[marcoacierno]

What

Resolves the open Dependabot alerts (https://github.com/pythonitalia/pycon/security/dependabot) across the three affected manifests.

Backend (backend/pyproject.toml, backend/uv.lock)

• Django 5.2.8 → 5.2.18, Pillow 12.2.0 → 13.0.0, Wagtail 7.3.2 → 7.3.4, djangorestframework 3.17.1 → 3.18.3, strawberry-graphql 0.324.0 → 0.327.2, certifi → 2026.10.23, urllib3 → 2.8.0, nltk → 3.10.4, pypdf → 6.21.4.
• Transitive bumps: aiohttp, brotli, brotlicffi, filelock, oauthlib 4.x, opentelemetry-api, pyasn1, setuptools, werkzeug.
• tablib was pinned to 3.5.0 by django-import-export 3.x, so django-import-export moves to 4.4.4 ([all] extra keeps the same export formats). The admin classes switch from resource_class to resource_classes as required by v4.

Custom admin (backend/custom_admin)

• Astro 5 → 7. @astrojs/tailwind only supports Astro ≤5, so it is removed and Tailwind 3 now runs through postcss.config.cjs with the @tailwind directives in src/tailwind.css (same output as the integration injected). compressHTML: true keeps the previous HTML compression mode.
• Tiptap 2 → 3 using the consolidated packages (@tiptap/extensions, @tiptap/extension-list, @tiptap/extension-table, Color/TextStyle from @tiptap/extension-text-style). StarterKit now bundles Link and Underline, so link: false is set to keep the custom link extension, and shouldRerenderOnTransaction: true preserves the v2 toolbar behaviour.
• graphql-codegen 5 → 7 and matching plugin versions.
• pnpm overrides in pnpm-workspace.yaml for minimatch (<11.0.1) and @graphql-tools/utils (<12.0.2): no in-range release of their dependents is patched. Both are drop-in (same CJS/ESM exports).

Badge service (badge-service)

• puppeteer 24 → 25, which drops extract-zip (two alerts with no patched version).
• Lockfile regenerated with pnpm 12 (was lockfile v6).
• pnpm overrides for glob (→14.x) and minimatch (→11.x); archiver-utils and readdir-glob only use glob.sync and Minimatch, both still exported.
• allowBuilds: puppeteer: true in pnpm-workspace.yaml: pnpm 12 blocks unreviewed dependency build scripts and fails the install with ERR_PNPM_IGNORED_BUILDS; puppeteer's postinstall downloads Chrome, which the badge service needs.

Verification

• pnpm audit on both npm lockfiles: no known vulnerabilities.
• pip-audit on the exported uv lock: no known vulnerabilities.
• Backend test suite in Docker: 1366 passed, 15 skipped, 3 xfailed. makemigrations --check: no changes.
• Custom admin pnpm install --frozen-lockfile, pnpm codegen and pnpm build in the node image: builds the same four pages; the CSS bundle contains the Tailwind preflight/utilities and Radix styles as before.
• Badge service: zip creation smoke test with archiver and the overridden glob/minimatch.
• Badge service: pnpm install --frozen-lockfile with pnpm 12.17.0 exits 0 and downloads Chrome 156 through puppeteer's postinstall.

ToDo

• Dependabot re-evaluates alerts only on the default branch, so the alert list clears after merge.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
pycon	Ready	Preview	Nov 2, 2026 11:23pm UTC

[claude]

This PR bumps dependencies across backend (Python), custom_admin (Astro 5→7, Tiptap 2→3, graphql-codegen 5→7, drops @astrojs/tailwind) and badge-service. It also migrates the rich editor imports to Tiptap 3.

• Unverified major upgrades: Astro 5→7, @astrojs/react 4→7, Tiptap 2→3 and codegen 5→7 are all breaking. The custom_admin build, pnpm codegen and the rich editor (links, buttons, tables, colour, focus) need a manual check. Please confirm that astro build succeeds and that the editor's HTML output is unchanged.
• Tailwind wiring: @astrojs/tailwind is removed and Tailwind v3 now runs only through postcss.config.cjs, with @tailwind directives pulled in via @import in custom-styles.css. Confirm the generated CSS still contains the utilities, because tailwind.config.cjs content globs are no longer applied by the integration.
• Tiptap 3 StarterKit: v3 bundles Link and Underline. link: false is set, but check that the custom link and button nodes do not conflict. rich-editor/index.tsx also still uses isAllowedUri: (url, ctx) => true, which disables Tiptap's URI sanitisation (javascript: links). That is pre-existing, but it matters more now that the option is explicit in v3.
• Node engine: Astro 7 requires Node >=22.23.4. CI and the Dockerfile use Node 26, so this is fine. Please check any other environment that builds custom_admin.
• pnpm overrides: overrides is duplicated in pnpm-workspace.yaml and the lockfile. Make sure the two stay in sync.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.41%. Comparing base (ccf9c25) to head (50593c8).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4841   +/-   ##
=======================================
  Coverage   92.41%   92.41%           
=======================================
  Files         360      360           
  Lines       10920    10920           
  Branches      946      946           
=======================================
  Hits        10092    10092           
  Misses        706      706           
  Partials      122      122           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.