fixes #2026

PiperOrigin-RevId: 1003523084

--
8e585db by release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>:

chore(main): release 2.32.0

COPYBARA_INTEGRATE_REVIEW=#3142 from googleapis:release-please--branches--main 8e585db
PiperOrigin-RevId: 1003531938

PiperOrigin-RevId: 1003696998

PiperOrigin-RevId: 1003758162

Extract the duplicated `ThreadingHTTPServer` + `_RecordingHandler` boilerplate across `tests/gaos/test_*_lifecycle.py` into a shared `mock_gaos_server` pytest fixture in `tests/gaos/conftest.py`:

- Replace mutable class-level attributes (`captured = []`, `captured_bodies = []`) and dynamic `type("Handler", (_RecordingHandler,), ...)` subclassing with a typed per-test `MockGaosServer` state object bound to `_GaosHTTPServer`.
- Standardize environment variable cleanup (`GOOGLE_GENAI_USE_VERTEXAI` and HTTP proxy variables) across all GAOS unit tests, fixing drift where proxy cleanup or `captured_bodies` overrides were omitted in newer test suites.
- Support default responses, queued multi-turn responses (`responses`), SSE streaming (`stream_payload`), and route-specific `handler_fn` callbacks in a single reusable fixture.

PiperOrigin-RevId: 1003900700

…quests

fixes #3160

PiperOrigin-RevId: 1004094486

Sync `third_party/golang/github_com/speakeasy_api/openapi_generation/v/v2` to `https://github.com/speakeasy-api/openapi-generation@bbc869f` (`v2.950.5`) and regenerate all SDKs (Python, TypeScript, Java, Go, Dotnet, and CLI).

- List the flags each command registers in `--usage` in the CLI (`67f55b4`).
- Keep base64 input mode on shared components in Python (`c834e12`).
- Compose `--usage` schemas from the runtime command tree in the CLI (`1c47aa7`).
- Render streamed events from the frame the server sent in Go and the CLI (`f538ec3`).
- Read body-less success responses before the timeout is cancelled in Go and the CLI (`4604e87`).
- Report a projected stream's status and resume fields when it ends incomplete in the CLI (`38dc6ac`).
- Move command suggestions into hints and drop the dry-run hint on CLI-raised validation errors (`7a70797`).
- Upgrade generated MCP servers to SDK v2 (`894473a`).
- Keep spaces from tag names in Mintlify page titles (`c407abf`).
- Prewarm WASM formatters at generation start instead of process init (`9c7191f`).

PiperOrigin-RevId: 1004100178

PiperOrigin-RevId: 1004101438

fixes #2835

PiperOrigin-RevId: 1004115950

…is.com endpoints and honor GOOGLE_API_USE_MTLS_ENDPOINT in Google Auth sessions

Multi-regional Vertex AI endpoints (`aiplatform.us.rep.googleapis.com` and `aiplatform.eu.rep.googleapis.com`) do not publish `.rep.mtls.googleapis.com` DNS records. When `GOOGLE_API_USE_CLIENT_CERTIFICATE=true` is set (such as on Vertex AI Agent Engine with `AGENT_IDENTITY=true`), rewriting these URLs in `to_mtls_url()` causes requests to fail with `NXDOMAIN` (`Name or service not known`).

Additionally, `_request_once`, `_async_request_once`, `download_file`, and `async_download_file` previously checked `session._is_mtls` directly when using `AuthorizedSession` / `AsyncAuthorizedSession`, bypassing `_use_mtls_endpoint()` and ignoring `GOOGLE_API_USE_MTLS_ENDPOINT=never`.

- Update `to_mtls_url()` to leave multi-regional `.us.rep.` and `.eu.rep.` endpoints unchanged while continuing to rewrite single-region `.rep.` endpoints.
- Gate `to_mtls_url()` in the synchronous and asynchronous Google Auth session paths via `self._use_mtls_endpoint(client_cert_loaded=...)`.

PiperOrigin-RevId: 1004213757

…ields.

PiperOrigin-RevId: 1004403542

Sync `third_party/golang/github_com/speakeasy_api/openapi_generation/v/v2` to `https://github.com/speakeasy-api/openapi-generation@c479885` (`v2.950.8`) and regenerate all SDKs (Python, TypeScript, Java, Go, Dotnet, and CLI).

This update includes an important Go toolchain security bump (`go 1.26.8` -> `go 1.26.10`):
- **Security (`crypto/x509`)**: Eight eMudhra (`emSign`) intermediate CA certificate private keys were reported compromised. Go `1.26.10` blocks the public keys of those compromised intermediates in `crypto/x509` so certificate chains signed by them no longer verify.
- Require `go 1.26.10` in generated `go.mod` files (`face5cd`) and update `third_party/gemini_api_cli/README.md` so consumers and CLI builds using default `GOTOOLCHAIN=auto` automatically select a patched Go `1.26.10+` toolchain instead of an older toolchain that still accepts the compromised CA intermediates.
- Bump the generator's own Go toolchain to `1.26.10` (`5033ab8`).

PiperOrigin-RevId: 1004902303

Support httpx2 as an opt-in HTTP transport via GOOGLE_GENAI_HTTP_CLIENT=httpx2
or custom client injection, while preserving httpx as the default in minor
releases for backward compatibility.

#2680

PiperOrigin-RevId: 1004914195

…tionResultSubContent

PiperOrigin-RevId: 1005051946

…ly) and `labels` to `LiveConnectConfig`.

PiperOrigin-RevId: 1005110886

… in lists of unions

And fix the type signature of a PIL Image call - use `tuple[float, float]`

PiperOrigin-RevId: 1005152230

Co-authored-by: release-please[bot] <55107282+release-please[bot]@users.noreply.github.com>