fix(cli): use relative paths in langgraph config for Windows compat by mdrxy · Pull Request #2244 · langchain-ai/deepagents

Mason Daugherty (mdrxy) · 2026-03-26T04:59:31Z

_scaffold_workspace passed absolute resolved paths (Path.resolve()) as graph and checkpointer refs in the generated langgraph.json. On Windows, importlib.import_module() receives a backslash path like C:\Users\...\server_graph and raises ModuleNotFoundError. Since the server subprocess already runs with cwd=work_dir, relative ./ refs resolve correctly on all platforms.

codspeed-hq · 2026-03-26T05:07:00Z

Merging this PR will not alter performance

✅ 32 untouched benchmarks

_{Comparing mdrxy/cli/relative-path (48f7d45) with main (f266db5)}

> [!CAUTION] > Merging this PR will automatically publish to **PyPI** and create a **GitHub release**. For the full release process, see [`.github/RELEASING.md`](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md). --- _Everything below this line will be the GitHub release body._ --- ## [0.0.35](deepagents-cli==0.0.34...deepagents-cli==0.0.35) (2026-04-07) ### Highlights * **Skills:** Invoke SDK skills directly from the CLI with `/skill:name` or at startup via `--skill`. Skills are a composable extension point for domain-specific agent behaviors. * **Themes & configuration:** New theme system with color overrides, global dotenv at `~/.deepagents/.env`, and a `DEEPAGENTS_CLI_` env var prefix for conflict-free configuration. * **Auto-updates:** Full update lifecycle — `/update` to upgrade in-place, `/auto-update` to toggle background checks, and a refreshed install script UX. * **Headless workflows:** Agent-friendly UX for scripted/headless invocations, AgentCore Code Interpreter sandbox provider, and improved non-interactive tracing and guidance. * **Performance:** Sub-250ms first paint via aggressive import deferral (pydantic, adapters, heavy SDK modules), markdown stack prewarming, and reduced health-poll intervals. ### Features * Load `~/.deepagents/.env` as global dotenv ([#1909](#1909)) ([5a21d0a](5a21d0a)) * Skill invocation via `/skill:name` ([#2037](#2037)) ([cc8cce7](cc8cce7)) * `--skill` startup invocation ([#2477](#2477)) ([5f0f1d4](5f0f1d4)) * Auto-update lifecycle, `/update` command, install script ux ([#2095](#2095)) ([fd92f6e](fd92f6e)) * `/auto-update` to toggle auto-updates ([#2276](#2276)) ([ad70bde](ad70bde)) * Themes ([#2134](#2134)) ([db67af0](db67af0)) * Allow color overrides on built-in themes, default dark to false ([#2275](#2275)) ([8f71865](8f71865)) * Add `DEEPAGENTS_CLI_` env var prefix and fix dotenv load order ([#2303](#2303)) ([29647bb](29647bb)) * Add `ls_integration` metadata to langsmith traces ([#2272](#2272)) ([5dd8098](5dd8098)) * Add animated spinner to non-interactive verbose mode ([#2001](#2001)) ([153f465](153f465)) * Add async backend support to local context middleware ([#2118](#2118)) ([a0d623c](a0d623c)) * Agent-friendly ux for scripted/headless workflows ([#2271](#2271)) ([386438f](386438f)) * AgentCore Code Interpreter sandbox provider ([#2120](#2120)) ([92556c7](92556c7)) * Context-aware connecting banner for resume and local server ([#2092](#2092)) ([18b385b](18b385b)) * Default langsmith project to `'deepagents-cli'` ([#2277](#2277)) ([7178b87](7178b87)) * Enhance tool-call UI, add `Ctrl+U` shortcut for chat input ([#1757](#1757)) ([800c552](800c552)) * Persist token count in graph state across sessions ([#2323](#2323)) ([5be352d](5be352d)) * Pop queued messages individually on `esc` instead of clearing all ([#2089](#2089)) ([c76d855](c76d855)) * Render ask-user questions as markdown ([#2339](#2339)) ([5fbb14a](5fbb14a)) * Show platform-specific ripgrep install command in missing-tool warning ([#1997](#1997)) ([f000ce5](f000ce5)) * Support root/MDM installs ([#2346](#2346)) ([f618acc](f618acc)) * Surface unsupported input modalities in system prompt ([#2327](#2327)) ([95620e7](95620e7)) ### Bug Fixes * Align headless todo guidance with non-interactive mode ([#2459](#2459)) ([281899b](281899b)) * Disable markup parsing for blocked-link notifications ([#2170](#2170)) ([15867bf](15867bf)) * Dismiss slash command autocomplete on space ([#2478](#2478)) ([02e46bc](02e46bc)) * Eliminate autocomplete popup flicker ([#2020](#2020)) ([4b2db1e](4b2db1e)) * Eliminate trace fragmentation in non-interactive mode ([#2136](#2136)) ([9bddc52](9bddc52)) * Enforce approval toggle when launched with `-y` ([#2278](#2278)) ([28a32b7](28a32b7)) * Escape exception text in rich markup error output ([#2307](#2307)) ([42bccca](42bccca)) * Escape markup in toast notifications ([#2139](#2139)) ([90ccc28](90ccc28)) * Exit app on `ctrl+d` when thread list is empty ([#2270](#2270)) ([e859077](e859077)) * Guard against textual cursor/document desync crash ([#2494](#2494)) ([c14a748](c14a748)) * Human-readable duration and consistent dim styling on teardown screen ([#1995](#1995)) ([901a0a4](901a0a4)) * Mark token count as approximate after interrupted generation ([#2353](#2353)) ([cb9a0c7](cb9a0c7)) * Resolve misleading "missing package" error when provider import fails ([#1960](#1960)) ([b90fbad](b90fbad)) * Open trace in browser immediately when busy ([#2305](#2305)) ([b452032](b452032)) * Patch model identity in system prompt on `/model` swap ([#2024](#2024)) ([36aecbf](36aecbf)) * Harden MCP pre-flight health checks ([#2019](#2019)) ([2b27055](2b27055)) * Pre-flight health checks for MCP servers ([#2008](#2008)) ([30d60e3](30d60e3)) * Prevent premature thinking state with parallel subtasks ([#1858](#1858)) ([189104c](189104c)) * Prevent session stats loss on mid-turn exit ([#2238](#2238)) ([b1807aa](b1807aa)) * Rebind toggle tool output to `ctrl+o` to unblock `cmd+right` ([#2088](#2088)) ([b486fe5](b486fe5)) * Remove duplicate server failure notification ([#2141](#2141)) ([c1cfe72](c1cfe72)) * Remove keybinding overrides that shadow textual built-ins ([#2084](#2084)) ([08fc5d0](08fc5d0)) * Resolve conflicting langsmith env var precedence ([#2455](#2455)) ([b6997d8](b6997d8)) * Show server startup error instead of generic agent message ([#2397](#2397)) ([a3e1e93](a3e1e93)) * Certain slash commands should not require server connection ([#1974](#1974)) ([32bd814](32bd814)) * Sort MCP tools deterministically for prompt-cache stability ([#2497](#2497)) ([39b43cf](39b43cf)) * Squash loading widget timer leak ([#2396](#2396)) ([01d3d86](01d3d86)) * Support pre-release versions in update checker ([#2164](#2164)) ([e18e9dc](e18e9dc)) * Surface clear error for missing sandbox provider deps ([#1999](#1999)) ([939f56a](939f56a)) * Use relative paths in langgraph config for Windows compat ([#2244](#2244)) ([d10dfbd](d10dfbd)) * Warn agent that local filesystem is inaccessible in sandbox mode ([#2274](#2274)) ([a3b61e5](a3b61e5)) * Wire `enable_ask_user` flag to remove tool in non-interactive mode ([#2105](#2105)) ([2399747](2399747)) ### Performance Improvements * Sub 250ms first paint ([#2027](#2027)) ([e42e05c](e42e05c)) * Defer `/model` selector data loading off event loop ([#2259](#2259)) ([a32ce7f](a32ce7f)) * Defer heavy imports from startup path ([#2022](#2022)) ([b7f5a99](b7f5a99)) * Defer pydantic and adapter imports out of startup hot path ([#2269](#2269)) ([0a410b4](0a410b4)) * Prewarm markdown stack and cache skill body render ([#2236](#2236)) ([0a3ba47](0a3ba47)) * Reduce health poll interval for local langgraph dev server ([#2283](#2283)) ([7f5c3de](7f5c3de)) --- _Everything above this line will be the GitHub release body._ --- > [!NOTE] > A **New Contributors** section is appended to the GitHub release notes automatically at publish time (see [Release Pipeline](https://github.com/langchain-ai/deepagents/blob/main/.github/RELEASING.md#release-pipeline), step 2). --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Mason Daugherty <[email protected]>

* fix(infra): pre-commit hook target new `Makefile` path (#2206) This was missed following #2172 * style(evals): deduplicate single `eval_categories` row in job summary (#2207) Fix duplicate `eval_categories` row in the GitHub Actions job summary when a single category is dispatched. Previously, both a raw `(list)` row and a `<ul>` row were always rendered — redundant for single-category runs. * feat(sdk,cli): add openrouter SDK attribution (#2205) Bump `langchain-openrouter` minimum to `0.2.0`. Previously, OpenRouter models routed through the SDK hit `init_chat_model` with no attribution header — only the CLI had those. Now both the CLI and SDK inject app attribution kwargs, with env var overrides (`OPENROUTER_APP_URL`, `OPENROUTER_APP_TITLE`) respected in the SDK path. - Add `check_openrouter_version()` and `_openrouter_attribution_kwargs()` to `deepagents._models` — the SDK now validates `langchain-openrouter >= 0.2.0` at runtime and injects `app_url` / `app_title` defaults for any `openrouter:` prefixed model - `resolve_model` gains an `openrouter:` branch that calls the version check and passes attribution kwargs, mirroring what the CLI already does via `_apply_openrouter_defaults` - Update `_OPENROUTER_APP_URL` in CLI config from the GitHub repo URL to the PyPI project page; add `app_categories: ["cli-agent"]` as a new default attribution field * fix(sdk): route subagent model resolution to `resolve_model` (#2208) `SubAgentMiddleware` was calling `init_chat_model` directly to resolve string model specs, bypassing `resolve_model`. The SDK's centralized entrypoint that applies provider-specific defaults (e.g., OpenAI Responses API, OpenRouter attribution headers). Subagents now route through the same path as top-level agents. * chore(evals): switch nemotron from openrouter to baseten (#2209) * docs(evals): fix stale category references (#2210) Follow-up to #2200 — that PR restructured eval categories from origin-based to capability-based names but left stale references to the old category names (`hitl`, `tool_usage`) in help strings, CI workflow descriptions, and the README test suite table. ## Changes - Replace stale `hitl` and `tool_usage` examples with current category names (`tool_use`, `retrieval`) in the `--eval-category` help text in `conftest.py`, the `radar.py` module docstring, and the `evals.yml` workflow input description - Rewrite the README test suite table: add a `Category` column showing current category assignments, reorder rows by category, and add the previously missing `test_todos.py` entry - Update the "Adding a new category" guide to document the `radar_categories` vs `categories` distinction in `categories.json` and the per-function `@pytest.mark.eval_category(...)` decorator pattern for mixed-category files * chore(evals): switch minimax 2.7 from openrouter to ollama (#2211) * chore(deps): bump requests from 2.32.5 to 2.33.0 in /libs/cli (#2216) Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.32.5&new-version=2.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/deepagents/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(evals): add frontier and fast model group presets (#2221) Add two new model group presets — `frontier` and `fast` — to the unified model registry. `frontier` targets the strongest reasoning models across providers (`claude-opus-4-6`, `gemini-3.1-pro-preview`, `gpt-5.4`), while `fast` targets high-throughput models optimized for speed (`claude-sonnet-4-6`, `gemini-3-flash-preview`, `gpt-5.4-mini`). ## Changes - Add `eval:frontier` / `harbor:frontier` tags to `anthropic:claude-opus-4-6`, `google_genai:gemini-3.1-pro-preview`, and `openai:gpt-5.4` in `REGISTRY` - Add `eval:fast` / `harbor:fast` tags to `anthropic:claude-sonnet-4-6`, `google_genai:gemini-3-flash-preview`, and a new `openai:gpt-5.4-mini` registry entry - Register `frontier` and `fast` in both `_EVAL_PRESETS` and `_HARBOR_PRESETS` - Add `frontier`, `fast`, and `openai:gpt-5.4-mini` to the workflow dispatch dropdown options in `evals.yml` and `harbor.yml` * chore(deps): bump requests from 2.32.5 to 2.33.0 in /examples/content-builder-agent (#2220) Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.32.5&new-version=2.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/deepagents/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the uv group across 4 directories with 1 update (#2222) Bumps the uv group with 1 update in the /examples/nvidia_deep_agent directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /libs/partners/modal directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /libs/partners/quickjs directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /libs/partners/runloop directory: [requests](https://github.com/psf/requests). Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/deepagents/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(sdk): bump recursion limit to 10_000 in deepagents and set agent name (#2194) * bump default recursion limit to 10_000 in deepagents * set agent name Users can control recursion limit for subagents using: ```python agent = create_agent(..) or create_deep_agent(..) agent = agent.with_config({ 'recursion_limit': 100 }) ``` Closes https://github.com/langchain-ai/deepagents/issues/1698 * chore: update dependabot.yml to comply with posture checks (#2224) ## Summary - **Monthly schedule**: change both entries from `weekly` to `monthly` to reduce PR noise while keeping dependencies current - **Update-type split**: replace single wildcard groups with `minor-and-patch` / `major` split so breaking updates arrive in a separate PR from safe updates - **Missing directories**: add 4 uv entries that had `pyproject.toml` + `uv.lock` but were absent from dependabot config: - `libs/partners/modal` - `libs/partners/quickjs` - `libs/partners/runloop` - `examples/nvidia_deep_agent` ## Test plan - [x] Verify dependabot creates PRs at monthly cadence after merge - [x] Confirm major-version updates arrive in a separate PR from minor/patch updates - [x] Confirm the 4 newly added directories start receiving dependency update PRs * chore(evals): switch nemotron 3 to ollama (#2226) * fix(evals): exclude `unit_test` category from radar chart (#2230) The `generate_radar.py` script was adding `unit_test` back to the radar chart despite `categories.json` excluding it from `radar_categories`. The script collects all categories present in result scores, then appends any not already in the ordered list — treating `unit_test` as an "unknown" category rather than a known-excluded one. ## Changes - Filter known-excluded categories (those in `ALL_CATEGORIES` but not `EVAL_CATEGORIES`) from the fallback append in `generate_radar.py:main()`, so `unit_test` scores no longer sneak onto the radar chart * fix(evals): prevent langsmith auto-capture of raw model fixtures (#2231) `@pytest.mark.langsmith` auto-captures test fixture values as LangSmith dataset inputs via `inspect.signature.bind_partial()`. When a test takes `model: BaseChatModel`, this serializes the full Pydantic model config into the dataset example. Tests that call `run_agent()` (from `tests.evals.utils`) as their first action are protected because `run_agent()` calls `t.log_inputs()` internally, replacing the auto-captured blob. Two test suites were vulnerable: tau2 (multi-turn loop calls `run_agent()` per turn but never set test-level inputs) and memory_agent_bench (can `pytest.skip()` before `run_agent()` ever runs). ## Changes - Add `_log_clean_inputs()` helper to memory_agent_bench that calls `t.log_inputs()` with a clean `config` + `model` name dict, wrapped in `contextlib.suppress(Exception)` since these tests can run without LangSmith - Call `_log_clean_inputs()` at the top of `test_conflict_resolution`, `test_time_learning`, and `test_memory_agent_bench_ci` — before `_require_memory_agent_bench_dependencies()` and the `pytest.skip()` on empty samples - Add `t.log_inputs()` twice in `test_tau2_airline`: once before `run_multi_turn()` (safety net if it raises) and once after (overrides per-turn inputs from `run_agent()` with test-level `task_id` + `model`) * chore(infra): harden security comments (#2232) * chore(evals): remove duplicate models from set1 (#2233) Remove duplicate model coverage from `set1` in the eval/harbor model registry. GLM-5 and MiniMax-M2.5 were each represented twice in `set1` — once via Baseten and once via Ollama. Since the Baseten-hosted variants already cover these models, the Ollama entries are redundant and waste CI minutes. * feat(evals): add model groups reference doc and drift test (#2234) Add a `generate_model_groups.py` script that reads the canonical model registry in `.github/scripts/models.py` and renders a human-readable `MODEL_GROUPS.md` listing every eval preset and its member models. This gives contributors a quick reference for which models belong to which eval groups without digging through the registry code. * fix(evals): log field-level diffs on tau2-airline db state mismatch (#2235) When a tau2-airline eval task fails the DB state check, the only signal was a log line showing two truncated hashes — useless for diagnosing *what* diverged. Add a structured diff so failures surface the actual vs. expected field-level discrepancies directly in the log output. ## Changes - Add `_diff_db` helper that recursively walks two `FlightDB.model_dump()` trees and collects human-readable per-field diffs (extra keys, missing keys, value mismatches, list length differences) - `check_db_state` now calls `_diff_db` on mismatch and logs up to 30 diff lines, with a truncation notice if there are more * ci: add minimum workflow permissions and SHA-pin third-party actions (#2223) ## Summary - Add top-level `permissions: contents: read` to three workflow files that were missing it (`auto-label-by-package.yml`, `_benchmark.yml`, `release-please.yml`), preventing GITHUB_TOKEN from inheriting broad org/repo defaults - SHA-pin all 6 unpinned third-party actions to protect against tag-hijacking supply chain attacks: - `pypa/gh-action-pypi-publish@release/v1` → `ed0c5393` (release.yml ×2) - `googleapis/release-please-action@v4` → `c3fc4de0` (release-please.yml) - `astral-sh/setup-uv@v7` → `94527f2e` (release-please.yml) - `dorny/paths-filter@v4` → `fbd0ab8f` (ci.yml) - `CodSpeedHQ/action@v4` → `dfaf2584` (_benchmark.yml) ## Test plan - [x] Verify CI passes on this PR - [x] Confirm `_benchmark.yml` reusable workflow still functions when called from `ci.yml` - [x] Confirm `release-please.yml` jobs still have correct effective permissions (job-level declarations are unchanged) - [x] Confirm PyPI publish jobs in `release.yml` still work with the SHA-pinned action * perf(cli): prewarm markdown stack and cache skill body render (#2236) Prewarm the markdown rendering stack (`markdown_it`, `pygments`, Textual's `Markdown` widget) during app startup so the first `SkillMessage` expand is instant instead of eating ~170 ms of cold-import time. The `SkillMessage` widget also now renders its markdown body at most once — subsequent expand/collapse toggles just flip `display` visibility, skipping redundant parse + highlight work. ## Changes - Add `markdown_it`, `pygments`, and `textual.widgets.Markdown` to `_prewarm_deferred_imports` in `app.py`, including a warm instantiation of the Python lexer to seed Pygments' internal cache - Gate `SkillMessage._update_body_display` behind a `_md_rendered` flag so `Markdown.update(body)` is called only on the first expand — re-collapses and re-expands toggle `display` without re-parsing * refactor(cli): unify file path header in approval widgets (#2237) The `write_file` and `edit_file` approval widgets displayed file path information inconsistently — `write_file` used an unstyled plain-text header while `edit_file` had a styled `File:` header with `+N -M` diff stats. This PR: - Extracts a shared `_file_header()` helper that renders a styled `File: <path> +N -M` header consistently across both widgets - Removes the redundant file path / line-count from the agent's plain-text description strings (it was duplicating what the widget already shows) - Promotes `_format_stats()` and `_count_diff_stats()` from `EditFileApprovalWidget` static methods to module-level functions for reuse <details> <summary><code>write_file</code> — before</summary> <img width="457" height="338" alt="before_write" src="https://github.com/user-attachments/assets/f106946f-ae96-498c-b142-eae6d252e0f9" /> </details> <details> <summary><code>write_file</code> — after</summary> <img width="454" height="301" alt="after_write" src="https://github.com/user-attachments/assets/60e17f4d-f662-4969-b4d6-d8eb8512aa98" /> </details> <details> <summary><code>edit_file</code> — before</summary> <img width="471" height="511" alt="before_edit" src="https://github.com/user-attachments/assets/062057a3-731b-4fa5-b2e6-14dfff08c416" /> </details> <details> <summary><code>edit_file</code> — after</summary> <img width="473" height="500" alt="after_edit" src="https://github.com/user-attachments/assets/6b24b973-5c04-488b-8b5f-4000a5f71089" /> </details> * fix(cli): prevent session stats loss on mid-turn exit (#2238) Fix a race condition where session stats from the active agent turn are lost when the user exits mid-turn (e.g., `Ctrl+D` during a pending tool call). Previously, `execute_task_textual` created `SessionStats` internally and returned it — but if the worker was cancelled before returning, the stats were silently dropped. Now the caller owns the stats object from the start. * style(cli): add semantic skill and tool color tokens (#2242) Introduce dedicated semantic color tokens for skill and tool-call widgets, replacing hardcoded hex values and the overloaded `$panel`/`$secondary`/`$warning` references. Skills get a purple accent and tools get amber — both with distinct hover variants. The unused `primary_dev` / `LC_ORANGE` color pair is removed since the dev-install banner now reuses the `tool` token. * style(cli): drop manual cursor blink toggle from chat input (#2243) Remove the manual `cursor_blink` toggle from `ChatTextArea.set_app_focus`. The `_app_has_focus` flag and the explicit `cursor_blink = has_focus` assignment are no longer needed — Textual handles cursor blink state natively when focus changes. The method still resets `_backslash_pending_time` and re-focuses the widget when the app regains focus. * fix(cli): use relative paths in langgraph config for Windows compat (#2244) Re: https://github.com/langchain-ai/deepagents/discussions/2241 `_scaffold_workspace` passed absolute resolved paths (`Path.resolve()`) as graph and checkpointer refs in the generated `langgraph.json`. On Windows, `importlib.import_module()` receives a backslash path like `C:\Users\...\server_graph` and raises `ModuleNotFoundError`. Since the server subprocess already runs with `cwd=work_dir`, relative `./` refs resolve correctly on all platforms. * feat(sdk): evict large HumanMessages (#2183) * fix(sdk): make created_at and modified_at NotRequired fields on FileData (#2248) * chore(sdk): add snapshot of tool descriptions (#2252) Add snapshot of tool descriptions * chore(sdk): add all snapshots (#2253) Add all snapshots * test(sdk): add a test for invalid args into a tool (#2254) add test for invalid args into a tool * fix(sdk): normalize CRLF line endings in `FilesystemBackend.edit()` (#2256) Closes #2247 --- On Windows, Python's text-mode writes translate `\n` → `\r\n` on disk. `FilesystemBackend.edit()` reads files in text mode (universal newlines → `\n`), but callers like `SummarizationMiddleware` obtain existing content via `download_files()`, which reads in binary mode and preserves the `\r\n` bytes as-is. When that CRLF-containing string is passed as `old_string` to `edit()`, `perform_string_replacement()` fails with "String not found in file" because the line endings don't match. This breaks conversation history offload after the first successful write cycle. This fix normalizes `\r\n` and bare `\r` to `\n` in both `old_string` and `new_string` before replacement, matching the normalization Python's text-mode read already applies to the file content. This is non-breaking: on Unix the strings already contain only `\n` so the `.replace()` calls are no-ops, and on Windows the normalization makes the caller's strings consistent with what `edit()` actually sees on disk. Importantly, this does **not** weaken the exact-match semantics of `perform_string_replacement()` (see [#403 (comment)](https://github.com/langchain-ai/deepagents/issues/403#issuecomment-3997938843)). The match is still exact, just performed after both sides agree on line-ending encoding. * chore(sdk): speed up init for file system, summarization middleware (#2257) This speeds up initialization for file system and summarization middleware * refactor(cli): extract `format_duration` into shared formatting module (#2258) Extract `format_duration` from `textual_adapter.py` into a standalone `formatting.py` module so the loading widget can reuse it. Previously, `LoadingWidget` displayed raw seconds (`"47s"`) even for multi-minute agent runs; it now shows the same human-readable format (`"2m 5s"`, `"1h 23m 4s"`) used in the session-end usage table. Whole-second values under a minute also drop the redundant decimal (`"5s"` instead of `"5.0s"`). * style(cli): show task subagent type badge with separate description line (#2251) Rework how `task` (subagent) tool calls display in the chat UI. Previously the header crammed a truncated description string into the one-line summary, which was noisy and buried the subagent type. Now the header shows a clean `[subagent_type]` badge, and the full task description renders on its own line below in dim italic — easier to scan when multiple subagents are running in parallel. <details> <summary>before</summary> <img width="661" height="458" alt="Screenshot 5" src="https://github.com/user-attachments/assets/6574c87b-f44f-47be-b561-5c401d84e684" /> </details> <details> <summary>after</summary> <img width="636" height="488" alt="Screenshot 1" src="https://github.com/user-attachments/assets/062fb7d0-7d28-463e-b65c-e521266076d8" /> </details> * perf(cli): defer `/model` selector data loading off event loop (#2259) The `/model` selector was blocking the Textual event loop during `ModelSelectorScreen.__init__` — `get_available_models()` and `get_model_profiles()` do filesystem I/O and (on first call) a ~400ms `langchain.chat_models.base` import. This moves all data loading off the event loop so the modal renders instantly, adds a per-module cache to `_load_provider_profiles` to eliminate duplicate work, and makes the startup prewarm unconditional so caches are warm before the user ever types `/model`. * chore(sdk): declare schema up front for remaining tools (#2264) Shaves another 20% from init time for agent creation * chore(sdk): add end-to-end test for compaction tool (#2268) * perf(cli): defer pydantic and adapter imports out of startup hot path (#2269) - Defer heavy imports (`pydantic`, `textual_adapter`, `update_check`) out of the CLI startup hot path so `deepagents -v` and argument parsing stay fast - Construct `TextualUIAdapter` eagerly in `_post_paint_init` (no agent dependency) and fire the import-prewarm worker earlier during `on_mount` so inline imports are dict lookups by the time they run - Cache `get_db_path()` result and thread-selector format functions (`format_path`, `format_timestamp`, `format_relative_timestamp`) to avoid repeated filesystem and deferred-import overhead - Pre-format all visible thread-selector cells in `_compute_column_widths` and pass the cache through to `ThreadOption.compose()` so each cell is formatted exactly once per render pass * fix(cli): exit app on `ctrl+d` when thread list is empty (#2270) When `ctrl+d` is pressed on an empty thread list in the `ThreadSe…

fix(cli): use relative paths in langgraph config for Windows compat

48f7d45

github-actions Bot added cli Related to `deepagents-cli` fix A bug fix (PATCH) internal User is a member of the `langchain-ai` GitHub organization size: XS < 50 LOC labels Mar 26, 2026

Mason Daugherty (mdrxy) enabled auto-merge (squash) March 26, 2026 05:05

Mason Daugherty (mdrxy) merged commit d10dfbd into main Mar 26, 2026
30 checks passed

Mason Daugherty (mdrxy) deleted the mdrxy/cli/relative-path branch March 26, 2026 05:07

github-actions Bot mentioned this pull request Mar 26, 2026

release(deepagents-cli): 0.0.35 #1956

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(cli): use relative paths in langgraph config for Windows compat#2244

fix(cli): use relative paths in langgraph config for Windows compat#2244
Mason Daugherty (mdrxy) merged 1 commit into
mainfrom
mdrxy/cli/relative-path

Mason Daugherty (mdrxy) commented Mar 26, 2026

Uh oh!

codspeed-hq Bot commented Mar 26, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Mason Daugherty (mdrxy) commented Mar 26, 2026

Uh oh!

codspeed-hq Bot commented Mar 26, 2026

Merging this PR will not alter performance

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant