Chore/batch dependabot 20260716

[MDzaja]

Summary

Batches all open dependabot dependency updates into a single PR, pulls the
patched HTTP stack enabled by the Python >=3.10 floor (#83), and moves Python
client dependency floor management into the shared OpenAPI generator template so
bumps survive regeneration.

Dependabot updates (cherry-picked, oldest → newest)

PR	Update
#8	pip-prod group across 5 directories — 14 updates (urllib3 2.7.0, aiohttp 3.14.1, pydantic 2.13.4, typing-extensions 4.16.0, python-dateutil 2.9.0.post0, aiohttp-retry 2.9.1, dev-group tooling)
#61	http-proxy-middleware 2.0.9 → 2.0.10 (proxy-table routing bypass hardening)
#65	actions/setup-java 5.4.0 → 5.5.0 (setup-toolchain composite action)
#66	apache/skywalking-eyes/header 29bd646 → 6e368ec (license header check)
#79	websocket-driver 0.7.4 → 0.7.5 (max-length enforcement hardening)
#85	cryptography 46.0.3 → 49.0.0 (dependabot targeted 48.0.1; the root constraint resolves to the newer release carrying the same fixes)
#86	webpack-dev-server 5.2.4 → 5.2.6
#87	protobufjs 7.6.2 → 7.6.5

Patched HTTP stack (follow-up to #83)

#8 originally couldn't land because its urllib3>=2.7.0 / aiohttp>=3.14.1
floors require Python >=3.10 while the repo still supported 3.9. With #83 merged,
this PR applies dependabot's floors as intended and updates the lock to
urllib3 2.7.0 and aiohttp 3.14.1, closing:

• urllib3: GHSA-mf9v-mfxr-j63j (HIGH), GHSA-qccp-gfcp-xxvc (HIGH)
• aiohttp: GHSA-xcgm-r5h9-7989, GHSA-4fvr-rgm6-gqmc, GHSA-g3cq-j2xw-wf74

Supporting generator changes:

• hack/python-client/postprocess.sh: urllib3 lower-bound sed retargeted
  2.1.0 → 2.7.0 (it would otherwise revert the floor on every regeneration), and
  a new sed syncs PYTHON_REQUIRES in the generated setup.py to >= 3.10
• setup.py / requirements.txt across all 6 generated clients now advertise
  Python >= 3.10 and urllib3 >= 2.7.0
• Root requires-python fixed from Poetry caret syntax (^3.10, invalid
  PEP 440 — uv refuses to parse it) to >=3.10,<4.0

Template override for generated Python clients

The generated clients' pyproject.toml is generator-owned (not in
.openapi-generator-ignore), so floor bumps applied directly to those files are
silently reverted by the next yarn generate:api-client. This PR adds
hack/python-client/openapi-templates/pyproject.mustache (override of the
upstream openapi-generator v7.21.0 template, shared by all 6 generated Python
clients) as the single source of truth for dependency floors.

• Regeneration reproduces every committed client byte-identically (zero drift)
• The analytics clients (not covered by chore(deps): Bump the pip-prod group across 5 directories with 14 updates #8) are brought to the same floors
• The batch-dependabot.md playbook documents the generated-manifest and
  minimum-Python floor rules

Generated Go clients need no equivalent (empty go.mod, no external deps); the
generated TS/Java/Ruby clients are not covered by dependabot.

Review feedback addressed

The previous Build clients failure (each client's poetry lock --regenerate
could not solve mypy >= 2.3.0 against the old >=3.9 range) is fixed by the
rebase onto #83 — verified locally in both a sync and an async client. cubic's
playbook comments are applied: nix-only tooling wording restored, regeneration
command routed through nix develop .#node, and the template scope corrected to
the 6 generated clients (sdk-python is hand-written).

Validation

• yarn install --immutable clean; poetry check --lock consistent
• poetry lock --regenerate solves inside sync and async generated clients
• yarn generate:api-client reproduces all committed files with zero drift
• sdk-typescript: 238/238 unit
• sdk-python: 529/529 unit; 97/97 sync e2e against production on urllib3 2.7.0
• Resolved versions confirmed in locks: urllib3 2.7.0, aiohttp 3.14.1,
  cryptography 49.0.0, webpack-dev-server 5.2.6, protobufjs 7.6.5

Closes

Closes #8
Closes #61
Closes #65
Closes #66
Closes #79
Closes #85
Closes #86
Closes #87

[cubic-dev-ai]

2 issues found across 13 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="analytics-api-client-python/pyproject.toml">

<violation number="1" location="analytics-api-client-python/pyproject.toml:26">
P1: Python 3.9 development/bootstrap can no longer resolve this project's default Poetry install because `pytest`, `tox`, `types-python-dateutil`, and `mypy` now have Python >=3.10 floors. Please retain Python-3.9-compatible constraints or add Python-version-specific dependency branches for all four tools.</violation>
</file>

<file name="analytics-api-client-python-async/pyproject.toml">

<violation number="1" location="analytics-api-client-python-async/pyproject.toml:27">
P2: Python 3.9 development installs can no longer resolve this generated client because four new dev-dependency floors require Python 3.10+. Version-split these constraints with Python markers (or retain Python-3.9-compatible floors) for `pytest`, `tox`, `types-python-dateutil`, and `mypy`.</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Python 3.9 development/bootstrap can no longer resolve this project's default Poetry install because pytest, tox, types-python-dateutil, and mypy now have Python >=3.10 floors. Please retain Python-3.9-compatible constraints or add Python-version-specific dependency branches for all four tools.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At analytics-api-client-python/pyproject.toml, line 26:

<comment>Python 3.9 development/bootstrap can no longer resolve this project's default Poetry install because `pytest`, `tox`, `types-python-dateutil`, and `mypy` now have Python >=3.10 floors. Please retain Python-3.9-compatible constraints or add Python-version-specific dependency branches for all four tools.</comment>

<file context>
@@ -23,12 +23,12 @@ Repository = "https://github.com/daytona/clients"
-flake8 = ">= 4.0.0"
-types-python-dateutil = ">= 2.8.19.14"
-mypy = ">= 1.5"
+pytest = ">=9.1.1"
+pytest-cov = ">=7.1.0"
+tox = ">=4.56.4"
</file context>

[cubic-dev-ai]

P2: Python 3.9 development installs can no longer resolve this generated client because four new dev-dependency floors require Python 3.10+. Version-split these constraints with Python markers (or retain Python-3.9-compatible floors) for pytest, tox, types-python-dateutil, and mypy.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At analytics-api-client-python-async/pyproject.toml, line 27:

<comment>Python 3.9 development installs can no longer resolve this generated client because four new dev-dependency floors require Python 3.10+. Version-split these constraints with Python markers (or retain Python-3.9-compatible floors) for `pytest`, `tox`, `types-python-dateutil`, and `mypy`.</comment>

<file context>
@@ -24,12 +24,12 @@ Repository = "https://github.com/daytona/clients"
-flake8 = ">= 4.0.0"
-types-python-dateutil = ">= 2.8.19.14"
-mypy = ">= 1.5"
+pytest = ">=9.1.1"
+pytest-cov = ">=7.1.0"
+tox = ">=4.56.4"
</file context>