fix(deps): update third party deps (major) by renovate[bot] · Pull Request #6268 · livekit/agents

renovate · 2026-06-29T01:10:57Z

This PR contains the following updates:

Package	Change	Age	Confidence
mcp	`>=1.24.0, <2` → `>=2, <3`
openai	`>=2,<3` → `>=3,<4`
websockets (changelog)	`>=14.0,<16.0` → `>=17,<17.1`

Release Notes

modelcontextprotocol/python-sdk (mcp)

`v2.0.0`

Compare Source

MCP Python SDK v2 Stable Release

This is v2.0.0, the stable v2 release of the MCP Python SDK. It supports the 2026-07-28 revision of the Model Context Protocol and serves every earlier revision from the same server. pip install mcp now installs 2.x.

pip install "mcp[cli]"

# or
uv add "mcp[cli]"

Documentation Rewrite

The documentation has the full tutorial and API reference. Coming from v1? What's new in v2 is the tour of what changed and why, and the migration guide lists every breaking change with before-and-after code.

V1 Maintenance mode

v1.x is in maintenance mode and will only receive security fixes from now on The 1.x line lives on the v1.x branch, continues to receive critical bug fixes and security patches, and is documented at https://py.sdk.modelcontextprotocol.io/v1/. If your project is not ready to migrate, keep a <2 upper bound on your requirement (for example mcp>=1.28,<2).

Highlights

One SDK, both protocol eras

v2 speaks the 2026-07-28 revision (stateless requests with no handshake, server/discover, subscriptions/listen, multi-round-trip requests) and still serves every 2025-era client from the same MCPServer, over Streamable HTTP and stdio, with nothing to configure. Client(target) negotiates the version automatically.

`FastMCP` is now `MCPServer`, and there is a first-class `Client`

The decorator API is unchanged; the low-level Server is rebuilt around a shared dispatcher engine, and one Client object replaces v1's transport-plus-ClientSession-plus-initialize() layering. It connects to a URL, a stdio subprocess, a custom transport, or straight to a server object in memory for tests.

Multi-round-trip requests and resolver dependency injection

At 2026-07-28 the server can no longer call the client, so tools return the question instead. A Resolve(fn) parameter is filled by your function invisibly to the model and can put a question to the user; one tool body serves both eras.

Extension APIs, OpenTelemetry, and a standalone types package

Servers and clients compose protocol extensions through pluggable extension APIs (MCP Apps built in); OpenTelemetry tracing ships on by default; every protocol type is its own package, mcp-types (imported as mcp_types), published in lock-step with mcp.

Hardened stdio and auth

stdio servers keep handler subprocesses and stray prints off the wire, and stdout is diverted to stderr while serving. OAuth adds RFC 9207 issuer validation, the SEP-990 identity-assertion flow, and the client-credentials extension.

Coming from a v2 pre-release

Since the last release candidate: the per-version wire packages are private (mcp_types._v*), mcp.types is a permanent alias for mcp_types, the auth registration request model is split from the registered-client record, cancelled requests are no longer answered, and log notifications are gated on the per-request log-level opt-in at 2026-07-28. Since the betas: Client(cache=False) is now cache=None with CacheConfig() the default; Context.client_id, RFC7523OAuthClientProvider, and OAuthClientProvider(timeout=) are removed; the client-credentials providers take scope=; message_handler receives notifications and exceptions only; FileResource(is_binary=) becomes encoding; MCP_* env vars are gone with pydantic-settings; Streamable HTTP servers reject bodies over 4 MiB with HTTP 413. The migration guide covers all of it.

Known gaps

The tasks extension (SEP-2663) is not part of this release. On the client, the DPoP proof binding (SEP-1932) and the workload-identity jwt-bearer grant are not implemented; both are additive and can land in 2.x.

Feedback

Something rough, confusing, or broken? Open an issue or find us in #python-sdk-dev on the MCP Contributors Discord.

Full Changelog: modelcontextprotocol/python-sdk@v2.0.0rc1...v2.0.0

`v1.29.1`

Compare Source

What's Changed

[v1.x] Complete the FastMCP Settings model at import time by @maxisbey in #3352
[v1.x] Apply the request body limit to the SSE and OAuth endpoints by @maxisbey in #3344
[v1.x] Give recursive tool return types an object-rooted output schema by @maxisbey in #3377

Full Changelog: modelcontextprotocol/python-sdk@v1.29.0...v1.29.1

`v1.29.0`

Compare Source

What's Changed

[v1.x] Route Context.report_progress() to the originating request stream by @maxisbey in #2994
[v1.x] docs: publish llms.txt and markdown renditions of the docs by @maxisbey in #3029
[v1.x] docs: pin mkdocs<2 by @maxisbey in #3074
[v1.x] Add Streamable HTTP request body limits by @Kludex in #3101
[v1.x] fix: reject trailing newline in tool-name validation by @maxisbey in #3086
[v1.x] ci: pick the docs toolchain per worktree in build-docs.sh by @maxisbey in #3082
[v1.x] Move the v1.x docs to /v1/ and mark v1.x as the maintenance line by @maxisbey in #3177

Full Changelog: modelcontextprotocol/python-sdk@v1.28.1...v1.29.0

openai/openai-python (openai)

`v3.1.0`

Compare Source

Features

api: add WebSocket stream IDs (#3612) (d9029e3)
api: add workload identity access token issued event (#3601) (df274d4)
api: deprecate Sora video APIs (#3610) (721cb1c)
api: Ultrafast tier, structured MCP and websocket errors, separate websocket events (#3617) (f38355e)

Chores

remove Stainless attribution and infrastructure (#3599) (a1eeab5)

`v3.0.0`

Compare Source

⚠ BREAKING CHANGES

api: HTTPX2 is now the default HTTP client, and httpx is no longer installed automatically. Applications using custom HTTPX clients, transports, or configuration objects must migrate to their HTTPX2 equivalents or use the temporary, runtime-only legacy HTTPX escape hatch. See the HTTPX2 migration guide.

Features

api: migrate to HTTPX2 (#3594)

`v2.54.0`

Compare Source

Features

api: Add new Responses model identifiers (#3595) (0652787)

Bug Fixes

api: clarify audio upload metadata requirements (#3596) (28888f9)

Chores

api: Update generated-file header attribution to Castiron (#3583) (ea17fda)

python-websockets/websockets (websockets)

Configuration

📅 Schedule: (UTC)

Branch creation
- "before 9am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-06-29T01:10:59Z

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: uv.lock

Command failed: uv lock --upgrade-package mcp --upgrade-package openai
Using CPython 3.14.7 interpreter at: /opt/containerbase/tools/python/3.14.7/bin/python3
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version == '3.14.*' and sys_platform == 'win32'):
  ╰─▶ Because openai[realtime]>=3.0.0 depends on websockets>=13,<16 and
      openai[realtime]>=3.1.0 depends on websockets>=13,<16, we can conclude
      that openai[realtime]>=3.0.0,<=3.1.0 depends on websockets>=13,<16.
      And because openai[realtime]>=3.2.0 depends on websockets>=13,<16 and
      openai[realtime]>=3.3.0 depends on websockets>=13,<16, we can conclude
      that openai[realtime]>=3.0.0,<=3.3.0 depends on websockets>=13,<16.
      And because openai[realtime]>=3.3.1 depends on websockets>=13,<16 and
      openai[realtime]>=3.4.0 depends on websockets>=13,<16, we can conclude
      that openai[realtime]>=3.0.0,<=3.4.0 depends on websockets>=13,<16.
      And because openai[realtime]>=3.5.0 depends on websockets>=13,<16 and
      openai[realtime]>=3.6.0 depends on websockets>=13,<16, we can conclude
      that all of:
          openai<2.50.0
          openai>2.54.0
      , all of:
          websockets<13
          websockets>=16
      , openai[realtime]>=2.50.0 are incompatible.
      And because livekit-plugins-openai depends on openai[realtime]>=2.50
      and livekit-agents depends on openai>=3, we can conclude that
      livekit-plugins-openai, all of:
          websockets<13
          websockets>=16
      , livekit-agents[anam] are incompatible.
      And because livekit-plugins-gnani depends on websockets>=17,<17.1
      and your workspace requires livekit-agents[anam], we can conclude
      that your workspace's requirements, livekit-plugins-gnani,
      livekit-plugins-openai[vertex] are incompatible.
      And because your workspace requires livekit-plugins-gnani and
      livekit-plugins-openai[vertex], we can conclude that your workspace's
      requirements are unsatisfiable.

hint: The resolution failed for an environment that is not the current one, consider limiting the environments with `tool.uv.environments`.

File name: uv.lock

Command failed: uv lock --upgrade-package websockets
Using CPython 3.14.7 interpreter at: /opt/containerbase/tools/python/3.14.7/bin/python3
  × No solution found when resolving dependencies for split (markers:
  │ python_full_version == '3.14.*' and sys_platform == 'win32'):
  ╰─▶ Because openai[realtime]>=3.0.0 depends on websockets>=13,<16 and
      openai[realtime]>=3.1.0 depends on websockets>=13,<16, we can conclude
      that openai[realtime]>=3.0.0,<=3.1.0 depends on websockets>=13,<16.
      And because openai[realtime]>=3.2.0 depends on websockets>=13,<16 and
      openai[realtime]>=3.3.0 depends on websockets>=13,<16, we can conclude
      that openai[realtime]>=3.0.0,<=3.3.0 depends on websockets>=13,<16.
      And because openai[realtime]>=3.3.1 depends on websockets>=13,<16 and
      openai[realtime]>=3.4.0 depends on websockets>=13,<16, we can conclude
      that openai[realtime]>=3.0.0,<=3.4.0 depends on websockets>=13,<16.
      And because openai[realtime]>=3.5.0 depends on websockets>=13,<16 and
      openai[realtime]>=3.6.0 depends on websockets>=13,<16, we can conclude
      that all of:
          openai<2.50.0
          openai>2.52.1,<2.54.0
          openai>2.54.0
      , all of:
          websockets<13
          websockets>=16
      , all of:
          openai[realtime]>=2.50.0,<=2.52.1
          openai[realtime]>=2.54.0
       are incompatible.
      And because livekit-plugins-openai depends on openai[realtime]>=2.50
      and livekit-agents depends on openai>=3, we can conclude that
      livekit-plugins-openai, all of:
          websockets<13
          websockets>=16
      , livekit-agents[anam] are incompatible.
      And because livekit-plugins-gnani depends on websockets>=17,<17.1
      and your workspace requires livekit-agents[anam], we can conclude
      that your workspace's requirements, livekit-plugins-gnani,
      livekit-plugins-openai[vertex] are incompatible.
      And because your workspace requires livekit-plugins-gnani and
      livekit-plugins-openai[vertex], we can conclude that your workspace's
      requirements are unsatisfiable.

hint: The resolution failed for an environment that is not the current one, consider limiting the environments with `tool.uv.environments`.

devin-ai-integration

Devin Review found 1 new potential issue.

View 1 additional finding in Devin Review.

devin-ai-integration · 2026-08-11T14:36:49Z

ClientSession


 [project.optional-dependencies]
-mcp = ["mcp>=1.24.0, <2"]
+mcp = ["mcp>=2, <3"]


🔴 Default MCP requests crash on timeout

ClientSession now accepts timeout seconds as a float, but MCPServer passes a timedelta. Every default tool request raises TypeError.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration

Note

This report is out of date. Scroll down for Devin Review's latest report on this PR.

Devin Review found 1 new potential issue.

1 flag not posted on this PR by your GitHub settings — view it in Devin Review. (Configure)

devin-ai-integration · 2026-08-29T02:48:06Z

    "opentelemetry-exporter-otlp>=1.39.0,<1.45",
    "prometheus-client>=0.22",
-    "openai>=2,<3",
+    "openai>=3,<4",


🔴 Fresh installations cannot import Agents

Fresh installations no longer receive httpx, although package initialization imports it unconditionally. Importing livekit.agents raises ModuleNotFoundError before any agent can start.

Prompt for agents

OpenAI 3 replaced its httpx dependency with httpx2, while livekit-agents/livekit/agents/inference/llm.py still imports legacy httpx and constructs an httpx.AsyncClient. A clean installation therefore contains httpx2 but not httpx, and importing livekit.agents fails because inference is imported eagerly. Restore a declared HTTP client dependency as an immediate compatibility fix, or migrate the inference client and every OpenAI-facing client that depends on this transitive package to httpx2. Verify the result in an isolated environment containing only the package's declared dependencies.

Was this helpful? React with 👍 or 👎 to provide feedback.

Generated by renovateBot

devin-ai-integration

Devin Review found 2 new potential issues.

3 flags not posted on this PR by your GitHub settings — view them in Devin Review. (Configure)

devin-ai-integration · 2026-08-30T05:06:44Z

 dependencies = [
    "livekit-agents[codecs]>=1.7.1",
-    "websockets>=14.0,<16.0",
+    "websockets>=17,<17.1",


🟡 Python 3.10 installations fail

On Python 3.10, websockets>=17 has no compatible release. Installing this plugin fails despite its declared Python 3.10 support.

Prompt for agents

Restore installability on Python 3.10, which this package and the repository explicitly support. websockets 17.0 and 17.0.1 both declare Python >=3.11. Either retain a websockets range that supports Python 3.10 or split the dependency by Python version while ensuring the Gnani WebSocket code works with each selected release. Do not raise this plugin's minimum Python version unless repository-wide Python 3.10 support is intentionally removed.

Was this helpful? React with 👍 or 👎 to provide feedback.

devin-ai-integration · 2026-08-30T05:06:46Z

 dependencies = [
    "livekit-agents[codecs]>=1.7.1",
-    "websockets>=14.0,<16.0",
+    "websockets>=17,<17.1",


🟡 Locked installs retain old WebSockets

With uv sync --frozen, the unchanged lock still installs WebSockets 15.0.1. Locked environments never receive the declared major upgrade.

Prompt for agents

Regenerate uv.lock after finalizing the Gnani plugin's compatible websockets constraint. The lock metadata still records >=14.0,<16.0 and resolves websockets 15.0.1, so frozen synchronization does not apply this manifest change.

Was this helpful? React with 👍 or 👎 to provide feedback.

renovate Bot requested a review from a team as a code owner June 29, 2026 01:10