[cursor]

Summary

Consolidates the one open Dependabot single currently in envs/ into a single aggregate PR, per the daily Dependabot triage automation.

Folds:

• chore(deps): bump opentelemetry-api from 1.45.1 to 1.45.2 in /envs/websearch_env #1623 — bump opentelemetry-api from 1.45.1 to 1.45.2 in envs/websearch_env (patch release: traceparent header length limit fix + metric cardinality limits)

Diff is exactly envs/websearch_env/uv.lock (3 insertions, 3 deletions), a clean fast-forward of #1623's branch onto origin/main. Verified with uv lock --check in envs/websearch_env (resolves cleanly, no drift). All CI checks on #1623 passed individually before folding.

Per repo policy, envs/ third-party environments don't need the same bar as src/ — this is a routine dependency bump, safe to merge once CI is green here too.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• New environment
• Refactoring
• Dependency maintenance (automated Dependabot consolidation)

Alignment Checklist

• I have read .claude/docs/PRINCIPLES.md and this PR aligns with our principles
• I have checked .claude/docs/INVARIANTS.md and no invariants are violated
• Lockfile verified with uv lock --check; this is a routine envs/-only dependency bump with no code changes

RFC Status

• Not required (dependency bump only)

Test Plan

• uv lock --check passes in envs/websearch_env
• chore(deps): bump opentelemetry-api from 1.45.1 to 1.45.2 in /envs/websearch_env #1623 (the folded single) passed full CI individually (test-*, lint, validate-env-locks, Runtime validation, etc.) before being folded here
• Will confirm this aggregate's own CI goes green before a maintainer merges

Claude Code Review

N/A — automated Dependabot triage run, not a Claude Code session.

---

Maintainer action needed

Once this PR is reviewed/merged, please close the folded single #1623.

The following 6 older Dependabot-consolidation aggregate PRs are now fully redundant/empty-diff (their folded singles already landed on main directly, or in the case of the most recent round, via the now-merged #1620) and have been flagged in every daily run's PR body for 2+ weeks with no action yet — they just need to be closed, not merged:

• chore(deps): consolidate core Dependabot bumps (2026-11-03) #1553, chore(deps): consolidate core Dependabot bumps (2026-10-31) #1540, chore(deps): consolidate core Dependabot bumps (2026-10-28) #1516 (core aggregates)
• chore(deps): consolidate envs Dependabot security bumps (2026-11-06) #1564, chore(deps): consolidate envs Dependabot security bumps (2026-10-31) #1541, chore(deps): consolidate envs Dependabot security bumps (2026-10-28) #1515 (envs aggregates)

Note: the core bucket has zero open Dependabot singles right now (only the excluded FastMCP #1331, see below), so no core aggregate PR was opened this run — nothing to open an empty placeholder for.

#1331 (fastmcp >=3.0.0,<4.0.0 → >=3.0.0,<5.0.0) remains intentionally excluded from the core aggregate: FastMCP 4.x (currently 4.2.0) still breaks OpenEnv's MCP session-persistence tests (TestMCPSessionTransportPersistence::test_http_session_mcp_state_persists_across_calls / test_websocket_mcp_state_persists_across_calls) because FastMCP 4's sessionless MCP SDK v2 engine replaced ctx.set_state with request-scoped state. 4.2.0 ("Mad Skills", 2026-11-13) adds a server-side skills API and raises the minimum Python to 3.11 — still nothing addressing session persistence. Leave #1331 open as the dedicated tracking PR for this upgrade; do not merge.

  

---

Note

Low Risk
Lockfile-only patch dependency bump in an isolated envs/ environment with no source changes.

Overview
Bumps opentelemetry-api from 1.45.1 to 1.45.2 in envs/websearch_env/uv.lock only, folding Dependabot #1623 into the aggregate envs maintenance PR. No application or test code changes—resolved sdist/wheel URLs and hashes are updated for the patch release (traceparent header length and metric cardinality limits, per the folded single).

^{Reviewed by Cursor Bugbot for commit ac01816. Bugbot is set up for automated code reviews on this repo. Configure here.}