build(deps)(deps): bump temporalio from 1.5.0 to 1.20.0 in /apps/guard-api

[dependabot]

Bumps temporalio from 1.5.0 to 1.20.0.

Release notes

Sourced from temporalio's releases.

1.20.0

PyPI

Worker Heartbeating (Public Preview)

This release adds a new feature called Worker Heartbeating. This feature spins up a single nexus-only worker per Client/Namespace/Task Queue in the background and periodically sends some basic metrics over to server for all of the workers registered on the same Client/Namespace/Task Queue.

Server version 1.29.1 and newer supports this feature. This feature will be enabled by default, although this currently requires a server dynamic config flag, --dynamic-config-value frontend.WorkerHeartbeatsEnabled=true to enable. Currently, the only way to interact with this new data is to also enable the flag --dynamic-config-value frontend.ListWorkersEnabled=true, then use CLI commands temporal worker list and temporal worker describe to query the data. If heartbeating is enabled with a server version older or with the config flag off, a single warning log Worker heartbeating configured for runtime, but server version does not support it. on worker startup will emit.

Highlights

• Core was upgraded from 682d441 to 45b1d7e.
• Runtime use across forks now eagerly fails, making it fail in a more obvious way. Specifically, using a Runtime from a different process ID will now eagerly fail.

Breaking changes

• Core crate names have changed, see temporalio/sdk-core#1034 for more details. If users are directly referencing these crate names, like for setting log levels, they will need to be updated to the new names.

Specific Changes

2025-11-17 - 5d1630d - Nexus task cancellation (#1204) 2025-11-17 - ceb7058 - Prevent Runtime use over forks (#1208) 2025-11-21 - 3fd1c7e - Fix up plugin readme (#1211) 2025-11-24 - 6d2924b - Add Summary to Nexus operations (#1219) 2025-11-24 - 77f2346 - use sys.stdlib_module_names in restrictions. Move dynamic import warning to only apply to non-passed through modules (#1222) 2025-11-25 - b5001f9 - Update Core, configure worker types, send plugin names to Core (#1157)

1.19.0

Sandbox Importing Changes

Modules imported after workflows have been loaded into the sandbox now produce a warning message by default. See the Import Notification Policy docs for more info and customization options.

OpenAI Agents Changes

• Add new upper bound of version 0.5.0 for openai-agents

Breaking Changes

• Python 3.9 support has been removed now that it has reached end of life status.
• Plugin interfaces have been updated to use invocation provided callables instead of initializers.
• MCPServerProviders now require a name argument.
• TestModel and TestModelProvider have been moved from temporalio.contrib.openai_agents to temporalio.contrib.openai_agents.test

Specific Changes

2025-09-30 - 4a70f3d - Update version to 1.18.1 (#1135) 2025-10-01 - a31886d - Serialization context (#1102) 2025-10-02 - 4f08626 - Use type in start/execute activity/workflow to address Pyright Strict mode error (#1137)

... (truncated)

Commits

• dbcbc08 1.20.0 (#1227)
• b5001f9 Update Core, configure worker types, send plugin names to Core (#1157)
• 6d2924b Add Summary to Nexus operations (#1219)
• 77f2346 use sys.stdlib_module_names in restrictions. Move dynamic import warning to o...
• 3fd1c7e Fix up plugin readme (#1211)
• 5d1630d Nexus task cancellation (#1204)
• ceb7058 Prevent Runtime use over forks (#1208)
• 11e8650 Update version to 1.19.0 for release (#1214)
• e543e8a fix: typed search contains should work for falsy values (#1206)
• 4156856 fix: typo in time sandboxed utilities (#1205)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #72.