[helldweller]

What

One pass over every dependency manifest in the repo, equivalent to merging Jamyn's 42 open Dependabot PRs plus the security fixes that need a regenerated lockfile.

Area	Change
Python (pyproject.toml, constraints.txt, requirements-lock.txt)	Pins as in Dependabot's python-minor-and-patch group: anthropic 1.17.0, openai 3.37.0, pydantic 2.14.1, sqlalchemy 2.0.55, starlette 1.10.0, cryptography 50.0.2, sentry-sdk 2.73.0, spacy 3.8.16, lxml 6.1.3, protobuf 7.36.2, validators 0.36.0, setuptools 84.2.1. Lock regenerated with --upgrade inside python:3.14.9-slim-trixie with uv 0.5.9: 87 packages move, among them aiohttp 3.14.5, urllib3 2.8.0, pyjwt 2.15.1, oauthlib 4.0.0, certifi 2026.10.23, multidict 7.2.1.
Frontend	Every minor/patch update: vuetify 4.3.0, vue 3.5.44, vue-router 5.4.0, tiptap 3.32.0, axios 1.20.0, dompurify 3.4.17, vite 8.3.5, eslint 10.13.0, @sentry/vue 10.76.2, @formkit/vue 1.7.2 and the rest. components.d.ts regenerated by unplugin-vue-components 0.28.
docs	react 19.3.1, @mdx-js/react 3.1.1, transitive tree refreshed.
Docker	python:3.14.7-slim-trixie → 3.14.9-slim-trixie (both stages).
Actions	setup-node 7.1.0, codecov-action 7.1.1, deploy-pages 5.0.1, SHA pins taken from the Dependabot PRs.

Deliberately not touched: fastapi (minor/major on the Dependabot ignore list), thinc (ignored), sqlalchemy 2.1 (a separate migration), apexcharts (MIT pin), majors in the frontend (@formkit/vue 2, typescript 7, unplugin-vue-components 32, dotenv 17, happy-dom 21).

Three edits beyond version bumps

• @openid/appauth is pinned to 1.3.2 in package.json. The hold from Jamyn/dispatch#320 lived only in the lockfile, so a regenerated lock resolved ^1.3.1 to 1.4.0 and vite build failed on @openid/appauth/built/authorization_request_handler in pkceAuthProvider.js.
• The monaco-editor → dompurify override moves to 3.4.17; without it monaco keeps a nested vulnerable copy and the critical alert stays open.
• Two optional-peer overrides, htmlnano → cssnano ^7.1.9 and @vuetify/v0 → @vue/devtools-api ^6.6.4. npm otherwise nests a second copy that scripts/check-lock-dev-flags.mjs counts as an unflagged package production cannot reach. Both peers are optional and dev-time only.

Verification

Local, same commands as CI:

• ruff check, ruff format --check, python -c "import dispatch.main, dispatch.cli" from the lock alone;
• pytest -n auto against postgres:18: 2085 passed, 104 skipped;
• python-lock-sync reproduced byte-for-byte (uv pip compile without --upgrade inside the base image);
• npm run lint, npm run typecheck, vitest run --dom 318/318, npm run build with the monaco worker present, check-lock-dev-flags.mjs, npm ci --dry-run for all three lockfiles;
• docs: npm ci && npm run build.

The image build is left to image-smoke.

Vulnerabilities

Manifest	Before	After	Left
requirements-lock.txt	34	3	python-jose, ecdsa: no fixed release exists
frontend package-lock.json	48	4	markdown-it/linkify-it: no fix; happy-dom needs a major, test-only
docs/package-lock.json	53	34	all inside Docusaurus 3.10.2, latest available, not shipped in the image

Notes

• The frontend lockfile had to be generated with npm 11: npm 10.9.4 crashes with Cannot read properties of null (reading 'edgesOut') in #loadPeerSet on vitest, even on the untouched package.json. npm 10 accepts the result and npm install --package-lock-only leaves it unchanged.
• 16 tests in tests/auth/ (test_oidc_entra.py, test_auth_providers.py, test_entra_end_to_end.py) fail on any machine whose local timezone is not UTC: tokens are minted with datetime.utcnow().timestamp(). Pre-existing, unrelated to this change, green under TZ=UTC; worth its own fix.

🤖 Generated with Claude Code

[Copilot]

🔵 Needs a closer look

It is a sweeping multi-ecosystem dependency bump with fully regenerated lockfiles and a regenerated generated type file that cannot be fully verified by static review and warrants human review plus CI/image-smoke validation.

1 open issue

• Comment contradicts bumped atlassian-python-api floor · New

What changed in this PR

This PR is a broad, mostly-mechanical dependency maintenance pass across every manifest in the repository, consolidating ~42 Dependabot updates plus security fixes that required regenerated lockfiles. It bumps Python runtime pins, frontend npm dependencies, docs (Docusaurus) dependencies, the Docker Python base image, and the SHA pins for GitHub Actions. A handful of non-version edits are included (an exact @openid/appauth pin, a monaco-editor → dompurify override, and two optional-peer overrides) to keep the regenerated lockfiles buildable and free of flagged vulnerabilities.

Changes:

• Bump Python (pyproject.toml, constraints.txt) and frontend/docs npm dependency pins, regenerating components.d.ts via a newer unplugin-vue-components.
• Bump the Docker base image python:3.14.7-slim-trixie → 3.14.9-slim-trixie (both stages; root Dockerfile is a symlink).
• Update pinned GitHub Actions to setup-node v7.1.0, codecov-action v7.1.1, and deploy-pages v5.0.1 (SHAs verified against their tags).

File	Description
pyproject.toml	Raises several Python pins; atlassian-python-api floor moved to >=5.0.5, which now contradicts its adjacent comment.
constraints.txt	Bumps setuptools to 84.2.1.
src/​dispatch/​static/​dispatch/​package.json	Updates frontend deps/devDeps, pins @openid/appauth exactly, adds htmlnano/@vuetify/v0 overrides.
src/​dispatch/​static/​dispatch/​components.d.ts	Regenerated by newer unplugin; module target @vue/runtime-core→vue; stale V*/unused entries pruned (vite config uses no Vuetify resolver).
docs/​package.json, docs/​package-lock.json	Bumps react/@mdx-js/react and refreshes the transitive Docusaurus tree.
docker/​Dockerfile	Bumps Python base image to 3.14.9 in both build stages.
.github/​workflows/​*.yml	Updates pinned Action SHAs (setup-node, codecov-action, deploy-pages) consistently across all workflows.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

It is a wide-reaching dependency and base-image update across many manifests and hand-regenerated lockfiles whose published-version existence and runtime behavior cannot be fully verified here, so final human review is warranted despite passing all internal-consistency checks.

No open issues 🎉

1 resolved since last review

• Comment contradicts bumped atlassian-python-api floor

_{Review effort: Balanced}