Full `uv lock --upgrade` and `pnpm update --latest`.
Python: curl-cffi 0.15 -> 0.16.3, python-socketio 5.16 -> 5.17, anyio,
multidict, urllib3, websockets, yarl and the pylint/isort dev chain. yt-dlp and
aiohttp were already current.
Frontend: Angular 22.1.2 -> 22.1.6 (build/cli 22.1.8), angular-eslint 22.5.0,
typescript-eslint 8.70.0, eslint 10, jsdom 30, plus three runtime majors --
@ng-select/ng-select 24, @fortawesome/angular-fontawesome 5 and zone.js 0.16.
Two upgrades are deliberately held back, both pinned by @angular/build's peer
ranges rather than by anything of ours:
* typescript stays on 6.0.x (peer `>=6.0 <6.1`). 7.0.2 breaks the build
outright -- @angular/compiler-cli's readConfiguration throws on it.
* vitest stays on 4.x (peer `^4.0.8`), which is also what the Angular unit-test
builder is written against. 4.1.11 carries the @vitest/mocker fix, so this
costs no coverage -- it is what dependabot's #1076 should have proposed.
`pnpm audit` is clean afterwards, which clears all nine open alerts (fast-uri,
js-yaml, hono, vitest) without touching the runtime image either way: the
Dockerfile only copies `dist` out of the builder stage.
Verified with the backend suite, `pnpm run lint`, `ng test`, a production
`pnpm run build`, and by running the app: icons, the collapsible sections, the
ng-select preset dropdown, and a queued item arriving over the websocket all
behave.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routine `uv lock --upgrade`. Notably yt-dlp 2026.6.17 -> 2026.7.22, plus
patch-level moves across the transitive set.
Full backend suite passes (372 tests).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Alex Shnitman