chore(deps): batch Dependabot updates (2026-07-21)

[corrin]

Batched Dependabot updates onto one branch for a single E2E pass.

Applied (8)

PR	Update	Notes
#473	js-cookie 3.0.7 → 3.0.8	in-range
#475	@vitejs/plugin-vue 6.0.7 → 6.0.8	in-range
#471	@vue/eslint-config-typescript 14.7.0 → 14.9.0	in-range
#472	rrweb-player 1.0.0-alpha.4 → 2.1.0	major; type-check + build green
#479	adm-zip 0.5.17 → 0.6.0	lockfile
#477	requests 2.33.1 → 2.34.2	in-range
#476	holidays 0.98 → 0.100	widened pyproject constraint <0.99 → <0.101
#470	actions/setup-node 6 → 7	CI only

requirements.txt regenerated from poetry.lock via scripts/generate_requirements.sh (codesight check passes).

Already satisfied

• chore(deps): bump mcp from 1.27.0 to 1.28.1 in the pip group across 1 directory #467 (mcp 1.27.0 → 1.28.1): poetry.lock already at 1.28.1 — safe to close, nothing to apply.

Dropped — upstream-blocked, keep open

• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 in /frontend #474 typescript 6.0.3 → 7.0.2: typescript-eslint has no TS7 release (latest 8.65.0 still pins typescript <6.1.0); vue-tsc calls TS's removed ./lib/tsc export. Adopting TS7 would mean removing type-aware ESLint, not migrating it.
• chore(deps): bump protobuf from 5.29.6 to 7.35.1 #478 protobuf 5.29.6 → 7.35.1: google-ai-generativelanguage 0.6.15 and grpcio-status 1.71.2 pin protobuf <6.0; poetry cannot resolve ≥6.
• chore(deps): bump astroid from 4.0.4 to 4.1.2 #444 astroid 4.0.4 → 4.1.2: every released pylint pins astroid <=4.1.dev0 (unchanged from the prior batch note).

Validation

• Frontend type-check + build: green.
• Pre-commit/pre-push hooks (mypy, lint, schema/client regen, codesight): green.
• Full E2E: passed ✅ (local run against live services).

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 17b118f8-0d23-4ee1-b547-4179e7d6e9e3

📥 Commits

Reviewing files that changed from the base of the PR and between c703b09 and 58910cc.

⛔ Files ignored due to path filters (2)

• frontend/package-lock.json is excluded by !**/package-lock.json
• poetry.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/ci.yml
• frontend/package.json
• pyproject.toml
• requirements.txt

---

📝 Walkthrough

Walkthrough

CI now uses actions/setup-node@v7, while frontend and Python dependency versions and environment constraints are updated.

Changes

Toolchain and dependency refresh

Layer / File(s)	Summary
CI Node setup updates .github/workflows/ci.yml	Five Node setup steps were upgraded from actions/setup-node@v6 to @v7.
Frontend dependency updates frontend/package.json	Runtime and development dependencies were bumped, including rrweb-player, js-cookie, and Vue tooling.
Python dependency constraints pyproject.toml, requirements.txt	holidays, requests, and related environment markers and Python-version bounds were updated.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• corrin/docketworks#454: Updates overlapping dependency-management surfaces, including requirements.txt environment markers and frontend dependencies.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The body describes the dependency batch, but it omits the required Jira key and the template sections.	Add the required template headings, include a valid Jira key (e.g. KAN-123), and format the changes and checklist sections explicitly.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the batch dependency update and matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependabot-batch-2026-07-21

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}