If you run agents in Python and your deploy does a fresh pip install -U, the last 48 hours quietly rearranged the floor under you. Three releases landed between July 27 and 29, and each one changes a package almost every agent imports. None of them is a headline. All of them can break a build that upgrades without pins.

Here's the whole week in one screen, then the fixes.

The one thing to do right now#

Pin these before your next unpinned upgrade:

# only after you've confirmed a Python 3.10+ runtime
openai>=2.49,<3
# hold the MCP SDK on v1 until you've run the v2 migration
mcp<2
# let the Anthropic SDK tolerate either MCP major
anthropic>=0.120.2

That's the defensive minimum. The rest of this piece is why each line is there.

1. openai 2.49 drops Python 3.9#

openai-python 2.49.0 shipped on July 27, and its one feature line is blunt: require Python 3.10 and automate version reviews (PR #3537). Support for 3.9 is gone. If any Lambda, base image, or CI runner is still on 3.9 and installs an unpinned openai, the newest wheel targets 3.10+ and simply won't run.

The floor didn't arrive out of nowhere — 2.47.0 (July 21) already required a patched aiohttp on 3.10+, so the direction was set. But 2.49.0 is the cutoff. The fix is a one-liner in either direction: move the runtime to 3.10+, or pin openai<2.49 until you can. Don't discover this from a red deploy.

2. The MCP Python SDK goes breaking v2#

The bigger migration is MCP Python SDK 2.0.0, out July 28. It follows the protocol's stateless turn, and it renames and reshapes enough to warrant a hold:

And the tell that this is a real break, not a cosmetic bump: v1.x is now maintenance mode, security fixes only. Pin mcp<2 in production, then decide deliberately — our MCP Python SDK v1 vs v2 breakdown walks the migration and which version to build on.

The fastest way to know a major release actually broke things is to watch what its dependents shipped the same day.

3. The ripple: anthropic patched twice in one day#

You don't have to take the MCP notes on faith about blast radius. anthropic-sdk-python shipped 0.120.1 to pin mcp<2 defensively, then 0.120.2 to support MCP SDK v2 alongside v1 — both on July 28. If your Anthropic client pulls the MCP extra, upgrade to at least 0.120.2 so it doesn't force one MCP major and can coexist with whichever your server runs.

The upgrade you actually want this week#

Not everything is a landmine. If you're on Pydantic AI, 2.20.0 (July 29) adds claude-opus-5 support the day after the model shipped, wires in OpenAI Responses API reasoning.context for the gpt-5.x families, and fixes two things that bite agent loops: a bare McpError from a server is now recoverable instead of fatal, and Anthropic thinking tokens finally show up in usage accounting. That's a clean pull.

Two honorable mentions from the same window, both verifiable on their release pages: Cline shipped free models across cline 4.0.12 and a native Desktop 0.0.7 (July 28–29), and the Google GenAI Python SDK 2.15.0 (July 29) added audio-transcription config and an enterprise auth mode.

The pattern under all of it: your agent's dependency tree is now moving faster than your deploy cadence. A lockfile — uv.lock, poetry.lock, or a pinned requirements.txt — is the difference between reading this as a checklist and reading it as an incident report. Pin first. Migrate on your schedule, not pip's.