Update npm and Python dependency groups

package.json

@@ -25,8 +25,8 @@
     "@xterm/xterm": "6.0.0"
   },
   "devDependencies": {
-    "eslint": "10.13.0",
-    "playwright": "^1.64.1"
+    "eslint": "10.14.0",
+    "playwright": "^1.65.0"
   },
   "overrides": {
     "eslint": {

requirements-graph.in

@@ -1,2 +1,2 @@
 # Build-only dependency for the published repository code graph.
-graphifyy==0.9.97
+graphifyy==0.9.103

requirements-graph.txt

@@ -1,7 +1,7 @@
 --require-hashes
-graphifyy==0.9.97 \
-    --hash=sha256:562a9007caa96419f33dbca007647374b6986bde486021b7475e2566d9c5904f \
-    --hash=sha256:eb24dd7f93293753c001ca36e7304e0b52e86fe4124c2f531dcdb3d64865e01a
+graphifyy==0.9.103 \
+    --hash=sha256:7948c030f8b04153d88bc1ee23a485ddaa0c2d6aaa03a748c177e3c217bcfe34 \
+    --hash=sha256:9ddf6c18666ee64ee65c130266b87adb45a613a9c4fe2afce7babbcbb1555b95
     # via -r requirements-graph.in
 networkx==3.6.1 ; python_full_version < '3.12' \
     --hash=sha256:26b7c357accc0c8cde558ad486283728b65b6a95d85ee1cd66bafab4c8168509 \

requirements-test.txt

@@ -3,9 +3,9 @@ async-timeout==5.0.1 ; python_full_version < '3.11.3' \
     --hash=sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c \
     --hash=sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3
     # via redis
-authlib==1.9.1 \
-    --hash=sha256:5c7d9848f47cac340f060f76ae0bc09b59f5c8e89cc1bb032d4370a0c55b5974 \
-    --hash=sha256:8b9be8b1e5174dcbf5520e984f1a22dc2edae5b6e40a61d4cedbf86b97e9e69b
+authlib==1.9.5 \
+    --hash=sha256:3f031d5e9b6486089e91e8f7f1b68f36275f3151c66460d650fc90d420545fd7 \
+    --hash=sha256:e32a63e3d869196b61816b2602231862179a2ffc29358c009d1f022c8b86a8b2
     # via -r requirements.in
 bcrypt==5.0.0 \
     --hash=sha256:046ad6db88edb3c5ece4369af997938fb1c19d6a699b9c1b27b0db432faae4c4 \
@@ -843,13 +843,13 @@ python-dotenv==1.2.4 \
     --hash=sha256:42269a8a5b3fd54ffa6f3d84b18abed50064717576b4ecf03dc4a55d8aa04fdc \
     --hash=sha256:f0d53e69935a851c0dcc78f3ab7aaccd8cabef0b92382b576b824212902873c0
     # via -r requirements.in
-python-engineio==4.14.0 \
-    --hash=sha256:9f0fe275fb7d67bfc1a632421adf22949fd4843bd9c458c004b0a89cede302a2 \
-    --hash=sha256:eaa1e386baf9c2c7959eef7f9d9165c5ea910c5b392f5316e78d29ed073cb43d
+python-engineio==4.15.1 \
+    --hash=sha256:1a412e798a90c64fabe7b20798939ae6d4a03f34da8a33d5a21a25a8bbbc3612 \
+    --hash=sha256:745cb3c07701c719a2906439a00b67e44ef042904036568530a2c3a8cf18c89a
     # via python-socketio
-python-socketio==5.17.0 \
-    --hash=sha256:b5826fd2f8aa02e11347816349b74ac6b53e8a4f4e4b1cf1388e1aff19b7f3f4 \
-    --hash=sha256:c3bbfc4937dcfea7c4d1b182afa94d4a30335d153987e8f2078b344beacf95a0
+python-socketio==5.18.1 \
+    --hash=sha256:07ab0e7c94a52833a67af1dc05958ad6fb0de69adc87de9198a61b22588c40d4 \
+    --hash=sha256:e768c473842be811f6dd24bd0a49cd0d4a0c994182e3eba23cc9d1489c7a697e
     # via
     #   -r requirements.in
     #   flask-socketio

requirements.in

@@ -3,7 +3,7 @@
 Flask==3.1.3
 Werkzeug==3.1.9
 Flask-SocketIO==5.7.0
-python-socketio==5.17.0
+python-socketio==5.18.1
 paramiko==5.1.0
 # Security contract: SMB support is qualified only against this exact API and protocol behavior.
 smbprotocol==1.17.0
@@ -29,8 +29,8 @@ pyasn1>=0.6.5,<0.7
 PyOTP>=2.10,<3
 # Compatibility: qrcode 8.2 provides local SVG QR generation without Pillow.
 qrcode>=8.2,<9
-# Compatibility: Authlib 1.9.1 is qualified for OIDC discovery, PKCE, state, nonce, and token validation.
-Authlib>=1.9.1,<2
+# Compatibility: Authlib 1.9.5 is qualified for OIDC discovery, PKCE, state, nonce, and token validation.
+Authlib>=1.9.5,<2
 # Compatibility: Authlib's Flask client uses the reviewed Requests 2.x transport API.
 requests>=2.34,<3
 # Compatibility: Requests 2.x supports urllib3 2.x; 2.8.0 fixes proxy TLS and chunk parsing vulnerabilities.

requirements.txt

@@ -3,9 +3,9 @@ async-timeout==5.0.1 ; python_full_version < '3.11.3' \
     --hash=sha256:39e3809566ff85354557ec2398b55e096c8364bacac9405a7a1fa429e77fe76c \
     --hash=sha256:d9321a7a3d5a6a5e187e824d2fa0793ce379a202935782d555d6e9d2735677d3
     # via redis
-authlib==1.9.1 \
-    --hash=sha256:5c7d9848f47cac340f060f76ae0bc09b59f5c8e89cc1bb032d4370a0c55b5974 \
-    --hash=sha256:8b9be8b1e5174dcbf5520e984f1a22dc2edae5b6e40a61d4cedbf86b97e9e69b
+authlib==1.9.5 \
+    --hash=sha256:3f031d5e9b6486089e91e8f7f1b68f36275f3151c66460d650fc90d420545fd7 \
+    --hash=sha256:e32a63e3d869196b61816b2602231862179a2ffc29358c009d1f022c8b86a8b2
     # via -r requirements.in
 bcrypt==5.0.0 \
     --hash=sha256:046ad6db88edb3c5ece4369af997938fb1c19d6a699b9c1b27b0db432faae4c4 \
@@ -811,13 +811,13 @@ python-dotenv==1.2.4 \
     --hash=sha256:42269a8a5b3fd54ffa6f3d84b18abed50064717576b4ecf03dc4a55d8aa04fdc \
     --hash=sha256:f0d53e69935a851c0dcc78f3ab7aaccd8cabef0b92382b576b824212902873c0
     # via -r requirements.in
-python-engineio==4.14.0 \
-    --hash=sha256:9f0fe275fb7d67bfc1a632421adf22949fd4843bd9c458c004b0a89cede302a2 \
-    --hash=sha256:eaa1e386baf9c2c7959eef7f9d9165c5ea910c5b392f5316e78d29ed073cb43d
+python-engineio==4.15.1 \
+    --hash=sha256:1a412e798a90c64fabe7b20798939ae6d4a03f34da8a33d5a21a25a8bbbc3612 \
+    --hash=sha256:745cb3c07701c719a2906439a00b67e44ef042904036568530a2c3a8cf18c89a
     # via python-socketio
-python-socketio==5.17.0 \
-    --hash=sha256:b5826fd2f8aa02e11347816349b74ac6b53e8a4f4e4b1cf1388e1aff19b7f3f4 \
-    --hash=sha256:c3bbfc4937dcfea7c4d1b182afa94d4a30335d153987e8f2078b344beacf95a0
+python-socketio==5.18.1 \
+    --hash=sha256:07ab0e7c94a52833a67af1dc05958ad6fb0de69adc87de9198a61b22588c40d4 \
+    --hash=sha256:e768c473842be811f6dd24bd0a49cd0d4a0c994182e3eba23cc9d1489c7a697e
     # via
     #   -r requirements.in
     #   flask-socketio

tests/e2e/profile-launcher.spec.js

@@ -909,18 +909,28 @@ for (const width of [390, 1440]) {
         await page.setViewportSize({width, height: 844});
         const launcher = page.locator('.profile-launcher').first();
         await expect(launcher.locator('.profile-launcher-card').first()).toBeVisible();
-        const styles = await launcher.evaluate(element => ({
-            titleSize: getComputedStyle(element.querySelector('.profile-launcher-title')).fontSize,
-            sectionsFlex: getComputedStyle(element.querySelector('.profile-launcher-sections')).flexGrow,
-            sectionsMaxHeight: getComputedStyle(element.querySelector('.profile-launcher-sections')).maxHeight,
-            actionAlign: getComputedStyle(element.querySelector('.profile-launcher-new')).alignSelf,
-            searchWidth: element.querySelector('.profile-launcher-search').getBoundingClientRect().width,
-            contentWidth: element.clientWidth - parseFloat(getComputedStyle(element).paddingLeft) - parseFloat(getComputedStyle(element).paddingRight),
-        }));
+        const styles = await launcher.evaluate(element => {
+            const launcherStyle = getComputedStyle(element);
+            const launcherRect = element.getBoundingClientRect();
+            const actionRect = element.querySelector('.profile-launcher-new').getBoundingClientRect();
+            const contentRight = launcherRect.left + element.clientLeft + element.clientWidth - parseFloat(launcherStyle.paddingRight);
+            return {
+                titleSize: getComputedStyle(element.querySelector('.profile-launcher-title')).fontSize,
+                sectionsFlex: getComputedStyle(element.querySelector('.profile-launcher-sections')).flexGrow,
+                sectionsMaxHeight: getComputedStyle(element.querySelector('.profile-launcher-sections')).maxHeight,
+                actionRightGap: contentRight - actionRect.right,
+                actionWidth: actionRect.width,
+                searchWidth: element.querySelector('.profile-launcher-search').getBoundingClientRect().width,
+                contentWidth: element.clientWidth - parseFloat(launcherStyle.paddingLeft) - parseFloat(launcherStyle.paddingRight),
+            };
+        });
         expect(styles.titleSize).toBe(width < 768 ? '24px' : '28px');
         expect(styles.sectionsFlex).toBe('1');
         expect(styles.sectionsMaxHeight).toBe('none');
-        expect(styles.actionAlign).toBe('flex-end');
+        // Assert the end alignment geometrically: browsers differ in how they
+        // serialize the computed align-self keyword (flex-end vs flow-end).
+        expect(Math.abs(styles.actionRightGap)).toBeLessThanOrEqual(1);
+        expect(styles.actionWidth).toBeLessThan(styles.contentWidth - 1);
         expect(Math.abs(styles.searchWidth - styles.contentWidth)).toBeLessThanOrEqual(1);
     });
 }

tests/test_dependency_policy.py

@@ -248,9 +248,9 @@ def test_graph_dependencies_are_hash_locked_and_generated_with_other_locks():
         encoding='utf-8'
     )
 
-    assert 'graphifyy==0.9.97' in graph_input
+    assert 'graphifyy==0.9.103' in graph_input
     assert '--require-hashes' in graph_lock
-    assert 'graphifyy==0.9.97' in graph_lock
+    assert 'graphifyy==0.9.103' in graph_lock
     assert 'requirements-graph.in' in lock_script
     assert 'requirements-graph.txt' in lock_script
 

tests/test_supply_chain_policy.py

@@ -459,9 +459,9 @@ def test_graph_pages_toolchain_versions_are_explicit():
 
     assert 'version-file: uv.toml' in workflow
     assert 'uv pip install --require-hashes -r requirements-graph.txt' in workflow
-    assert 'graphifyy==0.9.97' in graph_input
+    assert 'graphifyy==0.9.103' in graph_input
     assert '--require-hashes' in graph_lock
-    assert 'graphifyy==0.9.97' in graph_lock
+    assert 'graphifyy==0.9.103' in graph_lock
 
 
 def test_workflows_use_an_explicit_runner_release():