Redoes #48110 on this line. The lock moves mlflow, mlflow-skinny and mlflow-tracing to 3.17.2, pypdf to 6.21.2 and setuptools to 84.1.0 inside their existing ranges. mlflow 3.17.2 and pypdf 6.21.2 are still inside the 3-day exclude-newer window, so they get their own exclude-newer-package cutoffs, matching main. The lock was regenerated with uv 0.11.7
Moves the OpenTelemetry API, SDK and OTLP exporter pins to 1.45.1 and the FastAPI instrumentation to 0.66b1 in every group, logfire to 5.2.0, and splits Pillow so Python 3.11 and newer get 13.0.0 while 3.10 stays on 12.3.0, matching main
traceloop-sdk goes from 0.33.12 to 0.34.0 in the ci group, the version main already uses. Its 0.33.12 instrumentations pin opentelemetry-semantic-conventions below 0.50, which cannot resolve next to the 0.66b1 that OpenTelemetry 1.45.1 and logfire 5.2.0 need
The lock is re-derived on this line with uv 0.11.7. GitPython goes to 3.2.1, graphql-core to 3.2.12, Brotli to 1.2.1 and pypdf to 6.21.1 inside their existing ranges, and the OpenTelemetry 1.45 line pulls in opentelemetry-exporter-http-transport and opentelemetry-exporter-otlp-common. Apart from those, only OpenTelemetry packages and the traceloop instrumentations move
Brotli 1.2.1 is still inside the 3-day release window, so it gets its own exclude-newer-package cutoff
* fix(security): bump grpcio and boto3 so their bundled CA files drop the compromised eMudhra roots
grpc ignores SSL_CERT_FILE and verifies every channel against its own bundled roots.pem. In 1.78.0 that file still trusts emSign ECC Root CA - G3 and AAA Certificate Services, so Vertex AI, Google KMS, Chirp STT and OTLP gRPC exporters (Arize) accept all 14 advisory chains. 1.84.1 is the first release whose roots.pem drops both roots.
botocore uses certifi when it is installed and falls back to its bundled cacert.pem otherwise. Through 1.43.116 that file still trusts AAA Certificate Services. Requiring boto3 1.43.117 pulls in botocore 1.43.117, the first release whose cacert.pem rejects all 14 advisory chains, so the fallback stays safe if certifi is ever absent
* fix(docker): provide OpenSSL 3 when generating Prisma engines
(cherry picked from commit 52166b51a1)
Update certifi, Rust trust roots, and the Docker CA bundle to remove emSign ECC Root CA - G3
Require the fixed certifi release in litellm-core and retain libssl3 in Docker runtimes for Prisma compatibility
Co-authored-by: shin-berri <shin-laptop@berri.ai>
(cherry picked from commit f2118fc767)
Rotating the Speech-to-Text stream at 240 s no longer ends the active turn:
the turn and its billed seconds continue on the new stream, forced at 280 s.
Bound the request and event queues (64 and 256) so a slow peer applies
backpressure instead of growing memory. Route a model to the Chirp realtime
path from its cost-map entry (mode audio_transcription plus /v1/realtime)
instead of a hardcoded name. Return on every branch of the recv and
transform helpers (CodeQL mixed returns), have the shared protocol helper take
the provider's error class so the Meta tests assert MuseProtocolError again,
and pin google-cloud-speech in the ci group so unit shards import it.
Replace the bespoke dependency-install CI gate with a real migration:
require mcp>=2.2.0,<3 alongside httpx2>=2.5.0,<3 and pydantic>=2.12.0,<3
in the proxy and mcp extras, drop langchain-mcp-adapters (pins mcp<2)
from the dev group, and remove the dependency-install workflow and
tests/mcp_dependency_tests that only exercised the old pins.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Bridge OpenAI Realtime transcription sessions on vertex_ai/chirp_* models to
Google Speech-to-Text v2 StreamingRecognize over gRPC, so partial and final
transcripts stream back while audio is still being sent. Interim results become
delta events, finals become completed events carrying billed seconds, the gRPC
stream rotates at 240 s under Google's five-minute cap with billed time chained
across rotations, and audio is split into 25 KB requests.
The OpenAI transcription protocol helpers move into a shared module that Meta
Muse now uses too, google-cloud-speech ships behind a new stt-vertex-chirp extra
bundled into the proxy runtime, and the cost map lists /v1/realtime for chirp_3.
The bedrock-realtime extra pinned aws-sdk-bedrock-runtime 0.7.x, whose Config and BedrockRuntimeClient surface is gone in 0.11. The handler now resolves AsyncBedrockRuntimeConfig, builds AsyncBedrockRuntimeClient with the awscrt duplex transport, closes the client when the session ends, and tells an absent SDK apart from an installed but unsupported version. Moves the pin to >=0.10.0,<0.12.0 with the awscrt extra
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
