build: bump the python-deps group across 1 directory with 4 updates

[dependabot]

Bumps the python-deps group with 4 updates in the /infra/scripts/agent_scripts directory: agent-framework-core, azure-ai-projects, python-dotenv and aiohttp.

Updates agent-framework-core from 1.0.0rc6 to 1.16.0

Release notes

Sourced from agent-framework-core's releases.

python-1.16.0

[1.16.0] - 2026-08-27

Added

• agent-framework-core: Add configurable timeouts for waiting on the first background-agent task completion (#7908)
• agent-framework-core: Allow programmatic OpenTelemetry service metadata, resource attributes, and OTLP exporter configuration (#7703)

Changed

• agent-framework-foundry-hosting: Update Agent Server dependencies and expose parent FoundryToolbox constructor options (#7921)
• samples: Apply ChatKit attachment lifecycle checks consistently in the end-to-end sample (#7846)

Fixed

• agent-framework-ag-ui, agent-framework-foundry-hosting: Preserve backend-owned service-session snapshots and validate incremental provider continuation input (#7770)
• agent-framework-anthropic, agent-framework-mistral: Preserve unmapped provider finish reasons (#7850)
• agent-framework-azure-ai-search: Preserve the kinds of heterogeneous knowledge sources (#7875)
• agent-framework-core: Prevent workflow checkpoints from being mutated outside storage implementations (#7847)
• agent-framework-core: Discard unsafe Content fields during deep copy (#7903)
• agent-framework-core: Avoid mutating caller input in SerializationMixin.from_dict() (#7901)
• agent-framework-core: Keep the private agent-loop iteration marker out of provider SDK requests (#7860)
• agent-framework-gemini: Preserve unmapped finish reasons and attach usage details to the correct response (#7837)
• agent-framework-openai: Preserve streaming when GenAI instrumentation replaces the raw SDK response (#7705)

python-1.15.0

[1.15.0] - 2026-08-21

Added

• agent-framework-ag-ui, agent-framework-openai: Add optional A2UI support for agent-generated interfaces and preserve streaming tool-call indices for A2UI consumers (#7423)
• agent-framework-core: Add MiddlewareFailure as a first-class fatal signal for function middleware (#7562)
• agent-framework-core, agent-framework-azure-cosmos: Add a process-wide workflow checkpoint type registry, register Cosmos checkpoint state types, and declare the compatibility dependency required by the supported Cosmos SDK floor (#7636)
• agent-framework-core, agent-framework-foundry-hosting: Add steering, retry, and recovery support for resilient Foundry Hosted Agents, with long-running workflow samples (#7670)
• samples: Add the production-ready installment of the build-your-own-claw harness sample (#7698)

Changed

• agent-framework-ag-ui, agent-framework-core: [BREAKING] Consolidate OpenTelemetry GenAI semantic-convention support around stable and experimental modes with explicit message-event controls (#7673)
• agent-framework-ag-ui: Align run continuity and avoid emitting unchanged predictive state snapshots (#7662, #7766)
• agent-framework-core: Defer turn-scoped after_run context providers to the agent-loop boundary (#7289)
• agent-framework-ag-ui, agent-framework-core, agent-framework-declarative: Persist approval state and distinguish absent values from falsey approval data (#7631)
• agent-framework-devui: Forward function_invocation_kwargs through DevUI agent runs (#7779)
• agent-framework-core, samples: Clarify skill script arguments and MCP tool argument-filtering behavior (#7695, #7801)
• tests: Update uv, Ruff, mypy, ty, Flit, and the root build-system dependency range (#7644, #7645, #7780, #7781, #7782, #7783, #7784)
• docs: Clarify PR review resolution and pin the Agent Lightning installation documentation link (#7746, #7693)

Fixed

• agent-framework-a2a, agent-framework-core, agent-framework-orchestrations: Preserve and normalize A2A inputs when used through orchestrations (#7761)
• agent-framework-ag-ui: Preserve tool-message IDs, URL-source attachments, and JSON workflow resume payloads (#7510, #7655, #7684)
• agent-framework-anthropic, agent-framework-core: Preserve structured instructions when merging chat options (#7730)
• agent-framework-core: Preserve all fan-in trace contexts and restrict workflow type deserialization (#7557, #7500)
• agent-framework-core: Avoid remote MCP tool-name shadowing while retaining the documented argument allowlist (#7799)
• agent-framework-core: Always emit an arguments field for zero-argument tool calls in Foundry evaluations (#7734)
• agent-framework-core, agent-framework-github-copilot: Forward telemetry configuration to the GitHub Copilot client (#7625)

... (truncated)

Commits

• 2aa267e .NET: Updating version for dotnet release 1.16.0 (#7441)
• 6a3d535 .NET: Add regression tests and sample guidance for stable agent IDs in checkp...
• 73f48d2 .NET: Add FileMemoryProvider sample to 02-agents/AgentWithMemory (#7401)
• 28389df Python: Move SessionStore to core and persist Foundry Responses sessions (#7306)
• 143386f Python: fix(core): restrict unpickler module-prefix allowlist to types only (...
• 47c8e29 Python: Add FileMemoryProvider context provider sample (#7428)
• 51615d5 Fix DevFlow review comment trigger (#7434)
• 12b2893 Python: Apply header_provider headers to the MCP initialize handshake and oth...
• 93e8cb2 Python: make SerializationMixin.from_dict enforce the documented type check (...
• b64a2e2 Python: add feature-usage User-Agent telemetry (#7420)
• Additional commits viewable in compare view

Updates azure-ai-projects from 2.1.0 to 2.5.0

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates aiohttp from 3.13.5 to 3.14.3

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions