[dependabot]

Bumps blaxel from 0.2.50 to 0.4.21.

Release notes

Sourced from blaxel's releases.

v0.4.1

Fixed

• Job task exceptions now exit non-zero, so Blaxel executions are correctly marked failed instead of falsely reporting success (ENG-4261, #208).

Jobs with retries configured will now retry when their task raises. Tasks that perform non-idempotent work should remain retry-safe.

v0.4.0

⚠️ Behavior change — read before upgrading

Failed sandbox update_* and delete calls now raise SandboxAPIError instead of silently returning a malformed object.

Every generated control-plane API function returns Union[Error, T] | None, so an error status is a return value, not an exception. SandboxInstance.update_metadata, update_ttl, update_lifecycle, update_network and delete passed that response straight into cls(response), which does not type-check. A 403/404/500 therefore produced an instance wrapping an Error.

If you ignored the return value — the common shape — a failed write looked like a success:

• update_ttl returned normally and the TTL was never applied
• delete returned normally and the sandbox stayed alive and kept billing

If you used the return value, you hit AttributeError: 'Error' object has no attribute 'metadata' far from the real cause.

What this means for you

you	impact
Your calls succeed	No change. Same objects, same types, same behavior.
Your calls have been failing silently	You now get exceptions. You were already broken — the update never applied, the delete never happened.
You wrote a workaround checking isinstance(result.sandbox, Error)	This breaks. The call now raises before returning, so your check never runs.

Most notably: delete() on an already-deleted sandbox now raises where it previously returned quietly. If you delete in a finally: or a cleanup path, wrap it:

try:
    await sandbox.delete()
except SandboxAPIError:
    pass  # already gone

Also: delete() on an empty response now raises SandboxAPIError rather than ValueError.

This brings Python in line with the TypeScript SDK, which has always used throwOnError: true on these calls, and with Go, which returns idiomatic (res, err). Python was the only SDK swallowing these errors.

Fixes

• fix(sandbox): propagate control-plane errors from update_*/delete (#206, ENG-4244)
  • all four update_* helpers and delete, in both the async and sync (SyncSandboxInstance) trees
  • delete no longer raises a misleading ValueError("Sandbox X not found") for what may have been a 500
  • VolumeInstance.delete had the same gap and now raises on both Error and empty responses
  • Reported by Albert at EvenUp, who also identified the correct fix: routing through the existing _unwrap_response() helper.

... (truncated)

Commits

• 7a4c960 feat(sandbox): create a sandbox from a private registry image (ENG-6003) (#307)
• 18b9163 sandbox: create_if_not_exists warns when the existing sandbox differs from th...
• fc1df62 feat(sandbox): add fs.read_tree to read a directory's files in one call (#266)
• 46ecf39 fix(client): read an empty optional enum as unset (#290)
• dc48566 fix(deps): cap litellm below 1.106.0 in the googleadk extra (#289)
• c528c09 feat(fs): add on_keepalive and on_close to fs.watch (#294)
• edce017 sandbox: termination_grace_period_seconds and standby_grace_period_seconds on...
• e9b63fd feat: add PostHog event tracking for SDK installs (ENG-2277) (#141)
• 09cf277 Add workspace secrets (SecretInstance.set/list/delete) (#275)
• b503846 feat(customdomains): regenerate client with spec.validationMethod and add opt...
• Additional commits viewable in compare view

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-06T00:48:57.401124Z	90d36ae	New commits
🔒 Security Review	✅ Completed 2026-11-06T00:49:53.580230Z	90d36ae	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: efe4e271cc

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve MCP 2.x coverage in the main lock

Updating Blaxel causes the shared lock to downgrade mcp from 2.3.0 to 1.30.0. Because make sync and the standard CI jobs install this lock with all extras, the normal unit/type-check environment now exercises MCP 1.x—the same version already covered by the dedicated mcp-v1-compat job—while the supported MCP 2.x path loses its primary regression coverage. Keep an MCP 2.x environment in CI or isolate the Blaxel-constrained resolution so this optional-extra update does not silently replace that coverage.

AGENTS.md reference: AGENTS.md:L19-L19

Useful? React with 👍 / 👎.

[jbeckwith-oai]

@openai/sdks-team Hold for compatibility review. Blaxel 0.4.20 constrains MCP to <2, and this diff downgrades the shared lock from MCP 2.3.0 to 1.30.0. The current typecheck fails on MCP v2 fixture APIs (on_list_tools/on_list_prompts/on_call_tool and input_schema), with the test matrix also failing. This needs an explicit supported-version/provider decision rather than suppressing type errors or dropping coverage. The Blaxel release itself clears seven days, but complete transitive cooldown and compatibility review remains pending.

Reviewed head: efe4e271ccb9d3670f22a96f49805bceb4a77bec.

[jbeckwith-oai]

Covered by #5484, now merged through the protected queue. Main includes Blaxel 0.4.21 together with WebSockets 16.1.1 and the validated MCP/native test repairs. Verified the current lockfile update is otherwise covered by the merged dependency set.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.