chore(backend/deps): bump the production-dependencies group across 1 directory with 41 updates

[dependabot]

Bumps the production-dependencies group with 41 updates in the /autogpt_platform/backend directory:

Package	From	To
aiohttp	3.13.3	3.14.3
agentmail	0.4.7	0.5.9
anthropic	0.79.0	0.121.0
apscheduler	3.11.2	3.11.3
bleach	6.3.0	6.4.0
claude-agent-sdk	0.1.64	0.2.134
click	8.3.1	8.4.2
discord-py	2.6.4	2.7.1
e2b	2.15.2	2.37.1
e2b-code-interpreter	2.4.1	2.9.0
fastapi	0.128.7	0.128.8
feedparser	6.0.12	6.0.14
google-api-python-client	2.189.0	2.198.0
google-auth-oauthlib	1.2.4	1.4.0
google-cloud-storage	3.9.0	3.13.1
graphiti-core	0.28.2	0.29.3
launchdarkly-server-sdk	9.15.0	9.16.1
ollama	0.6.1	0.6.2
orjson	3.11.7	3.11.9
pika	1.3.2	1.4.4
prometheus-client	0.24.1	0.26.0
psycopg2-binary	2.9.11	2.9.12
pydantic	2.12.5	2.13.4
pydantic-settings	2.12.0	2.15.0
pytest-asyncio	1.3.0	1.4.0
python-dotenv	1.2.1	1.2.2
python-multipart	0.0.22	0.0.32
sentry-sdk	2.52.0	2.66.1
sqlalchemy	2.0.46	2.0.51
tweepy	4.16.0	4.17.0
uvicorn	0.40.0	0.52.1
tiktoken	0.12.0	0.13.0
gcloud-aio-storage	9.6.1	9.6.4
firecrawl-py	4.14.0	4.34.0
croniter	6.0.0	6.2.4
stagehand	3.7.0	3.22.0
posthog	7.19.2	7.38.3
fpdf2	2.8.6	2.8.7
langsmith	0.8.18	0.10.17
pymysql	1.1.2	1.2.0
pypdfium2	5.8.0	5.12.1

Updates aiohttp from 3.13.3 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

• Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

  Related issues and pull requests on GitHub: :issue:13180.

• Fixed error message construction in the C HTTP parser -- by :user:bdraco.

  Related issues and pull requests on GitHub: :issue:13222.

---

3.14.2 (2026-07-20)

Bug fixes

• Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

  Related issues and pull requests on GitHub: :issue:5303.

• Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

  Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

• 5e392ce Release v3.14.3 (#13225)
• 49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
• 240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
• d93f30a Bump version (#13202)
• c1b9212 Release v3.14.2 (#13201)
• 380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
• e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
• aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
• 71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
• 64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
• Additional commits viewable in compare view

Updates agentmail from 0.4.7 to 0.5.9

Commits

• 16924c1 Release 0.5.9
• e89f3bc Release 0.5.8
• 5746bb7 Release 0.5.7
• 947ba09 Release 0.5.6
• 967b362 Release 0.5.5
• 76647d2 Release 0.5.4
• 27173b5 Release 0.5.3
• 170ef6f Release 0.5.2
• 656be09 Release 0.5.1
• 232744b Release 0.5.0
• Additional commits viewable in compare view

Updates anthropic from 0.79.0 to 0.121.0

Release notes

Sourced from anthropic's releases.

v0.121.0

0.121.0 (2026-08-07)

Full Changelog: v0.120.2...v0.121.0

Features

• api: add mid-conversation-tool-changes-2026-07-01 beta (c7d1531)
• api: add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (193bae0)

Chores

• api: remove retired Claude Opus 4.1 models (5352a33)
• docs: small updates to descriptions (b8d4176)
• docs: updates to a few documentation strings (3a5dd69)
• ensure all dependencies have major version constraints (#274) (d52999b)

v0.120.2

0.120.2 (2026-07-28)

Full Changelog: v0.120.1...v0.120.2

Bug Fixes

• mcp: support mcp sdk v2 alongside v1 (#300) (177f88c)

v0.120.1

0.120.1 (2026-07-28)

Full Changelog: v0.120.0...v0.120.1

Bug Fixes

• mcp: pin mcp extra to <2 (#1783) (fb66371)

v0.120.0

0.120.0 (2026-07-24)

Full Changelog: v0.119.0...v0.120.0

Features

• api: add claude-opus-5 model (bf4e31c)
• api: add tool addition/removal blocks and tool_change events (bf4e31c)
• api: expand client-side fallback credit token types and add server-side fallbacks default option (bf4e31c)

v0.119.0

0.119.0 (2026-07-23)

... (truncated)

Changelog

Sourced from anthropic's changelog.

0.121.0 (2026-08-07)

Full Changelog: v0.120.2...v0.121.0

Features

• api: add mid-conversation-tool-changes-2026-07-01 beta (c7d1531)
• api: add support for session budgets, advisor tool, pinned inference location and skills auto-loading from GitHub (193bae0)

Chores

• api: remove retired Claude Opus 4.1 models (5352a33)
• docs: small updates to descriptions (b8d4176)
• docs: updates to a few documentation strings (3a5dd69)
• ensure all dependencies have major version constraints (#274) (d52999b)

0.120.2 (2026-07-28)

Full Changelog: v0.120.1...v0.120.2

Bug Fixes

• mcp: support mcp sdk v2 alongside v1 (#300) (177f88c)

0.120.1 (2026-07-28)

Full Changelog: v0.120.0...v0.120.1

Bug Fixes

• mcp: pin mcp extra to <2 (#1783) (fb66371)

0.120.0 (2026-07-24)

Full Changelog: v0.119.0...v0.120.0

Features

• api: add claude-opus-5 model (bf4e31c)
• api: add tool addition/removal blocks and tool_change events (bf4e31c)
• api: expand client-side fallback credit token types and add server-side fallbacks default option (bf4e31c)

0.119.0 (2026-07-23)

Full Changelog: v0.118.0...v0.119.0

Features

• api: add new stop reason 'model_context_window_exceeded' (d983cde)

... (truncated)

Commits

• 204fa8e release: 0.121.0
• 284a537 feat(api): add support for session budgets, advisor tool, pinned inference lo...
• de568f2 chore(docs): updates to a few documentation strings
• e271587 chore(api): remove retired Claude Opus 4.1 models
• 3d4115e chore: ensure all dependencies have major version constraints (#274)
• 5840eaa chore(docs): small updates to descriptions
• b4cfb5e feat(api): add mid-conversation-tool-changes-2026-07-01 beta
• f5c30d0 release: 0.120.2
• 8b327c3 fix(mcp): support mcp sdk v2 alongside v1 (#300)
• 3b65b23 release: 0.120.1
• Additional commits viewable in compare view

Updates apscheduler from 3.11.2 to 3.11.3

Release notes

Sourced from apscheduler's releases.

3.11.3

• Fixed sub-minute interval jobs stalling for the duration of a DST spring-forward gap when the scheduler was configured with a ZoneInfo time zone, caused by the wakeup delay being computed from the naive wall-clock difference instead of the actual UTC difference (#1103)
• Fixed imported jobs missing their scheduler and job store links (#1119)

Commits

• 4308ec9 Added the release version
• ff68780 Added a note about weekday numbers in CronTrigger.from_crontab()
• 36936e9 Updated actions
• c0ff7e4 Fixed Pyside6 tests failing on Python 3.9 and 3.8
• 1b782c9 Fixed fixture coreapp not found
• dc3dde4 Test against PySide6 on all Python versions
• 18a6f6b Fixed imported jobs missing their scheduler and job store links
• 1693db4 Fix interval jobs stalling across DST spring-forward with ZoneInfo (#1114)
• 0636bf4 Added Python 3.14 to the test matrix
• 3eb3de8 Fixed bad use of pytest.raises()
• Additional commits viewable in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

• Dropped support for pypy 3.10. (#764)

Security fixes

• Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

  Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

  For example::

  import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

  outputs::

  'Click'

  See the advisory for details.

• Fix GHSA-gj48-438w-jh9v.

  Fix issue where URI sanitization wasn't happening in formaction attributes.

  See the advisory for details.

Bug fixes

• Add support for pypy 3.11. (#764)

• Drop version max in tinycss2 pin. (#772)

  This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits

• f0355a7 fix: fix last release date in CHANGES
• ae4e8a2 chore: bleach 6.4.0 and final release
• 970df58 fix: uri-sanitization in formaction attributes
• 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
• 913ab75 fix: reduce redundancy in workflow jobs
• 218c15a fix: rework pip caching
• 4f0b097 fix: fix tox platform restrictions
• e95a79d chore: update pytest
• 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
• cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
• Additional commits viewable in compare view

Updates claude-agent-sdk from 0.1.64 to 0.2.134

Release notes

Sourced from claude-agent-sdk's releases.

v0.2.134

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.226

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.134/

pip install claude-agent-sdk==0.2.134

v0.2.133

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.225

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.133/

pip install claude-agent-sdk==0.2.133

v0.2.132

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.224

---

PyPI: https://pypi.org/project/claude-agent-sdk/0.2.132/

pip install claude-agent-sdk==0.2.132

v0.2.131

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.223

... (truncated)

Changelog

Sourced from claude-agent-sdk's changelog.

0.2.134

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.226

0.2.133

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.225

0.2.132

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.224

0.2.131

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.223

0.2.130

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.222

0.2.129

Breaking Changes

• Skill name validation in ClaudeAgentOptions.skills: Skill names containing parentheses, commas, control characters, wildcards (*, :*), leading /, surrounding whitespace, or surrogate code points now raise ValueError at connect time. skills=["plugin:*"] and skills=["*"] should be replaced with skills="all" or a Skill(...) rule in allowed_tools. Names with leading whitespace or / previously built rules that could never match (silently disabling the skill) and now raise explicitly (#1145)

Bug Fixes

• Validated skill names to prevent --allowedTools injection: Skill names from ClaudeAgentOptions(skills=[...]) were passed unchecked into the CLI's --allowedTools value, which splits on commas and spaces. A crafted name could inject extra permission rules. The transport now validates each name and rejects delimiter-carrying or malformed values (#1145)

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.221

0.2.128

Internal/Other Changes

• Updated bundled Claude CLI to version 2.1.220

... (truncated)

Commits

• 0982371 docs: update changelog for v0.2.134
• af03cc3 chore: release v0.2.134
• a20f44d chore: bump bundled CLI version to 2.1.226
• d58db4f docs: update changelog for v0.2.133
• 5a7a706 chore: release v0.2.133
• 2c643ad chore: bump bundled CLI version to 2.1.225
• 6c754df docs: update changelog for v0.2.132
• 7d28ac3 chore: release v0.2.132
• b95e101 chore: bump bundled CLI version to 2.1.224
• 71142da docs: update changelog for v0.2.131
• Additional commits viewable in compare view

Updates click from 8.3.1 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

• Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582

8.4.1

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-1 Milestone: https://github.com/pallets/click/milestone/32

• get_parameter_source() is available during eager callbacks and type conversion again. #3458 #3484
• Zsh completion scripts parse correctly on Windows. #3277 # 3466
• Shell completion of Choice Enum values produces a valid completion result. #3015
• Fix empty byte-string handling in echo. #3487
• Fix closed file error with echo_via_pager. #3449

8.4.0

This is the Click 8.4.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our [Version Support Policy][version] on our website.

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.4.2

Released 2026-06-24

• Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
• Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
• A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
• echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
• echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533
• Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. {pr}3578
• {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. {issue}2331 {issue}1884 {issue}3125 {pr}3582

Version 8.4.1

Released 2026-05-21

• get_parameter_source() is available during eager callbacks and type conversion again. {issue}3458 {pr}3484
• Zsh completion scripts parse correctly on Windows. {issue}3277 {pr}3466
• Shell completion of Enum values used as Choice options produces a valid completion result. {issue}3015 {pr}3471
• Fix empty byte-string handling in echo. {issue}3487 {pr}3493
• Fix closed file error with echo_via_pager. {issue}3449 {pr}3482
• Fix open_url on Windows when the file path contains spaces. {issue}2994 {pr}3478

Version 8.4.0

Released 2026-05-17

• {class}ParamType typing improvements. {pr}3371

  • {class}ParamType is now a generic abstract base class,

... (truncated)

Commits

• b2e30a1 Release version 8.4.2
• 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
• bec5928 Fix package_name resolution when top-level module differs from distribution...
• 916883a Fix tests to not rely on -Wdefault option (#3591)
• 09195f6 Fix double-bracketing of choices in synopsis (#3578)
• 1557e26 Check for warning exception with idiomatic context manager
• d9ff133 Static typing improvements in click.shell_completion (#3460)
• 762c97e Fix double-bracketing of choices in synopsis
• 8929d39 Convert changes to markdown. (#3559)
• 237be50 Move changes headings down a level.
• Additional commits viewable in compare view

Updates discord-py from 2.6.4 to 2.7.1

Commits

• dfd1144 Version bump to v2.7.1
• 64fcfe9 Add changelog for v2.7.1
• 9cf04ae Add warning and raise if davey is not installed
• 92c715e Unpin strict davey dependency
• 2383467 Show davey version in --version output
• 699a97f Fix aiohttp websocket timeout deprecation warning
• b01de35 Remove old workaround to /callback not having a return type
• 6161378 Fix memory leak with the view store when removing items
• 9798e59 Version bump for development
• 5df6e22 Version bump to v2.7.0
• Additional commits viewable in compare view

Updates e2b from 2.15.2 to 2.37.1

Release notes

Sourced from e2b's releases.

e2b@2.38.3

Patch Changes

• cab27aa: Kill newly created sandboxes when MCP gateway startup fails. The failure now surfaces as SandboxError (JS) / SandboxException (Python) with a Failed to start MCP gateway: <stderr> message instead of a bare command exit error.

e2b@2.38.2

Patch Changes

• d5a382e: Bump both undici dependencies past the 2026-07-24 security advisories: the required undici from ^7.28.0 to ^7.29.0, and the optional undici8 (npm:undici@…) from 8.8.0 to 8.10.0. Both releases fix one High (GHSA-4cwx-7wf7-3272) and four Medium advisories, and undici 8.10.0 additionally fixes HTTP/2 request settling, refused-stream retries and GOAWAY handling, which the SDK exercises because every dispatcher it builds sets allowH2: true. Neither bump moves a Node floor — 7.29.0 still requires Node >=20.18.1 and 8.10.0 still requires >=22.19.0, matching the UNDICI_8_MIN_NODE gate — so package selection and behaviour are unchanged.

e2b@2.38.1

Patch Changes

• 88f41f3: Align ANSI stripping of template build log messages across both SDKs. The Python SDK's strip_ansi_escape_codes now ports the JS SDK's stripAnsi regex: OSC sequences (hyperlinks, window titles) are matched non-greedily up to the first string terminator — including sequences spanning newlines — and CSI sequences are stripped without requiring a terminator. Both implementations additionally strip the remaining ECMA-48 string controls (DCS/Sixel, SOS, PM, APC) through their string terminator so control payloads no longer leak into cleaned logs.
• 86f7b8e: Export GitResetMode, GitResetOpts, GitRestoreOpts and GitStatusLabel from the JS SDK entry point, so the argument and status types of the public git.reset(), git.restore() and git.status() methods can be named by callers

e2b@2.38.0

Minor Changes

• 2821fb0: Route volume content requests to a team's custom (BYOC) cluster. When a team is connected to a custom cluster, the volume create and get endpoints now return that cluster's domain, and the SDK uses it as the destination for volume content requests instead of the default api.<E2B_DOMAIN> host. Teams on the default cluster are unaffected and keep their configured domain.

e2b@2.37.0

Minor Changes

• 1504fbc: Add fromFedoraImage, fromAlpineImage, and fromArchImage base-image helpers to the Template builder (from_fedora_image, from_alpine_image, from_arch_image in the Python SDK), alongside the existing fromUbuntuImage/fromDebianImage/etc. Templates can now start from Fedora, Alpine, and Arch base images (the orchestrator identifies the distro from /etc/os-release). Fedora and Alpine default to pinned tags (fedora:44, alpine:3.24) so builds stay reproducible; Arch defaults to latest because it is a rolling release and provisioning runs pacman -Syu regardless.

Patch Changes

• 6733f36: Align the Python SDK's from_fedora_image and from_alpine_image defaults with the JS SDK: fedora:44 and alpine:3.24, replacing fedora:42 (end-of-life, so its repositories leave the normal mirror network and provisioning can fail) and alpine:3.22. Callers that omit the variant now get the same base image in both SDKs, and both tags are the ones the orchestrator's distro build tests cover. Also corrects the JS TemplateFromImage type docs, which still named the old defaults.
• 1ebe925: Recognize web platform objects by what they are, not by which class minted them. Libraries replace the web globals the same way they replace globalThis.fetch (@hono/node-server installs its own Request, remix's installGlobals() swaps Request/Blob/File, web-streams-polyfill swaps ReadableStream, jsdom-style test environments bring their own copies), and values also cross realms — so a perfectly good Request, Blob or ReadableStream could fail the SDK's instanceof checks and take the wrong branch. This fixes: every API call crashing with Failed to parse URL from [object Request]; the abort signal of such a Request being ignored while it waited for an in-flight slot; uploads of a foreign Blob or ReadableStream — including the body of such a Request — silently containing the text "[object Blob]"/"[object ReadableStream]"; gzipped uploads of a foreign stream hanging; a foreign stream being buffered into memory instead of streamed; and volume.readFile() returning empty data.
• ee0ad25: Update snapshot docstrings to use project terminology instead of team (e.g. "my-project/my-snapshot", project slug)

e2b@2.36.1

Patch Changes

• 178e267: Bump the glob dependency from ^11.1.0 to ^13.0.6. glob 11 is deprecated on npm, so every install of a project depending on e2b printed a npm warn deprecated glob@11.1.0 warning that downstream packages could not silence (overrides and shrinkwrap only apply to the top-level project). glob 12 and 13 only changed the CLI — the --shell option and the glob bin, which moved to a separate glob-bin package — so the programmatic API the SDK uses (glob(pattern, { ignore, withFileTypes, dot, cwd }) plus Path#isDirectory()/fullpath()/relative()) is unchanged. glob 13 also drops the CLI's transitive dependencies, cutting a fresh npm install e2b from 37 to 26 packages.
• b511953: Remove the new Function('return import(...)') trick from undici loading. loadUndici now uses the shared dynamicImport helper, whose dynamic import is kept opaque to downstream bundlers with webpackIgnore/@vite-ignore annotations instead of runtime code generation. Environments that disallow code generation from strings (CSP, --disallow-code-generation-from-strings) now load undici normally instead of silently falling back to the global fetch.
• b511953: Fix the lazy fetcher loading in api/http2.ts and envd/http2.ts: a failed fetcher build is no longer cached forever (the next request retries instead of replaying the stale rejection), and the no-undici fallback now late-binds globalThis.fetch so fetch replacements installed after the first request (msw, instrumentation) are picked up. The previously duplicated loading logic is shared in undici.ts.

e2b@2.36.0

Minor Changes

• 4fcf7cb: Add FileType.SYMLINK to the sandbox filesystem types. Newer envd versions report symlinks with a dedicated FILE_TYPE_SYMLINK entry type; previously the SDKs treated it as unknown, so files.list() silently omitted symlink entries and getInfo()/get_info() returned an undefined/None type for them. Symlinks now surface as FileType.SYMLINK ('symlink') with symlinkTarget/symlink_target populated, in JS and both sync and async Python.

Patch Changes

• 3f46d56: Select template build-step stack-trace frames by SDK boundary instead of fixed depth. The caller's frame is now the first one whose file lies outside the SDK package, so traces stay correct when transpilers inject extra frames (e.g. TS class-field initializers) or runtimes elide delegating frames (e.g. Bun's tail-call elision). The suppress/override stack-trace collection machinery this made redundant (runInNewStackTraceContext, runInStackTraceOverrideContext and their Python equivalents) is removed.
• 1ae3f92: Recognize Cloudflare Workers' Network connection lost as a dropped sandbox connection so a sandbox killed mid-request surfaces as the health-checked TimeoutError (matching Node/Bun/Deno), and fix streaming downloads releasing their pooled connection twice when cancelled while a read was in flight
• 9ee4414: Fix template file uploads under Deno. Deno's native fetch ignores a Content-Length header on stream bodies and fell back to Transfer-Encoding: chunked, which S3-compatible presigned upload URLs reject (see #1243). Template.build uploads now stream the spooled archive through undici's fetch, which honors the header on every runtime, falling back to the global fetch where undici isn't resolvable.
• 5e141a7: Fix the Sandbox.getHost() documentation example so it can be copy-pasted. The @example called sandbox.commands.exec(...), which is not a method on the Commands class (it exposes run), so running the snippet threw TypeError: sandbox.commands.exec is not a function. It now uses sandbox.commands.run(..., { background: true }), allowing the long-running HTTP server to start before the example calls getHost(). Documentation only, no behavior change.

... (truncated)

Commits

• 2d2823c [skip ci] Release new versions
• 88f41f3 fix(python-sdk): port current JS stripAnsi regex to strip_ansi_escape_codes (...
• 26ee42c chore: upgrade pnpm to 10.34.5 and delay fresh releases by 3 days (#1644)
• 998e560 fix(python-sdk): relax wcmatch constraint to >=10.1,<12 (#1638)
• 86f7b8e fix(js-sdk): export the Git argument and status types (#1642)
• 9c555a1 ci: add a changeset to Dependabot pull requests automatically (#1639)
• 7a1fe45 [skip ci] Release new versions
• 2821fb0 feat(sdk): route volume content to BYOC cluster domain (#1634)
• 9ef3f1d [skip ci] Release new versions
• 1ebe925 fix(js-sdk): detect web platform objects by shape, not by class (#1618)
• Additional commits viewable in compare view

Updates e2b-code-interpreter from 2.4.1 to 2.9.0

Commits

• eb70a98 Support E2B_SANDBOX_URL env var for Jupyter requests (#310)
• 91e7cee [skip ci] Release new versions
• 74c4e36 fix: bump vite to 7.3.5 to resolve GHSA-fx2h-pf6j-xcff (#315)
• 623b0ec Update dependency nltk to v3.10.0 [SECURITY] (#314)
• fe491b8 chore: change codeowners (#313)
• 4be824a Update dependency e2b (#306)
• 803e315 Update dependency e2b to v2.32.0 (#305)
• 5aeca43 Update dependency e2b (#299)
• 1513daa Update dependency ipython to v9.15.0 (#303)
• 354cdf2 Update dependency vitest to v4.1.10 (#300)
• Additional commits viewable in compare view

Updates fastapi from 0.128.7 to 0.128.8

Release notes

Sourced from fastapi's releases.

0.128.8

Docs

• 📝 Fix grammar in docs/en/docs/tutorial/first-steps.md. PR #14708 by @​SanjanaS10.

Internal

• 🔨 Tweak PDM hook script. PR #14895 by @​tiangolo.
• ♻️ Update build setup for fastapi-slim, deprecate it, and make it only depend on fastapi. PR #14894 by @​tiangolo.

Commits

• bdd2005 🔖 Release version 0.128.8
• 1ed9bd4 📝 Update release notes
• aac30fd 🔨 Tweak PDM hook script (#14895)
• 417f1ee 📝 Update release notes
• ffb8965 ♻️ Update build setup for fastapi-slim, deprecate it, and make it only depe...
• 93fa935 📝 Update release notes
• f0f3e7a 📝 Fix grammar in docs/en/docs/tutorial/first-steps.md (#14708)
• See full diff in compare view

Updates feedparser from 6.0.12 to 6.0.14

Release notes

Sourced from feedparser's releases.

v6.0.14

Changed

• Upgrade to feedparser-sgmllib 2.0.0. (#585)

v6.0.13

Python support

• Drop support for Python 3.9 and lower.

Changed

• Migrate from sgmllib3k to feedparser-sgmllib.

Fixed

• Resolve package build warnings.

Changelog

Sourced from feedparser's changelog.

6.0.14 - 2026-07-30

• Upgrade to feedparser-sgmllib 2.0.0. (#585)

6.0.13 - 2026-07-28

Python support

• Drop support for Python 3.9 and lower.

Changed

• Migrate from sgmllib3k to feedparser-sgmllib.

Fixed

• Resolve package build warnings.

Commits

• 14425f6 Hotfix v6.0.14 (#586)
• 64757d0 Update project metadata
• 67ad0ed Upgrade to feedparser-sgmllib 2.x

[github-actions]

🔍 PR Overlap Detection

This check compares your PR against all other open PRs targeting the same branch to detect potential merge conflicts early.

🔴 Merge Conflicts Detected

The following PRs have been tested and will have merge conflicts if merged after this PR. Consider coordinating with the authors.

• feat(blocks): add Dakera memory blocks (store & recall) — closes #13458 #13467 (ferhimedamine · updated 5h ago)

  • .github/batch-bot/batch.mjs (3 conflicts, ~82 lines)
  • .github/workflows/batch-command-handler.yml (1 conflict, ~5 lines)
  • .github/workflows/platform-dev-deploy-event-dispatcher.yml (1 conflict, ~5 lines)
  • autogpt_platform/autogpt_libs/autogpt_libs/auth/__init__.py (2 conflicts, ~8 lines)
  • autogpt_platform/backend/.env.default (1 conflict, ~21 lines)
  • autogpt_platform/backend/backend/api/features/chat/routes.py (2 conflicts, ~9 lines)
  • autogpt_platform/backend/backend/api/features/chat/routes_test.py (1 conflict, ~8 lines)
  • autogpt_platform/backend/backend/api/features/integrations/router.py (1 conflict, ~4 lines)
  • autogpt_platform/backend/backend/api/features/library/db.py (3 conflicts, ~46 lines)
  • autogpt_platform/backend/backend/api/features/library/db_test.py (5 conflicts, ~234 lines)
  • autogpt_platform/backend/backend/api/features/library/model.py (1 conflict, ~5 lines)
  • autogpt_platform/backend/backend/api/features/library/routes/presets.py (1 conflict, ~14 lines)
  • autogpt_platform/backend/backend/api/features/orgs/db.py (5 conflicts, ~70 lines)
  • autogpt_platform/backend/backend/api/features/orgs/regression_test.py (6 conflicts, ~71 lines)
  • autogpt_platform/backend/backend/api/features/orgs/routes_test.py (3 conflicts, ~69 lines)
  • autogpt_platform/backend/backend/api/features/v1.py (3 conflicts, ~14 lines)
  • autogpt_platform/backend/backend/api/rest_api.py (3 conflicts, ~14 lines)
  • autogpt_platform/backend/backend/copilot/bot/README.md (2 conflicts, ~27 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/base.py (2 conflicts, ~30 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/slack/adapter.py (35 conflicts, ~634 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/slack/adapter_test.py (17 conflicts, ~335 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/slack/app-manifest.yaml (6 conflicts, ~46 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/slack/commands.py (7 conflicts, ~103 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/slack/commands_test.py (2 conflicts, ~26 lines)
  • autogpt_platform/backend/backend/copilot/bot/adapters/slack/config.py (1 conflict, ~11 lines)
  • autogpt_platform/backend/backend/copilot/bot/app.py (1 conflict, ~12 lines)
  • autogpt_platform/backend/backend/copilot/bot/handler.py (3 conflicts, ~474 lines)
  • autogpt_platform/backend/backend/copilot/bot/handler_test.py (2 conflicts, ~10 lines)
  • autogpt_platform/backend/backend/copilot/bot/webhook_routes.py (4 conflicts, ~45 lines)
  • autogpt_platform/backend/backend/copilot/bot/webhook_routes_test.py (5 conflicts, ~66 lines)
  • autogpt_platform/backend/backend/copilot/db.py (3 conflicts, ~63 lines)
  • autogpt_platform/backend/backend/copilot/model.py (4 conflicts, ~22 lines)
  • autogpt_platform/backend/backend/copilot/model_test.py (1 conflict, ~173 lines)
  • autogpt_platform/backend/backend/copilot/sdk/service.py (1 conflict, ~8 lines)
  • autogpt_platform/backend/backend/data/execution.py (4 conflicts, ~22 lines)
  • autogpt_platform/backend/backend/data/graph.py (1 conflict, ~5 lines)
  • autogpt_platform/backend/backend/data/org_migration.py (35 conflicts, ~421 lines)
  • autogpt_platform/backend/backend/data/org_migration_test.py (6 conflicts, ~281 lines)
  • autogpt_platform/backend/backend/data/user.py (1 conflict, ~5 lines)
  • autogpt_platform/backend/backend/data/user_test.py (3 conflicts, ~98 lines)
  • autogpt_platform/backend/backend/executor/scheduler.py (4 conflicts, ~20 lines)
  • autogpt_platform/backend/backend/executor/utils.py (2 conflicts, ~10 lines)
  • autogpt_platform/backend/backend/executor/utils_test.py (8 conflicts, ~39 lines)
  • autogpt_platform/backend/backend/platform_linking/chat.py (2 conflicts, ~10 lines)
  • autogpt_platform/backend/backend/platform_linking/chat_test.py (2 conflicts, ~19 lines)
  • autogpt_platform/backend/backend/util/settings.py (1 conflict, ~30 lines)
  • autogpt_platform/backend/poetry.lock (1 conflict, ~5 lines)
  • autogpt_platform/backend/schema.prisma (6 conflicts, ~134 lines)
  • autogpt_platform/backend/test/e2e_test_data.py (1 conflict, ~4 lines)
  • autogpt_platform/backend/test/test_migrate_webhook_presets.py (4 conflicts, ~20 lines)
  • autogpt_platform/frontend/src/app/(platform)/PlatformChrome/PlatformChrome.tsx (2 conflicts, ~31 lines)
  • autogpt_platform/frontend/src/app/(platform)/PlatformChrome/__tests__/PlatformChrome.test.tsx (1 conflict, ~7 lines)
  • autogpt_platform/frontend/src/app/(platform)/PlatformChrome/__tests__/usePlatformChrome.test.ts (5 conflicts, ~35 lines)
  • autogpt_platform/frontend/src/app/(platform)/PlatformChrome/usePlatformChrome.ts (4 conflicts, ~44 lines)
  • autogpt_platform/frontend/src/app/(platform)/copilot/CopilotPage.tsx (1 conflict, ~5 lines)
  • autogpt_platform/frontend/src/app/(platform)/copilot/components/ChatInput/ChatInput.tsx (1 conflict, ~5 lines)
  • autogpt_platform/frontend/src/app/(platform)/copilot/components/ChatInput/components/ComposerPlusMenu.tsx (5 conflicts, ~66 lines)
  • autogpt_platform/frontend/src/app/(platform)/library/followups/page.tsx (1 conflict, ~8 lines)
  • autogpt_platform/frontend/src/app/(platform)/library/skills/page.tsx (1 conflict, ~8 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/TourCopilot.tsx (2 conflicts, ~19 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/__tests__/app-shell.test.tsx (1 conflict, ~8 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/__tests__/main.test.tsx (2 conflicts, ~54 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/components/TourAgentCard/TourAgentCard.tsx (1 conflict, ~8 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/components/TourChatContainer/TourChatContainer.tsx (2 conflicts, ~41 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/components/TourPromptBar/TourPromptBar.tsx (1 conflict, ~5 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/components/TourSidebar/TourSidebar.tsx (4 conflicts, ~40 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/components/TourSidebar/components/TourUpsellCard.tsx (1 conflict, ~143 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/tourStore.ts (3 conflicts, ~42 lines)
  • autogpt_platform/frontend/src/app/(public)/tour/chat/useTourCopilot.ts (1 conflict, ~4 lines)
  • autogpt_platform/frontend/src/app/api/openapi.json (7 conflicts, ~91 lines)
  • autogpt_platform/frontend/src/components/contextual/IntegrationsPanel/components/ConnectServiceDialog/components/DetailView/__tests__/useOAuthConnect.test.ts (3 conflicts, ~241 lines)
  • autogpt_platform/frontend/src/components/contextual/IntegrationsPanel/components/ConnectServiceDialog/components/DetailView/useOAuthConnect.ts (7 conflicts, ~104 lines)
  • autogpt_platform/frontend/src/components/contextual/SchedulesPanel/SchedulesPanel.tsx (3 conflicts, ~14 lines)
  • autogpt_platform/frontend/src/components/contextual/SchedulesPanel/components/EmptyFollowups/EmptyFollowups.tsx (2 conflicts, ~11 lines)
  • autogpt_platform/frontend/src/components/contextual/SkillsPanel/SkillsPanel.tsx (3 conflicts, ~14 lines)
  • autogpt_platform/frontend/src/components/contextual/SkillsPanel/components/UploadSkillButton/UploadSkillButton.tsx (2 conflicts, ~13 lines)
  • autogpt_platform/frontend/src/components/layout/AppSidebar/AppSidebar.tsx (2 conflicts, ~10 lines)
  • autogpt_platform/frontend/src/components/layout/Navbar/components/OrgTeamSwitcher/OrgTeamSwitcher.tsx (5 conflicts, ~36 lines)
  • autogpt_platform/frontend/src/components/renderers/InputRenderer/custom/CredentialField/helpers.ts (1 conflict, ~84 lines)
  • autogpt_platform/frontend/src/providers/org-team/OrgTeamProvider.tsx (2 conflicts, ~10 lines)
  • autogpt_platform/frontend/src/providers/org-team/__tests__/OrgTeamProvider.test.tsx (4 conflicts, ~30 lines)

• feat(blocks): add Tenki code execution block #13646 (camcalaquian · updated 5h ago)

  • 📁 autogpt_platform/backend/
    • poetry.lock (2 conflicts, ~12 lines)

• feat(blocks): add E2B Desktop sandbox blocks #13254 (Abhi1992002 · updated 5h ago)

🟢 Low Risk — File Overlap Only

These PRs touch the same files but different sections (click to expand)

• feat(platform): add ChatGPT/Codex subscription transport preview #13761 (ntindle · updated 1h ago)

  • Shared files: autogpt_platform/backend/pyproject.toml

• feat(backend/blocks): MCP message signing and tool integrity verification #12455 (dataCenter430 · updated 5h ago)

  • Shared files: autogpt_platform/backend/pyproject.toml

• feat(backend): add Menlo robot control tools to copilot #13525 (ntindle · updated 5h ago)

  • Shared files: autogpt_platform/backend/pyproject.toml

• chore(backend/deps-dev): bump the development-dependencies group across 1 directory with 6 updates #13278 (dependabot · updated 10h ago)

  • Shared files: autogpt_platform/backend/pyproject.toml

Summary: 3 conflict(s), 0 medium risk, 4 low risk (out of 7 PRs with file overlap)

---

Auto-generated on push. Ignores: openapi.json, lock files.

[github-actions]

This pull request has conflicts with the base branch, please resolve those so we can evaluate the pull request.

[github-actions]

Conflicts have been resolved! 🎉 A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts with the base branch, please resolve those so we can evaluate the pull request.

[github-actions]

Conflicts have been resolved! 🎉 A maintainer will review the pull request shortly.

[github-actions]

This pull request has conflicts with the base branch, please resolve those so we can evaluate the pull request.

[github-actions]

Conflicts have been resolved! 🎉 A maintainer will review the pull request shortly.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.