[Evan Mattson (moonbox3)]

Motivation & Context

Consolidates the open Dependabot dependency updates into one maintainer-authored PR so the repository can review one combined dependency rollup instead of reviewing the individual bot PRs separately.

This supersedes Dependabot PRs #5984, #5985, #5986, #5987, #5988, #6614, #6615, #6616, #6726, #6885, #6886, #6887, #6888, and #6889. The older mcp 1.28.0 update from #6615 is superseded by the newer mcp[ws] 1.28.1 update from #6885.

Description & Review Guide

• What are the major changes?
  • Updates pinned GitHub Actions dependencies for cache, download-artifact, paths-filter, prek-action, and pytest-coverage-comment.
  • Updates the .NET Anthropic dependency from 12.20.0 to 12.31.0 and carries over the related unit-test adjustments.
  • Updates Python dev/runtime dependency locks for claude-agent-sdk, typing-extensions, agentlightning, ruff, mcp[ws], pyrefly, and ty, including the type/lint fallout from the individual Dependabot PRs.
• What is the impact of these changes?
  • Keeps dependency metadata and lockfiles current while preserving the same public API surface.
  • Reduces review overhead by replacing the separate Dependabot PR queue with one combined diff.
• What do you want reviewers to focus on?
  • Please spot-check that this faithfully supersedes the listed Dependabot PRs and that CI is green for the combined update.

Related Issue

No linked issue. This is a maintainer dependency-rollup PR that supersedes the open Dependabot PRs listed above.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[github-actions]

Python Test Coverage Report •

File	Stmts	Miss	Cover	Missing
TOTAL	44393	5338	87%

report-only-changed-files is enabled. No files were changed during this commit :)

Python Unit Test Overview

Tests	Skipped	Failures	Errors	Time
8769	33 💤	0 ❌	0 🔥	2m 19s ⏱️

[Copilot]

Pull request overview

This PR consolidates a set of Dependabot updates into a single maintainer-authored dependency rollup across GitHub Actions, the Python workspace/tooling, and the .NET Anthropic SDK, with small follow-up edits to keep type/lint tooling and tests aligned.

Changes:

• Update pinned GitHub Actions SHAs (cache, download-artifact, paths-filter, prek-action, pytest-coverage-comment).
• Roll forward Python dev/runtime tooling pins (ruff/pyrefly/ty/mcp[ws]) and adjust affected ignores/typing in tests and samples.
• Bump the .NET Anthropic package to 12.31.0 and update unit-test stubs to match the newer SDK surface.

Reviewed changes

Copilot reviewed 26 out of 27 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
python/samples/02-agents/devui/workflow_with_agents/init.py	Add pyrefly suppression for sample import.
python/samples/02-agents/devui/workflow_spam/init.py	Add pyrefly suppression for sample import.
python/samples/02-agents/devui/agent_weather/init.py	Add pyrefly suppression for sample import.
python/samples/02-agents/devui/agent_foundry/init.py	Add pyrefly suppression for sample import.
python/pyproject.toml	Bump Python dev tool pins and extend ruff ignore list for new/changed rules.
python/packages/ollama/tests/test_ollama_chat_client.py	Simplify ignores around AsyncMock method reassignment.
python/packages/lab/pyproject.toml	Allow agentlightning 0.3.x (upper bound <0.4.0) and bump ruff pin.
python/packages/foundry_hosting/tests/test_toolbox.py	Adjust ignores around mocking httpx client close behavior.
python/packages/durabletask/tests/test_durable_agent_state.py	Remove ty-specific ignores while keeping TypedDict suppressions.
python/packages/durabletask/tests/integration_tests/test_11_dt_subworkflow.py	Formatting-only change to a long string argument line.
python/packages/core/tests/core/test_types.py	Replace ty-specific TypedDict ignores with casts and refine assertions.
python/packages/core/tests/core/test_mcp.py	Remove ty-specific ignores around mocked methods/attributes.
python/packages/core/tests/core/test_embedding_types.py	Reduce ty-specific ignores for TypedDict usage access.
python/packages/core/tests/core/test_embedding_client.py	Remove ty-specific ignore on GeneratedEmbeddings construction.
python/packages/azurefunctions/tests/test_orchestration.py	Remove ty-specific ignore on Mock method reassignment.
python/packages/ag-ui/tests/ag_ui/test_helpers.py	Add explicit Any typing for test dictionaries.
dotnet/tests/Microsoft.Agents.AI.Anthropic.UnitTests/Extensions/AnthropicClientExtensionsTests.cs	Update test stub to satisfy new Anthropic client interface members.
dotnet/tests/Microsoft.Agents.AI.Anthropic.UnitTests/Extensions/AnthropicBetaServiceExtensionsTests.cs	Update beta service stubs for new SDK service members.
dotnet/Directory.Packages.props	Bump Anthropic NuGet package version to 12.31.0.
.github/workflows/python-test-coverage-report.yml	Update pytest-coverage-comment action pin.
.github/workflows/python-sample-validation.yml	Update download-artifact and cache action pins.
.github/workflows/python-merge-tests.yml	Update paths-filter, cache, and download-artifact action pins.
.github/workflows/python-lab-tests.yml	Update paths-filter action pin.
.github/workflows/python-integration-tests.yml	Update cache and download-artifact action pins.
.github/workflows/python-code-quality.yml	Update prek-action pin.
.github/workflows/dotnet-build-and-test.yml	Update paths-filter, download-artifact, and cache action pins.

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 64% | Result: All clear

Reviewed: Correctness, Security Reliability, Test Coverage, Failure Modes, Design Approach

---

Automated review by moonbox3's agents

[github-actions]

Flagged issue

python/packages/foundry_hosting/tests/test_toolbox.py:148 drops the repo's standard # type: ignore[method-assign] suppression even though test files are still gated by mypy and zuban running in mypy mode (python/scripts/workspace_poe_tasks.py:327-333,381-382). The existing pattern for this exact kind of mocked method reassignment is still # type: ignore[method-assign] in python/packages/core/tests/core/test_mcp.py:2735-2738.

---

Source: automated DevFlow PR review

[github-actions]

Automated Code Review

Reviewers: 5 | Confidence: 66%

✓ Correctness

No actionable issues found in this dimension.

✓ Security Reliability

No actionable issues found in this dimension.

✓ Test Coverage

No actionable issues found in this dimension.

✓ Failure Modes

No actionable issues found in this dimension.

✗ Design Approach

I found one issue in the test-typing fallout: a mocked method reassignment switched to a checker-specific # zuban: ignore comment, but this repo still gates test files with mypy, zuban-in-mypy-mode, pyrefly, ty, and pyright. That narows the suppression compared with the established cross-checker pattern and is likely to make the consolidated dependency update fail the typing gate.

Flagged Issues

• python/packages/foundry_hosting/tests/test_toolbox.py:148 drops the repo's standard # type: ignore[method-assign] suppression even though test files are still gated by mypy and zuban running in mypy mode (python/scripts/workspace_poe_tasks.py:327-333,381-382). The existing pattern for this exact kind of mocked method reassignment is still # type: ignore[method-assign] in python/packages/core/tests/core/test_mcp.py:2735-2738.

---

Automated review by moonbox3's agents