chore(deps-dev): bump dotenv from 17.4.2 to 18.0.4 in /libs/cli/js-examples in the major group (#9154)

Bumps the major group in /libs/cli/js-examples with 1 update:
[dotenv](https://github.com/motdotla/dotenv).

Updates `dotenv` from 17.4.2 to 18.0.4
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/motdotla/dotenv/blob/master/CHANGELOG.md">dotenv's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.3...v18.0.4">18.0.4</a>
(2026-09-25)</h2>
<h3>Changed</h3>
<ul>
<li><code>import dotenv/config</code> should default quiet: true (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1063">#1063</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.2...v18.0.3">18.0.3</a>
(2026-09-22)</h2>
<h3>Changed</h3>
<ul>
<li>Patch <code>DOTENV_QUIET</code> setting when inside .env file (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1059">#1059</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.1...v18.0.2">18.0.2</a>
(2026-09-21)</h2>
<h3>Changed</h3>
<ul>
<li>Patch additional edge cases for the fast parser (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1056">#1056</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v18.0.0...v18.0.1">18.0.1</a>
(2026-09-18)</h2>
<h3>Changed</h3>
<ul>
<li>Handle file urls in config logging (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1054">#1054</a>)</li>
</ul>
<h2><a
href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.0">18.0.0</a>
(2026-09-17)</h2>
<h3>Added</h3>
<ul>
<li>NEW: Dotenv now has a CLI. (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1022">#1022</a>)</li>
</ul>
<pre lang="sh"><code>$ dotenv run -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</code></pre>
<ul>
<li>NEW: Dotenv now has a fast parser thanks to <a
href="https://github.com/homanp"><code>@​homanp</code></a> of <a
href="https://superagent.sh">superagent.sh</a>. Pass <code>config({
fast: true })</code>, flag <code>--fast</code>, or set
<code>DOTENV_FAST=true</code> to opt-in to ~2x faster character-scanner
parser. (<a
href="https://redirect.github.com/motdotla/dotenv/pull/1010">#1010</a>)</li>
</ul>
<pre lang="sh"><code>$ dotenv run --fast -- node index.js
◇ injected env (2) from .env
Hello Dotenv
</code></pre>
<p><a href="https://dotenvx.com/blog/2026/09/28/dotenv-fast.html">faster
than Node native parseEnv!</a></p>
<h3>Changed</h3>
<ul>
<li>Injecting message sent to stderr rather than stdout and tips removed
(<a
href="https://redirect.github.com/motdotla/dotenv/pull/1037">#1037</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/motdotla/dotenv/commit/86804c0507aff98d3a82204759729af3bc2ce1a9"><code>86804c0</code></a>
18.0.4</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/2403db57c3f8b01123d69a8b441a5f8b828fab3c"><code>2403db5</code></a>
changelog</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/75b775eda45af3085fb7a7de6ae2613eb646807e"><code>75b775e</code></a>
npm audit</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/7e1750ce8034b3c9485f1e1722587a40890449e1"><code>7e1750c</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1064">#1064</a>
from motdotla/dependabot/npm_and_yarn/ip-address-10.7.2</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/a6ade63b6fa94a78fdc68f815c4e88cfe8781774"><code>a6ade63</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1063">#1063</a>
from motdotla/import</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/288b0d7cd85d8deba3f91a995abd033786626a8d"><code>288b0d7</code></a>
patch test</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/00da9125dd7633a121d169a3a55b62a686b64ef8"><code>00da912</code></a>
Bump ip-address from 10.2.0 to 10.7.2</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/e6b58161d2f2b1448c735b1f6555bde7a20443b7"><code>e6b5816</code></a>
import 'dotenv/config' should still be defaulting to quiet</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/3646ac5e5d000f5f68fe83db52399010f9cb781f"><code>3646ac5</code></a>
Merge pull request <a
href="https://redirect.github.com/motdotla/dotenv/issues/1061">#1061</a>
from motdotla/fast</li>
<li><a
href="https://github.com/motdotla/dotenv/commit/83fc961f92f6c330833da4a5f5dc7093d539501e"><code>83fc961</code></a>
report dotenv vs native vs dotenv.fast</li>
<li>Additional commits viewable in <a
href="https://github.com/motdotla/dotenv/compare/v17.4.2...v18.0.4">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dotenv&package-manager=npm_and_yarn&previous-version=17.4.2&new-version=18.0.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: John Kennedy <jkennedyvz@users.noreply.github.com>
Co-authored-by: open-swe[bot] <open-swe@users.noreply.github.com>

libs/cli/js-examples/package.json

@@ -36,7 +36,7 @@
     "@types/jest": "^30.0.0",
     "@typescript-eslint/eslint-plugin": "^8.68.0",
     "@typescript-eslint/parser": "^8.68.0",
-    "dotenv": "^17.4.2",
+    "dotenv": "^18.0.4",
     "eslint": "^10.9.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",

libs/cli/js-examples/yarn.lock

@@ -2072,10 +2072,10 @@ doctrine@^2.1.0:
   dependencies:
     esutils "^2.0.2"
 
-dotenv@^17.4.2:
-  version "17.4.2"
-  resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-17.4.2.tgz#c07e54a746e11eba021dd9e1047ced5afdc1c034"
-  integrity sha512-nI4U3TottKAcAD9LLud4Cb7b2QztQMUEfHbvhTH09bqXTxnSie8WnjPALV/WMCrJZ6UV/qHJ6L03OqO3LcdYZw==
+dotenv@^18.0.4:
+  version "18.0.4"
+  resolved "https://registry.yarnpkg.com/dotenv/-/dotenv-18.0.4.tgz#419bbe784f30915bfeb10e2d407e13ca5528504f"
+  integrity sha512-jGt9uI5BIxpVO15kvy+iEFqNAwxYClKWnkptLjSNPnFLC003Imd0ofr3aEVsbpHdSBdSsbcApNIlz4nbyGMwdA==
 
 dunder-proto@^1.0.0, dunder-proto@^1.0.1:
   version "1.0.1"

libs/sdk-py/tests/streaming/test_lifecycle_namespace.py

@@ -0,0 +1,67 @@
+"""Child lifecycle completion must not finish the parent thread's output."""
+
+from __future__ import annotations
+
+import asyncio
+from typing import cast
+
+import httpx
+import pytest
+from langchain_protocol import Event
+
+from langgraph_sdk._async.http import HttpClient
+from langgraph_sdk._async.threads import ThreadsClient
+from langgraph_sdk._sync.http import SyncHttpClient
+from langgraph_sdk._sync.stream import _BlockingResult
+from langgraph_sdk._sync.threads import SyncThreadsClient
+from streaming._events import input_requested_event, lifecycle_event
+
+
+@pytest.mark.parametrize("phase", ["completed", "failed"])
+async def test_async_child_terminal_does_not_finish_root(phase):
+    async with httpx.AsyncClient(base_url="http://test") as raw:
+        thread = ThreadsClient(HttpClient(raw)).stream(
+            thread_id="t-1", assistant_id="agent"
+        )
+        thread._run_done = asyncio.get_running_loop().create_future()
+        await thread._apply_lifecycle_event(
+            cast(Event, input_requested_event(namespace=["sub:1"]))
+        )
+        await thread._apply_lifecycle_event(
+            cast(Event, lifecycle_event(namespace=["sub:1"], event=phase))
+        )
+        assert not thread._run_done.done()
+        assert thread.interrupted
+        assert thread.interrupts[0]["namespace"] == ["sub:1"]
+
+        await thread._apply_lifecycle_event(
+            cast(Event, lifecycle_event(event="completed"))
+        )
+        assert thread._run_done.done()
+        assert (await thread._run_done).error is None
+        assert not thread.interrupted
+        assert thread.interrupts == []
+
+
+@pytest.mark.parametrize("phase", ["completed", "failed"])
+def test_sync_child_terminal_does_not_finish_root(phase):
+    with httpx.Client(base_url="http://test") as raw:
+        thread = SyncThreadsClient(SyncHttpClient(raw)).stream(
+            thread_id="t-1", assistant_id="agent"
+        )
+        thread._run_done = _BlockingResult()
+        thread._apply_lifecycle_event(
+            cast(Event, input_requested_event(namespace=["sub:1"]))
+        )
+        thread._apply_lifecycle_event(
+            cast(Event, lifecycle_event(namespace=["sub:1"], event=phase))
+        )
+        assert not thread._run_done.done()
+        assert thread.interrupted
+        assert thread.interrupts[0]["namespace"] == ["sub:1"]
+
+        thread._apply_lifecycle_event(cast(Event, lifecycle_event(event="completed")))
+        assert thread._run_done.done()
+        assert thread._run_done.result().error is None
+        assert not thread.interrupted
+        assert thread.interrupts == []