chore: Lock file maintenance by renovate[bot] · Pull Request #1853 · Aureliolo/synthorg

renovate · 2026-05-10T00:52:52Z

This PR contains the following updates:

Update	Change
lockFileMaintenance	All locks refreshed

🔧 This Pull Request updates lock files to use the latest dependency versions.

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- Between 12:00 AM and 06:59 AM, only on Sunday (* 0-6 * * 0)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-05-10T00:53:06Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 2 package(s) with unknown licenses.

See the Details below.

License Issues

site/package-lock.json

Package	Version	License	Issue Type
baseline-browser-mapping	2.10.29	Null	Unknown License

uv.lock

Package	Version	License	Issue Type
regex	2026.5.9	Null	Unknown License

Allowed Licenses:
MIT, MIT-0, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, PSF-2.0, Unlicense, 0BSD, CC0-1.0, CC-BY-3.0, CC-BY-4.0, Python-2.0, Python-2.0.1, LicenseRef-scancode-free-unknown, LicenseRef-scancode-protobuf, LicenseRef-scancode-google-patent-license-golang, ZPL-2.1, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-3.0-only, LGPL-3.0-or-later, BlueOak-1.0.0, OFL-1.1

Excluded from license check:
pkg:pypi/mem0ai@2.0.1, pkg:pypi/numpy@2.4.4, pkg:pypi/qdrant-client@1.17.1, pkg:pypi/posthog@7.9.12, pkg:pypi/aiohttp@3.13.5, pkg:pypi/cyclonedx-python-lib@11.7.0, pkg:pypi/fsspec@2026.3.0, pkg:pypi/griffelib@2.0.2, pkg:pypi/grpcio@1.80.0, pkg:pypi/charset-normalizer@3.4.6, pkg:pypi/wrapt@2.1.2, pkg:pypi/pytest-codspeed@4.5.0, pkg:pypi/hypothesis@6.152.4, pkg:pypi/litellm@1.83.14, pkg:pypi/openai@2.33.0, pkg:pypi/pyngrok@8.1.2, pkg:pypi/tokenizers@0.23.1, pkg:pypi/typer@0.25.0, pkg:npm/@img/sharp-wasm32@0.33.5, pkg:npm/@img/sharp-win32-ia32@0.33.5, pkg:npm/@img/sharp-win32-x64@0.33.5, pkg:npm/json-schema-typed@8.0.2, pkg:npm/victory-vendor@37.3.6, pkg:pypi/scikit-learn@1.8.0, pkg:pypi/torch@2.11.0, pkg:pypi/cuda-bindings@13.2.0, pkg:pypi/cuda-pathfinder@1.5.0, pkg:pypi/cuda-toolkit@13.0.2, pkg:pypi/nvidia-cublas@13.1.0.3, pkg:pypi/nvidia-cuda-cupti@13.0.85, pkg:pypi/nvidia-cuda-nvrtc@13.0.88, pkg:pypi/nvidia-cuda-runtime@13.0.96, pkg:pypi/nvidia-cudnn-cu13@9.19.0.56, pkg:pypi/nvidia-cufft@12.0.0.61, pkg:pypi/nvidia-cufile@1.15.1.6, pkg:pypi/nvidia-curand@10.4.0.35, pkg:pypi/nvidia-cusolver@12.0.4.66, pkg:pypi/nvidia-cusparse@12.6.3.3, pkg:pypi/nvidia-cusparselt-cu13@0.8.0, pkg:pypi/nvidia-nccl-cu13@2.28.9, pkg:pypi/nvidia-nvjitlink@13.0.88, pkg:pypi/nvidia-nvshmem-cu13@3.4.5, pkg:pypi/nvidia-nvtx@13.0.85

OpenSSF Scorecard

Package	Version	Score	Details
npm/baseline-browser-mapping	2.10.29	Unknown	Unknown
pip/regex	2026.5.9	Unknown	Unknown
npm/baseline-browser-mapping	2.10.29	Unknown	Unknown

Scanned Files

site/package-lock.json
uv.lock
web/package-lock.json

socket-security · 2026-05-10T00:53:47Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality
npm/class-variance-authority@0.7.1
npm/msw-storybook-addon@2.0.7
npm/esbuild@0.27.3 ⏵ 0.28.0		⁺¹
npm/recharts@3.8.1
npm/@vitest/coverage-v8@4.1.5
npm/react-router@7.15.0
npm/html-to-image@1.11.13
npm/cmdk-base@1.0.0
npm/size-limit@12.1.0
npm/lucide-react@1.14.0
npm/cross-env@10.1.0
npm/d3-force@3.0.0
npm/eslint-plugin-security@4.0.0
npm/rollup-plugin-visualizer@7.0.1
npm/eslint-plugin-react-refresh@0.5.2
npm/tailwind-merge@3.5.0
npm/openapi-typescript@7.13.0
npm/axios@1.16.0
npm/storybook@10.3.6
npm/fast-check@4.7.0
npm/eslint@10.3.0
npm/@xyflow/react@12.10.2
npm/@vitejs/plugin-react@5.2.0 ⏵ 6.0.1	⁺¹
npm/msw@2.14.5
npm/motion@12.38.0

View full report

codspeed-hq · 2026-05-10T00:55:15Z

Merging this PR will not alter performance

✅ 54 untouched benchmarks

_{Comparing renovate/lock-file-maintenance-lock-files (1c66b86) with main (59cf0b2)}

codecov · 2026-05-10T01:03:59Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.86%. Comparing base (59cf0b2) to head (1c66b86).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1853      +/-   ##
==========================================
+ Coverage   84.85%   84.86%   +0.01%     
==========================================
  Files        1801     1801              
  Lines      104993   104993              
  Branches     9206     9206              
==========================================
+ Hits        89087    89102      +15     
+ Misses      13668    13657      -11     
+ Partials     2238     2234       -4

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

## Highlights > _AI-generated summary (model: `openai/gpt-4.1-mini` via GitHub Models). Commit-based changelog below._ ### What you'll notice - Improved error logging and Prometheus instrumentation provide better system monitoring. - Eliminated race conditions in CI tagging for more reliable development releases. - Fixed critical configuration access and kill-switch bugs to enhance system stability. - Enhanced client experience with retry-after headers and better websocket reconnect behavior. ### What's new - Introduced composite indexes and cursor pagination for faster data queries. - Added server-sent events rate limiting and Ollama input sanitization for improved security. ### Under the hood - Centralized workflow error mappings to standardize error handling. - Refactored API lifecycle fallback to use a configuration snapshot for consistency. - Tightened startup settings baseline and reduced controller error baseline to zero. - Replaced flaky contributor-assistant GitHub action with a custom stable step. - Consolidated Renovate dependency groups to avoid update conflicts. - Upgraded in-toto-golang dependency to fix security vulnerabilities and dropped unnecessary CVE waivers. - Extensive lock file maintenance and multiple infrastructure and Python dependency updates.  :robot: I have created a release *beep* *boop* --- ## [0.8.2](v0.8.1...v0.8.2) (2026-05-10) ### Features * close audit gaps in error logging and Prometheus instrumentation ([#1821](#1821)) ([ef00fdc](ef00fdc)) ### Bug Fixes * **ci:** eliminate dev-release tag-vs-downstream race + CI hygiene audit ([#1827](#1827)) ([b7b9a59](b7b9a59)) * **config:** close 6 settings reachability + kill-switch gaps ([#1798](#1798)) ([410cb3b](410cb3b)) * correctness / safety fixes from 2026-05-05 audit (Wave 28) ([#1823](#1823)) ([d01e624](d01e624)) ### Performance * composite indexes + cursor pagination + clock seam + SSE rate-limit + Ollama sanitization + retry-after web client + WS reconnect jitter ([#1822](#1822)) ([d1faf86](d1faf86)) ### Refactoring * **api:** move activities lifecycle-cap fallback to ApiBridgeConfig snapshot ([#1840](#1840)) ([7a56e9c](7a56e9c)) * centralise workflow error mapping and shared error codes ([#1778](#1778) sub-tasks A + E) ([#1843](#1843)) ([11132cd](11132cd)) * drive controller-error baseline to zero ([#1778](#1778) sub-task A tail) ([#1846](#1846)) ([e96ae20](e96ae20)) * slim CLAUDE.md, port pr-review-toolkit agents, sync .opencode parity ([#1833](#1833)) ([e6372b8](e6372b8)) * tighten settings → startup-trace baseline (8 → 0) ([#1847](#1847)) ([3376ee2](3376ee2)) ### Documentation * fix CLAUDE.md inaccuracies and drop drift-prone counts ([#1844](#1844)) ([371925f](371925f)) ### Tests * replace test placeholders with real subsystem wiring ([#1845](#1845)) ([ddbb666](ddbb666)) ### CI/CD * **cla:** replace flaky contributor-assistant action with custom read-path step ([#1819](#1819)) ([11aeafe](11aeafe)) * tidy dev-release notes + stagger renovate lockfile day ([#1824](#1824)) ([ec746a9](ec746a9)) ### Maintenance * cleanup roundup, sub-tasks a/c/d/g/h/j/l/m of [#1781](#1781) ([#1838](#1838)) ([099b871](099b871)) * close remaining 5 sub-tasks of [#1781](#1781) (b/e/f/i/k) ([#1852](#1852)) ([59cf0b2](59cf0b2)) * collapse Renovate dep groups into Python / Web / Infrastructure to remove cross-PR overlap ([#1813](#1813)) ([4cbd857](4cbd857)) * **deps,security:** bump in-toto-golang v0.11.0 + drop two patched CVE waivers ([#1851](#1851)) ([0b8b5bb](0b8b5bb)) * disable Renovate vulnerabilityAlerts so security flows into normal updates ([#1834](#1834)) ([6b7d15f](6b7d15f)) * Lock file maintenance ([#1820](#1820)) ([ccbad73](ccbad73)) * Lock file maintenance ([#1842](#1842)) ([13b68a5](13b68a5)) * Lock file maintenance ([#1853](#1853)) ([db6650b](db6650b)) * Update dhi.io/nats:2.14-debian13 Docker digest to eb768bf ([#1841](#1841)) ([37f84fc](37f84fc)) * Update Infrastructure dependencies ([#1815](#1815)) ([75b12fe](75b12fe)) * Update Infrastructure dependencies ([#1831](#1831)) ([3f3c50b](3f3c50b)) * Update Python dependencies ([#1817](#1817)) ([e11332f](e11332f)) * Update Python dependencies ([#1832](#1832)) ([4515c8e](4515c8e)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). --------- Co-authored-by: synthorg-repo-bot[bot] <279117679+synthorg-repo-bot[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

chore: Lock file maintenance

1c66b86

renovate Bot added dependencies Pull requests that update a dependency file type:chore Maintenance, cleanup, dependency updates labels May 10, 2026

renovate Bot requested a review from Aureliolo as a code owner May 10, 2026 00:52

renovate Bot added type:chore Maintenance, cleanup, dependency updates dependencies Pull requests that update a dependency file labels May 10, 2026

renovate Bot temporarily deployed to atlas May 10, 2026 00:53 Inactive

renovate Bot temporarily deployed to cloudflare-preview May 10, 2026 00:54 Inactive

Aureliolo approved these changes May 10, 2026

View reviewed changes

Aureliolo merged commit db6650b into main May 10, 2026
80 of 81 checks passed

Aureliolo deleted the renovate/lock-file-maintenance-lock-files branch May 10, 2026 07:14

Aureliolo temporarily deployed to cloudflare-preview May 10, 2026 07:14 — with GitHub Actions Inactive

synthorg-repo-bot Bot mentioned this pull request May 9, 2026

chore(main): release 0.8.2 #1814

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: Lock file maintenance#1853

chore: Lock file maintenance#1853
Aureliolo merged 1 commit into
mainfrom
renovate/lock-file-maintenance-lock-files

renovate Bot commented May 10, 2026

Uh oh!

github-actions Bot commented May 10, 2026

Uh oh!

socket-security Bot commented May 10, 2026

Uh oh!

codspeed-hq Bot commented May 10, 2026 •

edited

Loading

Uh oh!

codecov Bot commented May 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented May 10, 2026

Configuration

Uh oh!

github-actions Bot commented May 10, 2026

Dependency Review

License Issues

site/package-lock.json

uv.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

socket-security Bot commented May 10, 2026

Uh oh!

codspeed-hq Bot commented May 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

codecov Bot commented May 10, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

codspeed-hq Bot commented May 10, 2026 •

edited

Loading