Skip to content

deps bump - #98

Merged
HardMax71 merged 4 commits into
mainfrom
fix/bump-deps
Jan 24, 2026
Merged

deps bump#98
HardMax71 merged 4 commits into
mainfrom
fix/bump-deps

Conversation

@HardMax71

@HardMax71 HardMax71 commented Jan 24, 2026

Copy link
Copy Markdown
Owner

Updated deps


Summary by cubic

Updated backend, frontend, and CI dependencies to current stable versions to improve security and maintenance, with minor Beanie query typing cleanups and lower test pod CPU requests to improve e2e concurrency. No functional code changes; minor risk around the rate-limiting library upgrade.

  • Dependencies

    • CI: actions/checkout v6, anchore scan-action v7, upload-artifact v6, codeql upload-sarif v4, actions/cache v5.
    • Backend: cachetools 6.2.4, google-auth 2.47.0, oauthlib 3.3.1, mypy 1.19.1 (lock adds librt), limits 5.6.0.
    • Frontend: rollup 4.56.0, @sveltejs/vite-plugin-svelte 6.2.4, vitest 4.0.18, svelte 5.48.2, lodash 4.17.23, devalue 5.6.2, @hey-api/openapi-ts 0.90.4.
  • Migration

    • Verify rate limiter behavior after upgrading limits to 5.6.0 (run backend tests/smoke flows).
    • Do clean installs (uv sync, npm ci) and run build/tests to confirm toolchain updates.

Written for commit 94f34ab. Summary will update on new commits.

Summary by CodeRabbit

  • Chores

    • Updated CI workflows and caching actions to newer versions; improved SBOM and vulnerability report uploads.
    • Bumped backend and frontend dependency versions for security and tooling.
    • Reduced CPU request in the test environment.
  • Refactor

    • Made database query/filter construction more explicit and typed across data access layers.
  • Style

    • Added small type-check annotations to suppress linter warnings.

✏️ Tip: You can customize this high-level summary in your review settings.

@coderabbitai

coderabbitai Bot commented Jan 24, 2026

Copy link
Copy Markdown
📝 Walkthrough

Walkthrough

Updated CI workflow action versions and SBOM reporting input; bumped multiple backend and frontend dependency versions; converted several Beanie repository query filters to explicit operator predicates and added a few type annotations; lowered test K8s pod CPU request.

Changes

Cohort / File(s) Change Summary
GitHub Actions workflows
\.github/workflows/sbom-compliance.yml, \.github/workflows/stack-tests.yml
Upgraded action versions (checkout v4→v6, anchore scan-action v6→v7, upload-artifact v4→v6, upload-sarif v3→v4, cache v4→v5). Added category: ${{ matrix.component }}-dependencies to vulnerability report upload.
Backend dependency manifest
backend/pyproject.toml
Bumped dependency versions (cachetools, google-auth, limits, oauthlib) and dev mypy.
Frontend manifest
frontend/package.json
Bumped runtime/tooling and dev packages (e.g., @babel/runtime, rollup, @hey-api/openapi-ts, @sveltejs/vite-plugin-svelte, @vitest/coverage-v8).
Beanie repository predicates & typing
Repositories
backend/app/db/repositories/*
backend/app/db/repositories/admin/admin_events_repository.py, backend/app/db/repositories/admin/admin_user_repository.py, backend/app/db/repositories/event_repository.py, backend/app/db/repositories/saga_repository.py, backend/app/db/repositories/user_repository.py, backend/app/db/repositories/user_settings_repository.py
Replaced direct comparison expressions with Beanie operator predicates (Eq, NE, In, GT, LT); introduced BaseFindOperator typing and conditional appends for optional filters; added a few # type: ignore annotations. Review query construction for correctness.
Env / test config
backend/.env.test
Reduced K8S_POD_CPU_REQUEST from 200m to 50m in test env. Review CI/test resource expectations.

Sequence Diagram(s)

(Skipped — changes are mostly refactors, dependency bumps, and workflow updates that don't introduce new multi-component control flow.)

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

Poem

🐰 I hopped through files with a cheerful grin,

Bumped versions up and tamed queries thin.
Workflows refreshed, tiny CPU shrank,
Predicates aligned in a tidy rank.
A rabbit's hop—CI and code leap in! ✨

🚥 Pre-merge checks | ✅ 1 | ❌ 2
❌ Failed checks (1 warning, 1 inconclusive)
Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 11.11% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
Title check ❓ Inconclusive The title 'deps bump' is vague and generic, using a non-descriptive term that doesn't clearly convey meaningful details about the substantial changes across multiple components including CI workflows, backend dependencies, frontend dependencies, and code refactoring. Consider a more descriptive title like 'Update CI workflows and dependencies to current stable versions' or 'Bump dependencies: CI actions, backend packages, frontend packages, and Beanie query refactoring' to better summarize the scope of changes.
✅ Passed checks (1 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 6 files

@sonarqubecloud

Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1 issue found across 2 files (changes from recent commits).

Prompt for AI agents (all issues)

Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="backend/tests/e2e/test_execution_routes.py">

<violation number="1">
P2: Removing the explicit longer timeout for concurrent executions drops the wait to the helper’s 90s default, which can cause flaky timeouts under CI load. Keep the longer timeout for this concurrency test.</violation>
</file>

Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Fix all issues with AI agents
In `@backend/.env.test`:
- Line 13: The test env lowers K8S_POD_CPU_REQUEST to 50m which may cause CI
flakiness; either restore the test default to the production-like value (set
K8S_POD_CPU_REQUEST back to 200m) or make the test harness/CI override
configurable so tests can run with higher CPU under load; after changing the
K8S_POD_CPU_REQUEST value run the e2e suite repeatedly in CI (or locally in the
same container resource profile) to confirm no timeouts or flakiness.
🧹 Nitpick comments (1)
backend/.env.test (1)

11-14: Consider reordering K8s resource variables for consistency.

The static analysis tool suggests grouping related resource keys together (CPU limits/requests, then memory limits/requests) for better readability.

📝 Suggested reordering
 K8S_POD_CPU_LIMIT=1000m
-K8S_POD_MEMORY_LIMIT=128Mi
 K8S_POD_CPU_REQUEST=50m
+K8S_POD_MEMORY_LIMIT=128Mi
 K8S_POD_MEMORY_REQUEST=128Mi

Based on static analysis hints from dotenv-linter.

Comment thread backend/.env.test
K8S_POD_CPU_LIMIT=1000m
K8S_POD_MEMORY_LIMIT=128Mi
K8S_POD_CPU_REQUEST=200m
K8S_POD_CPU_REQUEST=50m

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

# First, check the current state and history of the .env.test file
git log --oneline -n 20 -- backend/.env.test

Repository: HardMax71/Integr8sCode

Length of output: 135


🏁 Script executed:

# Get the git diff to see the actual change
git show HEAD:backend/.env.test | head -20

Repository: HardMax71/Integr8sCode

Length of output: 793


🏁 Script executed:

# Look for all environment files to understand the structure
fd ".env" backend/ -type f

Repository: HardMax71/Integr8sCode

Length of output: 236


🏁 Script executed:

# Search for references to K8S_POD_CPU_REQUEST in the codebase
rg "K8S_POD_CPU_REQUEST" -C 3

Repository: HardMax71/Integr8sCode

Length of output: 2815


🏁 Script executed:

# Search for test configuration files and timeout settings
fd -e yaml -e yml -e py -e js -e ts backend/ | grep -iE "(test|spec|e2e|config)" | head -20

Repository: HardMax71/Integr8sCode

Length of output: 403


🏁 Script executed:

# Look for e2e test configuration and timeout settings
rg -i "timeout|e2e" backend/ --type yaml -C 2 | head -50

Repository: HardMax71/Integr8sCode

Length of output: 307


🏁 Script executed:

# Check git history for K8S_POD_CPU_REQUEST changes
git log -p --all -- backend/.env.test | grep -A 5 -B 5 "K8S_POD_CPU_REQUEST" | head -40

Repository: HardMax71/Integr8sCode

Length of output: 48


🏁 Script executed:

# Look for all .env files to compare
fd ".env" backend/

Repository: HardMax71/Integr8sCode

Length of output: 48


🏁 Script executed:

# Check if there's a production .env or other env files with different values
git ls-files | grep -E "\.env"

Repository: HardMax71/Integr8sCode

Length of output: 110


🏁 Script executed:

# Specifically check the previous version of .env.test before the recent commit
git show HEAD~1:backend/.env.test 2>/dev/null | grep "K8S_POD_CPU_REQUEST" || echo "File or line not found in previous version"

Repository: HardMax71/Integr8sCode

Length of output: 108


🏁 Script executed:

# Check the .env file (non-test) for comparison
cat backend/.env | grep -A 2 -B 2 "K8S_POD"

Repository: HardMax71/Integr8sCode

Length of output: 345


🏁 Script executed:

# Look at the full git history of the .env.test file to see when this setting was added
git log --oneline backend/.env.test | head -10

Repository: HardMax71/Integr8sCode

Length of output: 135


🏁 Script executed:

# Get the complete diff of the recent commit that mentions cpu requests
git show 94f34ab

Repository: HardMax71/Integr8sCode

Length of output: 50382


🏁 Script executed:

# Check if K8S_POD_CPU_REQUEST was previously in .env.test at all
git log --all -S "K8S_POD_CPU_REQUEST" -- backend/.env.test

Repository: HardMax71/Integr8sCode

Length of output: 2057


Verify that tests run reliably with the new low CPU request.

This introduces K8S_POD_CPU_REQUEST=50m in the test environment—significantly lower than the production value of 200m. Given that the PR includes e2e test fixes and timeout adjustments, confirm that the reduced CPU allocation doesn't cause test flakiness or timeouts under typical CI load.

🧰 Tools
🪛 dotenv-linter (4.0.0)

[warning] 13-13: [UnorderedKey] The K8S_POD_CPU_REQUEST key should go before the K8S_POD_MEMORY_LIMIT key

(UnorderedKey)

🤖 Prompt for AI Agents
In `@backend/.env.test` at line 13, The test env lowers K8S_POD_CPU_REQUEST to 50m
which may cause CI flakiness; either restore the test default to the
production-like value (set K8S_POD_CPU_REQUEST back to 200m) or make the test
harness/CI override configurable so tests can run with higher CPU under load;
after changing the K8S_POD_CPU_REQUEST value run the e2e suite repeatedly in CI
(or locally in the same container resource profile) to confirm no timeouts or
flakiness.

@HardMax71
HardMax71 merged commit 3a2e06d into main Jan 24, 2026
22 checks passed
@HardMax71
HardMax71 deleted the fix/bump-deps branch January 24, 2026 23:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant