[bifrost0x]

Problem and outcome

Combines the two open Dependabot updates into one change with correctly generated locks.

• npm: eslint 10.13.0 → 10.14.0, playwright 1.64.1 → 1.65.0 (dev only).
• Python: Authlib 1.9.1 → 1.9.5 (includes the 1.9.3 security fix and the 1.9.5 JOSE hardening against SSH keys as HMAC secrets), python-socketio 5.17.0 → 5.18.1 with python-engineio 4.14.0 → 4.15.1, graphifyy 0.9.97 → 0.9.103 (graph build only).

Both Dependabot PRs failed CI:

• deps(python): bump the python-minor-and-patch group with 3 updates #322 rewrote the Python locks without scripts/lock_requirements.ps1. That dropped the --require-hashes header and the universal markers (async-timeout for Python < 3.11.3, colorama and sspilib on Windows) and duplicated the numpy hashes. The locks here are regenerated with the script and the uv version pinned in uv.toml; the diff only contains the actual version changes.
• deps(npm): bump the npm-minor-and-patch group with 2 updates #323: the Chromium build in Playwright 1.65 serializes a computed align-self: flex-end as flow-end. The launcher layout test now checks end alignment by geometry (right edge on the content edge, button not stretched) instead of the keyword string.

The policy tests that pin the graphify version and the Authlib qualification comment in requirements.in are updated accordingly.

Scope and links

Refs #322, #323. Both can be closed once this is merged.

Validation

• Exact tested revision and checks/results: 54728a8 on Windows with Python 3.14 in a clean venv installed from requirements-test.txt.
  • lock_requirements.ps1 -Check: passes.
  • pytest: 4878 passed, 1 failed. test_pytest_shard.py::test_ci_workflow_entrypoint_loads_local_plugin_without_pythonpath fails only under xdist load and passes on its own.
  • npm run lint:js: clean.
  • npm run test:js: 1067 passed, 1 failed. automation-tools.test.js fails on a Windows CRLF checkout; the file is unchanged and the test passed on Linux CI for both Dependabot PRs.
  • Playwright 1.65 for profile-launcher.spec.js and overview-filters.spec.js: 38/38 passed.
• Regression/acceptance coverage: the updated launcher test was mutation-checked. With align-self: flex-start it fails at both widths (220 px and 754 px offset).
• Compatibility, upgrade and security impact: I diffed the internals the app hooks in engineio and socketio. Engine.IO 4.15 rejects HTTP requests on sockets that are not connected yet or already upgraded. Socket.IO 5.18 keeps clients in a pre-connected state until the connect handler accepts them. get_participants and emit are unchanged, so the connected/unauthenticated event sent before return False is still delivered. The only is_connected call sits on the disconnect path after server.disconnect(), where the result is the same. The signatures of the wrapped _handle_connect methods are unchanged. No API, schema, config or deployment changes.
• Remaining deployment-specific checks or explicit limitations: the full E2E suite, SSH/SMB/Redis integration and the container checks were not run locally and rely on CI here. The Redis rate-limiter job failed on deps(python): bump the python-minor-and-patch group with 3 updates #322; I did not look into why, so CI on this PR has to confirm it passes with the corrected locks.

Delivery

Merging implements the change; it does not publish a versioned release.