chore(deps): consolidate the safe Dependabot backlog + unbreak lint CI

[lingzhong]

What this is

A single re-locked PR that consolidates the safe (non-major) Dependabot backlog, plus a one-line CI fix that unbreaks the lint job repo-wide.

Merging this lets Dependabot auto-close the safe PRs it supersedes, taking the dependency backlog from 20 → 4 (the remaining 4 are majors, intentionally left for your review).

Lock files were regenerated with uv (floor bumps + uv lock) pinned to the versions Dependabot proposes, rather than merging the individual branches — several of the older Dependabot branches were cut before the grouping config (#109) and the release-please migration (#86) landed, so merging them directly would revert those.

---

1. ci: pin ruff to 0.15.18 in lint workflows

The lint job is currently failing on every open PR in this repo, including Dependabot's own, on unchanged code.

Both lint workflows invoke uvx ruff with no version constraint, so each run installs whatever ruff is newest at that moment. Ruff 0.16 shipped between 2026-07-06 and 2026-07-24 and tightened several rules. Checking out main at 125db55 and running today's ruff reproduces it with no changes applied:

python/x402_a2a          → 99 errors, 1 file would be reformatted
python/examples/adk-demo → 20 errors

Visible on your own Dependabot PRs — #147 (2026-07-06) passed lint; #154 (2026-07-24) and #160 (2026-08-04) both fail it.

Pinning to 0.15.18 restores green CI without touching a single source file, and makes lint reproducible over time. The ruff dev-dependency floor in both pyproject.toml files is now 0.15.18 to match, so local and CI agree.

Maintenance caveat: this pin lives in a run: step, which Dependabot's github-actions ecosystem does not track (it only follows uses: references), so it will not be bumped automatically. Raising it is a one-line edit in both lint workflows.

If you'd rather adopt ruff 0.16 and fix the 99 findings, that's a reasonable alternative — but it's a source-changing PR, separate from this one.

2. chore(deps): ... — the consolidated safe bumps

python/x402_a2a — #112 (pydantic), #135 (dev group: pytest, pytest-asyncio, pytest-mock, trio, ruff), #115 (pytest-cov), #160 (aiohttp), #131 (python-multipart), #154 (pyasn1), #108 (idna), #106 (protobuf), #105 (requests), #104 (werkzeug), #103 (pygments), #101 (flask), #96 (urllib3)

python/examples/adk-demo — #147 (adk-demo-safe group: google-adk, click, uvicorn, web3, cdp-sdk, ruff + cascade), #118 (pytest-cov — satisfied indirectly: the pytest-cov specifier recorded in this workspace's lock is inherited from x402_a2a's dev group via the editable path dependency, and this PR raises it from >=6.2.1 to >=7.1.0. pytest-cov is not itself a resolved package in the adk-demo lock.)

GitHub Actions — #111 (setup-uv v8.1.0, gh-action-pypi-publish v1.14.0, release-please-action v5)

This PR was opened on 2026-06-05 and refreshed on 2026-08-10; #122, #100, #113 and #116 were superseded by #160, #154, #135 and #147 in the interim and are now tracked at the newer versions.

Intentionally excluded (majors → your existing human-review policy)

• chore(deps)(deps): bump x402 from 0.2.0 to 2.8.0 in /python/x402_a2a #117 x402 0.2.0 → 2.8.0 — breaking module reorg (x402.types removed); needs source changes (~7 files).
• chore(deps)(deps): bump a2a-sdk from 0.3.1 to 1.0.2 in /python/x402_a2a #114 a2a-sdk 0.3.1 → 1.0.2 — breaking (TextPart removed from a2a.types); needs source changes.
• chore(deps)(deps): bump starlette from 0.47.2 to 1.3.1 in /python/x402_a2a #133 starlette 0.47.2 → 1.3.1 — major; resolvable but lands a web-framework major.
• chore(deps): bump x402 from 0.2.0 to 2.3.0 in /python/x402_a2a #102 x402 0.2.0 → 2.3.0 — superseded by chore(deps)(deps): bump x402 from 0.2.0 to 2.8.0 in /python/x402_a2a #117.

Verification

• python/x402_a2a: uv lock --check clean · pytest → 3 passed · ruff 0.15.18 check + format clean
• python/examples/adk-demo: uv lock --check clean · ruff 0.15.18 check + format clean
• No Python source files are modified — the diff is locks, pyproject.toml floors, and workflow files only.
• Branches off current main (125db55); no conflicts.

Happy to split the CI pin into its own PR, or to close this entirely if you'd rather merge the individual Dependabot PRs — just say the word.

[gemini-code-assist]

Code Review

This pull request updates various dependencies and development tools across the workspace, including google-adk, click, uvicorn, web3, pydantic, pytest-cov, pytest-mock, trio, mypy, and ruff. The feedback suggests aligning the ruff version constraint to >=0.15.13 in both pyproject.toml files to ensure consistent linting and formatting rules across the project.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.