Skip to content

chore(deps-frontend)(deps-dev): bump the development-updates group across 1 directory with 3 updates - #143

Merged
overwrite00 merged 1 commit into
developfrom
dependabot/npm_and_yarn/frontend/develop/development-updates-56baa39111
Jul 30, 2026
Merged

chore(deps-frontend)(deps-dev): bump the development-updates group across 1 directory with 3 updates#143
overwrite00 merged 1 commit into
developfrom
dependabot/npm_and_yarn/frontend/develop/development-updates-56baa39111

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor

Bumps the development-updates group with 3 updates in the /frontend directory: @vitejs/plugin-react, globals and vite.

Updates @vitejs/plugin-react from 6.0.3 to 6.0.4

Release notes

Sourced from @​vitejs/plugin-react's releases.

[email protected]

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.4 (2026-07-22)

Fixed $RefreshSig$ is not defined error when running vite dev with NODE_ENV=production

When running vite dev with NODE_ENV=production, the app errored with $RefreshSig$ is not defined. This error is now fixed.

Commits

Updates globals from 17.7.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

  • Update globals (2026-07-01) (#347) 7394811

sindresorhus/globals@v17.7.0...v17.8.0

Commits

Updates vite from 8.1.4 to 8.1.5

Release notes

Sourced from vite's releases.

v8.1.5

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.1.5 (2026-07-16)

Bug Fixes

  • bundled-dev: avoid duplicated buildEnd (#22931) (8100320)
  • client: overlay error message format align rolldown (#22869) (5a72b87)
  • deps: update all non-major dependencies (#22921) (fef682d)
  • deps: update rolldown-related dependencies (#22922) (3c345e4)
  • module-runner: don't crash stack-trace source mapping when globalThis.Buffer is absent (#22945) (f8b38e3)
  • optimizer: respect importer module format for dynamic import interop with CJS deps (#22951) (6c08c39)
  • ssr: scope switch-case declarations to the switch, not the function (#22893) (b59a73f)

Documentation

  • build: fix incorrect @default for build.cssMinify (#22948) (c88c236)
  • build: fix incorrect @default for build.lib.formats (#22911) (369ed60)

Tests

  • avoid scanner scanning all files under __tests__ (#22912) (c961cae)
Commits
  • 5e7fe12 release: v8.1.5
  • 6c08c39 fix(optimizer): respect importer module format for dynamic import interop wit...
  • 5a72b87 fix(client): overlay error message format align rolldown (#22869)
  • f8b38e3 fix(module-runner): don't crash stack-trace source mapping when globalThis.Bu...
  • 8100320 fix(bundled-dev): avoid duplicated buildEnd (#22931)
  • c88c236 docs(build): fix incorrect @default for build.cssMinify (#22948)
  • b59a73f fix(ssr): scope switch-case declarations to the switch, not the function (#22...
  • fef682d fix(deps): update all non-major dependencies (#22921)
  • 3c345e4 fix(deps): update rolldown-related dependencies (#22922)
  • 369ed60 docs(build): fix incorrect @default for build.lib.formats (#22911)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-frontend)(deps-dev): bump the development-updates group ac…
af3b9a5 
…ross 1 directory with 3 updates

Bumps the development-updates group with 3 updates in the /frontend directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react), [globals](https://github.com/sindresorhus/globals) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react)

Updates `globals` from 17.7.0 to 17.8.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.8.0)

Updates `vite` from 8.1.4 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
- dependency-name: globals
  dependency-version: 17.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-updates
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file lang:javascript JavaScript-related scope:frontend Frontend-related changes labels Jul 27, 2026
@overwrite00
overwrite00 merged commit 1a44d81 into develop Jul 30, 2026
5 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/frontend/develop/development-updates-56baa39111 branch July 30, 2026 18:10
@overwrite00 overwrite00 mentioned this pull request Jul 30, 2026
Closed
overwrite00 added a commit that referenced this pull request Jul 30, 2026
@overwrite00
chore: sync main with develop (dependency updates + project automatio…
050a845 
…n fix)

- fix: correct broken project-automation.yml (wrong --assignee flag, wrong
  --add-project usage/missing checkout) - replaced with direct GraphQL
  addProjectV2ItemById mutation
- Bump fastapi 0.139.0 -> 0.139.2, uvicorn 0.50.0 -> 0.51.0, coverage 7.15.0 -> 7.15.2 (#136)
- Bump nltk >=3.9.4 -> >=3.10.0 (#137)
- Bump actions/setup-python v6 -> v7, actions/setup-node v6 -> v7 (#140, #141)
- Bump lucide-react 1.23 -> 1.27, react/react-dom 19.2.7 -> 19.2.8 (#142)
- Bump vite 8.1.4 -> 8.1.5, @vitejs/plugin-react 6.0.3 -> 6.0.4, globals 17.7 -> 17.8 (#143)
- Backport eslint 9 -> 10 security fix (already on main via #144) to keep branches in sync

122/122 backend tests passing, frontend build/lint clean.
overwrite00 added a commit that referenced this pull request Jul 30, 2026
@overwrite00 @dependabot
fix: sync start.bat with develop (missing FOUND_PYTHON/FOUND_VER init) (
e11ddb2 
#146)

* chore(deps-backend)(deps): bump the minor-and-patch group across 1 directory with 4 updates (#127)

Bumps the minor-and-patch group with 4 updates in the /backend directory: [fastapi](https://github.com/fastapi/fastapi), [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/), [slowapi](https://github.com/laurents/slowapi) and [coverage](https://github.com/coveragepy/coveragepy).


Updates `fastapi` from 0.138.0 to 0.139.0
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.138.0...0.139.0)

Updates `beautifulsoup4` from 4.14.0 to 4.15.0

Updates `slowapi` from 0.1.9 to 0.1.10
- [Release notes](https://github.com/laurents/slowapi/releases)
- [Changelog](https://github.com/laurentS/slowapi/blob/master/CHANGELOG.md)
- [Commits](laurentS/slowapi@v0.1.9...v0.1.10)

Updates `coverage` from 7.6.1 to 7.14.3
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.6.1...7.14.3)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.139.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: beautifulsoup4
  dependency-version: 4.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: slowapi
  dependency-version: 0.1.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: coverage
  dependency-version: 7.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-backend)(deps): bump the minor-and-patch group (#130)

Bumps the minor-and-patch group in /backend with 2 updates: [uvicorn](https://github.com/Kludex/uvicorn) and [coverage](https://github.com/coveragepy/coveragepy).


Updates `uvicorn` from 0.49.0 to 0.50.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.49.0...0.50.0)

Updates `coverage` from 7.14.3 to 7.15.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.3...7.15.0)

---
updated-dependencies:
- dependency-name: uvicorn
  dependency-version: 0.50.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: coverage
  dependency-version: 7.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-frontend)(deps): bump the minor-and-patch group (#131)

Bumps the minor-and-patch group in /frontend with 2 updates: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) and [react-router-dom](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router-dom).


Updates `lucide-react` from 1.22.0 to 1.23.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.23.0/packages/lucide-react)

Updates `react-router-dom` from 7.18.0 to 7.18.1
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/[email protected]/packages/react-router-dom/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/[email protected]/packages/react-router-dom)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-frontend)(deps-dev): bump the development-updates group across 1 directory with 3 updates (#133)

Bumps the development-updates group with 3 updates in the /frontend directory: [@eslint/js](https://github.com/eslint/eslint/tree/HEAD/packages/js), [eslint](https://github.com/eslint/eslint) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@eslint/js` from 9.39.4 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](https://github.com/eslint/eslint/commits/v9.39.5/packages/js)

Updates `eslint` from 9.39.4 to 9.39.5
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v9.39.4...v9.39.5)

Updates `vite` from 8.1.0 to 8.1.4
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.4/packages/vite)

---
updated-dependencies:
- dependency-name: "@eslint/js"
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
- dependency-name: eslint
  dependency-version: 9.39.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
- dependency-name: vite
  dependency-version: 8.1.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: prevent stack trace exposure in URLScan.io health check endpoint

CodeQL alert #15 (py/stack-trace-exposure, CWE-209/497): GET /api/reputation/test-urlscan
is a public unauthenticated endpoint that returned raw exception messages and type names
to the caller. Exception details are now logged server-side only; the client receives a
generic error message.

* fix: correct broken PR/issue project automation workflow

Two bugs prevented every PR and issue from being assigned to the project:
- '--assignee' is not a valid gh pr/issue edit flag (correct: --add-assignee)
- '--add-project <title>' requires a git checkout to resolve repo context,
  which this workflow never performed, and expects a project title rather
  than the configured node ID

Replaced project assignment with a direct addProjectV2ItemById GraphQL
mutation using the known project node ID, removing the checkout dependency
entirely.

* chore(deps-backend)(deps): bump the minor-and-patch group (#136)

Bumps the minor-and-patch group in /backend with 3 updates: [fastapi](https://github.com/fastapi/fastapi), [uvicorn](https://github.com/Kludex/uvicorn) and [coverage](https://github.com/coveragepy/coveragepy).


Updates `fastapi` from 0.139.0 to 0.139.2
- [Release notes](https://github.com/fastapi/fastapi/releases)
- [Commits](fastapi/fastapi@0.139.0...0.139.2)

Updates `uvicorn` from 0.50.0 to 0.51.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.50.0...0.51.0)

Updates `coverage` from 7.15.0 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.0...7.15.2)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-version: 0.139.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: uvicorn
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-backend)(deps): update nltk requirement in /backend (#137)

Updates the requirements on [nltk](https://github.com/nltk/nltk) to permit the latest version.
- [Release notes](https://github.com/nltk/nltk/releases)
- [Changelog](https://github.com/nltk/nltk/blob/develop/ChangeLog)
- [Commits](nltk/nltk@3.9.4...v3.10.0)

---
updated-dependencies:
- dependency-name: nltk
  dependency-version: 3.10.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(ci)(deps): bump actions/setup-python from 6 to 7 (#140)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(ci)(deps): bump actions/setup-node from 6 to 7 (#141)

Bumps [actions/setup-node](https://github.com/actions/setup-node) from 6 to 7.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@v6...v7)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-frontend)(deps): bump the minor-and-patch group across 1 directory with 3 updates (#142)

Bumps the minor-and-patch group with 3 updates in the /frontend directory: [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react), [react](https://github.com/react/react/tree/HEAD/packages/react) and [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom).


Updates `lucide-react` from 1.23.0 to 1.27.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.27.0/packages/lucide-react)

Updates `react` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react)

Updates `react-dom` from 19.2.7 to 19.2.8
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.2.8/packages/react-dom)

---
updated-dependencies:
- dependency-name: lucide-react
  dependency-version: 1.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* chore(deps-frontend)(deps-dev): bump the development-updates group across 1 directory with 3 updates (#143)

Bumps the development-updates group with 3 updates in the /frontend directory: [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react), [globals](https://github.com/sindresorhus/globals) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `@vitejs/plugin-react` from 6.0.3 to 6.0.4
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react)

Updates `globals` from 17.7.0 to 17.8.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](sindresorhus/globals@v17.7.0...v17.8.0)

Updates `vite` from 8.1.4 to 8.1.5
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.1.5/packages/vite)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
- dependency-name: globals
  dependency-version: 17.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-updates
- dependency-name: vite
  dependency-version: 8.1.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-updates
...

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

* fix: backport ESLint 10 security bump from main (PR #144)

PR #144 (Dependabot security update) bumped eslint 9.39.5 -> 10.8.0 directly
on main to fix 2 high-severity transitive vulnerabilities (js-yaml quadratic
CPU DoS, brace-expansion DoS), bypassing the configured develop target-branch
as GitHub always does for security-only Dependabot PRs.

Backporting the same eslint bump here to keep develop and main in sync and
avoid drift. Build and lint verified clean; only the pre-existing
react-router CSRF advisory remains (no fix available without a breaking
downgrade, tracked separately).

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file lang:javascript JavaScript-related scope:frontend Frontend-related changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@overwrite00