chore(deps): consolidate dependabot updates - #1510
Merged
Merged
Conversation
npm (all-minor-patch group, #1507): - @codemirror/view: 6.43.7 -> 6.43.9 - @mui/material: 9.2.0 -> 9.3.1 - @mui/system: 9.2.0 -> 9.3.0 - @sentry/nextjs: 10.69.0 -> 10.70.0 - @sentry/react: 10.69.0 -> 10.70.0 - @zumer/snapdom: 2.23.2 -> 2.24.1 - ag-grid-community: 36.0.2 -> 36.1.0 - ag-grid-react: 36.0.2 -> 36.1.0 - posthog-js: 1.410.9 -> 1.415.1 - @testing-library/jest-dom: 7.0.0 -> 7.0.1 - @types/node: 26.1.2 -> 26.2.0 - baseline-browser-mapping: 2.11.12 -> 2.11.15 - postcss: 8.5.25 -> 8.5.26 - read-excel-file: 9.3.5 -> 9.3.10 - vite: 8.2.0 -> 8.2.1 - storybook + @storybook/{addon-docs,addon-vitest,react,react-vite}: 10.5.6 -> 10.5.8 Python (#1502): - gitpython: 3.1.57 -> 3.1.59 (supersedes the 3.1.58 target; security hardening) @datarecce/ui dependency floors unchanged - no consumer-facing dependency changes. @mui/material, @mui/system, ag-grid-community, ag-grid-react and posthog-js floors stay at their published values; none of the bumps is required by an API change, security fix, or bug. Only the monorepo-only devDependencies (postcss, read-excel-file) moved there. @testing-library/jest-dom is pinned exactly in pnpm-workspace.yaml overrides, so the override was raised to 7.0.1 for the manifest bump to take effect. pnpm dedupe collapsed the duplicate copies the held ui floors would otherwise have created (-34 packages). Not applied: sqlparse 0.5.5 -> 0.6.0 (#1509). dbt-core pins sqlparse<0.6.0, and that PR reaches 0.6.0 only by replacing dbt-core 1.12.0 with the 2.0.0b1 pre-release. Left open deliberately. Refs: #1507, #1502, #1509 Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: Kent Huang <kent@infuseai.io>
Contributor
There was a problem hiding this comment.
Pull request overview
This PR consolidates multiple open Dependabot updates into a single dependency refresh across the Python (uv) and JavaScript (pnpm) parts of the Recce monorepo, primarily updating lockfiles/manifests without introducing source-code behavior changes.
Changes:
- Updated Python locked dependency
gitpythonto3.1.59inuv.lock. - Updated pnpm workspace override for
@testing-library/jest-domto7.0.1and refreshedjs/pnpm-lock.yamlto reflect the resolved dependency graph. - Bumped selected JS dependencies/devDependencies in workspace manifests (root
js/,packages/ui,packages/storybook) to align with the consolidated update set.
Reviewed changes
Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
uv.lock |
Updates the uv-resolved Python dependency set, including gitpython → 3.1.59. |
js/pnpm-workspace.yaml |
Updates an override pin (@testing-library/jest-dom) so the bump is effective across the workspace. |
js/pnpm-lock.yaml |
Captures the resulting pnpm resolution changes for the updated dependency set. |
js/packages/ui/package.json |
Updates postcss and read-excel-file devDependencies in the UI workspace package. |
js/packages/storybook/package.json |
Updates Storybook-family packages and @testing-library/jest-dom to match the consolidated update set. |
js/package.json |
Updates root frontend dependencies/devDependencies (MUI, Sentry, ag-grid, posthog, etc.) to the intended newer versions. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
wcchang1115
approved these changes
Aug 19, 2026
wcchang1115
left a comment
wcchang1115
left a comment
Collaborator
There was a problem hiding this comment.
local build and local run pass.
Thanks!
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidates the open Dependabot PRs into a single tested update, and clears
7 of the 11 open Dependabot security alerts on
main(6 high, 1 moderate).#1509 (sqlparse 0.5.5 → 0.6.0) is deliberately NOT closed.
dbt-corepinssqlparse<0.6.0, so 0.6.0 is unreachable; that PR only gets there by replacingdbt-core 1.12.0with the2.0.0b1pre-release. See Deferred below — the4 sqlparse alerts are real and this PR should stay open as the tracking item.
Security alerts resolved
Remaining open after this PR: the 4 sqlparse alerts (see Deferred).
Note on tooling:
pnpm auditreports clean on this branch because the tree isalready at the fixed nanoid. The 11-alert count is GitHub's, measured against
main. Neither number is wrong; they describe different trees.Dependabot-driven changes
@datarecce/ui impact
No consumer-facing dependency changes. Dependabot proposed raising seven
@datarecce/uidependenciesfloors; none is required by an API change,security fix, or bug in the old version, so all were held:
Raising
@mui/materialfrom^9.0.0to^9.3.1would have forced every npmconsumer off MUI 9.0–9.2. Only the monorepo-only devDependencies (
postcss,read-excel-file) moved inpackages/ui. All seven floors were queried againstthe npm advisory API at their minimum satisfying version — no advisories, so
holding them leaves consumers no known-vulnerable floor.
Reviewer notes — two non-obvious things
pnpm-workspace.yamlis in the diff.@testing-library/jest-domispinned exactly (
7.0.0) inoverrides:, which outranks the manifests, soDependabot's own PR would have bumped
package.jsonto 7.0.1 with no effect.The override was raised to 7.0.1 to make the update real. Seven other packages
in this group (
@mui/*,ag-grid-*,posthog-js,postcss,vite) arealso override-governed, but with ranges that already permitted the targets —
they needed
pnpm update, not an override edit.pnpm deduperan. Holding the@datarecce/uifloors low left duplicatecopies (
@codemirror/viewat both 6.43.7 and 6.43.9,@sentry/reactat10.69.0 and 10.70.0,
@zumer/snapdomat 2.23.2 and 2.24.1).pnpm dedupecollapsed them to the single newer version without touching any manifest,
removing 34 packages. Floors stay low, the tree stays single-version.
Security review
No high-confidence findings beyond the alerts resolved above.
CI=true pnpm install --frozen-lockfilepasses (strictDepBuildssatisfied, noallowBuildsplaceholder lines appended); none of the deliberate CVE-mitigation overrides
(
brace-expansion,js-yaml,minimatch,picomatch,xmldom,ws,fast-uri,serialize-javascript) was touched; every new lockfile entry carriesa sha512 integrity and no registry changed. Both telemetry SDKs were checked for
new data-capture defaults in range — Sentry 10.69→10.70 is a single hono fix and
posthog 1.411–1.415 changes no defaults.
Audit-driven recommendations
Advisory only — nothing below is applied in this PR.
Recommended to bundle
jaraco.context.tarball(). Not in GitHub's alert list. Transitive viatwine → keyring, so dev-tooling only, not shipped at runtime. One-command fix:uv lock --upgrade-package jaraco-context.That is 16 packages — right at the 15-package bundle cap, so splitting the
storybookfamily into its own PR is reasonable.Recommended separate PRs
.github/dependabot.ymlconfigures onlypipandnpm. There is nogithub-actionsecosystem, so action versions have never been updated automatically. Add the ecosystem, then bump in one PR.@v6— inconsistent todayjs/.husky/pre-commitpins the biome version and aborts the commit on a change until it is deliberately acknowledged (DRC-3460). Needs its own PR following the hook's printed steps.Deferred
dbt-corepinssqlparse<0.6.0. Reaching 0.6.0 today requiresdbt-core 2.0.0b1. Recce never imports sqlparse; the parsing path belongs to dbt-core and the input is the user's own dbt project, not attacker-controlled. Revisit when a stable dbt-core relaxes the pin..github/dependabot.yml("Pinned: breaking layout changes in v2") — skipping.pyproject.tomlposthog>=3.0.0vs 7.39.1,rich>=12.0.0vs 15.0.0,click>=7.1vs 8.4.2). Do not bulk-raise these.recceis published to PyPI, so itsdependenciesfloors are a consumer contract in exactly the way@datarecce/ui's are. The generic audit advice ("raise floors to document reality") applies to applications, not published libraries. Raise a floor only when recce's code needs the newer API.Test plan
pnpm lint— 672 files, no errorspnpm type:check— all three projectspnpm test— 4020 passed, 5 skipped (191 files)pnpm run build— succeedsCI=true pnpm install --frozen-lockfile— CI parity, strictDepBuilds satisfiedmake flake8— cleanpytest tests/— 1589 passed, 5 skippedGenerated with Claude Code