chore(deps): batch dependabot updates 2026-06-16

[Tpuljak]

Summary

• Batches all 15 open dependabot dependency updates into a single PR by cherry-picking each one onto a clean branch.
• Lock files (yarn.lock, poetry.lock, go.sum) regenerated and go work sync applied for cross-module consistency.
• Internal deps (api-client-go, toolbox-api-client-go) verified at or above their main baselines — no downgrades.

Notable fixes

• mcp-go v0.32.0 -> v0.54.1 (in the gomod-prod group) changed mcp.Result.Meta from map[string]interface{} to *mcp.Meta. Updated apps/cli/mcp/tools/execute_command.go to use mcp.NewMetaFromMap(...). Folded into the gomod-prod commit.
• Regenerated the four python client lib poetry.lock files after the pip-prod pyproject bumps.
• Forced the transitive launch-editor resolution to 2.14.1 (it is an indirect dependency).

Closes

Closes #4796
Closes #4862
Closes #4956
Closes #4961
Closes #4969
Closes #5018
Closes #5034
Closes #5051
Closes #5056
Closes #5058
Closes #5059
Closes #5060
Closes #5061
Closes #5062
Closes #5063

Validation

• Go apps cross-compiled with CGO_ENABLED=0 GOOS=linux GOARCH=amd64: runner, cli, daemon, proxy, snapshot-manager, ssh-gateway, daytona-e2e, otel-collector/exporter, common-go, sdk-go all build.
• libs/computer-use is not buildable under CGO_ENABLED=0 (robotgo requires CGO) — this is pre-existing on main, unchanged by this PR.
• yarn install produces no lockfile drift; poetry check --lock passes for all locks.

🤖 Generated with Claude Code

---

Summary by cubic

Batch Dependabot updates across Go, Node, Python, Docker, and CI; fixes toolbox file uploads by pinning gin, finalizes Python SDK websocket typing for newer aiohttp, and preserves Python client version pins during OpenAPI generation.

• Dependencies

  • Go: OTel 1.44, go-redis 9.20.1, google.golang.org/grpc 1.81.1 (exporter), minio 7.2.0, golang.org/x/oauth2 0.36.0, coreos/go-oidc 3.18.0, go-playground/validator 10.30.1; CLI uses github.com/mark3labs/mcp-go 0.54.1; internal api-client-go up to 0.189.0; AWS SDK v2 bumps in sdk-go.
  • Node: next 15.5.18, vite 7.3.5, vitest 3.2.6 (+ @vitest/ui 3.2.6), form-data 4.0.6, nodemailer 8.0.9, shell-quote 1.8.4, tar 7.5.16; force launch-editor 2.14.1.
  • Python: aiohttp 3.13.5 (+ aiohttp-retry 2.9.1), pydantic 2.13.4, python-dateutil 2.9.0.post0, typing-extensions 4.15.0, urllib3 2.6.3; dev tools (pytest 8.4.2, tox 4.30.3, mypy 1.19.1); widen aiofiles to <25.2.0 in sdk-python.
  • Docker/CI: base images to golang:1.26.4-alpine, alpine:3.24, python:3.15.0b2-slim; updated ruby/setup-ruby 1.313.0 and apache/skywalking-eyes; lockfiles refreshed; go work sync run.
  • OpenAPI Python clients: ignore generator output for pyproject.toml, requirements.txt, setup.py, and test-requirements.txt to keep manual pins.

• Bug Fixes

  • Pin github.com/gin-gonic/gin to 1.10.1 to resolve 400s on toolbox /files/upload, restoring upload/download flow (daemon, proxy, runner, common-go).
  • Python SDK: cast ws_connect to ClientWebSocketResponse in async process and code interpreter paths to satisfy newer aiohttp typing (Py3.10–3.12).

^{Written for commit df7b7f3. Summary will update on new commits.}

[nx-cloud]

View your CI Pipeline Execution ↗ for commit df7b7f3

Command	Status	Duration	Result
nx e2e:cleanup daytona-e2e	✅ Succeeded	<1s	View ↗
nx run sdk-typescript:test:runtime	✅ Succeeded	3m 27s	View ↗
nx run-many --target=test:e2e --all --nxBail=true	✅ Succeeded	6m 28s	View ↗
nx e2e daytona-e2e	✅ Succeeded	1m 5s	View ↗
nx run-many --target=build --projects=api,runne...	✅ Succeeded	9s	View ↗

💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗

---

☁️ Nx Cloud last updated this comment at 2026-06-19 17:32:36 UTC

[cubic-dev-ai]

3 issues found across 46 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>