chore(deps): weekly safe pypi updates · 14 packages

[mendral-app]

Packages bumped

Package	Group	Old	New
mcp	core	>=1.9.4	>=1.28.1
opentelemetry-instrumentation-anthropic	telemetry	>=0.41.0	>=0.62.1
opentelemetry-instrumentation-cohere	telemetry	>=0.41.0	>=0.62.1
opentelemetry-instrumentation-fastapi	telemetry	>=0.55b0	>=0.62.1
opentelemetry-instrumentation-google-generativeai	telemetry	>=0.41.0	>=0.62.1
opentelemetry-instrumentation-ollama	telemetry	>=0.41.0	>=0.62.1
opentelemetry-instrumentation-openai	telemetry	>=0.41.0	>=0.62.1
opentelemetry-instrumentation-crewai	crewai	>=0.41.0	>=0.62.1
opentelemetry-instrumentation-langchain	langgraph	>=0.35.0	>=0.62.1
opentelemetry-instrumentation-llamaindex	llamaindex	>=0.40.7	>=0.62.1
pillow	langgraph	>=10.0.0	>=12.3.0
fastapi	dev	>=0.115.12	>=0.139.0
pytest-asyncio	test	>=0.24.0	>=1.4.0
flask	test	>=3.0.0	>=3.1.3

Per-package details

mcp (>=1.9.4 → >=1.28.1)

• Many minor releases within v1.x with new features (streamable HTTP transport, improved error handling, tool annotations).
• WebSocket transport deprecated in 1.28.0 (still functional, removal only in future v2.0).
• Impact: Core dep used in src/blaxel/core/mcp/ for client/server communication. No breaking changes within v1.x. Integration tests already use streamable HTTP transport.

OpenTelemetry instrumentation packages (>=0.41.0/0.55b0/0.35.0 → >=0.62.1)

• All from traceloop/openllmetry. Regular releases with span attribute improvements, new model support, and bug fixes.
• Impact: Optional extras for telemetry/crewai/langgraph/llamaindex. Same 0.x line, additive changes only. Used in src/blaxel/telemetry/ for auto-instrumentation of LLM calls.

pillow (>=10.0.0 → >=12.3.0)

• Major releases with new format support, performance improvements, and security fixes.
• Impact: Optional dep in langgraph extra. Only used for basic image operations. Pillow maintains excellent backwards compatibility for standard PIL APIs.

fastapi (>=0.115.12 → >=0.139.0)

• Minor releases with Pydantic v2 optimizations, OpenAPI improvements, new middleware options.
• Impact: Dev dependency only (used for integration test servers). Not shipped to users.

pytest-asyncio (>=0.24.0 → >=1.4.0)

• v1.0 removed deprecated event_loop fixture; v1.x series is stable.
• Impact: Test dependency only. Codebase already uses v1.x patterns (asyncio_mode = "auto", asyncio_default_fixture_loop_scope = "function", loop_scope markers). No usage of removed APIs confirmed.

flask (>=3.0.0 → >=3.1.3)

• Minor releases with typing improvements and bug fixes.
• Impact: Test dependency only. No breaking changes in 3.1.x.

Files modified

• pyproject.toml

CI notes

Integration test failures (Core, pydantic, llamaindex, livekit) are pre-existing and unrelated to this PR:

• Core/pydantic/llamaindex: Flaky LLM tool-calling tests (same failures appear on other open PRs)
• livekit: Known livekit-agents incompatibility with newer opentelemetry-sdk (LogData import removed) — pre-existing, unrelated to the otel-instrumentation packages bumped here

All unit tests pass across Python 3.10–3.14. ✅

Skipped this ecosystem

Package	Current	Latest Eligible	Reason
langgraph	>=0.2.40	1.2.9	Major 0.x→1.x; deprecated create_react_agent we use
langchain-core	>=0.3.13	1.4.9	Major 0.x→1.x; coupled ecosystem upgrade
langchain-openai	>=0.3.10	1.3.5	Major 0.x→1.x; coupled to langchain-core
langchain-anthropic	>=0.3.10	1.4.8	Major 0.x→1.x; coupled to langchain-core
langchain-cohere	>=0.4.3	0.6.0	Coupled to langchain ecosystem upgrade
langchain-community	>=0.3.3	0.4.2	Coupled to langchain ecosystem upgrade
langchain-xai	>=0.2.2	1.2.2	Major 0.x→1.x; coupled to langchain-core
openai-agents	>=0.0.19	0.18.2	Large pre-1.0 jump; needs changelog review
pydantic-ai	>=1.0.8	2.9.0	Major 1.x→2.x; needs risky PR
google-adk	>=1.4.0	2.4.0	Major 1.x→2.x; needs risky PR
litellm	>=1.63.11	1.92.0	Large minor jump (+29); needs changelog review
websockets	<16.0.0	16.1	Explicitly capped by project
asgi-correlation-id	>=4.3.4,<5.0.0	5.0.1	Explicitly capped by project
ruff	>=0.8.2	0.15.21	Conflicts with pinned openapi-python-client==0.25.3 (requires ruff<0.13)
openapi-python-client	==0.25.3	—	Pinned exactly; skip
nest-asyncio	>=1.6.0	1.6.0	Already at latest
pytest-xdist	>=3.8.0	3.8.0	Already at latest