chore(deps): batch all open Dependabot updates

[David-Crty]

Batches all 13 open Dependabot PRs into a single branch off main, so CI runs once and the updates land together.

Composer

• guzzlehttp/guzzle 7.15.1 -> 7.15.2 (chore(deps): bump guzzlehttp/guzzle from 7.15.1 to 7.15.2 #514)
• nunomaduro/collision 8.9.4 -> 8.9.5 (chore(deps-dev): bump nunomaduro/collision from 8.9.4 to 8.9.5 #509)
• dedoc/scramble 0.13.30 -> 0.13.36 (chore(deps): bump dedoc/scramble from 0.13.30 to 0.13.36 #508)
• livewire/livewire 4.3.0 -> 4.3.3 (chore(deps): bump livewire/livewire from 4.3.0 to 4.3.3 #507)
• laravel/pao 1.1.2 -> 1.1.3 (chore(deps-dev): bump laravel/pao from 1.1.2 to 1.1.3 #503)
• league/flysystem-aws-s3-v3 3.34.0 -> 3.35.2 (chore(deps): bump league/flysystem-aws-s3-v3 from 3.34.0 to 3.35.2 #501)

npm

• @tailwindcss/oxide-linux-x64-gnu 4.3.2 -> 4.3.3 (chore(deps): bump @tailwindcss/oxide-linux-x64-gnu from 4.3.2 to 4.3.3 #506)
• @rollup/rollup-linux-x64-gnu 4.62.2 -> 4.62.3 (chore(deps): bump @rollup/rollup-linux-x64-gnu from 4.62.2 to 4.62.3 #505)
• laravel-vite-plugin 3.1.0 -> 3.1.3 (chore(deps): bump laravel-vite-plugin from 3.1.0 to 3.1.3 #502)
• axios 1.18.1 -> 1.19.0 (chore(deps): bump axios from 1.18.1 to 1.19.0 #500)
• daisyui 5.6.10 -> 5.7.7 (chore(deps-dev): bump daisyui from 5.6.10 to 5.7.7 #499)
• fast-uri 3.1.4 -> 3.1.5 in /docs (chore(deps): bump fast-uri from 3.1.4 to 3.1.5 in /docs #513)

GitHub Actions

• actions/setup-node 6 -> 7 (chore(deps): bump actions/setup-node from 6 to 7 #504)

Notes

One conflict, in package.json / package-lock.json between the rollup and tailwind oxide bumps (both touch optionalDependencies). Resolved by keeping both new versions and regenerating the lockfile; npm resolved rollup to 4.62.4, the latest patch matching ^4.62.3.

Verified locally: composer validate clean, npm run build succeeds, PHPStan 0 errors, full suite passes (1484 tests, 4086 assertions).

Closes #499, closes #500, closes #501, closes #502, closes #503, closes #504, closes #505, closes #506, closes #507, closes #508, closes #509, closes #513, closes #514

Summary by CodeRabbit

• Chores
  • Updated the documentation workflow tooling.
  • Refreshed several underlying packages to newer versions for improved compatibility and maintenance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ce23ced7-7169-4cea-afc6-666adc28ba3c

📥 Commits

Reviewing files that changed from the base of the PR and between d809305 and ca3b6c7.

⛔ Files ignored due to path filters (3)

• composer.lock is excluded by !**/*.lock
• docs/package-lock.json is excluded by !**/package-lock.json
• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• .github/workflows/docs.yml
• package.json

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: ci

🧰 Additional context used

🧠 Learnings (1)

📚 Learning: 2026-06-04T09:18:04.962Z

Learnt from: David-Crty
Repo: David-Crty/databasement PR: 361
File: .github/workflows/tests.yml:141-141
Timestamp: 2026-06-04T09:18:04.962Z
Learning: In David-Crty/databasement, GitHub Actions workflow references may use mutable version tags (e.g., `owner/repov4`, `v7`) and are intentionally accepted. During code review, do not flag these references for “pin to commit SHA” and do not recommend switching action refs from version tags to full commit SHAs.

Applied to files:

• .github/workflows/docs.yml

🪛 zizmor (1.29.0)

.github/workflows/docs.yml

[error] 39-39: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): this step

(cache-poisoning)

🔇 Additional comments (2)

.github/workflows/docs.yml (1)

39-43: 🔒 Security & Privacy

Security Misconfiguration (CWE-494): Download of Code Without Integrity Check

Verify the cache trust boundary for this deployment job.

With cache: 'npm', actions/setup-node@v7 caches global npm package data and uses docs/package-lock.json in the cache key. GitHub states that cache contents are not signed or verified and that poisoned caches can lead to code execution in trusted workflows. (github.com)

The provided range does not show the workflow triggers, permissions, or checkout ref. Verify that no untrusted event or attacker-controlled checkout can populate data later consumed by this build and deployment job. If that path exists, remove cache: 'npm' and cache-dependency-path, or separate the untrusted build from the trusted deployment. (docs.github.com)

#!/usr/bin/env bash
set -euo pipefail

workflow=".github/workflows/docs.yml"

sed -n '1,80p' "$workflow"

rg -n -C 3 \
  'pull_request|pull_request_target|workflow_run|workflow_dispatch|push:|permissions:|actions/checkout@|actions/setup-node@|cache:|cache-dependency-path:|npm ci|npm run build' \
  "$workflow"

package.json (1)

12-25: LGTM!

---

📝 Walkthrough

Walkthrough

The PR updates the documentation workflow to use actions/setup-node@v7 and updates four npm package version ranges in package.json.

Changes

Maintenance updates

Layer / File(s)	Summary
Documentation workflow action update .github/workflows/docs.yml	The workflow now uses actions/setup-node@v7 instead of @v6.
npm package version updates package.json	The manifest updates axios, @rollup/rollup-linux-x64-gnu, @tailwindcss/oxide-linux-x64-gnu, and daisyui.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related PRs

• David-Crty/databasement#361: Both PRs update package tooling versions, including @rollup/rollup-linux-x64-gnu.

Poem

A rabbit checks the workflow line,
“Node seven hops just fine!”
Four packages lift their ears,
Fresh versions nibble through the years.
The build burrows on with cheer.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The summary confirms several npm and GitHub Actions updates, but it does not evidence Composer updates, and required lockfiles are excluded.	Provide reviewable evidence for the Composer manifest updates and validate the excluded composer.lock, package-lock.json, and docs/package-lock.json files.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes batching Dependabot dependency updates, which matches the pull request objectives.
Out of Scope Changes check	✅ Passed	The reviewed changes update dependencies and the documentation workflow, which are within the stated dependency-maintenance scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-batch

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 92.34450% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 91.42%. Comparing base (5d90d17) to head (ca3b6c7).
⚠️ Report is 6 commits behind head on main.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
app/Rules/SafeEndpointUrl.php	81.81%	6 Missing ⚠️
app/Rules/SafeDatabasePath.php	78.57%	3 Missing ⚠️
...ttp/Controllers/Web/SnapshotDownloadController.php	85.71%	1 Missing ⚠️
...tp/Requests/Api/V1/SaveScheduledRestoreRequest.php	83.33%	1 Missing ⚠️
...tabaseServer/Connection/MongodbConnectionRules.php	0.00%	1 Missing ⚠️
...DatabaseServer/Connection/RedisConnectionRules.php	0.00%	1 Missing ⚠️
app/Providers/AppServiceProvider.php	80.00%	1 Missing ⚠️
app/Rules/SafeHost.php	80.00%	1 Missing ⚠️
app/Support/QueueTimeouts.php	93.75%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main     #519      +/-   ##
============================================
+ Coverage     91.06%   91.42%   +0.35%     
- Complexity     3084     3126      +42     
============================================
  Files           265      271       +6     
  Lines         10962    11027      +65     
============================================
+ Hits           9983    10081      +98     
+ Misses          979      946      -33     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.