[renovate-bot]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
google-adk (changelog)	==1.28.1 → ==1.39.1
google-genai	==2.3.0 → ==2.34.0
langchain (changelog)	==1.3.9 → ==1.4.9
langchain-google-genai (source, changelog)	==4.2.1 → ==4.4.3
llama-index	==0.14.18 → ==0.14.25
llama-index-llms-google-genai	==0.8.7 → ==0.11.3
pytest (changelog)	==9.0.3 → ==9.2.0
toolbox-core (changelog)	==1.0.0 → ==1.4.0
toolbox-langchain (changelog)	==1.0.0 → ==1.4.0
toolbox-llamaindex (changelog)	==0.6.0 → ==0.9.0

---

Release Notes

google/adk-python (google-adk)

v1.39.1

Compare Source

Bug Fixes

• a2a: Port event action allowlist, agent card description source and resume flattening to v1 (#​6801) (1f898a6)
• artifacts: Port app-scoped file artifact storage and layout-derived payload paths to v1 (#​6795) (0ae2bff)
• artifacts: Port artifact reference scoping and path-segment validation to v1 (#​6794) (efc5bb8)
• cli: check the Host header on every local API server request (v1) (#​6789) (15bf230)
• cli: Port deploy ignore-file handling to v1 (#​6793) (8467bf0)
• close the residual gaps from the v1 backport review (#​6890) (218061e)
• integrations: send api registry credentials only to google api endpoints (v1) (#​6889) (1e9e117)
• mcp: Port config stdio opt-in and reserved tool name checks to v1 (#​6796) (28b32b4)
• models: Port Gemini context cache fingerprint scoping to v1 (#​6804) (f2f8456)
• plugins: sanitize BigQuery analytics rows and build GCS paths per call (v1) (#​6808) (80e56de)
• Port A2A agent card RPC target origin validation to v1 (#​6800) (ccb4812)
• Port agent loader and file path resolution fixes to v1 (#​6788) (8bc927f)
• Port agent-config code-reference and config_path validation to v1 (#​6790) (15ae713)
• Port branch-scoped auth responses and OAuth2 nonce forwarding to v1 (#​6803) (5817d30)
• Port code executor container and pod isolation defaults to v1 (#​6807) (1b4da44)
• Port credential and inline-data field exclusions in logs, reprs and spans to v1 (#​6797) (7c2075c)
• Port eval identifier validation and persona template rendering to v1 (#​6806) (0a4a5c6)
• Port migration unpickle allowlist and database URL redaction to v1 (#​6791) (6deda28)
• Port session id validation, thread id scoping and Vertex RAG cleanup fixes to v1 (#​6809) (3fec8c5)
• Port skill resource path and skill name validation fixes to v1 (#​6805) (1353e8d)
• Port URL validation, client timeout and credential scoping fixes to v1 (#​6802) (7b6547f)
• Route thread-pool and live-mode tool dispatch through run_async (v1) (#​6799) (48c56c3)
• Scope custom eval metrics per registry and resolve their function path from the eval config (v1) (#​6792) (9886410)
• sessions: accept a full session resource name again on v1 (#​6888) (ef4f1e0)
• Validate user message parts and agent transfer targets (v1) (#​6798) (d830355)

v1.39.0

Compare Source

Features

• live: use RunConfig.session_resumption.handle when opening a live session (#​6770) (090869b)
• support audio_stream_end for realtime input (#​6699) (5e3b997)

Bug Fixes

• live: stop background tool tasks when a live agent run ends (#​6769) (5fb5ff1)
• validate session initialization events (v1) (#​6771) (e7dba7a)

v1.38.0

Compare Source

Features

• live: forward safety_settings from generate_content_config to the Live API (#​6641) (99c1aa3)

Bug Fixes

• avoid shell execution in ReadFileTool ranged reads and keep local environment file access in workspace (#​6597) (c680728)
• deps: exclude nltk 3.10.1, which breaks venvs living inside the working directory (v1) (#​6607) (f25bb90)
• eval: handle failed inference results without invocations (cherry-pick) (#​6565) (4555273)
• live: transfer to the target agent regardless of function response order (#​6608) (302885b)
• Port tool confirmation security and re-validation fixes to v1 (#​6575) (4783364)

v1.37.0

Compare Source

Features

• live: Support asynchronous non-blocking tools (#​6522) (c299420)

v1.36.2

Compare Source

Bug Fixes

• Update custom gemini llm connection logic to be used for all 3_x models, not just 3.1 (#​6438) (4ef72fe)

v1.36.1: Release 1.36.1

Compare Source

Bug Fixes

• exit connection cleanly on expected GoAway signal in bidi streaming (v1) (#​6264) (de2abdf)
• Fix Vertex AI Live API session replay on reconnect / modality switch (#​6218) (4caf782)

v1.36.0: Release 1.36.0

Compare Source

Features

• interactions: support for GenAI SDK upgraded to 2.9+ (#​6191) (7a9152a)

v1.35.2: Release 1.35.2

Compare Source

Bug Fixes

• remove live event buffering in runner (#​6151) (afe4083)

v1.35.1: Release 1.35.1

Compare Source

Bug Fixes

• Only send grounding_metadata for 3.1 live at the end of each turn (#​6129) (847a259)
• streaming: Ensure final partial=False frame is always yielded (#​6096) (6e59c61)

v1.35.0: Release 1.35.0

Features

• live: Handle input transcription differently for Gemini Live 3.1 models (#​6045) (ecfdaf5)

Bug Fixes

• add missing Gemini imports in base_llm_flow (#​5943) (6d027b4)
• flows: Reset reconnect attempts on connection success (#​6042) (87abf23)
• models: Default grounding metadata for Gemini 3.1 live (#​6018) (fafafb3)
• Support generalized history config injection for Gemini 3.1 Live on Vertex AI (#​5999) (aafd97f)

v1.34.2: Release 1.34.2

Compare Source

Bug Fixes

• Fix bug where grounding metadata in Gemini 3.1 live was being silently discarded (9b6b9e9)
• fix input and output transcription finished events for Gemini v3.1 (13763d7)
• tools: Prevent session drop on MCP tool error (1fd406b)

v1.34.1

Compare Source

Bug Fixes

• Fix bug where grounding metadata in Gemini 3.1 live was being silently discarded (9b6b9e9)
• fix input and output transcription finished events for Gemini v3.1 (13763d7)
• tools: Prevent session drop on MCP tool error (1fd406b)

v1.34.0

Compare Source

Features

• a2a: add support for persistent task stores (cd78d87)
• add general support for Gemini Live API in ADK evaluate (790c9be)
• Add mTLS support to Google Cloud Telemetry exporter (cfe8d2c)
• add support for A2aAgentExecutor factory in to_a2a() function (115124c)
• add support for non-ADK produced input-required events (6e53472)
• Added config option to include tool calls/responses in conversation history passed to user simulator (baf7efb)
• ci: add Gemini auto review and invoke workflows (fd8b492)
• Implement GCPSkillRegistry in ADK (88ebd42)
• Implement Skill Registry in ADK (380d261)
• Make Agent Skill description validation more informative (9f38973)
• Simplify data retrieved handling of ask_data_agent tool and ask_data_insights tool (48f1b30)
• Support OAuth PKCE in McpToolset (e7316dc)

Bug Fixes

• agents: fix visibility of output_key state delta in callbacks (0524797)
• anthropic: map negative thinking_budget to adaptive thinking (03b915b)
• auth: persist refreshed OAuth2 credentials to store (218ea76), closes #​5329
• auth: remove unneeded OAuth flows (c35a579)
• avoid pre-serializing dict values in Interactions API to prevent double-escaping (85f397d)
• cache: enforce CacheMetadata active-state invariant (76b9f0b)
• cache: handle fingerprint-only metadata in performance analyzer (9c5de58)
• Catch OSError when importing AnthropicLlm (91cb5c6)
• evaluation: handle none config in per_turn_user_simulator_quality (eed9bd3), closes #​5677
• fallback to project id if crendetials don't contain quota project (e377cb5)
• Fix missing dynamically loaded tools in SkillToolset during the same invocation (f9097cb)
• live: ensure sub live agent doesn't inherit session resumption handle from parent live agent to avoid interrupting the conversation (8dd9147)
• models: preserve string content in Anthropic tool_result blocks (9a1e75f), closes #​5358
• models: preserve tool_use IDs for Anthropic models on session resume (327c45f), closes #​5074
• models: treat empty GenerateContentResponse without prompt feedback as successful (0cb9ae9)
• only serialize llm_response to json if it will be included in the trace (1284493)
• Preserve live_session_id in function call handling (07a9a01)
• Prevent compaction of events involved in Human-in-the-Loop interactions (bb2efb6)
• raise eagerly on importing AgentRegistry if a2a-sdk is missing (33cf6cb)
• small: Convert events to the A2A format while respecting user vs agent role (59f7347)
• tools: preserve code_execution_result and executable_code in AgentTool (7e61b51), closes #​5481
• tools: Prevent AnyIO CancelScope task boundary violations during MCP session creation failure (4309159)
• Update model name in hello_world agent (192f19d)
• Update model to gemini-3-flash-preview in hello word agent sample (6d89d21)
• Update model to gemini-3-flash-preview in session state agent sample (2d423e8)
• use tool_responses role for gemma4 models in LiteLLM integration (3d07960), closes #​5650

Performance Improvements

• lazy-load service registries and split apps.app to cut cold start ~8% (bd062ec)
• models: guard debug log evaluation with isEnabledFor (57d8fc7)
• utils: cache find_context_parameter introspection (ec54bd4)

Code Refactoring

• Make the "a2a_metadata" string a constant that can be depended on by extension developers (0821f2d)

v1.33.0

Compare Source

Features

• add BufferableSessionService (0bc767e)
• apigee: allow injecting credentials into ApigeeLlm (ce578ff)
• Make ADK environment tools truncation limit configurable (83ae405)
• models: add get_function_calls and get_function_responses to LlmResponse (22fae7e)

Bug Fixes

• catch genai.ClientError when sandbox is missing (69fa777), closes #​5480
• double append bug (f8b4c59)
• Filter out video events with inline data from being stored in session (88421f8)
• fix fork detection, correct offload limits, and add response logging in BigQuery plugin (9d1bb4b)
• hot reload agents for adk web (740557c)
• Only append skills to system instruction if ListSkillsTool isn't available (01f1fc9)
• prevent state_delta overwrite on function_response-only events (fc27203, 211e2ce), closes #​3178
• Raise a clear actionable error when CustomAuthScheme lacks a registered AuthProvider (83f9817)
• should use app_name instead of req.app_name (8286066)
• simulation: Add error message when LlmBackedUserSimulator returns empty response (fb92aad)
• Update expressmode api call to include default api key param (e833995)
• use asyncio.sleep to avoid blocking event loop (3a1eadc)
• Use project and location instead of API key when deploying to agent engine (398f28f)

Code Refactoring

• adjust computation of workflow.steps metric and add new unit tests (03d6208)
• remove input.type and output.type attributes from adk metrics (9559968)

v1.32.0

Compare Source

Features

• Add an option to prevent the SaveFilesAsArtifactsPlugin from attaching reference file parts to the message (987c809)
• add credentials parameter to BigQueryAgentAnalyticsPlugin (34713fb)
• Add express mode onboarding support to adk deploy cli (2b04996)
• add native OpenTelemetry agentic metrics (6942aac)
• Add OpenTelemetry tracing for event compaction (c65dd55)
• Add sample agent demonstrating 2LO, 3LO, and API Key auth via GcpAuthProvider (909a8c2)
• Add support for Anthropic's thinking blocks (16952bd)
• Add support for excluding predefined functions in ComputerUseToolset (d760037)
• Add support for refusal messages in ApigeeLlm (d6594a1)
• Added indication of user message in history event list (662354a)
• Allow user to define credential_key for McpToolset (282db87), closes #​5103
• analytics: add support for logging LLM cache metadata to BigQuery (02deeb9)
• eval: add evaluate_full_response option to rubric-based evaluation (#​5316) (7623ff1)
• live: Add save_live_blob query parameter to /run_live endpoint (36ab8f1)
• mcp: gracefully handle tool execution errors and transport crashes (7744cfe)

Bug Fixes

• accumulate list values when merging parallel tool call state_delta (b0b8b31), closes #​5190
• Add support for overriding the API version in GoogleLLM (1cdd1e7)
• auth: isolate resolved credentials in context to prevent race conditions and data leakage (5578772)
• avoid double-execution of sync FunctionTools returning None (78a8851), closes #​5284
• block RCE vulnerability via nested YAML configurations in ADK (74f235b)
• bump Vertex SDK version (6380f6a)
• cancel siblings in parallel function calling on failure (49985c9)
• Capture and include LLM usage metadata in summarized events (5ce33b9), closes #​4014
• catch ValueError in safe-JSON serializers for circular refs (70a7add), closes #​5412
• deps: bump litellm cap to >=1.83.7 to admit CVE patches (6d2ada8)
• Disable bound token for mcp_tool (4c0c6db)
• fix dataset location handling in BigQueryAgentAnalyticsPlugin (c263426)
• Fix exception handling and argument order in ReflectRetryToolPlugin (1deab6d)
• Fix GcpAuthProvider to return capitalized Bearer scheme (ad937fe)
• fix lifecycle issues with credentials in BigQuery Agent Analytics Plugin (a69f861)
• Fix malformated skill.md (9a0d2f7)
• Fix misplaced pytest decorator on helper dataclass in 2LO integration tests (2343973)
• Fix RecursionError in ADK framework by adding circular reference detection to schema resolution (7de5bc5)
• fix rewind to preserve initial session state (af1b00a), closes #​4933
• Fix SSRF and local-file access in load_web_page (0447e93)
• handle None state values in skill_toolset after session rewind (a977aa3)
• litellm: emit input_audio for audio inline_data parts (4073238), closes #​5406
• live: mark all agents' Event as from other agents (48b7a64)
• live: treat input transcription as user message (ae1f2e6)
• optimization: handle None metric scores in LocalEvalSampler (#​5415) (684a6e7)
• otel: change gen_ai.tool_definitions to gen_ai.tool.definitions (029b87d)
• preserve cache fingerprint stability on creation failure (4d5438c)
• preserve empty-string text parts in A2A converter (2d61cb6)
• preserve function call IDs for Anthropic models (f0c787f)
• Prevent LoopAgent from resetting sub-agent state on pause (8846be5)
• Quote user_id literals in VertexAiSessionService list filters (bdece00)
• read_file/write_file path type mismatch in BaseEnvironment and LocalEnvironment (782796f)
• relax EventActions.state_delta value type to Any (dbec8e9)
• remove exclude_unset=True to correctly serialize pydantic types (f95ac48)
• samples: Upgrade google-adk to 1.28.1 to fix vulnerability (b848390)
• Sanitize user_id derived from PubSub subscription and Eventarc source (0c4f157), closes #​5324
• Scope Vertex RAG memory display names (784350d)
• Use correct camelCase functionCallId (c87ee1e)
• web oauth flow and trace view (87cd310)
• yield tool_call_parts immediately in live mode to unblock Gemini 3.1 tool calls (f57b05d)

Performance Improvements

• lazy-load optional providers and auth chain to cut cold start ~25% (66bfedc)

Code Refactoring

• move exception handling from metric emission into instrumentation handlers (62d7ee0)
• tests: Refactor tests to explicitly handle JSON_SCHEMA_FOR_FUNC_DECL feature flag (b580891)
• Use artifact_service.load_artifact during rewind (c3d50db), closes #​4932

Documentation

• gemini: show subclass pattern for custom Client config (34c7505), closes #​3628
• update output_schema docstring to reflect support for tools and output_schema together (e1e652d)
• Update README with instructions for installing ADK extensions (f2a1179)
• use sphinx-click to generate docs for google.adk.cli (f455974)

v1.31.1

Compare Source

Bug Fixes

• block RCE vulnerability via nested YAML configurations in ADK (e283ea0)
• bump Vertex SDK version (21ebe29)
• Disable bound token for mcp_tool (d0afddd)
• web oauth flow and trace view (c3dafdb)

v1.31.0

Compare Source

Features

• Add "google-adk" user agent to Parameter Manager and Secret Manager clients (b8e8f6b)
• Add support for memories.ingest_events in VertexAiMemoryBankService (d69477f)
• Add Vertex AI Agent Engine Sandbox integration for computer use (7686848)
• Firestore support (1a9df8f)
• live: Add live_session_id to LlmResponse (bf84e2c)

Bug Fixes

• Bump minimum mcp version from 1.23.0 to 1.24.0 (494c360)
• cli: correct console URL path after adk deploy agent_engine (64ed1a6), closes #​5336
• execute on_event_callback before append_event to persist plugin modifications (454188d), closes #​3990
• make _EvalMetricResultWithInvocation.expected_invocation Optional for conversation_scenario support (#​5215) (a4c9387)
• Pass in auth headers with header provider instead of connection params (e12b0af)
• populate required fields in FunctionDeclaration json_schema fallback (9b9faa4)
• Resolve BigQuery plugin issues with A2A transfers, spans, and metadata (9ca8c38)
• upgrade google-genai lower bound (8bc5728)

Code Refactoring

• live: Use send_client_content to send conversation history (67dc2eb)
• live: Use send_tool_response for function responses (70c5fc8)

Documentation

• update MCP Toolbox branding, binary version, and asset references (47fa7b7)

v1.30.0

Compare Source

Features

• Add Auth Provider support to agent registry (f2c68eb)
• Add Parameter Manager integration to ADK (b0715d7)
• Add support for Gemma 4 models in ADK (9d4ecbe), closes #​5156
• allow users to include artifacts from artifact_service in A2A events using provided interceptor (e63d991)
• emit a TaskStatusUpdateEvent for ADK events with no output parts but with event.actions (dcc485b)
• Live avatar support in ADK (a64a8e4)
• live: expose live_session_resumption_update as Event in BaseLlmFlow ([2626ad7](https://redirect.github.com/google/adk-python/commit/2626ad7c69fb64a88372225d5583085fc08b1fcd

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[dpebot]

/gcbrun

[gemini-code-assist]

Code Review

This pull request updates the versions of several Python dependencies across multiple requirements.txt files in the documentation's quickstart and pre-post-processing samples. The updated packages include google-adk, google-genai, langchain, langchain-google-genai, toolbox-langchain, pytest, langgraph, llama-index, llama-index-llms-google-genai, and toolbox-llamaindex. There are no review comments, and I have no feedback to provide.

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun

[dpebot]

/gcbrun