Skip to content

chore(deps): batch dependency updates + Vite 8 upgrade#74

Merged
scarson merged 15 commits into
mainfrom
dev
Apr 6, 2026
Merged

chore(deps): batch dependency updates + Vite 8 upgrade#74
scarson merged 15 commits into
mainfrom
dev

Conversation

@scarson
Copy link
Copy Markdown
Owner

@scarson scarson commented Apr 5, 2026

Summary

Batch merge of 14 Dependabot PRs plus one cleanup commit:

Security fixes (3):

Go backend (4):

  • huma/v2 2.37.2→2.37.3 — bugfixes (500 on marshal failure, float validation)
  • genai 1.50.0→1.52.0 — additive features behind LLMClient interface
  • lib/pq 1.11.2→1.12.0 — SSL fixes, new features (opt-in)
  • pgx/v5 5.8.0→5.9.1 — perf optimizations, DoS fixes, goroutine leak fix

CI (1):

  • actions/setup-go 6.3.0→6.4.0 — new optional input, internal dep bump

Frontend (7):

  • @tailwindcss/vite 4.2.1→4.2.2 — crash fixes + Vite 8 compat
  • yaml 2.8.2→2.8.3 — patch bugfix
  • vue-router 5.0.3→5.0.4 — patch bugfix
  • eslint 10.0.3→10.1.0 — minor feature (dev dep)
  • @vitest/eslint-plugin 1.6.12→1.6.13 — patch (dev dep)
  • vite 7.3.1→8.0.1 — major upgrade (Rolldown bundler, ~4.5x faster builds)
  • Removed vite-plugin-vue-devtools (no Vite 8 support yet; No Vite 8 Support vuejs/devtools#1071)

Test plan

  • Full Go test suite: 37 packages, all passing
  • Frontend build: Vite 8.0.3, built in 791ms (was 3.55s)
  • Frontend unit tests: 32 files, 419 tests passing
  • Frontend lint: 0 warnings, 0 errors
  • Frontend type-check: clean

🤖 Generated with Claude Code

dependabot Bot and others added 15 commits April 5, 2026 17:31
@dependabot @scarson
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#71
58fd889 
)

Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases)
- [Commits](go-jose/go-jose@v4.1.3...v4.1.4)

---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
  dependency-version: 4.1.4
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @scarson
chore(deps): bump defu from 6.1.4 to 6.1.6 in /web (#72)
01846f1 
Bumps [defu](https://github.com/unjs/defu) from 6.1.4 to 6.1.6.
- [Release notes](https://github.com/unjs/defu/releases)
- [Changelog](https://github.com/unjs/defu/blob/main/CHANGELOG.md)
- [Commits](unjs/defu@v6.1.4...v6.1.6)

---
updated-dependencies:
- dependency-name: defu
  dependency-version: 6.1.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @scarson
chore(deps): bump picomatch in /web (#66)
0b9e46e 
Bumps  and [picomatch](https://github.com/micromatch/picomatch). These dependencies needed to be updated together.

Updates `picomatch` from 4.0.3 to 4.0.4
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

Updates `picomatch` from 2.3.1 to 2.3.2
- [Release notes](https://github.com/micromatch/picomatch/releases)
- [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md)
- [Commits](micromatch/picomatch@4.0.3...4.0.4)

---
updated-dependencies:
- dependency-name: picomatch
  dependency-version: 4.0.4
  dependency-type: indirect
- dependency-name: picomatch
  dependency-version: 2.3.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/danielgtaylor/huma/v2 from 2.37.2 to 2.3…
10ec597 
…7.3 (#69)

Bumps [github.com/danielgtaylor/huma/v2](https://github.com/danielgtaylor/huma) from 2.37.2 to 2.37.3.
- [Release notes](https://github.com/danielgtaylor/huma/releases)
- [Commits](danielgtaylor/huma@v2.37.2...v2.37.3)

---
updated-dependencies:
- dependency-name: github.com/danielgtaylor/huma/v2
  dependency-version: 2.37.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump google.golang.org/genai from 1.50.0 to 1.52.0 (#70)
efcbd6b 
Bumps [google.golang.org/genai](https://github.com/googleapis/go-genai) from 1.50.0 to 1.52.0.
- [Release notes](https://github.com/googleapis/go-genai/releases)
- [Changelog](https://github.com/googleapis/go-genai/blob/v1.52.0/CHANGELOG.md)
- [Commits](googleapis/go-genai@v1.50.0...v1.52.0)

---
updated-dependencies:
- dependency-name: google.golang.org/genai
  dependency-version: 1.52.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/lib/pq from 1.11.2 to 1.12.0 (#60)
b0cbca4 
Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.11.2 to 1.12.0.
- [Release notes](https://github.com/lib/pq/releases)
- [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md)
- [Commits](lib/pq@v1.11.2...v1.12.0)

---
updated-dependencies:
- dependency-name: github.com/lib/pq
  dependency-version: 1.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump actions/setup-go from 6.3.0 to 6.4.0 (#68)
52fda94 
Bumps [actions/setup-go](https://github.com/actions/setup-go) from 6.3.0 to 6.4.0.
- [Release notes](https://github.com/actions/setup-go/releases)
- [Commits](actions/setup-go@4b73464...4a36011)

---
updated-dependencies:
- dependency-name: actions/setup-go
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump @tailwindcss/vite from 4.2.1 to 4.2.2 in /web (#65)
96c199e 
Bumps [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/tailwindlabs/tailwindcss/releases)
- [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.2.2/packages/@tailwindcss-vite)

---
updated-dependencies:
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @scarson
chore(deps): bump yaml from 2.8.2 to 2.8.3 in /web (#67)
62a7ecc 
Bumps [yaml](https://github.com/eemeli/yaml) from 2.8.2 to 2.8.3.
- [Release notes](https://github.com/eemeli/yaml/releases)
- [Commits](eemeli/yaml@v2.8.2...v2.8.3)

---
updated-dependencies:
- dependency-name: yaml
  dependency-version: 2.8.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Sam Carson <samuel.carson@gmail.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump vue-router from 5.0.3 to 5.0.4 in /web (#63)
7995dcf 
Bumps [vue-router](https://github.com/vuejs/router) from 5.0.3 to 5.0.4.
- [Release notes](https://github.com/vuejs/router/releases)
- [Commits](vuejs/router@v5.0.3...v5.0.4)

---
updated-dependencies:
- dependency-name: vue-router
  dependency-version: 5.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps-dev): bump eslint from 10.0.3 to 10.1.0 in /web (#64)
403257e 
Bumps [eslint](https://github.com/eslint/eslint) from 10.0.3 to 10.1.0.
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.0.3...v10.1.0)

---
updated-dependencies:
- dependency-name: eslint
  dependency-version: 10.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps-dev): bump @vitest/eslint-plugin in /web (#62)
abc07e3 
Bumps [@vitest/eslint-plugin](https://github.com/vitest-dev/eslint-plugin-vitest) from 1.6.12 to 1.6.13.
- [Release notes](https://github.com/vitest-dev/eslint-plugin-vitest/releases)
- [Commits](vitest-dev/eslint-plugin-vitest@v1.6.12...v1.6.13)

---
updated-dependencies:
- dependency-name: "@vitest/eslint-plugin"
  dependency-version: 1.6.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.1 (#59)
c7611ca 
Bumps [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) from 5.8.0 to 5.9.1.
- [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md)
- [Commits](jackc/pgx@v5.8.0...v5.9.1)

---
updated-dependencies:
- dependency-name: github.com/jackc/pgx/v5
  dependency-version: 5.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot
chore(deps-dev): bump vite from 7.3.1 to 8.0.1 in /web (#61)
1bab411 
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.3.1 to 8.0.1.
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.0.1/packages/vite)

---
updated-dependencies:
- dependency-name: vite
  dependency-version: 8.0.1
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@scarson @claude
chore(deps): remove vite-plugin-vue-devtools (no Vite 8 support)
b6eb60d 
The plugin's transitive dep vite-plugin-inspect doesn't support Vite 8
yet (vuejs/devtools#1071). It was installed but never registered in
vite.config.ts. The Vue DevTools browser extension provides equivalent
functionality. Re-add when upstream updates the peer dep range.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@scarson scarson merged commit d3a621b into main Apr 6, 2026
14 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@scarson