Skip to content

chore(deps): bump node from 435f353 to e49fd70 in /data-management/viewer/frontend#560

Merged
bindsi merged 1 commit into
mainfrom
dependabot/docker/data-management/viewer/frontend/node-e49fd70
Apr 28, 2026
Merged

chore(deps): bump node from 435f353 to e49fd70 in /data-management/viewer/frontend#560
bindsi merged 1 commit into
mainfrom
dependabot/docker/data-management/viewer/frontend/node-e49fd70

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 27, 2026

Bumps node from 435f353 to e49fd70.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 27, 2026

Labels

The following labels could not be found: docker. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@dependabot dependabot Bot added the dependencies Dependency version updates label Apr 27, 2026
@dependabot dependabot Bot requested a review from a team as a code owner April 27, 2026 03:30
@github-actions github-actions Bot changed the title chore(deps): bump node from 435f353 to e49fd70 in /data-management/viewer/frontend security(deps): bump node from 435f353 to e49fd70 in /data-management/viewer/frontend Apr 27, 2026
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 79bf52d.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026

AW Dependabot PR Review completed successfully!

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.56%. Comparing base (fe06b52) to head (79bf52d).

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #560      +/-   ##
==========================================
+ Coverage   63.91%   66.56%   +2.65%     
==========================================
  Files         250      262      +12     
  Lines       15409    16639    +1230     
  Branches     2163     2301     +138     
==========================================
+ Hits         9848    11076    +1228     
  Misses       5274     5274              
- Partials      287      289       +2     
Flag Coverage Δ *Carryforward flag
pester 83.13% <ø> (ø) Carriedforward from fe06b52
pytest-data-pipeline 100.00% <ø> (ø) Carriedforward from fe06b52
pytest-dataviewer 65.12% <ø> (ø) Carriedforward from fe06b52
pytest-dm-tools 100.00% <ø> (ø) Carriedforward from fe06b52
pytest-evaluation 99.83% <ø> (?)
pytest-fuzz 4.97% <ø> (ø) Carriedforward from fe06b52
pytest-inference 0.00% <ø> (ø) Carriedforward from fe06b52
pytest-training 82.14% <ø> (ø) Carriedforward from fe06b52
vitest 51.08% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.
see 12 files with indirect coverage changes

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Maintainer review recommended

Advisory Review Summary

Ecosystems / surfaces touched:

  • dockerdataviewer-frontend (data-management/viewer/frontend/Dockerfile)
Package From To Severity Surface
node (Docker) 25.9.0-slim@sha256:435f353... 25.9.0-slim@sha256:e49fd70... Unknown (no linked CVE/GHSA) docker / dataviewer-frontend

node (Docker)

Advisory summary: No explicit CVE or GHSA identifiers are present in the PR body. Dependabot classified this PR as security(deps):, indicating the updated digest contains upstream OS-layer security patches relative to the previous digest (435f3537...). Because no advisory record was linked, no severity or CWE can be cited without fabrication.

Release notes / changelog: Not resolvable from the PR body. The upstream change log for Docker Official Images node is maintained at github.com/docker-library/official-images — node. Checking commits dated around 2026-04-27 for the 25.9.0-slim entry will identify the patched Debian packages.

Repo-specific risk notes:

  • Digest drift without changelog — this is the sole high-risk trigger that fires. The Node.js tag (25.9.0-slim) does not change; only the base-OS package layer is updated. No ABI, API, or Node.js runtime changes are expected.
  • This image is not a CUDA / NVIDIA / Isaac Sim image, so GPU-ABI sensitivity does not apply.
  • The updated digest is a properly pinned SHA-256 reference (e49fd70491eb...), satisfying the SHA-pin requirement.
  • No transitive lockfile-only change; the only modified file is data-management/viewer/frontend/Dockerfile.

Validation advice: Run docker build data-management/viewer/frontend in CI or locally and smoke-test the frontend build step to confirm no unexpected package-level regression. Optionally use Docker Scout on the new digest to surface the resolved CVEs.


Advisory verdict: COMMENT — the security(deps): title indicates a real security patch, but no CVE/GHSA record is linked in the PR body, and the "digest drift without changelog" high-risk trigger fires for the docker surface. Maintainer confirmation that the new digest is intentional and validated is recommended before merging.

Generated by AW Dependabot PR Review for issue #560 · ● 193.1K

Comment thread data-management/viewer/frontend/Dockerfile
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 27, 2026

AW Dependabot PR Review completed successfully!

Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Maintainer review recommended

Advisory Review Summary

Surfaces touched: dataviewer-frontend (Docker base image, data-management/viewer/frontend/)

Package From To Severity Surface
node (Docker) 25.9.0-slim@sha256:435f353... 25.9.0-slim@sha256:e49fd70... Unknown (no GHSA/CVE listed) dataviewer-frontend

node (Docker base image)

Advisory summary:
No explicit CVE or GHSA identifiers are present in the PR body. The PR prefix security(deps): indicates Dependabot detected a security-relevant change in the new digest. The existing dependency-review workflow reported "No vulnerabilities or license issues found," though it also noted a snapshot warning ("No snapshots found for head SHA c273f12"), which means that result may be incomplete.

External changelog sources (Docker Hub API, GitHub releases) were inaccessible from this review environment, so the specific OS-level patches included in digest e49fd70... could not be enumerated. No advisory source URL can be cited for this bump.

Release-notes highlights:
Not retrievable — Docker Hub and registry APIs blocked by network firewall during this review run.

Repo-specific risk notes:

  • Digest drift without changelog (high-risk trigger): Same image tag (node:25.9.0-slim), new digest. This pattern is consistent with a Debian base OS security re-spin (e.g., OpenSSL, glibc, or apt-managed package patches). Changelog remains unconfirmed.
  • No CUDA / ABI sensitivity: node:25.9.0-slim is a standard Debian-slim Node.js image with no GPU or Isaac Sim dependencies. No ABI compatibility concerns apply.
  • Build-stage only: This image is used only in the AS build stage. The final served image is nginx:1.29-alpine (unchanged), so the node digest affects the build environment, not the runtime artifact.
  • Validation: Run docker build data-management/viewer/frontend/ and confirm npm ci and npm run build succeed against the new base. The npm run validate step in data-management/viewer/frontend is the recommended validation path per the surface rubric.

Uncovered-manifest note:
None detected in this PR.


Advisory verdict: COMMENT — Digest drift without an accessible changelog triggers the high-risk flag per the Docker surface rubric; the image itself carries no CUDA/ABI risk, but changelog verification is recommended before merge.

Generated by AW Dependabot PR Review for issue #560 · ● 329.6K

Comment thread data-management/viewer/frontend/Dockerfile
@katriendg
Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Apr 28, 2026

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 28, 2026

AW Dependabot PR Review completed successfully!

@katriendg
Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot dependabot Bot changed the title security(deps): bump node from 435f353 to e49fd70 in /data-management/viewer/frontend chore(deps): bump node from 435f353 to e49fd70 in /data-management/viewer/frontend Apr 28, 2026
@dependabot dependabot Bot force-pushed the dependabot/docker/data-management/viewer/frontend/node-e49fd70 branch from 8abab26 to 90b3277 Compare April 28, 2026 07:50
katriendg added a commit that referenced this pull request Apr 28, 2026
…rkflow_run trigger (#584)

## Description

The **AW Dependabot PR Review** workflow stopped firing for every
Dependabot PR after PR #580 introduced the `pull_request` →
`workflow_run` trigger migration. The `branches:` filter was set to
`main`, but for `workflow_run` events GitHub matches that filter against
the *triggering run's `head_branch`*, not its base. *PR Validation*
always runs on the PR's head branch (for example
`dependabot/docker/data-management/viewer/frontend/node-e49fd70`), so
`main` never matched and the reviewer never triggered.

This PR scopes the trigger to all Dependabot head branches by replacing
the filter with a `dependabot/**` glob. The existing `resolve-pr` step
still gates downstream on `pr.user.login === 'dependabot[bot]'`, so the
broader trigger surface stays gated.

Fixes #583

## Type of Change

- [x] 🐛 Bug fix (non-breaking change fixing an issue)
- [ ] ✨ New feature (non-breaking change adding functionality)
- [ ] 💥 Breaking change (fix or feature causing existing functionality
to change)
- [ ] 📚 Documentation update
- [ ] 🏗️ Infrastructure change (Terraform/IaC)
- [ ] ♻️ Refactoring (no functional changes)

## Component(s) Affected

- [ ] `infrastructure/terraform/prerequisites/` - Azure subscription
setup
- [ ] `infrastructure/terraform/` - Terraform infrastructure
- [ ] `infrastructure/setup/` - OSMO control plane / Helm
- [ ] `workflows/` - Training and evaluation workflows
- [ ] `training/` - Training pipelines and scripts
- [ ] `docs/` - Documentation

## Changes

- Replaced **`branches: [main]`** with **`branches: ["dependabot/**"]`**
on the `workflow_run` trigger in
*.github/workflows/aw-dependabot-pr-review.md*.
- Recompiled *.github/workflows/aw-dependabot-pr-review.lock.yml* via
`gh aw compile` (frontmatter hash and prompt heredoc markers updated; no
semantic changes outside the trigger filter).

## Testing Performed

- [ ] Terraform `plan` reviewed (no unexpected changes)
- [ ] Terraform `apply` tested in dev environment
- [ ] Training scripts tested locally with Isaac Sim
- [ ] OSMO workflow submitted successfully
- [ ] Smoke tests passed (`smoke_test_azure.py`)

Validated locally:

- `gh aw compile aw-dependabot-pr-review` → 0 errors, 0 warnings.
- `npm run lint:yaml` → actionlint found 0 issues.

End-to-end verification requires merging and observing the next
Dependabot PR's *PR Validation* completion trigger an
`aw-dependabot-pr-review` `workflow_run` event.

## Documentation Impact

- [x] No documentation changes needed
- [ ] Documentation updated in this PR
- [ ] Documentation issue filed

## Bug Fix Checklist

- [x] Linked to issue being fixed
- [ ] Regression test included, OR
- [x] Justification for no regression test: trigger semantics live in
workflow YAML and are not exercisable from repo-local test harnesses;
verification is observational against the next Dependabot PR.

## Checklist

- [x] My code follows the [project conventions](copilot-instructions.md)
- [x] Commit messages follow [conventional commit
format](instructions/commit-message.instructions.md)
- [x] I have performed a self-review
- [x] Documentation impact assessed above
- [x] No new linting warnings introduced

## Follow-up Tasks

- After merge, push an empty commit (or rebase) on existing open
Dependabot PRs such as #560 to re-run *PR Validation* and trigger the
reviewer for backlog coverage.
@katriendg
Copy link
Copy Markdown
Collaborator

@dependabot rebase

Bumps node from `435f353` to `e49fd70`.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 25.9.0-slim
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/docker/data-management/viewer/frontend/node-e49fd70 branch from 90b3277 to 79bf52d Compare April 28, 2026 09:27
@bindsi bindsi merged commit 2884649 into main Apr 28, 2026
39 checks passed
@bindsi bindsi deleted the dependabot/docker/data-management/viewer/frontend/node-e49fd70 branch April 28, 2026 09:33
WilliamBerryiii pushed a commit that referenced this pull request May 8, 2026
🤖 I have created a release *beep* *boop*
---


##
[0.8.0](v0.7.4...v0.8.0)
(2026-05-08)


### ⚠ BREAKING CHANGES

* **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4,
MSAL 5, ESLint 10
([#524](#524))

### ✨ Features

* **agents:** add automated validation for high-risk Dependabot bumps
([#574](#574))
([8c3686a](8c3686a)),
closes
[#573](#573)
* **data:** add camera selector to annotation workspace and fix AV1
frame extraction
([#591](#591))
([c809d2f](c809d2f))
* **data:** seed dataviewer frontend test foundation and per-section
codecov flags
([#594](#594))
([c06c4e3](c06c4e3))
* **dataviewer:** add OWASP security middleware stack
([#439](#439))
([239edb9](239edb9))
* **infrastructure:** add conversion pipeline Terraform module
([#542](#542))
([244531e](244531e))
* **infrastructure:** upgrade OSMO to chart 1.2.1 / image 6.2 with
secure auth and skrl 2.0.0 compatibility
([#492](#492))
([edfd7a5](edfd7a5))
* **pipeline:** add ACSA setup for ROS2 bag sync to Blob
([#451](#451))
([c271a54](c271a54))
* **workflows:** add advisory Dependabot PR reviewer agentic workflow
([#498](#498))
([d4bb140](d4bb140))
* **workflows:** trigger AW Dependabot PR reviewer after PR Validation
([#580](#580))
([7ab3d16](7ab3d16))


### 🐛 Bug Fixes

* **ci:** correct stale version comment for
actions/create-github-app-token
([#506](#506))
([b2e9a54](b2e9a54))
* **ci:** restore data-pipeline and training broken tests by domain
folder restructure
([#547](#547))
([06d8472](06d8472))
* **docs:** update remaining stale 'Coming soon' labels in
docs/README.md
([#507](#507))
([02439d6](02439d6))
* **docs:** update stale coming soon label for Training section
([#472](#472))
([46db49b](46db49b))
* **evaluation:** scope SIL AzureML validation code path and script
reference
([#387](#387))
([9f138a9](9f138a9))
* **infrastructure:** OSMO workflow execution, PostgreSQL public access,
and quickstart corrections
([#477](#477))
([9ed2da6](9ed2da6))
* **scripts:** exclude CHANGELOG.md from changed-files msdate check
([#644](#644))
([8133bdc](8133bdc))
* **workflows:** allow dependabot[bot] to activate AW Dependabot PR
Review
([#586](#586))
([39dc022](39dc022))
* **workflows:** correct branches filter on AW Dependabot PR Review
workflow_run trigger
([#584](#584))
([fe06b52](fe06b52))
* **workflows:** normalize validate.yaml placeholder env/compute values
([#510](#510))
([340ff44](340ff44))
* **workflows:** recompile aw-dependabot-pr-review lock file
([#576](#576))
([d77c167](d77c167))
* **workflows:** switch AW Dependabot PR Review to pull_request_target
([#589](#589))
([3f1edd1](3f1edd1))


### 📚 Documentation

* **docs:** Fix deployment guide links
([#614](#614))
([0070b04](0070b04))
* document dependency-pinning-artifacts directory purpose
([#508](#508))
([50e0010](50e0010))


### 📦 Build System

* **training:** standardize on Python 3.12 across manifests, containers,
and runtime scripts
([#541](#541))
([7ad014a](7ad014a))


### 🔧 Operations

* **build:** add Copilot cloud agent setup-steps workflow
([#593](#593))
([c912668](c912668))


### 🔧 Miscellaneous

* **build:** exclude auto-generated CHANGELOG.md from cspell and seed
dictionary
([#582](#582))
([de1dd57](de1dd57))
* **build:** redesign codecov flags and split pytest CI per component
([#520](#520))
([357e745](357e745))
* **dataviewer:** bump frontend stack to React 19, Vite 8, Tailwind v4,
MSAL 5, ESLint 10
([#524](#524))
([50f8ad4](50f8ad4))
* **dataviewer:** repoint stale src/dataviewer references to
data-management/viewer
([#504](#504))
([88fa1b4](88fa1b4)),
closes
[#503](#503)
* **deps-dev:** bump basic-ftp from 5.3.0 to 5.3.1
([#618](#618))
([ca10f2a](ca10f2a))
* **deps-dev:** bump globals from 15.15.0 to 17.5.0 in
/data-management/viewer/frontend
([#527](#527))
([0e0b2ae](0e0b2ae))
* **deps-dev:** bump ip-address from 10.1.0 to 10.2.0
([#616](#616))
([816c9cf](816c9cf))
* **deps-dev:** bump lint-staged from 16.4.0 to 17.0.2 in the
root-npm-dependencies group across 1 directory
([#626](#626))
([0e2f293](0e2f293))
* **deps-dev:** bump pydantic from 2.13.3 to 2.13.4 in the
python-dependencies group across 1 directory
([#629](#629))
([c24f1c1](c24f1c1))
* **deps-dev:** bump the python-dependencies group across 1 directory
with 2 updates
([#514](#514))
([8410f4b](8410f4b))
* **deps:** bump azure-core from 1.39.0 to 1.40.0 in /evaluation in the
inference-dependencies group across 1 directory
([#597](#597))
([6141db4](6141db4))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in
/data-management/viewer
([#424](#424))
([5fb6d58](5fb6d58))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in
/data-management/viewer/backend
([#423](#423))
([b516ad5](b516ad5))
* **deps:** bump lucide-react from 0.469.0 to 1.8.0 in
/data-management/viewer/frontend
([#528](#528))
([1bdfc1e](1bdfc1e))
* **deps:** bump nginx from `8aa63af` to `5616878` in
/data-management/viewer/frontend
([#511](#511))
([9e7e20e](9e7e20e))
* **deps:** bump nginx from 1.27-alpine to 1.29-alpine in
/data-management/viewer/frontend
([#484](#484))
([0e5c3dd](0e5c3dd))
* **deps:** bump node from `435f353` to `e49fd70` in
/data-management/viewer/frontend
([#560](#560))
([2884649](2884649))
* **deps:** bump react-is from 18.3.1 to 19.2.5 in
/data-management/viewer/frontend
([#530](#530))
([d51318c](d51318c))
* **deps:** bump tensordict from 0.11.0 to 0.12.1 in /evaluation in the
inference-dependencies group across 1 directory
([#456](#456))
([b24e733](b24e733))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 2 updates
([#531](#531))
([171a1da](171a1da))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 5 updates
([#516](#516))
([4f9a577](4f9a577))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 5 updates
([#602](#602))
([6c27ab5](6c27ab5))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 2 updates
([#529](#529))
([8646971](8646971))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 3 updates
([#601](#601))
([d28fb50](d28fb50))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 3 updates
([#632](#632))
([4ca5f3e](4ca5f3e))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 5 updates
([#515](#515))
([109ee81](109ee81))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 6 updates
([#630](#630))
([04d5dfd](04d5dfd))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 9 updates
([#563](#563))
([c08f450](c08f450))
* **deps:** bump the docusaurus-dependencies group across 1 directory
with 4 updates
([#627](#627))
([f5825fc](f5825fc))
* **deps:** bump the docusaurus-dependencies group across 1 directory
with 6 updates
([#599](#599))
([b859344](b859344))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#459](#459))
([2609c52](2609c52))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#517](#517))
([f54bf5d](f54bf5d))
* **deps:** bump the inference-dependencies group across 1 directory
with 11 updates
([#562](#562))
([087f53a](087f53a))
* **deps:** bump the inference-dependencies group across 1 directory
with 2 updates
([#628](#628))
([4a3be47](4a3be47))
* **deps:** bump the pip group across 2 directories with 1 update
([#494](#494))
([a14b6b0](a14b6b0))
* **docs:** update stale Python 3.11 references to 3.12
([#575](#575))
([6f85c95](6f85c95))
* **scripts:** remove redundant SC1091 disables in OSMO deploy scripts
([#509](#509))
([ae1cb82](ae1cb82))


### 🔒 Security

* **build:** pin dependencies and hash-verify downloads
([#465](#465))
([0289f49](0289f49))
* **build:** remediate dependency security advisories
([#479](#479))
([7196d6d](7196d6d))
* **deps-dev:** bump basic-ftp from 5.2.1 to 5.2.2
([#454](#454))
([cb158f1](cb158f1))
* **deps-dev:** bump basic-ftp from 5.2.2 to 5.3.0
([#495](#495))
([e983b8b](e983b8b))
* **deps-dev:** bump hypothesis from 6.152.3 to 6.152.4 in the
python-dependencies group
([#598](#598))
([83384d2](83384d2))
* **deps-dev:** bump markdownlint-cli2 from 0.22.0 to 0.22.1 in the
root-npm-dependencies group
([#559](#559))
([32bde35](32bde35))
* **deps-dev:** bump picomatch from 2.3.1 to 2.3.2 in /docs/docusaurus
([#455](#455))
([66f86ca](66f86ca))
* **deps-dev:** bump postcss from 8.5.10 to 8.5.12 in
/data-management/viewer/frontend
([#569](#569))
([a652dba](a652dba))
* **deps-dev:** bump the python-dependencies group with 2 updates
([#457](#457))
([749d231](749d231))
* **deps-dev:** bump the python-dependencies group with 2 updates
([#485](#485))
([71b44fd](71b44fd))
* **deps-dev:** bump the python-dependencies group with 3 updates
([#564](#564))
([9fc52fd](9fc52fd))
* **deps-dev:** bump typescript from 6.0.2 to 6.0.3 in /docs/docusaurus
in the docusaurus-dependencies group
([#513](#513))
([5694dbc](5694dbc))
* **deps:** bump azureml/openmpi4.1.0-ubuntu22.04 from 20260303.v5 to
20260409.v4 in /evaluation/sil/docker
([#480](#480))
([25d4df8](25d4df8))
* **deps:** bump cryptography from 46.0.6 to 46.0.7 in /evaluation in
the uv group across 1 directory
([#538](#538))
([92c5b2e](92c5b2e))
* **deps:** bump diffusers from 0.35.2 to 0.38.0 in /training/il/lerobot
([#638](#638))
([6261d19](6261d19))
* **deps:** bump follow-redirects from 1.15.11 to 1.16.0 in
/docs/docusaurus
([#469](#469))
([0458908](0458908))
* **deps:** bump gitpython and mako for lerobot IL training
([#623](#623))
([9f8022b](9f8022b))
* **deps:** bump node from 24.14.1-slim to 25.9.0-slim in
/data-management/viewer/frontend
([#482](#482))
([1532d09](1532d09))
* **deps:** bump packaging from 26.0 to 26.1 in /evaluation in the
inference-dependencies group
([#483](#483))
([f4afb6c](f4afb6c))
* **deps:** bump pillow from 12.1.1 to 12.2.0
([#467](#467))
([39fb663](39fb663))
* **deps:** bump python from 3.11-slim to 3.14-slim in
/data-management/viewer/backend
([#481](#481))
([7af9dfc](7af9dfc))
* **deps:** bump the dataviewer-backend-dependencies group across 1
directory with 15 updates
([#428](#428))
([e4446a2](e4446a2))
* **deps:** bump the dataviewer-backend-dependencies group in
/data-management/viewer/backend with 4 updates
([#487](#487))
([0f57c5b](0f57c5b))
* **deps:** bump the dataviewer-backend-dependencies group in
/data-management/viewer/backend with 8 updates
([#566](#566))
([d6e7869](d6e7869))
* **deps:** bump the dataviewer-dependencies group across 1 directory
with 5 updates
([#464](#464))
([24c208d](24c208d))
* **deps:** bump the dataviewer-dependencies group in
/data-management/viewer with 2 updates
([#486](#486))
([90149f3](90149f3))
* **deps:** bump the dataviewer-dependencies group in
/data-management/viewer with 6 updates
([#565](#565))
([f0bb36b](f0bb36b))
* **deps:** bump the dataviewer-frontend-patch-minor group across 1
directory with 10 updates
([#613](#613))
([e481f83](e481f83))
* **deps:** bump the github-actions group across 1 directory with 4
updates
([#534](#534))
([5478ab6](5478ab6))
* **deps:** bump the github-actions group with 2 updates
([#488](#488))
([4e6ce98](4e6ce98))
* **deps:** bump the github-actions group with 3 updates
([#567](#567))
([48c38dc](48c38dc))
* **deps:** bump the github-actions group with 3 updates
([#634](#634))
([00cfb49](00cfb49))
* **deps:** bump the github-actions group with 6 updates
([#603](#603))
([73eb79a](73eb79a))
* **deps:** bump the training-dependencies group across 1 directory with
23 updates
([#463](#463))
([d5a8656](d5a8656))
* **deps:** bump yaml from 2.8.2 to 2.8.3 in
/data-management/viewer/frontend
([#453](#453))
([10449df](10449df))
* pytest harness, dependabot advisories, and OSSF Scorecard remediations
([#501](#501))
([e8756e8](e8756e8))
* **scripts:** pin and hash-verify all shell script downloads
([#468](#468))
([0c2bb9c](0c2bb9c))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

---------

Co-authored-by: physical-ai-toolchain-release[bot] <267194360+physical-ai-toolchain-release[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency version updates

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants