chore(deps): batch the eight low-risk Dependabot bumps - #735
Merged
Conversation
Bumps [pytest-playwright](https://github.com/microsoft/playwright-pytest) from 0.8.0 to 0.9.0. - [Release notes](https://github.com/microsoft/playwright-pytest/releases) - [Commits](microsoft/playwright-pytest@v0.8.0...v0.9.0) --- updated-dependencies: - dependency-name: pytest-playwright dependency-version: 0.9.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [fastapi](https://github.com/fastapi/fastapi) from 0.140.0 to 0.141.1. - [Release notes](https://github.com/fastapi/fastapi/releases) - [Commits](fastapi/fastapi@0.140.0...0.141.1) --- updated-dependencies: - dependency-name: fastapi dependency-version: 0.141.1 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [snowflake-connector-python](https://github.com/snowflakedb/snowflake-connector-python) from 4.7.1 to 4.7.2. - [Release notes](https://github.com/snowflakedb/snowflake-connector-python/releases) - [Commits](snowflakedb/snowflake-connector-python@v4.7.1...v4.7.2) --- updated-dependencies: - dependency-name: snowflake-connector-python dependency-version: 4.7.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) from 10.0.0 to 10.0.1. - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](astral-sh/setup-uv@ae62891...20cfd1b) --- updated-dependencies: - dependency-name: astral-sh/setup-uv dependency-version: 10.0.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [python-dotenv](https://github.com/theskumar/python-dotenv) from 1.2.2 to 1.2.3. - [Release notes](https://github.com/theskumar/python-dotenv/releases) - [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md) - [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3) --- updated-dependencies: - dependency-name: python-dotenv dependency-version: 1.2.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps the npm-minor-patch group in /app with 1 update: [react-resizable-panels](https://github.com/bvaughn/react-resizable-panels). Updates `react-resizable-panels` from 4.12.2 to 4.12.3 - [Release notes](https://github.com/bvaughn/react-resizable-panels/releases) - [Changelog](https://github.com/bvaughn/react-resizable-panels/blob/main/CHANGELOG.md) - [Commits](bvaughn/react-resizable-panels@4.12.2...4.12.3) --- updated-dependencies: - dependency-name: react-resizable-panels dependency-version: 4.12.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: npm-minor-patch ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [preact](https://github.com/preactjs/preact) from 10.28.4 to 10.29.8. - [Release notes](https://github.com/preactjs/preact/releases) - [Commits](preactjs/preact@10.28.4...10.29.8) --- updated-dependencies: - dependency-name: preact dependency-version: 10.29.8 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 8.1.5 to 8.2.2. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
Each Dependabot commit locked against staging, so stacking them left app/package-lock.json resolved from the pre-batch tree. Regenerated so the lock matches the manifests it ships with. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
|
This PR was not deployed automatically as @Anchel123 does not have access to the Railway project. In order to get automatic PR deploys, please add @Anchel123 to your workspace on Railway. |
Dependency ReviewThe following issues were found:
OpenSSF ScorecardScorecard details
Scanned Files
|
Contributor
There was a problem hiding this comment.
Pull request overview
This PR batches eight low-risk Dependabot dependency updates into a single change set to reduce CI/review overhead while keeping dependency resolution consistent (including regenerating the frontend lockfile from the post-batch tree).
Changes:
- Bumps Python deps (FastAPI, pytest-playwright, snowflake-connector-python, python-dotenv) and updates Python version constraints where needed.
- Bumps frontend deps (preact, react-resizable-panels, vite) and regenerates
app/package-lock.json. - Updates the pinned commit SHA for the
astral-sh/setup-uvGitHub Action across CI workflows.
Reviewed changes
Copilot reviewed 6 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Updates resolved Python package versions/metadata for the bumped dependencies and reflects updated constraints. |
pyproject.toml |
Widens dependency constraints for fastapi and pytest-playwright to allow the new versions. |
app/package.json |
Bumps frontend dependency versions for preact, react-resizable-panels, and vite. |
app/package-lock.json |
Regenerates the frontend lockfile to reflect the bumped versions and updated transitive graph. |
.github/workflows/tests.yml |
Updates astral-sh/setup-uv action pin to v10.0.1 commit SHA. |
.github/workflows/pylint.yml |
Updates astral-sh/setup-uv action pin to v10.0.1 commit SHA. |
.github/workflows/publish-pypi.yml |
Updates astral-sh/setup-uv action pin to v10.0.1 commit SHA. |
.github/workflows/playwright.yml |
Updates astral-sh/setup-uv action pin to v10.0.1 commit SHA. |
Files not reviewed (1)
- app/package-lock.json: Generated file
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This was referenced Aug 24, 2026
The root package.json depends on the frontend via `file:app`, so its lockfile embeds the whole app tree. Dependabot only ever touches `app/package-lock.json`, leaving the root lock stale — and the npm Dependabot PRs skip the job that runs `npm ci` at the root, so nothing caught it until the bumps were batched onto a regular PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (3)
📒 Files selected for processing (6)
Included review availability: Your plan provides up to 4 included reviews per hour; 2 remain after this review. 📝 WalkthroughWalkthroughThis update refreshes the pinned ChangesDependency and CI updates
Estimated code review effort: 2 (Simple) | ~10 minutes Merge Risk: ⚪ Minimal · up to This PR batches validated low-risk dependency updates and regenerated lockfiles without introducing an evidenced correctness, security, availability, or deployment concern; no actionable merge-blocking risk remains beyond normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 inconclusive)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
galshubeli
approved these changes
Aug 26, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Batches the eight low-risk Dependabot bumps into one PR, so
stagingtakes oneCI run and one review instead of eight.
Each commit is Dependabot's own, cherry-picked unchanged, plus a final commit
that regenerates
app/package-lock.json— every bump locked againststagingindependently, so stacking them left the lock resolved from the pre-batch tree.
Included
pytest-playwright0.8.0 → 0.9.0fastapi0.140.0 → 0.141.1snowflake-connector-python4.7.1 → 4.7.2astral-sh/setup-uv10.0.0 → 10.0.1python-dotenv1.2.2 → 1.2.3react-resizable-panels4.12.2 → 4.12.3preact10.28.4 → 10.29.8vite8.1.5 → 8.2.2Only two manifest constraints needed widening, both by Dependabot itself:
fastapito<0.142.0andpytest-playwrightto>=0.8,<0.10. The rest werealready inside their existing ranges and are lockfile-only.
Deliberately left open
Three majors are not here, because each needs its own change and its own
review:
typescript6.0.3 → 7.0.2.app/tsconfig.jsonstill setsbaseUrl,which 6.0.3 already rejects (
TS5101, we build with--ignoreDeprecations)and 7 removes outright. Needs the path aliases migrated first.
zod3.25.76 → 4.4.3. Breaking API change across every schema inapp/src.openai2.48.0 → 3.1.0. Conflicts with the rangelitellmsupports;same constraint being untangled in GraphRAG-Server#362.
Validation
uv run pylint $(git ls-files '*.py')— 10.00/10uv run python -m pytest tests/ -q— 384 passed, 2 skippednpx playwright test --list— 69 tests collected across 5 files (thepytest-playwrightminor did not change collection)npm --prefix ./app run build:dev— cleannpx tsc --noEmit— cleannpm --prefix ./app ci— 0 vulnerabilitiesCloses #723
Closes #724
Closes #725
Closes #726
Closes #727
Closes #728
Closes #730
Closes #731
Summary by CodeRabbit