chore(sdk): speed up init for file system, summarization middleware by eyurtsev · Pull Request #2257 · langchain-ai/deepagents

Eugene Yurtsev (eyurtsev) · 2026-03-26T20:12:38Z

This speeds up initialization for file system and summarization middleware

codspeed-hq · 2026-03-26T20:26:33Z

Merging this PR will not alter performance

✅ 32 untouched benchmarks

_{Comparing eugene/optimization (2bb4f43) with main (69bd21e)}

Copilot

Pull request overview

This PR aims to reduce graph/middleware construction overhead by avoiding repeated tool-schema inference during initialization of the filesystem and summarization middleware, and adds a benchmark to measure filesystem middleware setup cost.

Changes:

Add explicit Pydantic args_schema models for filesystem tools and disable StructuredTool schema inference (infer_schema=False).
Disable schema inference for the compact_conversation summarization tool by providing an explicit (empty) args schema.
Extend benchmarks and adjust make benchmark to run only the benchmarks suite.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

File	Description
libs/deepagents/deepagents/middleware/filesystem.py	Introduces explicit `BaseModel` schemas for filesystem tools and uses them with `StructuredTool.from_function(..., infer_schema=False, args_schema=...)`.
libs/deepagents/deepagents/middleware/summarization.py	Adds an explicit args schema for `compact_conversation` and disables schema inference on tool creation.
libs/deepagents/tests/benchmarks/test_benchmark_create_deep_agent.py	Adds a benchmark for `FilesystemMiddleware()` initialization and renames the minimal agent benchmark.
libs/deepagents/Makefile	Updates the benchmark target to run only `./tests/benchmarks`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-26T20:41:02Z

+
+

CompactConversationSchema is empty, and Pydantic's default extra handling will typically ignore unexpected keys. Since the tool description says it takes no arguments, consider configuring the model to forbid extras so accidental model-supplied args fail fast instead of being silently dropped.

Suggested change

class Config:

"""Pydantic configuration to forbid unexpected fields for this empty schema."""

extra = "forbid"

Copilot · 2026-03-26T20:41:03Z

+class LsSchema(BaseModel):
+    """Input schema for the `ls` tool."""
+
+    path: str = Field(description="Absolute path to the directory to list. Must be absolute, not relative.")
+


These new *Schema models duplicate the parameter descriptions already present in the tool function signatures via Annotated[...]. Now that args_schema is the source of truth (and schema inference is disabled), consider removing or centralizing the duplicated descriptions to avoid future drift between the schema and function docs.

…angchain-ai#2257) This speeds up initialization for file system and summarization middleware

Merges upstream-sync-round8 into master. Upstream commits (10): - test(sdk): add a test for invalid args into a tool (langchain-ai#2254) - chore(sdk): add all snapshots (langchain-ai#2253) - chore(sdk): add snapshot of tool descriptions (langchain-ai#2252) - fix(sdk): normalize CRLF line endings in FilesystemBackend.edit() (langchain-ai#2256) - fix(sdk): make created_at and modified_at NotRequired fields on FileData (langchain-ai#2248) - chore(sdk): speed up init for file system, summarization middleware (langchain-ai#2257) - feat(sdk): evict large HumanMessages (langchain-ai#2183) - refactor(cli): extract format_duration into shared formatting module (langchain-ai#2258) - style(cli): show task subagent type badge with separate description line (langchain-ai#2251) - perf(cli): defer /model selector data loading off event loop (langchain-ai#2259) Local fixes (2): - docs: Add Round 8 merge log and execution checklist - fix(evals,cli): sync category definitions and stabilize flaky tests Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

* fix(infra): pre-commit hook target new `Makefile` path (#2206) This was missed following #2172 * style(evals): deduplicate single `eval_categories` row in job summary (#2207) Fix duplicate `eval_categories` row in the GitHub Actions job summary when a single category is dispatched. Previously, both a raw `(list)` row and a `<ul>` row were always rendered — redundant for single-category runs. * feat(sdk,cli): add openrouter SDK attribution (#2205) Bump `langchain-openrouter` minimum to `0.2.0`. Previously, OpenRouter models routed through the SDK hit `init_chat_model` with no attribution header — only the CLI had those. Now both the CLI and SDK inject app attribution kwargs, with env var overrides (`OPENROUTER_APP_URL`, `OPENROUTER_APP_TITLE`) respected in the SDK path. - Add `check_openrouter_version()` and `_openrouter_attribution_kwargs()` to `deepagents._models` — the SDK now validates `langchain-openrouter >= 0.2.0` at runtime and injects `app_url` / `app_title` defaults for any `openrouter:` prefixed model - `resolve_model` gains an `openrouter:` branch that calls the version check and passes attribution kwargs, mirroring what the CLI already does via `_apply_openrouter_defaults` - Update `_OPENROUTER_APP_URL` in CLI config from the GitHub repo URL to the PyPI project page; add `app_categories: ["cli-agent"]` as a new default attribution field * fix(sdk): route subagent model resolution to `resolve_model` (#2208) `SubAgentMiddleware` was calling `init_chat_model` directly to resolve string model specs, bypassing `resolve_model`. The SDK's centralized entrypoint that applies provider-specific defaults (e.g., OpenAI Responses API, OpenRouter attribution headers). Subagents now route through the same path as top-level agents. * chore(evals): switch nemotron from openrouter to baseten (#2209) * docs(evals): fix stale category references (#2210) Follow-up to #2200 — that PR restructured eval categories from origin-based to capability-based names but left stale references to the old category names (`hitl`, `tool_usage`) in help strings, CI workflow descriptions, and the README test suite table. ## Changes - Replace stale `hitl` and `tool_usage` examples with current category names (`tool_use`, `retrieval`) in the `--eval-category` help text in `conftest.py`, the `radar.py` module docstring, and the `evals.yml` workflow input description - Rewrite the README test suite table: add a `Category` column showing current category assignments, reorder rows by category, and add the previously missing `test_todos.py` entry - Update the "Adding a new category" guide to document the `radar_categories` vs `categories` distinction in `categories.json` and the per-function `@pytest.mark.eval_category(...)` decorator pattern for mixed-category files * chore(evals): switch minimax 2.7 from openrouter to ollama (#2211) * chore(deps): bump requests from 2.32.5 to 2.33.0 in /libs/cli (#2216) Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.32.5&new-version=2.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/deepagents/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(evals): add frontier and fast model group presets (#2221) Add two new model group presets — `frontier` and `fast` — to the unified model registry. `frontier` targets the strongest reasoning models across providers (`claude-opus-4-6`, `gemini-3.1-pro-preview`, `gpt-5.4`), while `fast` targets high-throughput models optimized for speed (`claude-sonnet-4-6`, `gemini-3-flash-preview`, `gpt-5.4-mini`). ## Changes - Add `eval:frontier` / `harbor:frontier` tags to `anthropic:claude-opus-4-6`, `google_genai:gemini-3.1-pro-preview`, and `openai:gpt-5.4` in `REGISTRY` - Add `eval:fast` / `harbor:fast` tags to `anthropic:claude-sonnet-4-6`, `google_genai:gemini-3-flash-preview`, and a new `openai:gpt-5.4-mini` registry entry - Register `frontier` and `fast` in both `_EVAL_PRESETS` and `_HARBOR_PRESETS` - Add `frontier`, `fast`, and `openai:gpt-5.4-mini` to the workflow dispatch dropdown options in `evals.yml` and `harbor.yml` * chore(deps): bump requests from 2.32.5 to 2.33.0 in /examples/content-builder-agent (#2220) Bumps [requests](https://github.com/psf/requests) from 2.32.5 to 2.33.0. <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=uv&previous-version=2.32.5&new-version=2.33.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/deepagents/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump the uv group across 4 directories with 1 update (#2222) Bumps the uv group with 1 update in the /examples/nvidia_deep_agent directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /libs/partners/modal directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /libs/partners/quickjs directory: [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /libs/partners/runloop directory: [requests](https://github.com/psf/requests). Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Updates `requests` from 2.32.5 to 2.33.0 <details> <summary>Release notes</summary> Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>. <blockquote> <h2>v2.33.0</h2> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/M0d3v1"><code>@M0d3v1</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6865">psf/requests#6865</a></li> <li><a href="https://github.com/aminvakil"><code>@aminvakil</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7220">psf/requests#7220</a></li> <li><a href="https://github.com/E8Price"><code>@E8Price</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6960">psf/requests#6960</a></li> <li><a href="https://github.com/mitre88"><code>@mitre88</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7244">psf/requests#7244</a></li> <li><a href="https://github.com/magsen"><code>@magsen</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/6553">psf/requests#6553</a></li> <li><a href="https://github.com/Rohan5commit"><code>@Rohan5commit</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7227">psf/requests#7227</a></li> </ul> Full Changelog: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25">https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25</a> </blockquote> </details> <details> <summary>Changelog</summary> Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>. <blockquote> <h2>2.33.0 (2026-03-25)</h2> Announcements <ul> <li>📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at <a href="https://redirect.github.com/psf/requests/issues/7271">#7271</a>. Give it a try, and report any gaps or feedback you may have in the issue. 📣</li> </ul> Security <ul> <li>CVE-2026-25645 <code>requests.utils.extract_zipped_paths</code> now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.</li> </ul> Improvements <ul> <li>Migrated to a PEP 517 build system using setuptools. (<a href="https://redirect.github.com/psf/requests/issues/7012">#7012</a>)</li> </ul> Bugfixes <ul> <li>Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (<a href="https://redirect.github.com/psf/requests/issues/7205">#7205</a>)</li> </ul> Deprecations <ul> <li>Dropped support for Python 3.9 following its end of support. (<a href="https://redirect.github.com/psf/requests/issues/7196">#7196</a>)</li> </ul> Documentation <ul> <li>Various typo fixes and doc improvements.</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761"><code>bc04dfd</code></a> v2.33.0</li> <li><a href="https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7"><code>66d21cb</code></a> Merge commit from fork</li> <li><a href="https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028"><code>8b9bc8f</code></a> Move badges to top of README (<a href="https://redirect.github.com/psf/requests/issues/7293">#7293</a>)</li> <li><a href="https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286"><code>e331a28</code></a> Remove unused extraction call (<a href="https://redirect.github.com/psf/requests/issues/7292">#7292</a>)</li> <li><a href="https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29"><code>753fd08</code></a> docs: fix FAQ grammar in httplib2 example</li> <li><a href="https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71"><code>774a0b8</code></a> docs(socks): same block as other sections</li> <li><a href="https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303"><code>9c72a41</code></a> Bump github/codeql-action from 4.33.0 to 4.34.1</li> <li><a href="https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be"><code>ebf7190</code></a> Bump github/codeql-action from 4.32.0 to 4.33.0</li> <li><a href="https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798"><code>0e4ae38</code></a> docs: exclude Response.is_permanent_redirect from API docs (<a href="https://redirect.github.com/psf/requests/issues/7244">#7244</a>)</li> <li><a href="https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a"><code>d568f47</code></a> docs: clarify Quickstart POST example (<a href="https://redirect.github.com/psf/requests/issues/6960">#6960</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.32.5...v2.33.0">compare view</a></li> </ul> </details> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/langchain-ai/deepagents/network/alerts). </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix(sdk): bump recursion limit to 10_000 in deepagents and set agent name (#2194) * bump default recursion limit to 10_000 in deepagents * set agent name Users can control recursion limit for subagents using: ```python agent = create_agent(..) or create_deep_agent(..) agent = agent.with_config({ 'recursion_limit': 100 }) ``` Closes https://github.com/langchain-ai/deepagents/issues/1698 * chore: update dependabot.yml to comply with posture checks (#2224) ## Summary - **Monthly schedule**: change both entries from `weekly` to `monthly` to reduce PR noise while keeping dependencies current - **Update-type split**: replace single wildcard groups with `minor-and-patch` / `major` split so breaking updates arrive in a separate PR from safe updates - **Missing directories**: add 4 uv entries that had `pyproject.toml` + `uv.lock` but were absent from dependabot config: - `libs/partners/modal` - `libs/partners/quickjs` - `libs/partners/runloop` - `examples/nvidia_deep_agent` ## Test plan - [x] Verify dependabot creates PRs at monthly cadence after merge - [x] Confirm major-version updates arrive in a separate PR from minor/patch updates - [x] Confirm the 4 newly added directories start receiving dependency update PRs * chore(evals): switch nemotron 3 to ollama (#2226) * fix(evals): exclude `unit_test` category from radar chart (#2230) The `generate_radar.py` script was adding `unit_test` back to the radar chart despite `categories.json` excluding it from `radar_categories`. The script collects all categories present in result scores, then appends any not already in the ordered list — treating `unit_test` as an "unknown" category rather than a known-excluded one. ## Changes - Filter known-excluded categories (those in `ALL_CATEGORIES` but not `EVAL_CATEGORIES`) from the fallback append in `generate_radar.py:main()`, so `unit_test` scores no longer sneak onto the radar chart * fix(evals): prevent langsmith auto-capture of raw model fixtures (#2231) `@pytest.mark.langsmith` auto-captures test fixture values as LangSmith dataset inputs via `inspect.signature.bind_partial()`. When a test takes `model: BaseChatModel`, this serializes the full Pydantic model config into the dataset example. Tests that call `run_agent()` (from `tests.evals.utils`) as their first action are protected because `run_agent()` calls `t.log_inputs()` internally, replacing the auto-captured blob. Two test suites were vulnerable: tau2 (multi-turn loop calls `run_agent()` per turn but never set test-level inputs) and memory_agent_bench (can `pytest.skip()` before `run_agent()` ever runs). ## Changes - Add `_log_clean_inputs()` helper to memory_agent_bench that calls `t.log_inputs()` with a clean `config` + `model` name dict, wrapped in `contextlib.suppress(Exception)` since these tests can run without LangSmith - Call `_log_clean_inputs()` at the top of `test_conflict_resolution`, `test_time_learning`, and `test_memory_agent_bench_ci` — before `_require_memory_agent_bench_dependencies()` and the `pytest.skip()` on empty samples - Add `t.log_inputs()` twice in `test_tau2_airline`: once before `run_multi_turn()` (safety net if it raises) and once after (overrides per-turn inputs from `run_agent()` with test-level `task_id` + `model`) * chore(infra): harden security comments (#2232) * chore(evals): remove duplicate models from set1 (#2233) Remove duplicate model coverage from `set1` in the eval/harbor model registry. GLM-5 and MiniMax-M2.5 were each represented twice in `set1` — once via Baseten and once via Ollama. Since the Baseten-hosted variants already cover these models, the Ollama entries are redundant and waste CI minutes. * feat(evals): add model groups reference doc and drift test (#2234) Add a `generate_model_groups.py` script that reads the canonical model registry in `.github/scripts/models.py` and renders a human-readable `MODEL_GROUPS.md` listing every eval preset and its member models. This gives contributors a quick reference for which models belong to which eval groups without digging through the registry code. * fix(evals): log field-level diffs on tau2-airline db state mismatch (#2235) When a tau2-airline eval task fails the DB state check, the only signal was a log line showing two truncated hashes — useless for diagnosing *what* diverged. Add a structured diff so failures surface the actual vs. expected field-level discrepancies directly in the log output. ## Changes - Add `_diff_db` helper that recursively walks two `FlightDB.model_dump()` trees and collects human-readable per-field diffs (extra keys, missing keys, value mismatches, list length differences) - `check_db_state` now calls `_diff_db` on mismatch and logs up to 30 diff lines, with a truncation notice if there are more * ci: add minimum workflow permissions and SHA-pin third-party actions (#2223) ## Summary - Add top-level `permissions: contents: read` to three workflow files that were missing it (`auto-label-by-package.yml`, `_benchmark.yml`, `release-please.yml`), preventing GITHUB_TOKEN from inheriting broad org/repo defaults - SHA-pin all 6 unpinned third-party actions to protect against tag-hijacking supply chain attacks: - `pypa/gh-action-pypi-publish@release/v1` → `ed0c5393` (release.yml ×2) - `googleapis/release-please-action@v4` → `c3fc4de0` (release-please.yml) - `astral-sh/setup-uv@v7` → `94527f2e` (release-please.yml) - `dorny/paths-filter@v4` → `fbd0ab8f` (ci.yml) - `CodSpeedHQ/action@v4` → `dfaf2584` (_benchmark.yml) ## Test plan - [x] Verify CI passes on this PR - [x] Confirm `_benchmark.yml` reusable workflow still functions when called from `ci.yml` - [x] Confirm `release-please.yml` jobs still have correct effective permissions (job-level declarations are unchanged) - [x] Confirm PyPI publish jobs in `release.yml` still work with the SHA-pinned action * perf(cli): prewarm markdown stack and cache skill body render (#2236) Prewarm the markdown rendering stack (`markdown_it`, `pygments`, Textual's `Markdown` widget) during app startup so the first `SkillMessage` expand is instant instead of eating ~170 ms of cold-import time. The `SkillMessage` widget also now renders its markdown body at most once — subsequent expand/collapse toggles just flip `display` visibility, skipping redundant parse + highlight work. ## Changes - Add `markdown_it`, `pygments`, and `textual.widgets.Markdown` to `_prewarm_deferred_imports` in `app.py`, including a warm instantiation of the Python lexer to seed Pygments' internal cache - Gate `SkillMessage._update_body_display` behind a `_md_rendered` flag so `Markdown.update(body)` is called only on the first expand — re-collapses and re-expands toggle `display` without re-parsing * refactor(cli): unify file path header in approval widgets (#2237) The `write_file` and `edit_file` approval widgets displayed file path information inconsistently — `write_file` used an unstyled plain-text header while `edit_file` had a styled `File:` header with `+N -M` diff stats. This PR: - Extracts a shared `_file_header()` helper that renders a styled `File: <path> +N -M` header consistently across both widgets - Removes the redundant file path / line-count from the agent's plain-text description strings (it was duplicating what the widget already shows) - Promotes `_format_stats()` and `_count_diff_stats()` from `EditFileApprovalWidget` static methods to module-level functions for reuse <details> <summary><code>write_file</code> — before</summary> <img width="457" height="338" alt="before_write" src="https://github.com/user-attachments/assets/f106946f-ae96-498c-b142-eae6d252e0f9" /> </details> <details> <summary><code>write_file</code> — after</summary> <img width="454" height="301" alt="after_write" src="https://github.com/user-attachments/assets/60e17f4d-f662-4969-b4d6-d8eb8512aa98" /> </details> <details> <summary><code>edit_file</code> — before</summary> <img width="471" height="511" alt="before_edit" src="https://github.com/user-attachments/assets/062057a3-731b-4fa5-b2e6-14dfff08c416" /> </details> <details> <summary><code>edit_file</code> — after</summary> <img width="473" height="500" alt="after_edit" src="https://github.com/user-attachments/assets/6b24b973-5c04-488b-8b5f-4000a5f71089" /> </details> * fix(cli): prevent session stats loss on mid-turn exit (#2238) Fix a race condition where session stats from the active agent turn are lost when the user exits mid-turn (e.g., `Ctrl+D` during a pending tool call). Previously, `execute_task_textual` created `SessionStats` internally and returned it — but if the worker was cancelled before returning, the stats were silently dropped. Now the caller owns the stats object from the start. * style(cli): add semantic skill and tool color tokens (#2242) Introduce dedicated semantic color tokens for skill and tool-call widgets, replacing hardcoded hex values and the overloaded `$panel`/`$secondary`/`$warning` references. Skills get a purple accent and tools get amber — both with distinct hover variants. The unused `primary_dev` / `LC_ORANGE` color pair is removed since the dev-install banner now reuses the `tool` token. * style(cli): drop manual cursor blink toggle from chat input (#2243) Remove the manual `cursor_blink` toggle from `ChatTextArea.set_app_focus`. The `_app_has_focus` flag and the explicit `cursor_blink = has_focus` assignment are no longer needed — Textual handles cursor blink state natively when focus changes. The method still resets `_backslash_pending_time` and re-focuses the widget when the app regains focus. * fix(cli): use relative paths in langgraph config for Windows compat (#2244) Re: https://github.com/langchain-ai/deepagents/discussions/2241 `_scaffold_workspace` passed absolute resolved paths (`Path.resolve()`) as graph and checkpointer refs in the generated `langgraph.json`. On Windows, `importlib.import_module()` receives a backslash path like `C:\Users\...\server_graph` and raises `ModuleNotFoundError`. Since the server subprocess already runs with `cwd=work_dir`, relative `./` refs resolve correctly on all platforms. * feat(sdk): evict large HumanMessages (#2183) * fix(sdk): make created_at and modified_at NotRequired fields on FileData (#2248) * chore(sdk): add snapshot of tool descriptions (#2252) Add snapshot of tool descriptions * chore(sdk): add all snapshots (#2253) Add all snapshots * test(sdk): add a test for invalid args into a tool (#2254) add test for invalid args into a tool * fix(sdk): normalize CRLF line endings in `FilesystemBackend.edit()` (#2256) Closes #2247 --- On Windows, Python's text-mode writes translate `\n` → `\r\n` on disk. `FilesystemBackend.edit()` reads files in text mode (universal newlines → `\n`), but callers like `SummarizationMiddleware` obtain existing content via `download_files()`, which reads in binary mode and preserves the `\r\n` bytes as-is. When that CRLF-containing string is passed as `old_string` to `edit()`, `perform_string_replacement()` fails with "String not found in file" because the line endings don't match. This breaks conversation history offload after the first successful write cycle. This fix normalizes `\r\n` and bare `\r` to `\n` in both `old_string` and `new_string` before replacement, matching the normalization Python's text-mode read already applies to the file content. This is non-breaking: on Unix the strings already contain only `\n` so the `.replace()` calls are no-ops, and on Windows the normalization makes the caller's strings consistent with what `edit()` actually sees on disk. Importantly, this does **not** weaken the exact-match semantics of `perform_string_replacement()` (see [#403 (comment)](https://github.com/langchain-ai/deepagents/issues/403#issuecomment-3997938843)). The match is still exact, just performed after both sides agree on line-ending encoding. * chore(sdk): speed up init for file system, summarization middleware (#2257) This speeds up initialization for file system and summarization middleware * refactor(cli): extract `format_duration` into shared formatting module (#2258) Extract `format_duration` from `textual_adapter.py` into a standalone `formatting.py` module so the loading widget can reuse it. Previously, `LoadingWidget` displayed raw seconds (`"47s"`) even for multi-minute agent runs; it now shows the same human-readable format (`"2m 5s"`, `"1h 23m 4s"`) used in the session-end usage table. Whole-second values under a minute also drop the redundant decimal (`"5s"` instead of `"5.0s"`). * style(cli): show task subagent type badge with separate description line (#2251) Rework how `task` (subagent) tool calls display in the chat UI. Previously the header crammed a truncated description string into the one-line summary, which was noisy and buried the subagent type. Now the header shows a clean `[subagent_type]` badge, and the full task description renders on its own line below in dim italic — easier to scan when multiple subagents are running in parallel. <details> <summary>before</summary> <img width="661" height="458" alt="Screenshot 5" src="https://github.com/user-attachments/assets/6574c87b-f44f-47be-b561-5c401d84e684" /> </details> <details> <summary>after</summary> <img width="636" height="488" alt="Screenshot 1" src="https://github.com/user-attachments/assets/062fb7d0-7d28-463e-b65c-e521266076d8" /> </details> * perf(cli): defer `/model` selector data loading off event loop (#2259) The `/model` selector was blocking the Textual event loop during `ModelSelectorScreen.__init__` — `get_available_models()` and `get_model_profiles()` do filesystem I/O and (on first call) a ~400ms `langchain.chat_models.base` import. This moves all data loading off the event loop so the modal renders instantly, adds a per-module cache to `_load_provider_profiles` to eliminate duplicate work, and makes the startup prewarm unconditional so caches are warm before the user ever types `/model`. * chore(sdk): declare schema up front for remaining tools (#2264) Shaves another 20% from init time for agent creation * chore(sdk): add end-to-end test for compaction tool (#2268) * perf(cli): defer pydantic and adapter imports out of startup hot path (#2269) - Defer heavy imports (`pydantic`, `textual_adapter`, `update_check`) out of the CLI startup hot path so `deepagents -v` and argument parsing stay fast - Construct `TextualUIAdapter` eagerly in `_post_paint_init` (no agent dependency) and fire the import-prewarm worker earlier during `on_mount` so inline imports are dict lookups by the time they run - Cache `get_db_path()` result and thread-selector format functions (`format_path`, `format_timestamp`, `format_relative_timestamp`) to avoid repeated filesystem and deferred-import overhead - Pre-format all visible thread-selector cells in `_compute_column_widths` and pass the cache through to `ThreadOption.compose()` so each cell is formatted exactly once per render pass * fix(cli): exit app on `ctrl+d` when thread list is empty (#2270) When `ctrl+d` is pressed on an empty thread list in the `ThreadSe…

Eugene Yurtsev (eyurtsev) added 11 commits March 26, 2026 11:02

x

4668bea

x

9790dd4

meow

7775050

x

76686b1

x

fdf14cf

x

75c8ed6

x

6d4e973

Merge branch 'main' into eugene/optimization

986c567

Merge branch 'main' into eugene/optimization

dd50e78

x

04263ce

x

d82d2c9

Eugene Yurtsev (eyurtsev) changed the title ~~chore(sdk): speed up init for file system middleware~~ chore(sdk): speed up init for file system, summarization middleware Mar 26, 2026

github-actions Bot added deepagents Related to the `deepagents` SDK / agent harness infra Repo meta changes internal User is a member of the `langchain-ai` GitHub organization size: S 50-199 LOC labels Mar 26, 2026

Eugene Yurtsev (eyurtsev) added 2 commits March 26, 2026 16:14

Merge branch 'main' into eugene/optimization

b08dd2d

x

dfb8143

x

2bb4f43

Eugene Yurtsev (eyurtsev) marked this pull request as ready for review March 26, 2026 20:30

Copilot AI review requested due to automatic review settings March 26, 2026 20:30

Copilot started reviewing on behalf of Eugene Yurtsev (eyurtsev) March 26, 2026 20:31 View session

Eugene Yurtsev (eyurtsev) enabled auto-merge (squash) March 26, 2026 20:31

Eugene Yurtsev (eyurtsev) merged commit f69761b into main Mar 26, 2026
32 checks passed

Eugene Yurtsev (eyurtsev) deleted the eugene/optimization branch March 26, 2026 20:36

Copilot AI reviewed Mar 26, 2026

View reviewed changes

ccurme (ccurme) mentioned this pull request Mar 27, 2026

chore(sdk): add end-to-end test for compaction tool #2268

Merged

james8814 pushed a commit to james8814/deepagents that referenced this pull request Mar 28, 2026

chore(sdk): speed up init for file system, summarization middleware (l…

28803fb

…angchain-ai#2257) This speeds up initialization for file system and summarization middleware

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(sdk): speed up init for file system, summarization middleware#2257

chore(sdk): speed up init for file system, summarization middleware#2257
Eugene Yurtsev (eyurtsev) merged 14 commits into
mainfrom
eugene/optimization

Eugene Yurtsev (eyurtsev) commented Mar 26, 2026 •

edited

Loading

Uh oh!

codspeed-hq Bot commented Mar 26, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Copilot AI Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

+    class Config:
+        """Pydantic configuration to forbid unexpected fields for this empty schema."""
+        extra = "forbid"

Uh oh!

Conversation

Eugene Yurtsev (eyurtsev) commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codspeed-hq Bot commented Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 26, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Eugene Yurtsev (eyurtsev) commented Mar 26, 2026 •

edited

Loading

codspeed-hq Bot commented Mar 26, 2026 •

edited

Loading