[赵瑞哲 (zhaoruizhe81)]

Motivation & Context

The weekly Python - Dependency Maintenance workflow has failed its bounds test for packages/anthropic at lowest-direct resolution every week since 2026-08-03 (last green run: 2026-07-27, immediately before #7342 merged). Because test mode aborts on the first lower-scenario failure, the upper-bound validation and dependency-range updates are skipped every week — only dev-dependency updates survive. The bot-created tracker is #6661.

Root cause: two imports in agent_framework_anthropic reference packages the package never declares:

• _vertex_client.py:23 imports google.auth.credentials under TYPE_CHECKING (used only in parameter annotations at lines 47 and 123). In the dev workspace google-auth arrives transitively (via agent-framework-gemini → google-genai → google-api-core → google-auth), but the bounds test builds an isolated per-package environment containing only the declared dependencies (--resolution lowest-direct), so the import cannot resolve → 4 pyright errors.
• _bedrock_client.py:36 imports boto3 inside _resolve_aws_region (optional runtime import with an ImportError fallback, added by Python: Update Anthropic SDK to 1.11 #9119 on 2026-10-07 — after the last CI run, which is why recent logs show only the 4 vertex errors; the next run shows 8) → 4 more errors.

A static # type: ignore is not viable here: the root config sets reportUnnecessaryTypeIgnoreComment = "error" (python/pyproject.toml), so in dev environments where these packages are installed the ignores would themselves be flagged.

Description & Review Guide

• Major change (reworked per review): boto3>=1.35.0,<2.0.0 and google-auth>=2.0.0,<3.0.0 are no longer runtime dependencies. They are declared in a PEP 735 [dependency-groups] dev group of python/packages/anthropic/pyproject.toml — the same pattern as packages/core, whose dev group exists precisely "so isolated source checks can resolve their APIs". The bounds probe installs every declared dependency group (--group dev) alongside the non-all extras, so the isolated pyright pass resolves both imports, while a plain pip install agent-framework-anthropic no longer pulls boto3/google-auth for Anthropic-only users. No source-code changes.
• uv.lock updated to match: the anthropic entry's dev group is recorded ([package.dev-dependencies] + [package.metadata.requires-dev]), regenerated with the repo-pinned uv 0.12.23; uv lock --locked passes. Branch rebased onto current main.

Related Issue

Fixes #6661

Context on the tracker: #6661 is the auto-generated tracking issue ("Dependency bounds test failed"); its body describes the June packages/core incident, which was fixed by declaring azure-ai-agentserver-core — this PR applies the dev-side equivalent of that pattern to the current failure, which is packages/anthropic. Note this PR fixes the packages/anthropic failure specifically; the gate still has other pre-existing failures documented in #8049 (e.g. packages/azure-contentunderstanding fails at its declared floor), so a full-gate green run needs those addressed separately.

How I verified

Environment: macOS arm64, Python 3.13, uv 0.12.23 (the version required-version now pins in python/pyproject.toml). All commands run from python/.

• Dependency bounds (this patch): uv run python -m scripts.dependencies.validate_dependency_bounds --mode test --package anthropic → packages/anthropic: lower passed, packages/anthropic: upper passed, Test mode completed successfully. Exit code 0.
• Lockfile freshness: uv lock --locked passes under the repo-pinned uv 0.12.23 (which required-version in python/pyproject.toml now enforces).
• Unit tests: unchanged code paths; the package suite was verified green (199 passed) on the earlier iteration of this branch, and the dev group only adds test-visible imports (tests/test_anthropic_provider_clients.py patches boto3.Session).
• Full-gate context check: --mode test (all packages) proceeds past packages/anthropic: lower passed and aborts at packages/azure-contentunderstanding: lower failed (pre-existing, documented in Python: [Bug]: dependency-maintenance upper-bound step has been skipped since Aug 3, freezing every package's dependency bounds #8049) — consistent with this PR not claiming a fully green gate.

AI Assistance

• This is an AI-assisted contribution. I reviewed, understood, and verified all submitted content and accept responsibility for it.

AI assistance details: failure diagnosis (CI log + workflow analysis), patch drafting, and local verification runs were performed with an AI coding agent (Claude Code / ZCode CLI); I reviewed the diff and reproduction steps and accept responsibility for the content.

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR links to an agreed issue with no competing open PR, or the Related Issue section documents a trivial-change or repository-automation exception.
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟡 Changes recommended

The committed uv.lock must be regenerated to include the new dependency edges.

1 open finding

• Regenerate uv.lock to include new runtime dependencies · New

What changed in this PR

Adds missing runtime dependencies to unblock Anthropic dependency-bound validation.

Changes:

• Declares boto3 and google-auth dependencies.
• Ensures isolated Pyright probes can resolve provider imports.

File	Description
python/​packages/​anthropic/​pyproject.toml	Adds AWS and Google authentication dependencies.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[Eduard van Valkenburg (eavanvalkenburg)]

赵瑞哲 (@zhaoruizhe81) These look like test/dependency-bounds requirements rather than runtime dependencies of agent-framework-anthropic. Adding boto3 and google-auth here would install them for users who only connect directly to Anthropic. Please keep them out of the package's runtime dependencies and, if the dependency-bounds test needs them, add them through the test/development dependency path instead.

[赵瑞哲 (zhaoruizhe81)]

@microsoft-github-policy-service agree

[赵瑞哲 (zhaoruizhe81)]

Done — boto3 and google-auth are out of runtime dependencies and now live in a [dependency-groups] dev group (same pattern as packages/core), with uv.lock updated to match. The bounds probe picks up the dev group, so --mode test --package anthropic passes both scenarios again, and a plain pip install agent-framework-anthropic no longer pulls either package. uv lock --locked is clean under uv 0.12.23 and 0.13.0.