chore: Lock file maintenance

[renovate]

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Saturday (* 0-6 * * 6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 14 package(s) with unknown licenses.

View full job summary

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​class-variance-authority@​0.7.1
	npm/​msw-storybook-addon@​2.0.7
	npm/​esbuild@​0.27.7 ⏵ 0.28.0	+1		+1
	npm/​recharts@​3.8.1
	npm/​@​vitest/​coverage-v8@​4.1.5
	npm/​react-router@​7.15.0
	npm/​html-to-image@​1.11.13
	npm/​cmdk-base@​1.0.0
	npm/​lucide-react@​1.14.0
	npm/​cross-env@​10.1.0
	npm/​d3-force@​3.0.0
	npm/​eslint-plugin-security@​4.0.0
	npm/​rollup-plugin-visualizer@​7.0.1
	npm/​eslint-plugin-react-refresh@​0.5.2
	npm/​openapi-typescript@​7.13.0
	npm/​axios@​1.16.0
	npm/​eslint@​10.3.0
	npm/​fast-check@​4.7.0
	npm/​@​xyflow/​react@​12.10.2
	npm/​@​vitejs/​plugin-react@​5.2.0 ⏵ 6.0.1	+1
	npm/​motion@​12.38.0
	npm/​msw@​2.14.5

View full report

[codspeed-hq]

Merging this PR will not alter performance

✅ 54 untouched benchmarks

---

_{Comparing renovate/lock-file-maintenance-lock-files (6941edf) with main (e11332f)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.75%. Comparing base (e11332f) to head (6941edf).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1820      +/-   ##
==========================================
- Coverage   84.76%   84.75%   -0.01%     
==========================================
  Files        1798     1798              
  Lines      103991   103991              
  Branches     9109     9109              
==========================================
- Hits        88145    88140       -5     
- Misses      13638    13641       +3     
- Partials     2208     2210       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Aureliolo]

Decision: Renovate lockFileMaintenance refresh of uv.lock, web/package-lock.json, site/package-lock.json; CI green; no source/config diffs; all transitive bumps stay within existing pyproject.toml and package.json constraints.

Changelog digest:

• Scope: lockfile-only (3 files, 0 source/config). Reviewed every distinct version delta in the diff.
• Reviewed but not relevant (transitive churn within unchanged top-level constraints):
  • Python: googleapis-common-protos 1.74.0 -> 1.75.0, hf-xet 1.4.3 -> 1.5.0, huggingface-hub 1.13.0 -> 1.14.0, markdown-it-py 4.0.0 -> 4.2.0, openai 2.33.0 -> 2.36.0 (still satisfies pyproject.toml floor openai>=2.33 and CI provider tests pass), pip 26.1 -> 26.1.1, pydantic-settings 2.14.0 -> 2.14.1, python-discovery 1.2.2 -> 1.3.0, pytz 2026.1.post1 -> 2026.2 (tzdata refresh), sse-starlette 3.4.1 -> 3.4.2, transformers 5.7.0 -> 5.8.0, urllib3 2.6.3 -> 2.7.0, uv 0.11.8 -> 0.11.11, virtualenv 21.3.0 -> 21.3.1.
  • Web: @puppeteer/browsers 2.13.0 -> 2.13.1, immer 11.1.4 -> 11.1.7, @storybook/icons 2.0.1 -> 2.0.2, @types/estree 1.0.8 -> 1.0.9, caniuse-lite / electron-to-chromium / baseline-browser-mapping data refreshes, enhanced-resolve 5.21.0 -> 5.21.2, graphql 16.13.2 -> 16.14.0, get-east-asian-width 1.5.0 -> 1.6.0.
  • Site (Astro): vite 7.3.2 -> 7.3.3, @oxc-project/types 0.127.0 -> 0.128.0, @rolldown/binding-* rc.17 -> rc.18, @rollup/rollup-* 4.60.2 -> 4.60.3.
• Marker simplification in uv.lock (e.g. scikit-learn, scipy, sentence-transformers, sympy lose redundant extra == markers on transitive deps): pure resolver bookkeeping, no behaviour change.
• Reviewed but not relevant (no items affected us): no breaking changes touching any first-party usage; no deprecations on APIs we call; no security advisories surfaced by Dependency Review or Socket.
• Relevant: none (lockfile maintenance does not adopt new top-level features; Renovate's lockFileMaintenance only refreshes resolved versions within existing constraints).

Follow-ups: none.