chore(deps): combine all dependabot dependency updates#504
Conversation
Python dependencies: - uvicorn: 0.41.0 → 0.42.0 - litellm: 1.82.0 → 1.82.6 - authlib: 1.6.8 → 1.6.9 - fastmcp: 3.0.1 → 3.1.1 - pytest-asyncio: 1.2.0 → 1.3.0 GitHub Actions: - astral-sh/setup-uv: v5.4.2 → v7.6.0 - rojopolis/spellcheck-github-actions: 0.59.0 → 0.60.0 NPM dependencies (app/): - typescript-eslint: 8.53.0 → 8.57.0 - flatted: 3.3.3 → 3.4.2 - picomatch: 2.3.1 → 2.3.2 / 4.0.3 → 4.0.4 Replaces: #483, #484, #486, #487, #491, #493, #498, #499, #500, #501 Skipped major version bumps (require migration work): - #488 vite 7→8, #489 react-dom 18→19 - #490 tailwind-merge 2→3, #492 tailwindcss 3→4 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Completed Working on "Code Review"✅ Review submitted: COMMENT. Total comments: 1 across 1 files. ✅ Workflow completed successfully. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (6)
📝 WalkthroughWalkthroughThis PR updates multiple dependencies and GitHub Action versions across the project. It bumps the Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
🚅 Deployed to the QueryWeaver-pr-504 environment in queryweaver
|
Dependency ReviewThe following issues were found:
|
railway-app
bot
temporarily deployed
to
queryweaver / QueryWeaver-pr-504
![overcut-ai[bot]](https://avatars.githubusercontent.com/in/1367736?s=60&v=4){kind=small}
There was a problem hiding this comment.
Review Summary
- Total findings: 1
- By severity: 1 MAJOR (0 BLOCKER, 0 CRITICAL, 0 MINOR, 0 SUGGESTION, 0 PRAISE)
- Affected files:
app/package-lock.json
Key Theme
- Dependency/tooling upgrade introduces a potentially incompatible Node engine requirement in the lint toolchain.
Next Steps
- Ensure CI and local development Node versions satisfy the new transitive engine constraints, or
- Pin
typescript-eslint(and related transitive deps) to a compatible range before merging. - Re-run install/lint in CI after adjustment to confirm deterministic success.
There was a problem hiding this comment.
Pull request overview
Rolls up multiple Dependabot updates into a single dependency-refresh PR across backend (uv/Python), frontend (npm/app), and CI workflows to reduce merge noise while keeping the repo on current patch/minor releases.
Changes:
- Updated Python dependency lockfile (
uv.lock) and adjustedpyproject.tomlconstraints foruvicornandpytest-asyncio. - Updated frontend tooling dependency
typescript-eslintinapp/and refreshed npm lockfiles. - Bumped GitHub Actions used in CI (notably
astral-sh/setup-uvand the spellcheck action).
Reviewed changes
Copilot reviewed 6 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Refreshes locked Python dependency versions (including transitive additions). |
pyproject.toml |
Updates Python dependency constraints (uvicorn, pytest-asyncio). |
package-lock.json |
Refreshes root lockfile used by workflows that run npm ci at repo root. |
app/package.json |
Bumps typescript-eslint version range. |
app/package-lock.json |
Updates app lockfile for the typescript-eslint bump and related tree changes. |
.github/workflows/tests.yml |
Updates astral-sh/setup-uv action pin. |
.github/workflows/pylint.yml |
Updates astral-sh/setup-uv action pin. |
.github/workflows/playwright.yml |
Updates astral-sh/setup-uv action pin (workflow also uses root npm ci). |
.github/workflows/spellcheck.yml |
Updates spellcheck action pin. |
Files not reviewed (1)
- app/package-lock.json: Language not supported
Summary
Combines 10 dependabot PRs into a single update to reduce merge noise.
Changes
Python Dependencies
uvicorn: 0.41.0 → 0.42.0 (chore(deps): bump uvicorn from 0.41.0 to 0.42.0 #499)litellm: 1.82.0 → 1.82.6 (chore(deps): bump litellm from 1.82.0 to 1.82.6 #500)authlib: 1.6.8 → 1.6.9 (chore(deps): bump authlib from 1.6.8 to 1.6.9 #484, chore(deps): bump authlib from 1.6.8 to 1.6.9 in the uv group across 1 directory #493)fastmcp: 3.0.1 → 3.1.1 (chore(deps): bump fastmcp from 3.0.1 to 3.1.1 #487)pytest-asyncio: 1.2.0 → 1.3.0 (chore(deps-dev): bump pytest-asyncio from 1.2.0 to 1.3.0 #486)GitHub Actions
astral-sh/setup-uv: v5.4.2 → v7.6.0 (chore(deps): bump astral-sh/setup-uv from 5.4.2 to 7.6.0 #498)rojopolis/spellcheck-github-actions: 0.59.0 → 0.60.0 (chore(deps): bump rojopolis/spellcheck-github-actions from 0.59.0 to 0.60.0 #483)NPM Dependencies (app/)
typescript-eslint: 8.53.0 → 8.57.0 (chore(deps-dev): bump typescript-eslint from 8.53.0 to 8.57.0 in /app #491)flatted: 3.3.3 → 3.4.2 (chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #501)picomatch: 2.3.1 → 2.3.2 / 4.0.3 → 4.0.4 (chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates #501)Skipped (major version bumps requiring migration)
Testing
CI pipeline validates all changes.
Memory / Performance Impact
N/A — minor/patch dependency bumps only.
Related Issues
Replaces: #483, #484, #486, #487, #491, #493, #498, #499, #500, #501
Summary by CodeRabbit