framework-release: agent-framework 1.20.0 → 1.21.0 #1126

agent-framework 1.21.0 is out; the PR lock pins 1.20.0.

Results against the PR lock

agent-framework==1.21.0 does not resolve against the PR lock, so it was installed unconstrained (needs co-bump).
Other locked packages that moved: agent-framework-ag-ui 1.5.0 → 1.5.1, agent-framework-anthropic 1.0.0b261002 → 1.0.0b261008, agent-framework-azure-contentunderstanding 1.0.0b261002 → 1.0.0b261008, agent-framework-bedrock 1.0.0b261002 → 1.0.0b261008, agent-framework-core 1.20.0 → 1.21.0, agent-framework-declarative 1.2.0 → 1.2.1, agent-framework-devui 1.0.0b261002 → 1.0.0b261008, agent-framework-foundry 1.14.0 → 1.14.1, agent-framework-foundry-hosting 1.0.0b261002 → 1.0.0b261008, agent-framework-gemini 1.0.0b261002 → 1.0.0b261008, agent-framework-github-copilot 2.0.1 → 2.0.2, agent-framework-hyperlight 1.0.0b261002 → 1.0.0b261008, agent-framework-monty 1.0.0b261002 → 1.0.0b261008, agent-framework-ollama 1.0.0b261002 → 1.0.0b261008, agent-framework-openai 1.15.0 → 1.16.0, agent-framework-orchestrations 1.3.0 → 1.3.1, agent-framework-purview 1.0.0b261002 → 1.0.0b261008, agent-framework-tools 1.0.0b261002 → 1.0.0b261008, aiohttp 3.14.4 → 3.14.5, anthropic 0.116.0 → 1.13.0, ast-serialize 0.12.1 → 0.13.0, azure-ai-agentserver-responses 2.2.0 → 2.3.0, azure-monitor-opentelemetry-exporter 1.0.0b57 → 1.0.0b58, boto3 1.43.108 → 1.43.113, botocore 1.43.108 → 1.43.113, claude-agent-sdk 0.2.163 → 0.2.166, durabletask 1.11.0 → 1.12.0, durabletask-azuremanaged 1.11.0 → 1.12.0, github-copilot-sdk 1.0.11 → 1.0.21, google-api-core 2.41.0 → 2.42.0, google-auth 2.60.0 → 2.62.0, google-genai 2.28.0 → 2.30.1, httptools 0.8.0 → 0.9.0, iniconfig 2.3.0 → 2.3.1, jsonpath-ng 1.9.1 → 1.10.1, microsoft-opentelemetry 1.3.9 → 1.4.0, multidict 6.9.1 → 7.1.0, numpy 2.5.3 → 2.5.4, openai 3.24.0 → 3.31.0, opentelemetry-api 1.44.0 → 1.45.1, opentelemetry-exporter-otlp-proto-common 1.44.0 → 1.45.1, opentelemetry-exporter-otlp-proto-http 1.44.0 → 1.45.1, opentelemetry-instrumentation 0.65b0 → 0.66b1, opentelemetry-instrumentation-asgi 0.65b0 → 0.66b1, opentelemetry-instrumentation-dbapi 0.65b0 → 0.66b1, opentelemetry-instrumentation-django 0.65b0 → 0.66b1, opentelemetry-instrumentation-fastapi 0.65b0 → 0.66b1, opentelemetry-instrumentation-flask 0.65b0 → 0.66b1, opentelemetry-instrumentation-httpx 0.65b0 → 0.66b1, opentelemetry-instrumentation-logging 0.65b0 → 0.66b1, opentelemetry-instrumentation-psycopg2 0.65b0 → 0.66b1, opentelemetry-instrumentation-requests 0.65b0 → 0.66b1, opentelemetry-instrumentation-urllib 0.65b0 → 0.66b1, opentelemetry-instrumentation-urllib3 0.65b0 → 0.66b1, opentelemetry-instrumentation-wsgi 0.65b0 → 0.66b1, opentelemetry-proto 1.44.0 → 1.45.1, opentelemetry-sdk 1.44.0 → 1.45.1, opentelemetry-semantic-conventions 0.65b0 → 0.66b1, opentelemetry-util-http 0.65b0 → 0.66b1, posthog 7.64.1 → 7.69.0, pycparser 3.0 → 3.11, pydantic 2.13.5 → 2.14.1, pydantic-core 2.46.5 → 2.50.1, ruff 0.16.10 → 0.17.0, sqlalchemy 2.1.3 → 2.1.4, starlette 1.7.0 → 1.8.0, truststore 0.10.4 → 0.10.5.

Run: https://github.com/Donkey-Development-Kit/donkey-development-kit/actions/runs/38549203785

Impact review (AI, advisory)

Risk: low. Recommended action: bump. Confidence: medium.

The only release after 1.20.0 is 1.21.0, and its changelog has no breaking, rename, removal or deprecation entries for the constructors, kwargs, chat_middleware or exception classes the adapter uses. Two streaming fixes sit next to the adapter: delegated provider streams now close when public streams are released (#⁠9100), and streamed log probabilities are preserved across empty chunks (#⁠8997). I read the changelog and release notes but not the diff, so confidence is medium.

Reviewed by claude-sonnet-5-5 in https://github.com/Donkey-Development-Kit/donkey-development-kit/actions/runs/38400097553. Advisory only: this is not verification (§0.3), it never changes a docs/verified-apis.md §8 row, and a maintainer confirms any finding before acting on it.

Next action

Safe to bump. It needs the co-bumps listed above, which the recompile picks up. The nightly lock-refresh PR (lock-refresh.yml) may already carry it. Otherwise, from python/:

1. python scripts/compile_constraints.py
2. python scripts/generate_docs.py
3. python scripts/verify_frameworks.py --only agent_framework --emit-verified, and record the rows in docs/verified-apis.md §8
4. the pre-PR gate (CONTRIBUTING.md §1)

Opened and kept current by framework-release-watch.yml (docs/ci.md). It closes this issue once the lock reaches this version.