea765 Merge branch 'release-1.43.71' into develop
• 3a07077 Bumping version to 1.43.71
• 9886147 Add changelog entries from botocore
• 8c2ae68 Merge branch 'release-1.43.70'
• 116daa7 Merge branch 'release-1.43.70' into develop
• 4901fc8 Bumping version to 1.43.70
• Additional commits viewable in compare view

Updates botocore to 1.43.72

Commits

• 6e07fe0 Merge branch 'release-1.43.72'
• 69cb7f5 Bumping version to 1.43.72
• 2ac8c14 Update endpoints model
• 8fa7fa3 Update to latest models
• db50220 Merge branch 'release-1.43.71'
• 47b07b6 Merge branch 'release-1.43.71' into develop
• 15a5583 Bumping version to 1.43.71
• f94e310 Update to latest models
• 25e520d Bump https://github.com/astral-sh/ruff-pre-commit (#3774)
• 144a686 Merge branch 'release-1.43.70'
• Additional commits viewable in compare view

Updates requests to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates pytest to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

• #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
• #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
• #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
• #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

Commits

• cf470ec Prepare release version 9.1.1
• e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
• 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
• 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
• b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
• 9a567e0 [automated] Update plugin list (#14617) (#14618)
• ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
• 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
• 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
• 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
• Additional commits viewable in compare view

Updates requests to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates strands-agents from 1.32.0 to 1.52.0

Release notes

Sourced from strands-agents's releases.

python/v1.52.0

Auto-drafted from commits in python/v1.51.0..python/v1.52.0, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🚀 Features

• feat(model-routing): add ModelRouter and accept it via Agent(model=) (#3474) (26770e17c)
• feat(catalog): add strands-github-storage integration (#3750) (7f19592f9)
• feat(storage-py): add top level storage (#3743) (0b296c37d)
• feat(middleware): add AgentStreamStage with middleware-initiated interrupts (#3594) (792afbd91)
• feat(ts): support appending to notebooks (#3459) (1a06dffd7)

🐛 Fixes

• fix(streaming): log warning when tool input JSON is malformed (#2054) (2e11e734c)
• fix(bedrock/py): retry incompatible tool-result turns (#3622) (1114e8b08)
• fix(ts): abort in-flight Bedrock requests on cancellation (#3337) (2c6c53177)
• fix(site): keep root lockfile bumps out of the other language's changelog (#3717) (d73ed034d)
• fix(test): Move count_tokens fixture to gemini-3.1-flash-lite (#3763) (93b67745a)
• fix(models/gemini): emit thought signature as its own reasoning delta (#3306) (9a020b716)
• fix(openai): send tool-result documents as file_data, not file_url (#3674) (20ecff5e4)
• fix(context-offloader): report retrieval failures as tool errors (#3680) (d72332972)
• fix(conversation): trim at complete tool pairs (#3447) (13990f016)
• fix(test): move count_tokens fixture off retired gemini-2.0-flash (#3755) (86b98f628)
• fix(vended-tools): keep the pre-rename name on the deprecated bash aliases (#3751) (679665fe9)
• fix(bidi): update bidi google-genai version floor (#3740) (5f357aef7)
• fix(bedrock): honor a cache point placed in the last user message (#3677) (d69941a05)
• fix(openai): send document content as file_data on the Responses API (#3576) (ff73bd913)
• fix(deps): bump @​aws-sdk/core to 3.977.6 to fix NumericValue metadata regression (#3709) (f621b82c9)

♻️ Refactoring

• refactor(site): consolidate src/utils into src/util (#3777) (6ff1d9799)
• refactor(vended-tools): treat bash as its own deprecated tool (#3756) (e4d57c1c6)

📚 Documentation

• docs(community): add Neo4j Agent Memory session manager (#3757) (ea1027add)
• docs(community): add Zep memory integration (#3742) (bf275c70d)
• docs: add prescriptive guidance for keeping cognitive complexity low (#3741) (cc7597c8b)
• docs: add business KPI best practice to metrics page (#3720) (ae44fe91c)
• docs(changelog): sync strands-agents/evals backfill (#3715) (11ad6366a)
• docs(changelog): sync strands-agents/harness-sdk typescript/v1.12.0 (#3716) (c4c35e129)
• docs(changelog): sync strands-agents/harness-sdk python/v1.51.0 (#3712) (f175b5704)
• docs: add estimateUtilization documentation (#3679) (a181423a1)

✅ Tests

• test(models): retry inconclusive Mantle routing probes (#3747) (9eaaff4a6)

... (truncated)

Commits

• ea1027a docs(community): add Neo4j Agent Memory session manager (#3757)
• 243f779 ci(docs): bump markdown-it from 14.3.0 to 15.0.0 in /site (#3605)
• d4129c3 ci(docs): bump js-yaml from 4.3.0 to 4.3.1 in /site in the npm_and_yarn group...
• b487b9a ci(docs): bump the npm_and_yarn group across 1 directory with 2 updates (#3670)
• 2e11e73 fix(streaming): log warning when tool input JSON is malformed (#2054)
• 26770e1 feat(model-routing): add ModelRouter and accept it via Agent(model=) (#3474)
• bf275c7 docs(community): add Zep memory integration (#3742)
• c2df950 ci(docs-preview): link catalog and standalone page changes in the preview com...
• 1114e8b fix(bedrock/py): retry incompatible tool-result turns (#3622)
• 2c6c531 fix(ts): abort in-flight Bedrock requests on cancellation (#3337)
• Additional commits viewable in compare view

Updates bedrock-agentcore from 1.4.7 to 1.21.0

Release notes

Sourced from bedrock-agentcore's releases.

Bedrock AgentCore SDK v1.21.0

Installation

pip install bedrock-agentcore==1.21.0

What's Changed

See CHANGELOG.md for details.

What's Changed

• propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound calls by @​Sudip2403 in aws/bedrock-agentcore-sdk-python#607
• feat(memory): add AgentCoreMemoryStore Strands integration by @​strandly-the-agent in aws/bedrock-agentcore-sdk-python#588
• Release v1.21.0 by @​agentcore-devx-automation[bot] in aws/bedrock-agentcore-sdk-python#623

New Contributors

• @​Sudip2403 made their first contribution in aws/bedrock-agentcore-sdk-python#607
• @​strandly-the-agent made their first contribution in aws/bedrock-agentcore-sdk-python#588

Full Changelog: aws/bedrock-agentcore-sdk-python@v1.20.0...v1.21.0

Bedrock AgentCore SDK v1.20.0

Installation

pip install bedrock-agentcore==1.20.0

What's Changed

See CHANGELOG.md for details.

What's Changed

• ci: wire shared composite actions by @​JunyangHe in aws/bedrock-agentcore-sdk-python#601
• feat: third-party eval metrics adapter (DeepEval + Autoevals) with strands-evals mappers by @​stone-coding in aws/bedrock-agentcore-sdk-python#568
• fix(ci): add pinned deepeval and autoevals to dev group by @​jariy17 in aws/bedrock-agentcore-sdk-python#609
• ci: install deepeval and autoevals for evaluation integ tests by @​jariy17 in aws/bedrock-agentcore-sdk-python#608
• fix(test): repair four unit tests drifting behind source and upstream APIs by @​jariy17 in aws/bedrock-agentcore-sdk-python#610
• Validate agent input in sample agents and runtime docs by @​jariy17 in aws/bedrock-agentcore-sdk-python#612
• fix(test): repair eval adapter integ fixture and wire LLM judge key by @​jariy17 in aws/bedrock-agentcore-sdk-python#614
• fix(a2a): bind the A2A contract port, ignore generic PORT by @​jariy17 in aws/bedrock-agentcore-sdk-python#615
• fix(test): pin autoevals judge to the OpenAI API by @​jariy17 in aws/bedrock-agentcore-sdk-python#617
• Release v1.20.0 by @​agentcore-devx-automation[bot] in aws/bedrock-agentcore-sdk-python#619

New Contributors

• @​stone-coding made their first contribution in aws/bedrock-agentcore-sdk-python#568

Full Changelog: aws/bedrock-agentcore-sdk-python@v1.19.0...v1.20.0

Bedrock AgentCore SDK v1.19.0

Installation

... (truncated)

Changelog

Sourced from bedrock-agentcore's changelog.

[1.21.0] - 2026-08-06

Other Changes

• feat(memory): add AgentCoreMemoryStore Strands integration (#588) (439d788)
• feat(runtime): propagate X-Amz-Bedrock-AgentCore-Identity-WAT on outbound calls (#607) (01d3800)

[1.20.0] - 2026-08-04

Added

• feat: third-party eval metrics adapter (DeepEval + Autoevals) with strands-evals mappers (#568) (9b7d38e)

Fixed

• fix: validate sample agent inputs (#612) (528471e)

Other Changes

• fix(test): pin autoevals judge to the OpenAI API (#617) (703ccfd)
• fix(a2a): bind the A2A contract port, ignore generic PORT (#615) (207adb7)
• fix(test): repair eval adapter integ fixture and wire LLM judge key (#614) (9d8cc26)
• fix(test): repair four unit tests drifting behind source and upstream APIs (#610) (53b0b48)
• ci: install deepeval and autoevals for evaluation integ tests (#608) (5d23292)
• fix(ci): add pinned deepeval and autoevals to dev group (#609) (70165d9)
• ci: wire shared composite actions (#601) (a3382a4)

[1.19.0] - 2026-07-28

Fixed

• fix: preserve generated API reference content (#595) (4a7a8c4)
• fix: convert RST admonition to ADOC (#594) (641000d)

Other Changes

• fix(a2a): advertise resolved port on explicit cards (#605) (34e06f0)
• fix(memory-integ): address capacity cap and update failures in tests (#604) (59cbff3)
• ci: migrate workflows to shared reusable workflows (#597) (f1a7106)
• fix(ci): pin Twine to 6.2.0 (#600) (c707388)
• fix(a2a): honor PORT when serving locally (#593) (331f441)
• feat(a2a): migrate runtime integration to a2a-sdk v1 (#591) (16f732f)
• Add LLM issue auto-triage: type and high-severity labelers (#584) (3000d50)

[1.18.1] - 2026-07-17

Fixed

• fix: tighten package specifier validation in install_packages() (#581) (3c4b4ee)

Other Changes

• chore(deps): bump python-multipart from 0.0.27 to 0.0.31 (#527) (986801f)
• chore(deps): bump soupsieve from 2.8 to 2.8.4 (#575) (1a79821)
• chore(deps): bump cryptography from 46.0.7 to 48.0.1 (#531) (3a4361e)
• chore(deps): bump pyjwt from 2.12.0 to 2.13.0 (#525) (8e1abcf)
• chore(deps): bump starlette from 0.49.1 to 1.3.1 (Description has been truncated

[github-actions]

Commit: f818b44 | Updated: 2026-08-18 13:44:48 UTC

Security Scan Results

Scanner	S	C	H	M	L	I	Time	Action	Result	Thresh
bandit	0	0	0	0	0	0	923ms	0	PASSED	MED (g)
cdk-nag	0	0	0	0	0	0	6.6s	0	PASSED	MED (g)
cfn-nag	0	0	0	0	0	0	9ms	0	PASSED	MED (g)
checkov	0	0	0	0	0	0	5.8s	0	PASSED	MED (g)
detect-secrets	0	0	0	0	0	0	126ms	0	PASSED	MED (g)
grype	0	0	0	0	0	0	1m 3s	0	PASSED	MED (g)
npm-audit	0	0	0	0	0	0	229ms	0	PASSED	MED (g)
opengrep	0	0	0	0	0	0	19.5s	0	PASSED	MED (g)
semgrep	0	0	0	0	0	0	<1ms	0	MISSING	MED (g)
syft	0	0	0	0	0	0	2.2s	0	PASSED	MED (g)

[dependabot]

Superseded by #20.

[Robobc]

Thanks dependabot — but this batch cannot be installed as written, and it's been split into three verified PRs instead.

Why it can't merge

It pins mcp==2.0.0, while three packages in the same PR still require mcp<2.0.0:

• claude-agent-sdk 0.2.139 → mcp<2.0.0,>=1.23.0
• langchain-mcp-adapters 0.3.2 → mcp<2.0.0,>=1.24.0
• strands-agents 1.52.0 → mcp<2.0.0,>=1.23.0

$ pip install --dry-run strands-agents==1.52.0 mcp==2.0.0
ERROR: ResolutionImpossible

Replacement PRs (same bumps, mcp held at 1.29.0)

PR	Scope	Verification
#21	root toolchain (CDK, boto3, pytest 9, …)	99 tests on pytest 9; byte-identical synth output
#22	strands family ×4 patterns	container builds + in-image imports; live invoke with gateway web search
#23	langchain + claude-sdk ×4 patterns	container builds + imports; live AG-UI invoke on the upgraded stack

Grouping across 10 directories also means one PR touches every agent pattern at once, and nothing in GitHub CI builds the containers or invokes an agent — so a green check here would not have meant much. The three PRs above were each verified against live AWS.

Closing once those land.