Refresh framework frontend pins and locked backend dependencies

Merged
MA
6h ago
+2680-2154

Type of change

  • Bug fix (non-breaking change which fixes an issue)

Routine dependency sweep: framework frontend pins plus the locked backend environment. I applied one rule throughout: take the newest release that is at least seven days old. The backend lock already enforces this with exclude-newer = "7 days". This PR applies it to npm pins as well, with one exception noted below.

Frontend

PackageFromToWhere
react / react-dom19.3.019.3.1reflex-base
vite8.3.28.3.4reflex-base
postcss8.5.298.5.30reflex-base
postcss-import17.0.017.0.1reflex-base
@radix-ui/react-accordion1.2.201.3.1radix
@radix-ui/react-dialog (dialog, drawer)1.1.231.3.1radix
@radix-ui/react-form0.1.160.3.0radix
@radix-ui/react-progress1.1.161.2.1radix
@radix-ui/react-slider1.4.71.6.1radix
react-syntax-highlighter16.1.116.1.2code
tailwind-merge3.6.03.7.0internal
@icons-pack/react-simple-icons13.13.013.15.1internal
  • React 19.3.1 contains one commit, a React Server Components (Flight) transport fix. Reflex doesn't use RSC; taking it keeps React current.
  • Radix: the old pins matched exactly the primitives inside radix-ui@1.6.7, which @radix-ui/themes depends on, so apps loaded one copy of each primitive. The new set matches radix-ui@1.8.1, the current release a fresh Themes install resolves to. Bumping them individually would load two copies of the Radix internals (separate dismissable-layer and focus stacks). This set is about 3 hours inside the 7-day window; keeping a single copy seemed worth the exception. The upstream changelogs list type fixes and additive features only.
  • Held for the next sweep (too new): react-router 8.5.0 (published Oct 19) and vite 8.3.5.
  • Unchanged: the existing holds in [tool.check-outdated-deps] (plotly.js, tailwind, react-dropzone, lucide-react, ag-grid and others), @babel/core (8.x is a major), and Bun 1.4.4 from #7639.
  • Regenerated docs/app/reflex.lock. It resolves radix-ui@1.8.1 with no nested duplicate @radix-ui/* copies.

Backend

  • uv lock --upgrade within the existing window, keeping ruff and pyright at their pinned versions. Notable moves: SQLAlchemy 2.1.4, pydantic 2.14.1, Starlette 1.8.0, granian 2.8.4, FastAPI 0.143.2, python-engineio 4.14.0, playwright 1.64.0, reflex-enterprise 0.9.8, towncrier 26.9.0.
  • Main is merged in, so the lock keeps virtualenv 21.14.12 from #7644 (the Dependabot security fix).
  • reflex-release: widened towncrier from <26 to <27. Version 26 is CalVer with no breaking changes.
  • docs app: xy 0.0.7 → 0.0.8. It's a single bugfix that restores live chart rendering on Reflex 0.10.
  • [tool.check-outdated-deps]:
    • Hold the Python plotly package, because plotly.py 7 targets plotly.js 4, which is still held at 3.x (#7002).
    • Drop the pydantic-core and pyee holds; both now resolve to their latest versions, so the script flagged them as stale.
  • scripts/check_outdated_deps.py backend passes.

Fixes the upgrades required

  • SQLAlchemy 2.1 typing: its catch-all returning(*cols) overload types rows as one-element tuples, which broke pyright in reflex-workflow. lease() is now annotated -> Update, so execute() returns untyped rows. I checked this with pyright on both SQLAlchemy 2.0.52 and 2.1.4. One test helper gets an assert until is not None.
  • test_get_leaf_vars_sorts_every_cached_operation (from #7606):
    • reflex-enterprise 0.9.8 registers a reflex_app pytest plugin that imports its LambdaVar.
    • Var.__init_subclass__ then generates a LambdaCastedVar inside reflex_base.vars.base, and the test counted it as one of Reflex's own operations.
    • The subclass walk now stops at classes defined outside Reflex. The test passes with the plugin loaded and with -p no:reflex_app.
  • tests/integration/test_urls.py now uses httpx instead of requests:
    • pytest-playwright 0.10 dropped its pytest-base-url dependency, which was the only thing installing requests in the integration environment.
    • Without it, collecting the module failed and took every app-harness job down. httpx is already a reflex runtime dependency.

Validation

  • Unit suite: 13,177 passed. The only failures are 14 tests in tests/units/reflex_bench/drivers/test_browser.py. They fail identically with the previous Playwright, because this container's preinstalled Chromium (build 1194) is older than Playwright needs.
  • ruff check, ruff format --check, pyright reflex tests, full pyright, the pre-commit ty check, uv lock --check, reflex-release changelog-check and reflex-release sync --check all pass. Stub regeneration leaves pyi_hashes.json unchanged.
  • Real app: built a production app with Bun 1.4.4 on React 19.3.1, Vite 8.3.4 and PostCSS 8.5.30. In Chromium, checked the accordion, dialog, drawer, form submit (backend round trip), slider (state update), progress bar, code block and markdown code. No page errors.
  • I left out docs-only frontend packages outside the framework (@mantine/core, @xyflow/react, rehype-sanitize, react-colorful).

News fragments were added for reflex-base, components-radix, components-code, components-internal, reflex-release and reflex-workflow.

Generated by Claude Code