build(deps): update modal requirement from >=1.5.3 to >=1.5.4 in /sandbox

[dependabot]

Updates the requirements on modal to permit the latest version.

Changelog

Sourced from modal's changelog.

Changelog

Both client libraries are pre-1.0, and they have separate versioning.

Unreleased

• (JS) Reference documentation now lives on modal.com/docs, replacing the TypeDoc site previously published to GitHub Pages.
• (Go, JS) Experimental options for Sandboxes (ExperimentalOptions in SandboxCreateParams in Go, experimentalOptions in Sandbox.create in JS) now accept string values in addition to booleans.
• (Go, JS) Added a ConflictError error type, returned when the current state of a resource conflicts with the requested operation.
• Breaking: (Go) Unexported AuthTokenManager, NewAuthTokenManager, TokenAndExpiry, and ValidateExecArgs which were not meant to be part of the public API.
• (Go, JS) Sandbox.Filesystem.CopyFromLocal / WriteBytes / WriteText (Go) and sandbox.filesystem.copyFromLocal / writeBytes / writeText (JS) now stream data to the Sandbox instead of issuing a request per chunk, making large writes ~2.5× faster.
• Breaking: (Go) FunctionUpdateAutoscalerParams.ScaledownWindow now is typed as a *time.Duration instead of as a *uint32.
• (Go, JS) Function.UpdateAutoscaler now returns a struct containing the current autoscaler settings immediately after applying the change.
• (Go) RefreshWindow is deprecated and has no effect. Auth tokens are now refreshed a jittered fraction of the way through their lifetime instead of a fixed five minutes before expiry.
• (Go) Added a logs attribute for Function and FunctionCall objects for fetching current and historical logs generated by that object. The logs propery exposes a fetch method for time-based queries, tail for fetching the most recent entries, and stream for fetching entries as they arrive.

js/v0.9.0, go/v0.9.0

• (Go, JS) Functions.FromName / Cls.FromName (Go) and client.functions.fromName / client.cls.fromName (JS) now accept an optional Version (Go) / version (JS) parameter to look up a version-pinned Function or Cls.
• (Go, JS) Secrets.FromMap (Go) / client.secrets.fromObject (JS) is now lazy, so the returned Secret has an empty SecretID (Go) / secretId (JS) until it is first used. Latency for Sandbox.ExperimentalCreate / Sandbox.experimentalCreate and Sandbox.Exec / Sandbox.exec is improved by sending the secrets directly to the Sandbox and avoiding the secret creation limits.
• (Go, JS) Function.WithOptions / Cls.WithOptions (Go) and Function_.withOptions / Cls.withOptions (JS) now accept a RoutingRegion / routingRegion option to override the region the Function's or Cls's inputs and outputs are routed through.
• (Go, JS) Added Sandbox.Filesystem.Watch (Go) / Sandbox.filesystem.watch (JS) to watch a path in the Sandbox for filesystem changes. It yields FileWatchEvent objects and supports Recursive / recursive, an event-type Filter / filter, and a Timeout / timeoutMs bound.
• Breaking: (Go, JS) Sandbox.ReloadVolumes (Go) / Sandbox.reloadVolumes (JS) now blocks until the Volumes have been reloaded, bounded by a new timeout (55 seconds by default) that is configurable via SandboxReloadVolumesParams.Timeout (Go) / SandboxReloadVolumesParams.timeoutMs (JS). If the reload does not complete within that window, a TimeoutError is raised.
• Breaking: (Go, JS) Renamed the VolumeMountOptions type to VolumeMountOptionsParams. In Go, update WithMountOptions(&VolumeMountOptions{...}) / withMountOptions type annotations accordingly.
• Breaking: (Go) Changed OutboundCIDRAllowlist and OutboundDomainAllowlist in SandboxCreateParams from []string to *Allowlist. A non-nil *Allowlist enables allowlist mode (even with empty Entries, which blocks all traffic of that type); nil means open access. Migrate OutboundCIDRAllowlist: []string{"10.0.0.0/8"} to OutboundCIDRAllowlist: &Allowlist{Entries: []string{"10.0.0.0/8"}}.

js/v0.8.2, go/v0.8.2

• Added Sandbox.updateNetworkPolicy (JS) and Sandbox.UpdateNetworkPolicy (Go) to update the outbound network policy of a running Sandbox. Both outboundCidrAllowlist and outboundDomainAllowlist must be provided.

js/v0.8.1, go/v0.8.1

• (Go, JS) Sandbox.CreateConnectToken (Go) / Sandbox.createConnectToken (JS) now accept an optional Port / port parameter on their params struct, controlling which container port requests are routed to when using the token. Defaults to 8080.

js/v0.8.0, go/v0.8.0

This release primarily contains a number of breaking changes as we continue working towards 1.0 in the JS and Go SDKs.

• Added support for named Images, akin to a Modal-native Image registry, decoupling Image builds from App deployment or Sandbox creation:
  • (Go) Image.Publish and Image.FromName
  • (JS) Image.publish and Image.fromName
• Added support for restricting the domains that processes inside of a Sandbox can connect to:
  • (Go) OutboundDomainAllowlist in SandboxCreateParams
  • (JS) outboundDomainAllowlist in Sandbox.create
• Added support for dynamic configuration of Functions:
  • (Go) Function.WithOptions, Function.WithConcurrency, Function.WithBatching, Function.Instance
  • (JS) Function_.withOptions, Function_.withConcurrency, Function_.withBatching, Function_.instance
• Improved reliability when uploading or downloading large data payloads for Function calls.
• Fixed a bug where adding Dockerfile commands to an Image loaded with Image.FromID (Go) / Image.fromId (JS) could fail to use the resolved Image as the base.
• Sandbox.exec (JS) / Sandbox.Exec (Go) now reject a relative Workdir client-side with InvalidError. In JS, an empty-string workdir is also rejected (pass undefined to use the image default).

... (truncated)

Commits

• a8fee72 Release v1.5.4 of the Python SDK (#52926)
• bfb89f8 Stop Invoke from eating type-ahead; opt interactive tasks back into stdin (#5...
• cde1bd4 Fix reference doc formatting of two modal CLI commands (#52928)
• 0ec535d [PY-SDK] App.logs SDK (#52470)
• f6c8de5 Clarify that _experimental_list also returns mirrored V1 sandboxes (#52723)
• 2a177f9 [FLPRD-271] Add task types to managed Endpoint specs (#52720)
• 551fff5 Call ContainerStop from stop_fetching_inputs (#51743)
• ca17722 client: [python] Use a sandbox_v2 var to route to v2 backend (#52118)
• c5588b5 billing rates api client (#52163)
• 4f6bdf8 Allow environment-scoped Sandbox._experimental_list (#52433)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	push	371edf5	Aug 22 2026, 09:44 PM

[push-agent]

This is a Dependabot patch-level minimum-version bump for the Modal SDK (1.5.3 → 1.5.4) in the sandbox requirements. The sandbox app (sandbox/app.py) uses only stable Modal 1.5.x APIs, so this bump raises the floor without touching any code path or altering the existing unbounded >= constraint semantics. No correctness, compatibility, or security concerns.

---

Review by Push · fugu