chore: batch dependabot dependency updates (2026-07-14)

[corrin]

Bundles the open dependabot updates into one branch ahead of a hard test pass. Backend updates applied via poetry (the source of truth) with requirements.txt regenerated from poetry.lock; frontend via npm. Raw dependabot branches were not merged — their pip PRs only edit the generated requirements.txt and would fail the check_requirements.sh gate. This matches the prior batch (#435).

pip (poetry.lock + requirements.txt)

package	from	to	PR
cryptography	47.0.0	49.0.0	#451
django	6.0.4	6.0.7	#451
msgpack	1.1.2	1.2.1	#451
pydantic-settings	2.14.0	2.14.2	#451
pyjwt	2.12.1	2.13.0	#451
pypdf	6.10.2	6.14.2	#451
python-multipart	0.0.27	0.0.32	#451
starlette	1.2.1	1.3.1	#451, #449
pyproject-api	1.10.0	1.10.1	#450
mistralai	2.4.9	2.6.0	#448
cachetools	7.1.1	7.1.4	#442
pylint	4.0.5	4.0.6	(to try to unblock astroid)
pylint-django	2.7.0	2.8.0	(pulled with pylint)

Some versions land newer than the dependabot targets because poetry resolved the latest compatible release. pyproject.toml needed no constraint changes.

npm (frontend/package.json + frontend/package-lock.json)

package	from	to	PR
eslint	10.4.0	10.7.0	#447
@typescript-eslint/parser	8.59.4	8.63.0	#443
@tailwindcss/vite	4.3.1	4.3.2	#445
lucide-vue-next	0.513.0	1.0.0	#446

lucide-vue-next 1.0.0 is a major bump — verified npm run type-check and npm run build both pass with no icon-import changes needed across the 145 files that use it.

Excluded

• astroid 4.1.2 (chore(deps): bump astroid from 4.0.4 to 4.1.2 #444) — upstream-blocked. Every released pylint (incl. 4.0.6) caps astroid <4.1.dev0, so poetry cannot resolve it. Bumping pylint didn't help. Leave chore(deps): bump astroid from 4.0.4 to 4.1.2 #444 open until pylint ships astroid-4.1 support.

Follow-up (not in this PR)

• lucide-vue-next@1.0.0 self-deprecates in favor of @lucide/vue. Worth a migration ticket later; 1.0.0 works fine.

Merging this closes the corresponding dependabot PRs. #444 stays open.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated frontend and backend dependency versions.
  • Upgraded security, framework, tooling, validation, and document-processing packages.
  • Refined platform compatibility settings for a dependency.

[coderabbitai]

📝 Walkthrough

Walkthrough

Dependency pins are updated in frontend/package.json and requirements.txt, including frontend tooling, Python frameworks, runtime libraries, and development utilities. The cffi environment marker conditions are also modified.

Changes

Dependency refresh

Layer / File(s)	Summary
Frontend dependency updates frontend/package.json	Updates Tailwind Vite, Lucide Vue, TypeScript ESLint parser, and ESLint versions.
Python dependency updates requirements.txt	Updates runtime, framework, API, tooling, and document-processing packages, and changes cffi environment markers.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: dependabot[bot]

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers the dependency batch but omits the required Jira work item and checklist sections from the template.	Add a Related Jira Work Item section with the KAN-123 key and include the template checklist sections, even if briefly completed.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: a batch of Dependabot dependency updates.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-batch-2026-07-14

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

frontend/package.json (1)

59-59: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Migrate the Vue package name with the v1 upgrade.

Lucide v1 moved the Vue package from lucide-vue-next to @lucide/vue; frontend/src/components/AIProvidersDialog.vue still imports from the deprecated package. The current build may pass, but this leaves the application on the inactive compatibility package and blocks the supported package path. (lucide.dev)

Proposed package change

-    "lucide-vue-next": "^1.0.0",
+    "`@lucide/vue`": "^1.0.0",

Update imports from lucide-vue-next to @lucide/vue in the frontend sources.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@frontend/package.json` at line 59, Update the lucide dependency entry and
imports used by AIProvidersDialog.vue and any other frontend sources from
lucide-vue-next to `@lucide/vue`, preserving the existing icon usage and
v1-compatible package path.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@frontend/package.json`:
- Line 59: Update the lucide dependency entry and imports used by
AIProvidersDialog.vue and any other frontend sources from lucide-vue-next to
`@lucide/vue`, preserving the existing icon usage and v1-compatible package path.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: a6a45b73-56ce-4696-9a0b-e278b19ad228

📥 Commits

Reviewing files that changed from the base of the PR and between 25a42ba and f2b63d5.

⛔ Files ignored due to path filters (2)

• frontend/package-lock.json is excluded by !**/package-lock.json
• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (2)

• frontend/package.json
• requirements.txt