chore: update dependencies

[cohix]

Brings every workspace up to its latest compatible dependency releases. Two commits: the original 2026-09-04 pass and a follow-up refresh made today on top of it (nothing had drifted on main in between; the branch is 0 commits behind).

Rust (server, baectl, client-rust, e2e, launchers/*)

Crate	From	To
reqwest	0.12 (rustls-tls)	0.13.5 (feature renamed to rustls; query feature added for baectl)
rusqlite	0.32	0.40
rand	0.8	0.10
sha2	0.10	0.11
getrandom	0.2	0.4
toml	0.8	1.1
jsonschema	0.48	0.56 (0.53 in the first commit, 0.56 today)
tower-http	0.6	0.7
tokio-cron-scheduler	0.14	0.15
transitive (lockfiles)		rustls 0.23.44, bitflags 2.13.2, indexmap 2.14.2, syn 3.0.5, zerocopy 0.8.57, wasm-bindgen 0.2.128, hashlink 0.12.2, hybrid-array 0.4.15, ipnet 2.12.2, uuid 1.26.1, fancy-regex 0.19.1, and the rest of cargo update

Also confirmed at latest: axum 0.8.9, clap 4.6.6, tokio 1.53.1, opentelemetry* 0.32, tracing-opentelemetry 0.33, tonic 0.14.6, thiserror 2.0.20, regex 1.13.1, url 2.5.8, subtle 2.6.1, tower 0.5.3, http-body-util 0.1.5.

Code changes required

• rand 0.10 removed OsRng/RngCore::fill_bytes; baectl/src/keygen.rs, server/src/store/keys.rs, and server/src/store/mod.rs now use SysRng::try_fill_bytes (with an explicit expect, since the new API is fallible).
• getrandom 0.4 renamed getrandom() to fill() (client-rust/src/subagent.rs).
• reqwest 0.13 renamed the rustls-tls feature to rustls, and Client::query() moved behind the query feature (baectl/Cargo.toml).
• jsonschema 0.54 to 0.56's breaking changes are confined to the canonical module, which this repo does not use; validator_for and ValidationError are unchanged.
• rustls now pulls in aws-lc-rs, whose build needs CMake, so cmake was added to Dockerfile, Dockerfile.dev, and Dockerfile.max.

TypeScript (client-typescript, max/web, max/server, launchers/webapp/web)

Package	From	To
typescript	5.7 / 5.9 / ~6.0	7.0.2
vitest	3.0 / 4.1	5.0.0
@opentelemetry/context-async-hooks, core, sdk-trace-base	1.30	2.11.0
@types/node	22 / 24	26.4.1
react, react-dom	19.2.7	19.3.0
@types/react, @types/react-dom	19.2.x	19.3.0
vite	8.1.1	8.3.0
@vitejs/plugin-react	6.0.3	6.1.1
oxlint	1.71	1.82.0
jsdom	29	30.0.1
@testing-library/jest-dom	6.9	7.0.1
@testing-library/react	16.3.2	16.3.3
@playwright/test	1.61	1.63.0
prettier	3.4 / 3.9.4	3.9.6
tsx	4.19	4.23.13
ws	8.21.0	8.21.3
@types/supertest	7.2.0	7.2.1

Code changes required

• OpenTelemetry JS SDK 2.x renamed ReadableSpan.instrumentationLibrary to instrumentationScope and replaced parentSpanId with parentSpanContext (client-typescript/src/telemetry.test.ts).
• TypeScript 7 no longer auto-includes @types/node; client-typescript/tsconfig.json now lists "types": ["node"].
• oxlint 1.8x's React plugin added react/purity and react/set-state-in-effect; three intentional patterns got targeted oxlint-disable-next-line comments with justification (AgentPage.tsx, useSessionStream.ts, SessionsTab.tsx).

Python (client-python)

• Lockfile refresh: anyio 4.15.1, and (from the first commit) opentelemetry-api/sdk 1.44.0, pytest 9.1.1, pytest-asyncio 1.4.0, ruff 0.16.6, httpx 0.28.1 pinned by resolution.
• ruff 0.16 changed its defaults; pyproject.toml now pins the previous rule set (E4, E7, E9, F) explicitly and excludes *.md so behaviour is unchanged.

CI / images

• GitHub Actions: actions/checkout v4 to v7, actions/upload-artifact v4 to v7, actions/download-artifact v4 to v8, docker/build-push-action v6 to v7, docker/login-action v3 to v4, docker/setup-buildx-action v3 to v4. All are the current major versions as of today.
• Dockerfiles use floating base tags (rust:1-bookworm, node:22-bookworm, debian:bookworm-slim), so no image pins needed moving.

Validation

Run on a host toolchain matching Dockerfile.dev (Rust 1.98.1 stable with clippy/rustfmt and the aarch64 musl target, Node 22.23.2, Python 3.11 via uv, cmake):

make build   # all 11 components, incl. baectl's static musl release build — exit 0
make lint    # clippy -D warnings + cargo fmt --check, tsc + prettier, ruff check + format — exit 0
make test    # exit 0

Test totals: server 236 (unit + integration incl. the stdio MCP fixtures), baectl 33, client-rust 57, client-typescript 75, client-python 94, max 96 + entrypoint regression script, launchers/core 8, launchers/schedule 10, launchers/api 27, launchers/webapp 11, e2e 2. No tests were modified, skipped, or removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UueMkvfsdcrfzBjwa5UZAR