chore(deps-dev): bump the python-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the python-dependencies group with 6 updates in the / directory:

Package	From	To
mashumaro	3.20	3.21
google-genai	1.73.1	2.0.1
mcp	1.27.0	1.27.1
coverage	7.13.5	7.14.0
mypy	1.20.2	2.0.0
pip	26.1	26.1.1

Updates mashumaro from 3.20 to 3.21

Release notes

Sourced from mashumaro's releases.

v3.21

Changes

• Added support for recursive dataclasses in JSON Schema (#308)
• Fixed building JSON Schema for dataclasses with slots (#307)
• Fixed issue with deferred evaluation of annotations for serialization strategies and serializable types that include PEP 695 generic type parameters (#310)
• Fixed errors for PEP 695 type aliases with generic arguments or cyclic references (#311, #312)
• Code coverage report tool coveralls.io was replaced by codecov.io (#309)
• Fixed propagation of lazy_compilation config value in generic dataclasses with inheritance (#319)
• Added ability for serialization strategies to match subclasses (#298, #317)
• Dropped support for Python 3.9 (#314)

Commits

• 69143a2 Bump version
• 5b74f3f Merge pull request #325 from Fatal1ty/py39-eol
• 01ae942 Remove KW_ONLY fallback import
• bb37ef4 Update black
• a895a78 Deprecate py39
• 447beee Merge branch 'kdkavanagh-kdkavanagh/298'
• 1a5b4c2 Improve test coverage
• e167f92 Improve typing in _get_strategy_for_type
• 35a894e Merge remote-tracking branch 'kdkavanagh/kdkavanagh/298' into kdkavanagh-kdka...
• 23c56ad Bad import
• Additional commits viewable in compare view

Updates google-genai from 1.73.1 to 2.0.1

Release notes

Sourced from google-genai's releases.

v2.0.1

2.0.1 (2026-05-09)

Bug Fixes

• Update response_format field names to snake_case. (97142b1)

v2.0.0

2.0.0 (2026-05-07)

⚠ BREAKING CHANGES - Interactions Only

Note: The breaking changes are only in interactions. GenerateContent usage in unaffected. Refer to https://ai.google.dev/gemini-api/docs/interactions-breaking-changes-may-2026 for details

• Add steps for interactions (41d8e5b)
• Rename SSE events to interaction.created and interaction.completed (0549c1c)
• Deprecate legacy response_format and publish new polymorphic field. (7fdc9a1)

Documentation

• Update docs (d3020fd)

v1.75.0

1.75.0 (2026-05-04)

Features

• [Python] Multimodal file search (fe5d69e)

Bug Fixes

• Avoid caching stale token in async mTLS path (4e17a9c)

Documentation

• Fix python docstrings for Image.from_file() to use kwargs (cce5398)
• Update docs (ef26583)

v1.74.0

1.74.0 (2026-04-29)

Features

• [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (aed41ec)

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.0.1 (2026-05-09)

Bug Fixes

• Update response_format field names to snake_case. (97142b1)

2.0.0 (2026-05-07)

⚠ BREAKING CHANGES - Interactions Only

Note: The breaking changes are only in interactions. GenerateContent usage in unaffected. Refer to https://ai.google.dev/gemini-api/docs/interactions-breaking-changes-may-2026 for details

• Add steps for interactions (41d8e5b)
• Rename SSE events to interaction.created and interaction.completed (0549c1c)
• Deprecate legacy response_format and publish new polymorphic field. (7fdc9a1)

Documentation

• Update docs (d3020fd)

1.75.0 (2026-05-04)

Features

• [Python] Multimodal file search (fe5d69e)

Bug Fixes

• Avoid caching stale token in async mTLS path (4e17a9c)

Documentation

• Fix python docstrings for Image.from_file() to use kwargs (cce5398)
• Update docs (ef26583)

1.74.0 (2026-04-29)

Features

• [Interactions] Add FileCitation.{custom_metadata,media_id,page_number} (aed41ec)
• Add output_info to BatchJob (7b77ab8)
• Add gemini-3.1-flash-tts-preview model to options (8bdc1c3)
• Add ImageResizeMode for GenerateVideos (317d2af)

... (truncated)

Commits

• b5cdc50 chore(main): release 2.0.1 (#2403)
• 97142b1 fix: Update response_format field names to snake_case.
• 00d76d1 chore: refresh
• e64fc2a chore(main): release 2.0.0 (#2380)
• 580e192 chore: Update Agent Platform MCP util to pass schema directly to backend
• 0549c1c feat!: Rename SSE events to interaction.created and interaction.completed
• 99393c2 chore: Remove legacy streaming event types from InteractionSseEvent.
• 246b576 chore: Remove experimental warnings for interactions
• 04bf0b8 chore: fix mtls test
• 7fdc9a1 feat: Deprecate legacy response_format and publish new polymorphic field.
• Additional commits viewable in compare view

Updates mcp from 1.27.0 to 1.27.1

Release notes

Sourced from mcp's releases.

v1.27.1

What's Changed

• [v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2.13 compat) by @​maxisbey in modelcontextprotocol/python-sdk#2435
• [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthClientMetadata by @​felixweinberger in modelcontextprotocol/python-sdk#2405
• [v1.x] build: restrict httpx to <1.0.0 by @​maxisbey in modelcontextprotocol/python-sdk#2559
• [v1.x] refactor: import SSEError from httpx_sse public API by @​maxisbey in modelcontextprotocol/python-sdk#2561

Full Changelog: modelcontextprotocol/python-sdk@v1.27.0...v1.27.1

Commits

• 77431eb [v1.x] refactor: import SSEError from httpx_sse public API (#2561)
• 2034cae [v1.x] build: restrict httpx to <1.0.0 (#2559)
• 73d458b [v1.x] fix(auth): coerce empty-string optional URL fields to None in OAuthCli...
• 8d4c2f5 [v1.x] fix: catch PydanticUserError when generating output schema (pydantic 2...
• See full diff in compare view

Updates coverage from 7.13.5 to 7.14.0

Changelog

Sourced from coverage's changelog.

Version 7.14.0 — 2026-05-10

• Feature: now when running one of the reporting commands, if there are parallel data files that need combining, they will be implicitly combined before creating the report. There is no option to avoid the combination; let us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.

• Fix: the output from combine was too verbose, listing each file considered. Now it shows a single line with the counts of files combined, files skipped, and files with errors. The -q flag suppresses this line. The old detailed lines are available with the new --debug=combine option.

• Fix: running a Python file through a symlink now sets the sys.path correctly, matching regular Python behavior. Fixes issue 2157_.

• Fix: Collector.flush_data could fail with "RuntimeError: Set changed size during iteration" when a tracer in another thread added a line to the per-file set that add_lines (or add_arcs) was iterating. The values passed to CoverageData are now snapshotted via dict.copy() and set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.

• Fix: the soft keyword lazy is now bolded in HTML reports.

• We are no longer testing eventlet support. Eventlet started issuing stern deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: coveragepy/coveragepy#1781 .. _issue 2157: coveragepy/coveragepy#2157 .. _pull 2162: coveragepy/coveragepy#2162 .. _pull 2165: coveragepy/coveragepy#2165

.. _changes_7-13-5:

Commits

• 646351b docs: sample HTML for 7.14.0
• 39cd015 docs: prep for 7.14.0
• 649e8aa docs: thanks Alex Vandiver for #2165
• 8cd392e fix: snapshot data in Collector.flush_data to avoid threading race (#2165)
• c48e0ed fix: less output for combining
• c2a3a28 docs: explain the change from #2162
• 1cd47aa fix: implicit combine-during-report now removes the combined data files
• 2d99fd7 feat: automatically combine coverage in report, thanks Tim Hatch (#2162)
• 9fbdcdf fix: lazy soft keywords are bolded
• 5de7d02 build: oops, misplaced quote
• Additional commits viewable in compare view

Updates mypy from 1.20.2 to 2.0.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.0

We’ve just uploaded mypy 2.0.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. There are also changes to options and defaults. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Enable --local-partial-types by Default

This flag affects the inference of types based on assignments in other scopes. For now, explicitly disabling this continues to be supported, but this support will be removed in the future as the legacy behaviour is hard to support with other current and future features in mypy, like the daemon or the new implementation of flexible redefinitions.

Contributed by Ivan Levkivskyi, Jukka Lehtosalo, Shantanu in PR 21163.

Enable --strict-bytes by Default

Per PEP 688, mypy no longer treats bytearray and memoryview values as assignable to the bytes type.

Contributed by Shantanu in PR 18371.

New Behavior for --allow-redefinition

The --allow-redefinition flag now behaves like --allow-redefinition-new in mypy 1.20 and earlier. The new behavior is generally more flexible. For example, you can have different types for a variable in different blocks:

# mypy: allow-redefinition
def foo(cond: bool) -> None:
if cond:
for x in ["a", "b"]:
# Type of "x" is "str" here
...
else:
for x in [1, 2]:
# Type of "x" is "int" here
...

... (truncated)

Commits

• 7a76500 Remove +dev from version
• 5a3ab3b Changelog for mypy 2.0 (#21422)
• f9c86e2 Some changelog updates for 2.0 (#21413)
• 519eaf1 Bump librt to 0.10.0 (#21415)
• 158a620 Fix negative narrowing for containers (#21411)
• e556eb9 Try fixing mypy mypyc wheels (#21392)
• f2c9797 Expose --num-workers and --native-parser (#21387)
• db0cb2f Bump ast-serialize cache version (#21388)
• 1090ca6 Bump ast-serialize version to 0.3.0 only (#21391)
• 714ca9f [mypyc] Add note about librt.strings thread safety (#21383)
• Additional commits viewable in compare view

Updates pip from 26.1 to 26.1.1

Changelog

Sourced from pip's changelog.

26.1.1 (2026-05-04)

Bug Fixes

• Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent __pycache__ directory when a .py file is removed. ([#13973](https://github.com/pypa/pip/issues/13973) <https://github.com/pypa/pip/issues/13973>_)

Commits

• 4432a37 Bump for release
• 4943e17 Merge pull request #13973 from pypa/revert-13725-vfazio-remove-all-optimizati...
• e9e7b90 Add news
• 0ff6964 Revert "Remove pycache when package is removed"
• cc6b082 Merge pull request #13951 from sbidoul/release/26.1
• b2671f1 Bump for development
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.