Skip to content

build(deps): combine the open Dependabot updates - #588

Merged
vvbandeira merged 19 commits into
The-OpenROAD-Project:masterfrom
vvbandeira:dependabot-prep-20261104
Nov 9, 2026
Merged

build(deps): combine the open Dependabot updates#588
vvbandeira merged 19 commits into
The-OpenROAD-Project:masterfrom
vvbandeira:dependabot-prep-20261104

Conversation

@vvbandeira

@vvbandeira vvbandeira commented Nov 8, 2026

Copy link
Copy Markdown
Member

Combine the open Dependabot updates for backend, frontend, and evaluation into one change.
Each master merge in these paths starts a paid Secret CI evaluation, so one merge is cheaper than eighteen.

Security fixes:

  • authlib 1.6.12 -> 1.9.1 (backend)
  • dnspython -> 2.9.0 (backend and frontend)
  • pyasn1 0.6.4 -> 0.6.5 (backend, frontend, and evaluation)
  • pypdf 6.21.2 -> 6.21.4 (backend)
  • joserfc 1.7.5 -> 1.7.6 (backend)
  • oauthlib 4.0.0 -> 4.0.1 (frontend and evaluation)
  • minimatch 10.2.6 -> 11.0.5 (Next.js frontend, GHSA-g3hv-75wg-m249).
    No 10.x release has the fix, and @typescript-eslint/typescript-estree still asks for ^10.2.2, so a resolution scoped to that range forces 11.
    The lint-nextjs job checks that ESLint still works.

The batch also includes the routine updates from the quality-tools, python-runtime, and npm groups, pre-commit 4.7.0, and the fastapi floor.
It moves the common health-check image from Ubuntu Jammy to Ubuntu 26.04.

Supersedes #564, #569, #570, #571, #572, #575, #576, #577, #578, #579, #580, #581, #582, #583, #584, #585, #586, #587, and the Jammy date bump in #561.
The Python 3.15 image (#573), protobuf 7 (#567), and pyarrow 26 (#566) updates stay separate.

dependabot Bot and others added 19 commits November 2, 2026 23:57
@dependabot @vvbandeira
Build(deps): Bump authlib from 1.6.12 to 1.9.1 in /backend
52ed458 
Bumps [authlib](https://github.com/authlib/authlib) from 1.6.12 to 1.9.1.
- [Release notes](https://github.com/authlib/authlib/releases)
- [Commits](authlib/authlib@v1.6.12...v1.9.1)

---
updated-dependencies:
- dependency-name: authlib
  dependency-version: 1.9.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump dnspython from 2.8.0 to 2.9.0 in /backend
ac0efcb 
Bumps [dnspython](https://github.com/rthalley/dnspython) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.8.0...v2.9.0)

---
updated-dependencies:
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump dnspython from 2.7.0 to 2.9.0 in /frontend
0db3e81 
Bumps [dnspython](https://github.com/rthalley/dnspython) from 2.7.0 to 2.9.0.
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.7.0...v2.9.0)

---
updated-dependencies:
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump ruff in /evaluation in the quality-tools group
563e7c9 
Bumps the quality-tools group in /evaluation with 1 update: [ruff](https://github.com/astral-sh/ruff).

Updates `ruff` from 0.17.0 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.17.0...0.17.1)

---
updated-dependencies:
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: quality-tools
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump pre-commit from 4.6.2 to 4.7.0 in /frontend
a9ed1ac 
Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 4.6.2 to 4.7.0.
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

---
updated-dependencies:
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps-dev): Bump pre-commit from 4.6.2 to 4.7.0 in /backend
679305c 
Bumps [pre-commit](https://github.com/pre-commit/pre-commit) from 4.6.2 to 4.7.0.
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.2...v4.7.0)

---
updated-dependencies:
- dependency-name: pre-commit
  dependency-version: 4.7.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Update fastapi[standard] requirement in /frontend
16f1973 
Updates the requirements on [fastapi[standard]](https://github.com/fastapi/fastapi) to permit the latest version.
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.143.0...0.146.0)

---
updated-dependencies:
- dependency-name: fastapi[standard]
  dependency-version: 0.146.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump the npm group across 1 directory with 6 updates
35c0aa6 
Bumps the npm group with 6 updates in the /frontend/nextjs-frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@babel/runtime](https://github.com/babel/babel/tree/HEAD/packages/babel-runtime) | `8.0.7` | `8.0.8` |
| [next](https://github.com/vercel/next.js) | `16.4.1` | `16.4.3` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.3.0` | `19.3.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.3.0` | `19.3.1` |
| [eslint-config-next](https://github.com/vercel/next.js/tree/HEAD/packages/eslint-config-next) | `16.4.0` | `16.4.3` |
| [postcss](https://github.com/postcss/postcss) | `8.5.29` | `8.5.31` |

Updates `@babel/runtime` from 8.0.7 to 8.0.8
- [Release notes](https://github.com/babel/babel/releases)
- [Changelog](https://github.com/babel/babel/blob/main/CHANGELOG.md)
- [Commits](https://github.com/babel/babel/commits/v8.0.8/packages/babel-runtime)

Updates `next` from 16.4.1 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](vercel/next.js@v16.4.1...v16.4.3)

Updates `react` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react)

Updates `react-dom` from 19.3.0 to 19.3.1
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.1/packages/react-dom)

Updates `eslint-config-next` from 16.4.0 to 16.4.3
- [Release notes](https://github.com/vercel/next.js/releases)
- [Commits](https://github.com/vercel/next.js/commits/v16.4.3/packages/eslint-config-next)

Updates `postcss` from 8.5.29 to 8.5.31
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](postcss/postcss@8.5.29...8.5.31)

---
updated-dependencies:
- dependency-name: "@babel/runtime"
  dependency-version: 8.0.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: next
  dependency-version: 16.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: react-dom
  dependency-version: 19.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: eslint-config-next
  dependency-version: 16.4.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
- dependency-name: postcss
  dependency-version: 8.5.31
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@vvbandeira
build(deps): bump the quality-tools group in backend and frontend
e173371 
Dependabot PR 576: pytest-asyncio 1.4.0 -> 1.4.1, ruff 0.17.0 -> 0.17.2.
Merged with the pre-commit 4.7.0 bump in frontend/pyproject.toml.

Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump the python-runtime group across 1 directory with 4 …
4ea5592 
…updates

Bumps the python-runtime group with 4 updates in the /evaluation directory: [google-auth](https://github.com/googleapis/google-cloud-python), [deepeval](https://github.com/confident-ai/deepeval), [langchain-google-vertexai](https://github.com/langchain-ai/langchain-google) and [langsmith](https://github.com/langchain-ai/langsmith-python).

Updates `google-auth` from 2.61.0 to 2.62.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-auth-v2.61.0...google-auth-v2.62.0)

Updates `deepeval` from 4.2.8 to 4.3.1
- [Release notes](https://github.com/confident-ai/deepeval/releases)
- [Commits](confident-ai/deepeval@python-v4.2.8...python-v4.3.1)

Updates `langchain-google-vertexai` from 3.2.4 to 3.2.5
- [Release notes](https://github.com/langchain-ai/langchain-google/releases)
- [Commits](langchain-ai/langchain-google@libs/vertexai/v3.2.4...libs/vertexai/v3.2.5)

Updates `langsmith` from 0.14.7 to 0.14.17
- [Release notes](https://github.com/langchain-ai/langsmith-python/releases)
- [Changelog](https://github.com/langchain-ai/langsmith-python/blob/main/CHANGELOG.md)
- [Commits](https://github.com/langchain-ai/langsmith-python/commits/v0.14.17)

---
updated-dependencies:
- dependency-name: google-auth
  dependency-version: 2.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: deepeval
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-runtime
- dependency-name: langchain-google-vertexai
  dependency-version: 3.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
- dependency-name: langsmith
  dependency-version: 0.14.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@vvbandeira
build(deps): bump the python-runtime group in backend and frontend
a5c4d11 
Dependabot PR 578: alembic, fastapi 0.143.0 -> 0.162.0, google-cloud-storage, langchain-google-genai, langchain-google-vertexai, langgraph, langgraph-checkpoint, markdown, openai 3.29.0 -> 3.37.0, sentence-transformers, transformers, sphinx, sqlalchemy and starlette 1.7.0 -> 1.10.0.
frontend/uv.lock is re-locked in a later commit.

Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@vvbandeira
build(deps): re-lock frontend after combining the updates
a0dc746 
The combined branch merged frontend/uv.lock as text. Re-lock with uv 0.13.0 so that it matches frontend/pyproject.toml, and take fastapi 0.162.0 as Dependabot PR 578 did.

Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@vvbandeira
build(common): use Ubuntu 26.04
3b7c8bd 
Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@vvbandeira
build(deps): bump pyasn1 to 0.6.5
c42e520 
Update the backend, frontend, and evaluation locks together.

Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@dependabot @vvbandeira
Build(deps): Bump pypdf from 6.21.2 to 6.21.4 in /backend
dc9d8a1 
Bumps [pypdf](https://github.com/py-pdf/pypdf) from 6.21.2 to 6.21.4.
- [Release notes](https://github.com/py-pdf/pypdf/releases)
- [Changelog](https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md)
- [Commits](py-pdf/pypdf@6.21.2...6.21.4)

---
updated-dependencies:
- dependency-name: pypdf
  dependency-version: 6.21.4
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @vvbandeira
Build(deps): Bump oauthlib from 4.0.0 to 4.0.1 in /evaluation
6097210 
Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/oauthlib/oauthlib/releases)
- [Changelog](https://github.com/oauthlib/oauthlib/blob/v4.0.1/CHANGELOG.rst)
- [Commits](oauthlib/oauthlib@v4.0.0...v4.0.1)

---
updated-dependencies:
- dependency-name: oauthlib
  dependency-version: 4.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @vvbandeira
Build(deps): Bump joserfc from 1.7.5 to 1.7.6 in /backend
cbc1b79 
Bumps [joserfc](https://github.com/authlib/joserfc) from 1.7.5 to 1.7.6.
- [Release notes](https://github.com/authlib/joserfc/releases)
- [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst)
- [Commits](authlib/joserfc@1.7.5...1.7.6)

---
updated-dependencies:
- dependency-name: joserfc
  dependency-version: 1.7.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @vvbandeira
Build(deps): Bump oauthlib from 4.0.0 to 4.0.1 in /frontend
64be818 
Bumps [oauthlib](https://github.com/oauthlib/oauthlib) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/oauthlib/oauthlib/releases)
- [Changelog](https://github.com/oauthlib/oauthlib/blob/v4.0.1/CHANGELOG.rst)
- [Commits](oauthlib/oauthlib@v4.0.0...v4.0.1)

---
updated-dependencies:
- dependency-name: oauthlib
  dependency-version: 4.0.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@vvbandeira
build(deps): force minimatch 11 for typescript-estree
039e655 
GHSA-g3hv-75wg-m249 affects minimatch 7.0.0 to 11.0.0, and no 10.x
release has the fix. @typescript-eslint/typescript-estree, latest
included, still asks for ^10.2.2, so scope the resolution to that
range. The lint-nextjs job checks that ESLint still works.

Signed-off-by: Vitor Bandeira <vvbandeira@precisioninno.com>
@vvbandeira
vvbandeira merged commit f720733 into The-OpenROAD-Project:master Nov 9, 2026
8 checks passed
@vvbandeira
vvbandeira deleted the dependabot-prep-20261104 branch November 9, 2026 17:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vvbandeira