chore(deps): consolidate dependabot updates

[gcko]

PR checklist

• Appropriate tests run.
• DCO signed.

What type of PR is this?

chore(deps)

What this PR does / why we need it:

Consolidates all five open Dependabot PRs, including fixes for the reported Next.js, Vitest, fast-uri, and sqlparse advisories. Updates all three frontend workspaces and their overrides so pinned overrides do not silently retain older versions.

The grouped PR supplies Next.js 16.3.4 and fast-uri 4.1.4, superseding the individual 16.3.3 and 4.1.3 PRs. Aligns Vitest's coverage and browser companion packages at 4.1.11.

Which issue(s) this PR fixes:

Closes #1548
Closes #1547
Closes #1546
Closes #1535
Closes #1509

Special notes for your reviewer:

• Regenerates the Python lockfile with sqlparse 0.6.0 and stable dbt-core 1.12.4. The original sqlparse PR selected dbt-core 2.0.0b1 and removed sqlparse instead of upgrading it. dbt-core 1.12.4 supports sqlparse <0.7 and requires the experimental parser update; OpenTelemetry API is its new dependency. All changed Python packages support Python 3.10.
• Verifies Biome 2.5.12 on macOS arm64 (705-file check and staged check), updates the version guard and schema, and accepts its formatting adjustment in RunView.
• Updates the cell rendering test to assert the inherited parent color: happy-dom now computes inherit to a color value. No application behavior change.
• Reviews tsdown 0.23.0 migration notes; the UI package builds successfully with the existing config. Its external option still works but emits a deprecation warning recommending deps.neverBundle.

Package changes

Package	From	To	Ecosystem
@amplitude/unified	1.1.28	1.1.32	npm
@codemirror/state	6.7.1	6.7.4	npm
@codemirror/view	6.43.9	6.43.11	npm
@mui/material	9.3.1	9.4.0	npm
@mui/system	9.3.0	9.4.0	npm
@next/third-parties	16.3.0	16.3.4	npm
@sentry/nextjs	10.70.0	10.73.0	npm
@sentry/react	10.70.0	10.73.0	npm
@tanstack/react-query	5.101.4	5.102.8	npm
@xyflow/react	12.11.2	12.11.6	npm
@zumer/snapdom	2.24.1	2.24.15	npm
happy-dom	20.11.2	20.14.0	npm
import-in-the-middle	3.3.3	3.4.0	npm
next	16.3.0	16.3.4	npm
posthog-js	1.415.1	1.428.3	npm
@amplitude/analytics-core	2.54.1	2.55.0	npm
@biomejs/biome	2.5.7	2.5.12	npm
@testing-library/react	16.3.2	16.3.3	npm
@testing-library/user-event	14.6.3	14.6.7	npm
@types/node	26.2.0	26.5.0	npm
@types/react-dom	19.2.4	19.2.7	npm
@vitejs/plugin-react	6.0.5	6.1.1	npm
baseline-browser-mapping	2.11.15	2.11.21	npm
globals	17.9.0	17.12.0	npm
postcss	8.5.26	8.5.28	npm
vite	8.2.1	8.2.2	npm
@playwright/test	1.62.1	1.63.0	npm
@storybook/addon-docs	10.5.8	10.6.0	npm
@storybook/addon-vitest	10.5.8	10.6.0	npm
@storybook/react	10.5.8	10.6.0	npm
@storybook/react-vite	10.5.8	10.6.0	npm
playwright	1.62.1	1.63.0	npm
storybook	10.5.8	10.6.0	npm
@tsdown/css	0.22.14	0.23.0	npm
tsdown	0.22.14	0.23.0	npm
typedoc-plugin-markdown	4.12.0	4.13.0	npm
vitest	4.1.10	4.1.11	npm
@vitest/coverage-v8	4.1.10	4.1.11	npm
@vitest/browser-playwright	4.1.10	4.1.11	npm
fast-uri	4.1.2	4.1.4	npm
sqlparse	0.5.5	0.6.0	python
dbt-core	1.12.0	1.12.4	python
dbt-core-experimental-parser	2.0.0a5	2.0.0rc2	python
opentelemetry-api	—	1.44.0	python

Security review

No high-confidence vulnerabilities identified in the combined working-tree diff. pnpm audit --json reports zero advisories. Fresh PyPI checks report no advisories or yanked releases for the four changed Python packages. Existing GitHub alerts were checked for the security context of each update. The subsequent full Python dependency audit found an unchanged development dependency advisory in jaraco.context; see recommendations below. This review covers the changeset, not a full application penetration test.

Validation

• CI=true pnpm install --frozen-lockfile
• pnpm lint:fix, pnpm lint, and pnpm exec biome check --staged
• pnpm type:check (all three workspaces)
• pnpm test: 211 files passed; 4,444 tests passed, 5 skipped
• pnpm --filter @datarecce/ui build and pnpm run build
• uv lock --check and uv sync --locked --extra dev --extra mcp
• uv run --locked --extra dev --extra mcp make check
• uv run --locked --extra dev --extra mcp python -m pytest tests/ -q: 2,026 passed, 5 skipped (Python 3.12)
• Live recce server smoke test: HTTP 200 with built Next.js asset references
• All pre-commit hooks enabled; core.hooksPath=js/.husky/_

Backend tests run directly through pytest to avoid make test changing the hook configuration. Existing deprecation warnings and an openpyxl cleanup warning remain non-fatal. The multi-version tox matrix was not run; no adapter code changed.

Audit-driven recommendations

Fresh registry audit at 2026-09-14 01:02 UTC (09:02 Taipei): queried 95 distinct npm dependencies across all three manifests, 44 Python runtime/dev/build requirements across both pyprojects, and 15 GitHub Actions. Compared the manifests and committed lockfiles with live registry metadata; no local-cache “latest” values were used. The audit found 24 npm and 27 Python packages with newer releases, plus the transitive security finding below. No tracked Dockerfiles were found. All recommendations below are advisory and have not been applied.

Prioritize: existing development dependency advisory

pip-audit --path .venv/lib/python3.12/site-packages --format json found one advisory: jaraco.context 6.0.1, CVE-2026-23949 / GHSA-58pv-8j8x-9vj2, high severity path traversal when extracting malicious tarballs. Recommend 6.1.2 (the first fixed release is 6.1.0). Dependency chain: recce[dev] → twine 7.0.0 → keyring 25.7.0 → jaraco-context 6.0.1. The same version is in main; no application call to jaraco.context or its tarball helper was found. This is a known vulnerable dependency, not a confirmed new exploitable application path. pip-audit skipped the local development version of Recce itself because it is not published on PyPI.

Recommended next maintenance bundle (15 packages; not included here)

These releases are at least seven days old and their metadata supports Python 3.10. Review resolver compatibility and release notes, particularly the pre-1.0 packages, before applying them. The security update should take priority.

Package	Current lock	Registry latest	Recommendation
jaraco.context	6.0.1	6.1.2	Urgent: fix the development-tool advisory
ruamel-yaml	0.18.16	0.19.1	Minor/patch update; rerun quality gate
click	8.4.1	8.5.0	Minor/patch update; rerun quality gate
fastapi	0.137.1	0.141.1	Minor/patch update; rerun quality gate
uvicorn	0.49.0	0.52.4	Minor/patch update; rerun quality gate
pydantic	2.13.4	2.13.5	Minor/patch update; rerun quality gate
pygithub	2.9.1	2.10.0	Minor/patch update; rerun quality gate
sqlglot	30.11.0	30.18.0	Minor/patch update; rerun quality gate
packaging	26.2	26.3	Minor/patch update; rerun quality gate
pytest	9.0.3	9.1.1	Minor/patch update; rerun quality gate
pytest-asyncio	1.3.0	1.4.0	Minor/patch update; rerun quality gate
black	26.3.1	26.5.1	Minor/patch update; rerun quality gate
pre-commit	4.6.0	4.6.2	Minor/patch update; rerun quality gate
tox-uv	1.29.0	1.36.0	Minor/patch update; rerun quality gate
cryptography	50.0.0	50.0.1	Minor/patch update; rerun quality gate

Recommended separate migrations

Package/family	Current lock	Latest	Action
Vitest, coverage-v8, browser-playwright	4.1.11	5.0.0	One family migration PR; review changed mock defaults, assertions, config, and Storybook integration
deepdiff	8.6.2	9.1.0	Major upgrade: validate diff output and serialization contracts
isort	7.0.0	9.0.1	Major formatter upgrade: review configuration and formatting changes
dbt-duckdb	1.10.1	1.11.0	Dedicated adapter update with the dbt tox matrix
mcp	1.28.1	2.2.0	Major SDK migration; latest is only 6.4 days old, wait one cycle
portalocker	3.2.0	4.3.2	Major locking migration; latest was just published, wait one cycle

GitHub Actions migration PR

Eleven actions have newer major versions. Update them in a dedicated CI migration, verifying runner requirements and artifact producer/consumer compatibility; keep upload/download-artifact changes together.

Package	Current lock	Registry latest	Recommendation
actions/create-github-app-token	v2	v3.2.0	Major migration
actions/checkout	v4, v6	v7.0.1	Major migration
astral-sh/setup-uv	v4	v10.1.0	Major migration; v10.1.0 is less than 7 days old
actions/setup-python	v5	v7.0.0	Major migration
actions/cache	v4	v6.1.0	Major migration
codecov/codecov-action	v5	v7.0.0	Major migration
actions/stale	v10.2.0	v11.0.0	Major migration
getsentry/action-release	v1	v3.7.0	Major migration
actions/upload-artifact	v4	v7.0.1	Major migration
stefanzweifel/git-auto-commit-action	v4	v7.2.0	Major migration
actions/download-artifact	v4	v8.0.1	Major migration

The pinned actions/stale SHA matches its annotated v10.2.0 tag; its drift is to a newer major, not an incorrectly pinned existing tag. Floating major refs for setup-node, pnpm/action-setup, claude-code-action, and workflow-dispatch are on their current major.

Deferred: releases younger than seven days

Recheck next cycle. Upgrade React with its DOM and type packages, Sentry as a family, and Next.js with third-parties. Biome still requires the macOS arm64 verification and guard acknowledgment.

Package	Current lock	Registry latest	Recommendation
@babel/helpers	8.0.0	8.0.5	Defer one cycle (3.2 days old)
@babel/runtime	8.0.0	8.0.5	Defer one cycle (3.2 days old)
@next/third-parties	16.3.4	16.3.5	Defer one cycle (2.3 days old)
@sentry/nextjs	10.73.0	10.74.0	Defer one cycle (4.4 days old)
@sentry/react	10.73.0	10.74.0	Defer one cycle (4.4 days old)
@zumer/snapdom	2.24.15	2.24.18	Defer one cycle (3.0 days old)
happy-dom	20.14.0	20.14.5	Defer one cycle (2.0 days old)
import-in-the-middle	3.4.0	3.5.1	Defer one cycle (2.5 days old)
next	16.3.4	16.3.5	Defer one cycle (2.3 days old)
posthog-js	1.428.3	1.430.3	Defer one cycle (1.4 days old)
react	19.2.8	19.3.0	Defer one cycle (4.3 days old)
react-dom	19.2.8	19.3.0	Defer one cycle (4.3 days old)
yaml	2.9.0	2.9.1	Defer one cycle (2.2 days old)
@biomejs/biome	2.5.12	2.5.13	Defer one cycle (3.6 days old)
@testing-library/dom	10.4.1	10.4.2	Defer one cycle (0.3 days old)
@types/node	26.5.0	26.5.1	Defer one cycle (4.3 days old)
@types/react	19.2.18	19.3.0	Defer one cycle (4.3 days old)
@types/react-dom	19.2.7	19.3.0	Defer one cycle (4.3 days old)
baseline-browser-mapping	2.11.21	2.11.23	Defer one cycle (1.3 days old)
fast-check	4.9.0	4.10.0	Defer one cycle (2.7 days old)
vite	8.2.2	8.3.0	Defer one cycle (3.6 days old)
boto3	1.43.32	1.43.93	Defer one cycle (2.2 days old)
sentry-sdk	2.63.0	2.69.1	Defer one cycle (5.5 days old)
posthog	7.19.2	7.53.0	Defer one cycle (2.3 days old)
gitpython	3.1.59	3.1.62	Defer one cycle (6.9 days old)
tox	4.32.0	4.61.4	Defer one cycle (5.0 days old)

Deferred: compatibility and requirement floors

Package	Current lock	Registry latest	Recommendation
websockets	16.0	17.1	Requires Python >=3.11; retain Python 3.10 compatibility
pandas	2.3.3	3.0.5	Requires Python >=3.11; retain Python 3.10 compatibility
pytz	2025.2	2026.3.post1	Calendar version, not a semantic major; verify timezone-data changes separately

The audit also checked >= and ~= floors. Requests, rich, openpyxl, flake8, and pyyaml already resolve to latest but have older declared floors. Review floors separately against supported dbt/Python versions; raising them is not required to update this lockfile. Recce Cloud still declares Python >=3.9, so do not copy Python-3.10-only minimums into its manifest. hatchling is an unpinned isolated build dependency (latest 1.32.0), so no lockfile “current version” can be asserted for it.

Configured ignores for @dagrejs/dagre and html2canvas-pro were honored. Consider adding a github-actions ecosystem and explicit Recce Cloud Python coverage to Dependabot; the current config covers root Python and /js only. Retain the existing intentional ignores.

Dependabot may file new PRs after merge: packages can release between this audit and merge, and changing dependabot.yml triggers a full rescan (this PR does not change that file).

Does this PR introduce a user-facing change?:

Dependency security and maintenance updates; no intended UI or API behavior changes.

[wcchang1115]

Code Review: PR #1550

SHA ab7d07cb · Verdict GO

Blockers

None.

Issues

None.

Notes

1. js/packages/ui/package.json:144 — The minimum version of @codemirror/state moves
   from ^6.7.1 to ^6.7.4. The internal consumer, recce-cloud-infra, holds
   @codemirror/state at an exact 6.7.1 through a pnpm override. A pnpm override wins over
   the package range, so that install stays at 6.7.1 and no error appears. Align the
   override there on the next @datarecce/ui release. The other raised floors
   (@tanstack/react-query ^5.102.8, @mui/material and @mui/system ^9.4.0,
   @xyflow/react ^12.11.6, posthog-js ^1.428.3) all match what that consumer
   already resolves, so they add no second copy.

2. js/packages/ui/package.json:186 — tsdown moves from 0.22.14 to 0.23.0, which moves
   rolldown from 1.2.4 to 1.2.8 (js/pnpm-lock.yaml:4744). This rebuilds the published
   @datarecce/ui files. Nothing in this repo runs those files: js/vitest.config.ts:16-25
   and js/tsconfig.json:24 point @datarecce/ui at packages/ui/src, and the Next build
   output holds 9637 references to packages/ui/src against 55 to packages/ui/dist. The
   internal consumer, recce-cloud-infra, installs the published package, so its build is
   the first place the new bundler output runs. A rolldown version change has broken that
   output before. A small import smoke test against packages/ui/dist would close the gap.

3. js/.husky/pre-commit:18 — The guard reads the biome version from js/package.json
   only. js/pnpm-workspace.yaml:16 also sets @biomejs/biome, and a pnpm override wins
   over the package.json entry. A future bump that touches only the override file changes
   the installed biome version and the guard stays quiet. Not new in this PR.

4. js/.husky/pre-commit:35-37 — The history line still ends at "2.5.5 in the prior
   Dependabot consolidation". 2.5.7 is now a prior version and is not listed. The new
   2.5.12 paragraph also sits above the older 2.5.7 paragraph, so the block no longer
   reads in order.

5. PR body — The body lists sqlparse under security fixes. sqlparse reaches this repo
   through dbt-duckdb, which is in the dev extra only (pyproject.toml:66), and no
   file under recce/ imports sqlparse. The released recce package does not ship it.

Checks run

• CI=true pnpm install --frozen-lockfile: clean, lockfile matches the manifests
• pnpm lint: 705 files, no diagnostics
• pnpm type:check: all three workspaces clean
• pnpm test: 211 files, 4444 passed, 5 skipped
• pnpm --filter @datarecce/ui build and pnpm run build: both succeed
• uv lock --check: in sync
• uv run --locked --extra dev --extra mcp python -m pytest tests/ -q: 2026 passed, 5 skipped
• Superseded PRs: all 36 packages in chore(deps): Bump the all-minor-patch group across 1 directory with 36 updates #1548 appear in this PR, and chore(deps): Bump next from 16.3.0 to 16.3.3 in /js #1547, chore(deps): Bump vitest from 4.1.10 to 4.1.11 in /js #1546, chore(deps): Bump fast-uri from 4.1.2 to 4.1.3 in /js #1535,
  chore(deps): Bump sqlparse from 0.5.5 to 0.6.0 #1509 are each at or above their target version

[wcchang1115]

GO at ab7d07cb. Full review: #1550 (comment) — no blockers, no issues, 5 notes.