Dependencies

[jmthomas]

What changed

Bump dependencies

Why it changed

Prepare for release

Testing strategy

Built and ran

Review notes

Notable upgrates:
versitygw 1.7.0 -> 1.8.0, astro-web-components 7.27.0 -> 8.0.0, pinia 3.0.4 -> 4.0.3, rdoc 7.2.0 -> 8.0.0

Notable skips:
QuestDB 9 -> 10

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​dompurify@​3.4.15
	pypi/​numpy@​2.5.1 ⏵ 2.5.3	+1
	pypi/​orjson@​3.11.9 ⏵ 3.12.0
	pypi/​psycopg@​3.3.4 ⏵ 3.3.5	+1
	npm/​typescript-eslint@​8.66.0 ⏵ 8.69.0			+1
	npm/​@​dagrejs/​dagre@​3.1.0 ⏵ 3.1.1	+1		+1	+1
	npm/​@​astrouxds/​astro-web-components@​8.0.0
	pypi/​lxml@​6.1.1 ⏵ 6.1.3	+1				-19
	npm/​globals@​17.9.0 ⏵ 17.12.0			+1
	npm/​monocart-coverage-reports@​2.12.12 ⏵ 2.13.0				+2
	npm/​pinia@​4.0.3
	npm/​eslint-plugin-vue@​10.10.0 ⏵ 10.11.0			+1	-4
	pypi/​coverage@​7.15.4 ⏵ 7.16.0	+1
	npm/​eslint@​10.8.0 ⏵ 10.10.0	+1
	pypi/​boto3@​1.43.65 ⏵ 1.43.89
	npm/​@​playwright/​test@​1.62.1 ⏵ 1.63.0
	pypi/​fakeredis@​2.37.0 ⏵ 2.37.1	+1
	pypi/​ruff@​0.16.1 ⏵ 0.16.6	+1
	pypi/​iroh@​1.0.0 ⏵ 1.1.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @astrouxds/astro-web-components is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: openc3-cosmos-init/plugins/packages/openc3-cosmos-demo/package.json → npm/@astrouxds/astro-web-components@8.0.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@astrouxds/astro-web-components@8.0.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @stencil/core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: openc3-cosmos-init/plugins/pnpm-lock.yaml → npm/@astrouxds/astro-web-components@8.0.0 → npm/@stencil/core@4.43.5 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@stencil/core@4.43.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.23%. Comparing base (679c8b9) to head (760a940).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3837      +/-   ##
==========================================
- Coverage   79.30%   79.23%   -0.08%     
==========================================
  Files         896      896              
  Lines       67371    67374       +3     
  Branches     2608     2662      +54     
==========================================
- Hits        53426    53381      -45     
- Misses      13276    13324      +48     
  Partials      669      669              

Flag	Coverage Δ
frontend	66.48% <ø> (-0.09%)	⬇️
python	79.36% <ø> (+<0.01%)	⬆️
ruby-api	81.40% <ø> (-0.78%)	⬇️
ruby-backend	84.58% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

🟢 Approval recommended

The version bumps are internally consistent (no remaining references to the prior pinned versions found in the repo) and the updated Debian roadmap check matches the current roadmap wording.

Pull request overview

Updates a set of pinned dependency versions across the release/build tooling, container images, and frontend E2E/tooling workspaces to prepare for an upcoming release.

Changes:

• Bumped container/build dependencies (versitygw, Traefik, Valkey image tag).
• Updated Playwright workspace dependencies and lockfile.
• Updated plugin workspace dependencies/lockfile (notably astro-web-components, Pinia, Vue/Vuetify, Axios, Sass, ESLint tooling), and tightened the Debian release mention check in the release audit script.

File summaries

File	Description
scripts/release/package_audit_lib.rb	Tightens roadmap validation to look for the documented “Debian release is []” phrasing.
scripts/release/build_multi_arch.sh	Bumps versitygw and Traefik versions used during multi-arch builds.
scripts/linux/openc3_build_ubi.sh	Bumps Traefik version used for UBI builds.
openc3-traefik/Dockerfile	Updates default Traefik image tag argument.
openc3-redis/Dockerfile	Updates the default Valkey image tag argument.
openc3-buckets/Dockerfile-ubi	Updates default versitygw version argument for UBI buckets image.
openc3-buckets/Dockerfile	Updates default versitygw version argument for Debian buckets image.
playwright/package.json	Bumps Playwright and related tooling dependencies.
playwright/pnpm-lock.yaml	Updates lockfile to reflect Playwright/tooling dependency bumps.
openc3-cosmos-init/plugins/package.json	Bumps ESLint/globals/typescript-eslint toolchain versions for the plugins workspace.
openc3-cosmos-init/plugins/pnpm-lock.yaml	Updates plugins workspace lockfile for dependency/tooling bumps (including Pinia/Vue/Vuetify and astro-web-components).
openc3-cosmos-init/plugins/packages/openc3-vue-common/package.json	Bumps shared Vue package deps (Pinia/Vue/Vuetify/Astro/Axios/Sass).
openc3-cosmos-init/plugins/packages/openc3-tool-base/package.json	Bumps tool-base deps and updates peerDependency pinia to 4.0.3.
openc3-cosmos-init/plugins/packages/openc3-js-common/package.json	Bumps shared JS deps (Astro/Axios/Sass).
openc3-cosmos-init/plugins/packages/openc3-cosmos-tool-*/package.json	Bumps per-tool deps (Astro/Axios/Sass/Vue, and Dagre where applicable).

Review details

Files not reviewed (2)

• openc3-cosmos-init/plugins/pnpm-lock.yaml: Generated file
• playwright/pnpm-lock.yaml: Generated file

• Files reviewed: 27/32 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud