Chore: Go through all dependabot PRs and update the deps that are addressed in the dependency updates

[yasha-dev1]

Chore: Go through all dependabot PRs and update the deps that are addressed in the dependency updates

[github-actions]

📋 Issue Triage — Not Actionable

Summary: Maintenance chore to review and merge open dependabot dependency-update PRs, but with no specifics on which PRs or packages are in scope.
Confidence: 0.85

This issue needs more information before it can be worked on. Please provide:

• List of specific dependabot PR numbers or dependency names to update
• Clarification on which updates are safe (minor/patch only vs. major version bumps) — CLAUDE.md explicitly forbids major upgrades (e.g. Celery 5→6, Pydantic 2→3) without explicit instruction
• Acceptance criteria defining when the chore is considered complete
• Whether any dependencies should be explicitly excluded from this sweep

Edit this issue with the requested details and we will re-evaluate automatically.

---

🤖 Issue Triage Agent — automated issue triage.

[yasha-dev1]

all dependabot prs

[github-actions]

📋 Implementation Plan

Files to Modify

• poetry.lock — Regenerate after updating transitive dependency pins. All 6 Python dependabot PRs (chore(deps-dev): bump redis from 7.1.0 to 7.2.0 #195, chore(deps-dev): bump ruff from 0.15.0 to 0.15.2 #193, chore(deps): bump filelock from 3.20.3 to 3.24.3 #190, chore(deps): bump werkzeug from 3.1.5 to 3.1.6 #206, chore(deps-dev): bump aiobotocore from 3.1.2 to 3.1.3 #182, chore(deps): bump cryptography from 46.0.4 to 46.0.5 #150) only touch this file. The consolidated update will incorporate all changes in a single lock-file refresh.

• .pre-commit-config.yaml — Update the ruff-pre-commit rev from v0.8.6 to v0.15.2 to stay in sync with the ruff version being bumped via PR chore(deps-dev): bump ruff from 0.15.0 to 0.15.2 #193 (0.15.0 → 0.15.2). The current pin is significantly behind.

• dashboard/frontend/package.json — Bump version pins for all 15 npm dependencies addressed by the open frontend dependabot PRs. These are minor/patch bumps within existing ^ ranges, but the PRs also update exact versions in the caret specs.

• dashboard/frontend/package-lock.json — Regenerated by running npm install after package.json updates.

• dashboard/frontend/pnpm-lock.yaml — Regenerated by running pnpm install after package.json updates.

• dashboard/frontend/yarn.lock — Regenerated by running yarn install after package.json updates.

Files to Create

None.

Approach

This is a dependency consolidation chore. Instead of merging 21 individual dependabot PRs, the implementation agent should apply all updates in a single branch and PR.

Step 1: Python dependency updates (poetry.lock only)

All 6 Python dependabot PRs change only poetry.lock (no pyproject.toml changes). The updated packages and their version bumps:

PR	Package	From	To	Type	Direct in pyproject.toml?
#195	redis	7.1.0 → 7.2.0	minor	Yes (redis>=5.0.0) — within range
#193	ruff	0.15.0 → 0.15.2	patch	Yes (ruff>=0.1.0) — within range
#190	filelock	3.20.3 → 3.24.3	minor	Yes (filelock>=3.12.0) — within range
#206	werkzeug	3.1.5 → 3.1.6	patch	No — transitive (via Celery/Flower)
#182	aiobotocore	3.1.2 → 3.1.3	patch	Yes (aiobotocore>=2.5.0) — within range
#150	cryptography	46.0.4 → 46.0.5	patch	No — transitive

All updates fall within the existing >= version ranges in pyproject.toml, so no pyproject.toml changes are needed for the Python side.

Implementation:

1. Run poetry lock to regenerate the lock file, pulling latest compatible versions. Alternatively, run poetry update redis ruff filelock werkzeug aiobotocore cryptography to target just these packages.
2. Run poetry install to verify the resolved versions install cleanly.
3. Run ruff check . and mypy pyworkflow --ignore-missing-imports to verify no regressions from the new ruff/redis versions.
4. Run pytest to confirm all tests pass.

Note on CI failures: The individual dependabot PRs for #195, #193, #190 show Type Check: FAILURE. This is likely because those PRs only update poetry.lock in isolation without updating the CI environment properly. The consolidated update should resolve this. PR #206 (werkzeug) has all checks passing. PR #150 (cryptography) also passes all checks.

Step 2: Pre-commit ruff sync

Update .pre-commit-config.yaml line 15: change rev: v0.8.6 to rev: v0.15.2 to match the ruff version in the updated lock file. This is important — the pre-commit hook version should stay reasonably aligned with the dev dependency.

Step 3: Frontend npm dependency updates

All 15 npm dependabot PRs update packages in dashboard/frontend/. The version bumps:

PR	Package	From → To	Type
#202	tailwindcss	4.1.18 → 4.2.0	minor
#201	typescript-eslint	8.54.0 → 8.56.0	minor
#200	@types/node	25.2.1 → 25.3.0	minor
#199	react-hook-form	7.71.1 → 7.71.2	patch
#198	@tabler/icons-react	3.36.1 → 3.37.1	minor
#197	tailwind-merge	3.4.0 → 3.5.0	minor
#196	@tanstack/react-router	1.158.4 → 1.161.4	minor
#194	@tanstack/router-plugin	1.158.4 → 1.161.4	minor
#192	@tailwindcss/vite	4.1.18 → 4.2.0	minor
#191	lucide-react	0.563.0 → 0.575.0	minor
#205	ajv	6.12.6 → 6.14.0	minor (transitive/dev)
#186	react-day-picker	9.13.1 → 9.13.2	patch
#185	@types/react	19.2.13 → 19.2.14	patch
#181	@tanstack/react-query	5.90.20 → 5.90.21	patch
#152	axios	1.13.4 → 1.13.5	patch

Implementation:

1. cd dashboard/frontend
2. Update package.json caret ranges to reflect the new minimum versions where the dependabot PR bumped them (most are already within range; update the caret base where the PR changed it).
3. Run npm install (primary lockfile) to regenerate package-lock.json.
4. Run pnpm install to regenerate pnpm-lock.yaml.
5. Run yarn install to regenerate yarn.lock.
6. Run npm run build and npm run lint to verify no regressions.

Step 4: Close stale dependabot PRs

After the consolidated PR merges, close all 21 dependabot PRs with a comment like: Superseded by #<consolidated-PR-number>.

Test Strategy

• Full Python test suite: Run pytest — all tests must pass on Python 3.11, 3.12, and 3.13 (mirrors CI matrix).
• Lint: Run ruff check . — must be clean with the new ruff 0.15.2 (patch update, low risk of new rule breakage since project already pins specific rule sets in [tool.ruff.lint]).
• Type check: Run mypy pyworkflow --ignore-missing-imports — must pass. The redis 7.2.0 bump introduces new APIs but no breaking changes to existing type stubs.
• Build: Run python -m build — must produce a valid sdist and wheel.
• Pre-commit: Run pre-commit run --all-files — verifies the updated ruff-pre-commit hook works correctly.
• Frontend build: Run npm run build and npm run lint in dashboard/frontend/ — verifies the npm updates don't break the TypeScript build or linting.

No new test files needed — this is a dependency-only update with no code changes.

Edge cases to verify:

• redis 7.1.0 → 7.2.0 is a minor bump with new features (OTel, Redis 8.6 support) and bug fixes. Verify no breaking API changes affect pyworkflow/storage/redis.py.
• ruff 0.15.0 → 0.15.2 is a patch bump. The expanded default rule set only applies in preview mode (not enabled in this project). Verify ruff check . produces no new violations.
• filelock 3.20.3 → 3.24.3 is a significant minor jump with new features (lifetime parameter, cancel_check). These are additive and should not break existing usage.
• tailwindcss 4.1.18 → 4.2.0 and @tailwindcss/vite 4.1.18 → 4.2.0 should be bumped together to stay in sync.
• @tanstack/react-router and @tanstack/router-plugin should be bumped together (both 1.158.4 → 1.161.4) to stay in sync.

Risk Assessment

• Risk tier: Tier 3 — poetry.lock is explicitly listed as a Tier 3 pattern in harness.config.json. This requires: lint + type-check + full test suite + review-agent sign-off + manual human review before merge.

• Affected modules: No pyworkflow source modules are directly changed. The dependency updates affect:

  • storage (redis 7.2.0 — transitive, within range)
  • storage (aiobotocore 3.1.3 — transitive, within range)
  • Dev tooling (ruff, pre-commit)
  • Dashboard frontend (npm packages)

• Dependency rule impact: No import violations. No source code changes.

• Breaking changes: None expected. All Python updates are minor/patch within existing ranges. All npm updates are minor/patch within existing caret ranges. redis 7.1→7.2 deprecates client_tracking_on/client_tracking_off for cluster clients but this is unlikely to affect pyworkflow's usage.

• New dependencies: None. This is purely updating existing dependency versions.

• Assumptions:

  • The type-check failures on individual dependabot PRs (chore(deps-dev): bump redis from 7.1.0 to 7.2.0 #195, chore(deps-dev): bump ruff from 0.15.0 to 0.15.2 #193, chore(deps): bump filelock from 3.20.3 to 3.24.3 #190) are environment-specific CI issues, not actual type errors introduced by the bumps. The consolidated update with a fresh poetry lock should resolve them.
  • werkzeug and cryptography are transitive dependencies (not declared in pyproject.toml); they're pulled in by Celery/Flower and other transitive chains.
  • The project uses three lockfiles for the frontend (package-lock.json, pnpm-lock.yaml, yarn.lock). All three must be regenerated to stay in sync.

---

🤖 Issue Planner Agent — automated implementation planning.

[github-actions]

🤖 Implementation agent starting...

Branch: cf/chore-go-through-all-dependabot-prs-and-update-the-212
Run: 22286659463

---

🤖 Issue Implementer Agent — automated implementation.