Repository navigation
chore(deps): monthly dependency refresh #5417
Description
Routine dependency refresh: npm outdated across the root and every workspace, a uv lock refresh check for each Python server, and a workflow uses: check, run against v2/main on a monthly schedule. It replaces Dependabot's version-update PRs (#4874).
This is a tracking issue, not a diff. Pick what is worth bumping and open a normal PR against v2/main. Wanted is the safe default; Latest may cross a major and needs its own judgement. Pin a transitive npm package with an overrides entry, not npm audit fix; bump a devDependency several workspaces declare in every one of them; and commit a Python server's refreshed uv.lock with the change (AGENTS.md, Dependencies).
npm
src/everything
| Package | Current | Wanted | Latest |
|---|---|---|---|
@vitest/coverage-v8 |
4.1.12 | 4.1.12 | 5.0.5 |
express |
5.2.1 | 5.3.0 | 5.3.0 |
jszip |
3.10.1 | 3.10.2 | 3.10.2 |
typescript |
5.9.3 | 5.9.3 | 7.0.2 |
vitest |
4.1.12 | 4.1.12 | 5.0.5 |
src/filesystem
| Package | Current | Wanted | Latest |
|---|---|---|---|
@types/diff |
5.2.3 | 5.2.3 | 7.0.2 |
@types/node |
24.19.2 | 24.19.2 | 26.6.6 |
@vitest/coverage-v8 |
4.1.12 | 4.1.12 | 5.0.5 |
diff |
8.0.4 | 8.0.4 | 9.0.0 |
minimatch |
10.2.5 | 10.2.6 | 11.0.3 |
typescript |
5.9.3 | 5.9.3 | 7.0.2 |
vitest |
4.1.12 | 4.1.12 | 5.0.5 |
src/memory
| Package | Current | Wanted | Latest |
|---|---|---|---|
@types/node |
24.19.2 | 24.19.2 | 26.6.6 |
@vitest/coverage-v8 |
4.1.12 | 4.1.12 | 5.0.5 |
typescript |
5.9.3 | 5.9.3 | 7.0.2 |
vitest |
4.1.12 | 4.1.12 | 5.0.5 |
src/sequentialthinking
| Package | Current | Wanted | Latest |
|---|---|---|---|
@types/node |
24.19.2 | 24.19.2 | 26.6.6 |
@vitest/coverage-v8 |
4.1.12 | 4.1.12 | 5.0.5 |
chalk |
5.6.2 | 5.6.2 | 6.0.1 |
typescript |
5.9.3 | 5.9.3 | 7.0.2 |
vitest |
4.1.12 | 4.1.12 | 5.0.5 |
uv
uv lock --upgrade is what refreshing each lockfile within the declared ranges would move, transitive packages included. Latest is the newest release of a direct dependency; where it is past the uv lock --upgrade column, the range in pyproject.toml is what holds it back.
src/fetch/uv.lock
| Package | Locked | uv lock --upgrade |
Latest (direct only) |
|---|---|---|---|
annotated-types |
0.7.0 | 0.8.0 | — |
attrs |
25.4.0 | 26.1.0 | — |
beautifulsoup4 |
4.12.3 | 4.15.0 | 4.15.0 |
cffi |
2.0.0 | 2.1.1 | — |
charset-normalizer |
3.4.1 | 3.5.2 | — |
click |
8.1.7 | 8.5.0 | — |
exceptiongroup |
1.2.2 | 1.3.1 | — |
httpx |
0.27.2 | 0.28.1 | 0.28.1 |
idna |
3.18 | 3.20 | — |
iniconfig |
2.3.0 | 2.3.1 | — |
lxml |
6.1.0 | 6.1.3 | — |
markdownify |
0.14.1 | 1.2.3 | 1.2.3 |
nodeenv |
1.9.1 | 1.12.0 | — |
opentelemetry-api |
1.45.1 | 1.45.2 | — |
packaging |
26.0 | 26.3 | — |
pluggy |
1.6.0 | 1.7.0 | — |
pydantic |
2.12.5 | 2.14.2 | 2.14.2 |
pydantic-core |
2.41.5 | 2.50.2 | — |
pygments |
2.20.0 | 2.21.0 | — |
pyright |
1.1.389 | 1.1.414 | 1.1.414 |
pytest |
9.0.3 | 9.2.0 | 9.2.0 |
pytest-asyncio |
1.3.0 | 1.4.1 | 1.4.1 |
pywin32 |
311 | 312 | — |
regex |
2024.11.6 | 2026.9.29 | — |
requests |
2.33.1 | 2.34.2 | 2.34.2 |
ruff |
0.8.1 | 0.17.3 | 0.17.3 |
six |
1.16.0 | 1.17.0 | — |
sniffio |
1.3.1 | (removed) | — |
tomli |
2.4.0 | 2.5.0 | — |
truststore |
0.10.4 | 0.10.5 | — |
typing-inspection |
0.4.2 | 0.4.4 | — |
uvicorn |
0.32.0 | 0.54.0 | — |
webencodings |
0.5.1 | 0.6.1 | — |
src/git/uv.lock
| Package | Locked | uv lock --upgrade |
Latest (direct only) |
|---|---|---|---|
annotated-types |
0.7.0 | 0.8.0 | — |
attrs |
25.4.0 | 26.1.0 | — |
cffi |
2.0.0 | 2.1.1 | — |
click |
8.1.7 | 8.5.0 | 8.5.0 |
exceptiongroup |
1.2.2 | 1.3.1 | — |
gitdb |
4.0.11 | 4.0.12 | — |
idna |
3.18 | 3.20 | — |
iniconfig |
2.0.0 | 2.3.1 | — |
nodeenv |
1.9.1 | 1.12.0 | — |
opentelemetry-api |
1.45.1 | 1.45.2 | — |
packaging |
24.2 | 26.3 | — |
pluggy |
1.5.0 | 1.7.0 | — |
pydantic |
2.12.5 | 2.14.2 | 2.14.2 |
pydantic-core |
2.41.5 | 2.50.2 | — |
pygments |
2.20.0 | 2.21.0 | — |
pyright |
1.1.407 | 1.1.414 | 1.1.414 |
pytest |
9.0.3 | 9.2.0 | 9.2.0 |
pytest-asyncio |
1.4.0 | 1.4.1 | 1.4.1 |
pywin32 |
311 | 312 | — |
ruff |
0.8.0 | 0.17.3 | 0.17.3 |
smmap |
5.0.1 | 5.0.3 | — |
tomli |
2.2.1 | 2.5.0 | — |
truststore |
0.10.4 | 0.10.5 | — |
typing-inspection |
0.4.2 | 0.4.4 | — |
uvicorn |
0.32.1 | 0.54.0 | — |
src/time/uv.lock
| Package | Locked | uv lock --upgrade |
Latest (direct only) |
|---|---|---|---|
annotated-types |
0.7.0 | 0.8.0 | — |
attrs |
25.4.0 | 26.1.0 | — |
cffi |
2.0.0 | 2.1.1 | — |
click |
8.1.7 | 8.5.0 | — |
exceptiongroup |
1.2.2 | 1.3.1 | — |
freezegun |
1.5.1 | 1.5.5 | 1.5.5 |
idna |
3.18 | 3.20 | — |
iniconfig |
2.0.0 | 2.3.1 | — |
nodeenv |
1.9.1 | 1.12.0 | — |
opentelemetry-api |
1.45.1 | 1.45.2 | — |
packaging |
24.2 | 26.3 | — |
pluggy |
1.5.0 | 1.7.0 | — |
pydantic |
2.12.5 | 2.14.2 | 2.14.2 |
pydantic-core |
2.41.5 | 2.50.2 | — |
pygments |
2.20.0 | 2.21.0 | — |
pyright |
1.1.389 | 1.1.414 | 1.1.414 |
pytest |
9.0.3 | 9.2.0 | 9.2.0 |
pytest-asyncio |
1.4.0 | 1.4.1 | 1.4.1 |
python-dateutil |
2.9.0.post0 | 3.0.0 | — |
pywin32 |
311 | 312 | — |
ruff |
0.8.1 | 0.17.3 | 0.17.3 |
six |
1.16.0 | 1.17.0 | — |
tomli |
2.2.1 | 2.5.0 | — |
truststore |
0.10.4 | 0.10.5 | — |
typing-inspection |
0.4.2 | 0.4.4 | — |
tzdata |
2024.2 | 2026.6 | 2026.6 |
tzlocal |
5.3.1 | 5.4.5 | 5.4.5 |
uvicorn |
0.32.1 | 0.54.0 | — |
GitHub Actions
| Action | Current | Latest |
|---|---|---|
actions/checkout |
v6 | v7.0.1 |
actions/checkout |
v6.1.0 (d23441a) |
v7.0.1 |
actions/download-artifact |
v8.0.1 (3e5f45b) |
v8.0.2 |
actions/setup-node |
v7.0.0 (8207627) |
v7.1.0 |
actions/setup-python |
v7.0.0 (5fda3b9) |
v7.1.0 |
actions/upload-artifact |
v7.0.1 (043fb46) |
v7.0.2 |
anthropics/claude-code-action |
v1.0.238 (12dd8d7) |
v1.0.266 |
astral-sh/setup-uv |
v7 | v10.3.3 |
astral-sh/setup-uv |
v7.6.0 (37802ad) |
v10.3.3 |
pypa/gh-action-pypi-publish |
v1.14.2 (dc37677) |
v1.14.3 |
A SHA pin is ranked by its # vX.Y.Z comment. When bumping one, resolve the new SHA and its exact release from the same tag lookup (verify:action-pins cannot check offline that they agree).
A later run of this sweep updates this body in place rather than filing a duplicate.
Activity
cliffhall commentedon Nov 5, 2026
Triage: Priority Medium (total 6)
Board: Servers V2 (#43), Status
Todo: it arrived with its milestone set, so it keeps that approval.