chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Update	Change	OpenSSF
a2a-sdk (changelog)	patch	==1.1.0 → ==1.1.2
langchain-core (changelog)	minor	==1.4.9 → ==1.5.3
langchain-google-genai (source, changelog)	minor	==4.2.7 → ==4.3.2
mcp	minor	==1.28.1 → ==1.29.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

a2aproject/a2a-python (a2a-sdk)

v1.1.2

Compare Source

Features

• server: add aclose() to drain ActiveTask background tasks (#​1101) (#​1105) (9801f46)

Bug Fixes

• agent_execution: resolve ActiveTask 'destroyed but pending' warning during teardown (#​1122) (d19c4d2)
• persist early producer failure as FAILED with originating message (#​1106) (4e3d724)

v1.1.1

Compare Source

Bug Fixes

• server: improve Swagger /docs example annotations for A2A routes (#​1092) (46b292b)

Miscellaneous Chores

• grpc: eliminate third-party grpcio-status dependency (#​1130) (723880e)
• http: eliminate httpx-sse dependency (#​1132) (0d82ab9)

modelcontextprotocol/python-sdk (mcp)

v1.29.0

Compare Source

What's Changed

• [v1.x] Route Context.report_progress() to the originating request stream by @​maxisbey in #​2994
• [v1.x] docs: publish llms.txt and markdown renditions of the docs by @​maxisbey in #​3029
• [v1.x] docs: pin mkdocs<2 by @​maxisbey in #​3074
• [v1.x] Add Streamable HTTP request body limits by @​Kludex in #​3101
• [v1.x] fix: reject trailing newline in tool-name validation by @​maxisbey in #​3086
• [v1.x] ci: pick the docs toolchain per worktree in build-docs.sh by @​maxisbey in #​3082
• [v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line by @​maxisbey in #​3177

Full Changelog: modelcontextprotocol/python-sdk@v1.28.1...v1.29.0

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates Python dependency versions across the A2A IAG demo agents to keep SDK/tooling and LangChain components current.

Changes:

• Bump a2a-sdk[http-server,sql] from 1.1.0 to 1.1.2 across multiple agents.
• Bump mcp[cli] to 1.29.0 in iag-mcp-demo agents.
• Bump langchain-core / langchain-google-genai in analyst_agent and retriever_agent under iag-mcp-demo.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
a2a/iag-mcp-demo/weather_agent/requirements.txt	Bumps a2a-sdk and mcp[cli] pins
a2a/iag-mcp-demo/retriever_agent/requirements.txt	Bumps a2a-sdk, mcp[cli], and LangChain pins
a2a/iag-mcp-demo/orchestrator_agent/requirements.txt	Bumps a2a-sdk pin
a2a/iag-mcp-demo/analyst_agent/requirements.txt	Bumps a2a-sdk, mcp[cli], and LangChain pins
a2a/iag-demo/weather_agent/requirements.txt	Bumps a2a-sdk pin
a2a/iag-demo/retriever_agent/requirements.txt	Bumps a2a-sdk pin
a2a/iag-demo/orchestrator_agent/requirements.txt	Bumps a2a-sdk pin

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[deepsource-io]

DeepSource Code Review

We reviewed changes in a776916...c48c8ab on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Secrets		Aug 3, 2026 3:55a.m.	Review ↗
Python		Aug 3, 2026 3:55a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[cowan-macady]

DO NOT MERGE - VERY IMPORTANT: These dependencies MUST be tested with the current demos first: demos CANNOT be broken