Dependency Dashboard

[cmlplatform-renovate]

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Awaiting Schedule

The following updates are awaiting their schedule. To get an update now, click on a checkbox below.

• fix(deps): update all non-major (@astrojs/starlight, @biomejs/biome, @mermaid-js/layout-elk, @scalar/api-reference, @tanstack/query-async-storage-persister, @tanstack/react-query, @tanstack/react-query-persist-client, @types/node, @typescript-eslint/parser, @vitest/coverage-v8, aquasec/trivy, astral-sh/uv-pre-commit, baseline-browser-mapping, clamav/clamav, cloudflare, commitizen-tools/commitizen, docker/dockerfile, eslint, grafana/alloy, lucide-react-native, mermaid, pnpm, python, react-hook-form, renovatebot/github-action, uniwind, uv, vitest, wrangler)
• chore(deps): update dependency msw to v3
• chore(deps): lock file maintenance
• 🔐 Create all awaiting schedule PRs at once 🔐

Detected Dependencies

asdf (1)

.tool-versions (3)

• python 3.14.7 → [Updates: 3.14.8]
• uv 0.12.19 → [Updates: 0.12.23]
• just 1.58.0

devcontainer (5)

.devcontainer/app/devcontainer.json (3)

• ghcr.io/devcontainers/features/git 1.3.8
• ghcr.io/devcontainers-extra/features/expo-cli 1.0.11
• ghcr.io/guiyomh/features/just 0.1.0

.devcontainer/backend/devcontainer.json (2)

• ghcr.io/devcontainers/features/git 1.3.8
• ghcr.io/guiyomh/features/just 0.1.0

.devcontainer/devcontainer.json (3)

• ghcr.io/devcontainers/features/git 1.3.8
• ghcr.io/jsburckhardt/devcontainer-features/uv 1.0.0
• ghcr.io/guiyomh/features/just 0.1.0

.devcontainer/docs/devcontainer.json (3)

• ghcr.io/cirolosapio/devcontainers-features/alpine-bash 0.0.3
• ghcr.io/devcontainers/features/git 1.3.8
• ghcr.io/guiyomh/features/just 0.1.0

.devcontainer/www/devcontainer.json (2)

• ghcr.io/devcontainers/features/git 1.3.8
• ghcr.io/guiyomh/features/just 0.1.0

docker-compose (8)

backend/perf/compose.capacity.yaml

compose.ci.yaml

compose.deploy.yaml (2)

• clamav/clamav 1.5.4_base-debian@sha256:391b6fa181c22836793b4fca3007848bc3df5cceb5904d70b78f76f8f664926d → [Updates: 1.5.4_base-debian]
• cloudflare/cloudflared 2026.9.3@sha256:072c067d25ccbe61d46e18f0d0723255f2bb5304f7317caa95b27031520ff92c → [Updates: 2026.10.0]

compose.dev.yaml

compose.e2e.yaml

compose.telemetry.gpu.yml (1)

• utkuozdemir/nvidia_gpu_exporter 1.15.1-nvml@sha256:92a73ec03e2f5cae4a7cfcc99c242b46797741c24de8f3768d394925f8e0a323

compose.telemetry.yml (2)

• tecnativa/docker-socket-proxy v0.5.0@sha256:1f5038b54f06c3e18422902cf00ba21803d1c97805aae032e5e6673d532d3459
• grafana/alloy v1.20.0@sha256:f111cce835516c5f99166342be7038496b52ced16667be5a11e19258a3e4cd30 → [Updates: v1.20.1]

compose.yaml (2)

• redis 8-alpine@sha256:3811787313eba226a2ef38658c6ccb91cd5e110edc89c37767de373120a0e5a0
• postgres 18@sha256:5a5a84b19854a9ffaa54082c166ff4ec27473a361e496e5ea167f298f2da9722 → [Updates: 18]

dockerfile (5)

app/Dockerfile (4)

• docker/dockerfile 1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 → [Updates: 1]
• node 26-slim@sha256:ec7758ee051e457b468b32bde57b0879010b325bb9862718e9615225ce4aaae1 → [Updates: 26-slim]
• caddy 2-alpine@sha256:6aeddd44c3078b0f9a35206472a11420648a79c184603ef95957d0a20044cb2b → [Updates: 2-alpine]
• alpine 3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

backend/Dockerfile (4)

• docker/dockerfile 1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 → [Updates: 1]
• ghcr.io/astral-sh/uv 0.12-python3.14-trixie-slim@sha256:a2657d5b8da6a702204e49b2ed2467597da15fb45eb9fee00304c127dad4b1e9 → [Updates: 0.12-python3.14-trixie-slim]
• ghcr.io/astral-sh/uv 0.12-python3.14-trixie-slim@sha256:a2657d5b8da6a702204e49b2ed2467597da15fb45eb9fee00304c127dad4b1e9 → [Updates: 0.12-python3.14-trixie-slim]
• python 3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d → [Updates: 3.14-slim-trixie]

backend/Dockerfile.backups (2)

• docker/dockerfile 1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 → [Updates: 1]
• postgres 18@sha256:5a5a84b19854a9ffaa54082c166ff4ec27473a361e496e5ea167f298f2da9722 → [Updates: 18]

backend/Dockerfile.migrations (3)

• docker/dockerfile 1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 → [Updates: 1]
• ghcr.io/astral-sh/uv 0.12-python3.14-trixie-slim@sha256:a2657d5b8da6a702204e49b2ed2467597da15fb45eb9fee00304c127dad4b1e9 → [Updates: 0.12-python3.14-trixie-slim]
• python 3.14-slim-trixie@sha256:51dafde81dbdb6ebde285137a295cf18a47ca95234fe388a343719cb97305b3d → [Updates: 3.14-slim-trixie]

Dockerfile.sites (2)

• docker/dockerfile 1@sha256:ecfaec9ed6d810b56388c508f4121597bfbba70d41a6dfeee4d8cad5f295fc32 → [Updates: 1]
• node 26-slim@sha256:ec7758ee051e457b468b32bde57b0879010b325bb9862718e9615225ce4aaae1 → [Updates: 26-slim]

github-actions (10)

.github/actions/publish-reports/action.yml (3)

• codecov/codecov-action v7.1.1@303a32d7a59b442fa8d48b6a1cc6825c09c847a5
• codecov/codecov-action v7.1.1@303a32d7a59b442fa8d48b6a1cc6825c09c847a5
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

.github/actions/setup-runtime/action.yml (5)

• astral-sh/setup-uv v10.2.0@c18668ad3cf93ea998bef934396af7bb5c839dc7
• actions/setup-python v7.0.0@5fda3b95a4ea91299a34e894583c3862153e4b97
• pnpm/setup v3.0.0@fbda4c85fc2e1e08721cd8763afea8f48d60f024
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• extractions/setup-just v4.0.0@53165ef7e734c5c07cb06b3c8e7b647c5aa16db3

.github/workflows/ci.yml (39)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/cache v6.1.0@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
• opentofu/setup-opentofu v2.0.2@a1320f892987e89d278cc92dc5adc984fb93aca4
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• docker/setup-buildx-action v4.4.1@f87e5991a6d7451dcb8d9637bfbc97413f497069
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• docker/setup-buildx-action v4.4.1@f87e5991a6d7451dcb8d9637bfbc97413f497069
• crazy-max/ghaction-github-runtime v4.0.0@04d248b84655b509d8c44dc1d6f990c879747487
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• gacts/gitleaks v1.3.3@4fd785dcdaf557fda64e05b0ae033b8f7d82fb81
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/dependency-review-action v5.0.0@a1d282b36b6f3519aa1f3fc636f609c47dddb294
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• aquasec/trivy 0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 → [Updates: 0.75.0]
• github/codeql-action v4.38.2@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• github/codeql-action v4.38.2@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
• github/codeql-action v4.38.2@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
• advanced-security/dismiss-alerts v2.0.3@a18f986bdb40edba0dd7a74382c15d4a3d50a1c8
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04
• ubuntu 26.04

.github/workflows/container-images.yml (7)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• docker/setup-buildx-action v4.4.1@f87e5991a6d7451dcb8d9637bfbc97413f497069
• docker/build-push-action v7.4.0@c3c9e263c25d99ce0380d002d59b67737d91b0dc
• aquasec/trivy 0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 → [Updates: 0.75.0]
• aquasec/trivy 0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 → [Updates: 0.75.0]
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• ubuntu 26.04

.github/workflows/deploy-sites.yml (3)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ubuntu 26.04
• ubuntu 26.04

.github/workflows/ops.yml (8)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• docker/setup-buildx-action v4.4.1@f87e5991a6d7451dcb8d9637bfbc97413f497069
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• ubuntu 26.04
• ubuntu 26.04

.github/workflows/publish-images.yml (13)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• docker/setup-buildx-action v4.4.1@f87e5991a6d7451dcb8d9637bfbc97413f497069
• docker/build-push-action v7.4.0@c3c9e263c25d99ce0380d002d59b67737d91b0dc
• aquasec/trivy 0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 → [Updates: 0.75.0]
• aquasec/trivy 0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969 → [Updates: 0.75.0]
• docker/login-action v4.6.0@dbcb813823bdd20940b903addbd779551569679f
• actions/attest v4.2.2@1e69f48acb82d1966a394da916b4c1698aa569d6
• actions/attest v4.2.2@1e69f48acb82d1966a394da916b4c1698aa569d6
• actions/upload-artifact v7.0.1@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
• actions/download-artifact v8.0.1@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
• actions/attest v4.2.2@1e69f48acb82d1966a394da916b4c1698aa569d6
• ubuntu 26.04
• ubuntu 26.04

.github/workflows/release.yml (2)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ubuntu 26.04

.github/workflows/renovate.yml (3)

• actions/create-github-app-token v3.2.0@bcd2ba49218906704ab6c1aa796996da409d3eb1
• renovatebot/github-action v46.3.4@f3a31a786096ba6b40d0f0ffe11a494ef73bfa7c → [Updates: v46.3.6]
• ubuntu 26.04

.github/workflows/scorecard.yml (4)

• actions/checkout v7.0.1@3d3c42e5aac5ba805825da76410c181273ba90b1
• ossf/scorecard-action v2.4.4@2d1146689b8cda280b9bc96326124645441f03bc
• github/codeql-action v4.38.2@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2
• ubuntu 26.04

nodenv (1)

.node-version (1)

• node 26.10.0

npm (5)

app/package.json (38)

• @hookform/resolvers ^5.2.2
• @react-native-async-storage/async-storage 3.1.1
• @rn-primitives/separator ^1.5.2
• @rn-primitives/switch ^1.5.2
• @rn-primitives/toggle-group ^1.5.2
• @tanstack/query-async-storage-persister ^5.101.4 → [Updates: ^5.101.4]
• @tanstack/react-query ^5.101.4 → [Updates: ^5.101.4]
• @tanstack/react-query-persist-client ^5.101.4 → [Updates: ^5.101.4]
• class-variance-authority ^0.7.1
• hls.js ^1.6.16
• lucide-react-native ^1.24.0 → [Updates: ^1.24.0]
• react-hook-form ^7.73.1 → [Updates: ^7.73.1]
• react-native-qrcode-svg ^6.3.21
• tailwind-merge ^3.6.0
• uniwind ^1.10.1 → [Updates: ^1.10.1]
• use-debounce ^10.1.1
• zod ^4.3.6
• zustand ^5.0.15
• @babel/core 7.29.7
• @babel/runtime 7.29.7
• @jest/globals 30.5.2
• @tailwindcss/postcss 4.3.3
• @testing-library/react-native 14.0.1
• @types/jest 30.0.0
• @typescript-eslint/parser 8.70.1 → [Updates: 8.71.0]
• babel-plugin-react-compiler 1.0.0
• baseline-browser-mapping 2.11.26 → [Updates: 2.11.27]
• eslint 10.11.0 → [Updates: 10.12.0]
• eslint-plugin-react-hooks 7.1.1
• eslint-plugin-react-native-a11y 3.5.1
• eslint-plugin-react-refresh 0.5.7
• jest 30.5.2
• jest-junit 17.0.0
• msw 2.15.0 → [Updates: 3.0.2]
• openapi-typescript 7.13.0
• postcss 8.5.28 → [Updates: 8.5.29]
• serve 14.2.6
• test-renderer 1.3.0

docs/package.json (6)

• @astrojs/starlight 0.42.4 → [Updates: 0.42.5]
• @mermaid-js/layout-elk ^1.0.0 → [Updates: ^1.0.0]
• @scalar/api-reference ^1.64.1 → [Updates: ^1.64.1]
• mermaid ^12.0.0 → [Updates: ^12.0.0]
• linkinator 8.1.0
• vitest 5.0.2 → [Updates: 5.0.3]

package.json (3)

• node 26.x
• pnpm 12.x
• pnpm 12.6.0+sha512.3ef68f951cb111ac204b4a5a16f0b2ddf0da56a96e0413e81d855d9f0b55ef926714709028e1cd00c405c2c5fb7b9e8ec4dc46777c805d0373c2f2ff00fd20ec → [Updates: 12.9.0]

pnpm-workspace.yaml (10)

• @astrojs/check ^0.9.10
• @axe-core/playwright ^4.12.1
• @biomejs/biome ^2.5.8 → [Updates: ^2.5.8]
• astro 7.3.5 → [Updates: 7.3.6]
• @playwright/test ^1.62.1
• @types/node ^26.2.0 → [Updates: ^26.2.0]
• tailwindcss 4.3.3
• typescript ^6.0.3
• wrangler ^4.140.0 → [Updates: ^4.140.0]
• lightningcss 1.33.0

www/package.json (4)

• @astrojs/sitemap ^3.7.3
• @vitest/coverage-v8 5.0.2 → [Updates: 5.0.3]
• happy-dom 20.14.5
• vitest 5.0.2 → [Updates: 5.0.3]

pep621 (2)

backend/pyproject.toml (52)

• python >=3.14
• fastapi-mail >=1.6.2
• fastapi-pagination >=0.13.2
• fastapi >=0.115.14
• uvicorn >=0.42.0
• asyncpg >=0.30.0
• email-validator >=2.2.0
• cashews >=7.5.0
• fastapi-users >=14.0.1
• pyjwt >=2.12.1
• pyotp >=2.9.0
• redis >=5.2.1
• limits >=5.8.0
• sqlalchemy >=2.0.41
• httpx >=0.28.1
• relab-rpi-cam-models >=0.5.0,<0.6
• pydantic >=2.12
• pydantic-settings >=2.10.1
• python-json-logger >=4.1.0
• pillow >=11.2.1
• opentelemetry-api >=1.41.0
• opentelemetry-sdk >=1.41.0
• opentelemetry-exporter-otlp-proto-http >=1.41.0
• opentelemetry-instrumentation-fastapi >=0.62b0
• opentelemetry-instrumentation-sqlalchemy >=0.62b0
• opentelemetry-instrumentation-httpx >=0.62b0
• fastapi-filters >=0.3.3
• mjml >=0.11.1
• ruff >=0.12.1
• ty >=0.0.15
• alembic >=1.16.2
• alembic-postgresql-enum >=1.7.0
• psycopg >=3.2.9
• boto3 >=1.38.0
• openpyxl >=3.1.5
• pandas >=2.3.3
• faker >=33.3.0
• polyfactory >=2.15.0
• pyarrow >=21.0.0
• opencv-python-headless >=4.0
• websockets >=14.0
• pytest-asyncio >=1.0.0
• pytest-cov >=6.2.1
• pytest-timeout >=2.3.0
• pytest-xdist >=3.5.0
• pytest >=8.4.1
• httpx >=0.27.0
• pytest-alembic >=0.12.1
• testcontainers >=4.15.0
• fakeredis >=2.25.0
• dirty-equals >=0.8.0
• pytest-mock >=3.14.0

pyproject.toml (8)

• python >=3.14
• commitizen >=4.8.3
• prek >=0.4.11
• pytest >=9.1.1
• pyyaml >=6.0.3
• ruff >=0.12.1
• rumdl >=0.2.60
• ty >=0.0.15

pre-commit (1)

.pre-commit-config.yaml (8)

• gitleaks/gitleaks 83d9cd684c87d95d656c1458ef04895a7f1cbd8e
• rhysd/actionlint 914e7df21a07ef503a81201c76d2b11c789d3fca
• zizmorcore/zizmor-pre-commit v1.30.1@fa412071e4f5d44d44f9e365f4676f9df92456a2
• shellcheck-py/shellcheck-py v0.11.0.1-1@a6564f5d57444e123433a5c9af733e3975c77229
• scop/pre-commit-shfmt 05c1426671b9237fb5e1444dd63aa5731bec0dfb
• commitizen-tools/commitizen v4.19.0@3f5ccc87b27966d9ed21cf5ea8ec2fba38ca65ce → [Updates: v4.19.1]
• simonvanlierde/check-json5 c70883b5be6d9fb87deac8d75395031372d54e83
• astral-sh/uv-pre-commit 0.12.19@2aeb804518b4373dbf5adb8dddc5466d9a6e6b21 → [Updates: 0.12.22]

pyenv (1)

backend/.python-version (1)

• python 3.14

terraform (2)

infra/cloudflare-zone/versions.tf (2)

• cloudflare ~> 5.0 → [Updates: ~> 5.0]
• hashicorp/terraform >= 1.8

infra/cloudflare/versions.tf (3)

• cloudflare ~> 5.0 → [Updates: ~> 5.0]
• github ~> 6.13
• hashicorp/terraform >= 1.8