chore(deps): bump everything to latest stable

Merged
HA
10d ago
+6789-7052

Bumps every dependency in the repo to its latest stable version. It supersedes all 17 open dependabot PRs (#270 to #286), which land here at the same or newer versions.

  • Backend: Python 3.12 to 3.14, every pin to latest (FastAPI 0.143, starlette 1.7, FastStream 0.7.7, pydantic 2.14, redis-py 8, mypy 2.4, ruff 0.17, gunicorn 26). 24 unused deps removed.
  • Frontend: every npm package to latest including majors (vitest 5, lucide 1.x, hey-api 0.99), Node 26, nginx 1.31.
  • Compose: Mongo 9.0.2, Redis 8, Kafka 4 (cp-kafka 8.3.2), Grafana 13, Loki 3.7, VictoriaMetrics 1.153, otel-collector 0.162, Jaeger v1 to v2.
  • CI: actions to latest majors, k3s 1.37.1, Kueue 0.20.1, Trivy 0.75.
  • Dependabot now opens one grouped PR per ecosystem and also tracks docker-compose images and the composite actions.

Two things are held back on purpose. TypeScript stays on 6.0.3, since TS 7 doesn't ship the compiler API that typescript-eslint, svelte-check and the build load. Jaeger stays on 2.20.0, since 2.21 removed the search endpoint Grafana's Jaeger datasource still calls (grafana/grafana#112336). Dependabot ignores Jaeger >= 2.21 until Grafana ships that.

Two pins were already broken on main and are fixed here: aquasecurity/trivy-action@0.34.1 no longer exists upstream (now pinned to the v0.36.0 commit), and otel-collector 0.91 couldn't load the committed config at all.

Before deploying:

  • Mongo 9 starts fine on an 8.0 data volume (tested), but stays at FCV 8.0 until db.adminCommand({setFeatureCompatibilityVersion: "9.0", confirm: true}).
  • Grafana 13 needs 512m and downloads the prometheus and jaeger plugins from grafana.com on first start.
  • cert-generator installs Kueue 0.20.1 on the host cluster and the queues move to v1beta2, so check prod's k3s version first.

Tested locally: ruff, mypy strict (319 files), grimp and 291 backend unit tests; 1112 frontend tests, svelte-check with 0 errors and 0 warnings, eslint, stylelint, prettier and the production build; mkdocs strict. The new backend image ran against Mongo 9, Redis 8 and Kafka 4: health returned 200 under gunicorn, 411 of 430 non-k8s e2e tests passed, and the other 19 wait on pod events from the k8s worker. The k3s e2e run is this PR's CI.

Follow-ups this surfaced: the Mongo dashboard queries 22 metric names the collector doesn't emit, and the memory alerts have no data since system_memory_utilization isn't enabled in the collector.

Review and CI follow-ups pushed after the first round:

  • httpx is replaced by httpx2 (Pydantic's maintained fork). async-asgi-testclient is gone; the SSE e2e tests use a small streaming transport in tests/e2e/conftest.py with httpx2's client.sse(), and the replay status test now goes through its real stream route.
  • The docs build was broken by uv tool run no longer reusing the installed tool; it's one pinned uvx call now.
  • Every action is pinned to a commit SHA, tools are pinned to exact versions, installs use --no-build and --ignore-scripts, and Playwright runs through npm scripts.
  • The log sanitizer's email regex was quadratic (8.2s on a 40k-char line); it's linear now, with a regression test.
  • The SSE bus e2e test raced its own subscription; it now waits for Redis to report the subscriber.
  • Memory alerts query system_memory_utilization_ratio, which the collector now actually emits.

Known pre-existing flake, not from this PR: test_get_seeds_with_provided_defaults resets the shared system-settings document, so a parallel xdist worker can change it between reset and read.