chore(deps): consolidate dependabot updates

[gcko]

PR checklist

• Ensure you have added or ran the appropriate tests for your PR.
• DCO signed

What type of PR is this?

chore (dependencies)

What this PR does / why we need it:

This PR consolidates the 4 open Dependabot PRs and takes each to the newest version that passed this run's checks. It also applies the updates Dependabot missed. Those include the whole Python lockfile: Dependabot only edits pyproject.toml, so uv.lock had drifted behind what a fresh pip install recce resolves.

Dependabot-driven changes (npm)

Package	From	To	Notes
all-minor-patch group (#1572)	—	—	35 packages, taken to latest. Highlights: next / @next/third-parties 16.3.6 → 16.4.2, @mui/material + system 9.4.0 → 9.5.0, @tanstack/react-query 5.104.0 → 5.104.4, posthog-js 1.434.17 → 1.438.12, @amplitude/unified 1.1.37 → 1.1.42, vite 8.3.1 → 8.3.4, vitest family 5.0.1 → 5.0.5, storybook family 10.6.1 → 10.6.2, playwright 1.63.0 → 1.64.1, @biomejs/biome 2.5.14 → 2.5.15, @zumer/snapdom 3.2.0 → 3.3.5
@sentry/nextjs (#1571)	10.74.0	11.8.0	major
@sentry/react (#1570)	10.74.0	11.8.0	Dependabot proposed 10.76.2. Moved to 11 with @sentry/nextjs so the family stays on one major.
msw (#1569)	2.15.0	3.0.3	major (storybook only)

Audit-driven changes

Package	From	To	Ecosystem	Notes
happy-dom	20.14.5	21.0.3	npm	major (test env). Only breaking change: CSS/iframe loading is now opt-in (SSRF hardening).
react / react-dom	19.3.0	19.3.1	npm	patch; override moved too
@testing-library/user-event	14.6.7	14.6.8	npm	patch
typedoc-plugin-markdown	4.13.1	4.14.0	npm	minor (ui devDep)
dompurify / markdown-it / fast-uri / brace-expansion	3.4.15 / 14.3.0 / 4.1.4 / 5.0.9	3.4.17 / 14.3.3 / 4.2.2 / 5.0.12	npm (transitive)	security advisories; lockfile-only refresh, no manifest changes
uv.lock (~110 packages)			pip	Refreshed to latest within the existing pyproject.toml ranges. Includes fastapi 0.146, pydantic 2.14.1, posthog 7.71, sentry-sdk 2.72, boto3 1.43.114, dbt-core 1.12.6, and mcp 1.28.1 → 2.3.0 (fixes CVE-2026-59951). Also jaraco-context 6.0.1 → 6.1.2 (fixes CVE-2026-23949).
sqlglot	<31.0 (locked 30.11.0)	<30.22 (locked 30.21.0)	pip	Cap. See reviewer notes.
pytest-flake8	1.3.0	removed	pip	Unused (flake8 runs directly everywhere) and breaks pytest ≥ 9.1 (PluginValidationError).

Security: npm audit goes from 17 findings on main to 1. The one left is braces, via @tailwindcss/cli → @parcel/watcher, and has no patched release. pip-audit goes from 2 CVEs to 0.

Deferred / separate PRs recommended

Item	Current	Latest	Reason
sqlglot	30.21.0	30.23.0	Breaks column-level lineage, so the range is capped. Follow-up: DRC-4901.
deepdiff	8.6.2	9.1.0	Allowed by our range, but dbt-core 1.12 caps it below 9. Upgrading forces dbt-core back to 1.8.8, so it's held.
postcss	8.5.30	8.5.31	Published < 1 day ago and blocked by pnpm 12's minimumReleaseAge. Dependabot will pick it up next cycle.
@dagrejs/dagre	3.1.0	3.1.1	Ignored in .github/dependabot.yml, so skipped.

GitHub Actions + pre-commit (second commit)

A new github-actions ecosystem in .github/dependabot.yml now tracks these going forward, covering both floating tags and SHA pins.

Action	From	To	Breaking changes checked against our usage
actions/checkout	v4 / v6	v7	Node 24. v7 blocks fork-PR checkout under pull_request_target/workflow_run; release-ui only runs from nightly/release, so no impact.
actions/cache	v4	v6	Node 24, ESM. Inputs unchanged.
actions/setup-python	v5	v7	Node 24, ESM.
actions/upload-artifact / download-artifact	v4 / v4	v7 / v8	Downloads are by name (v5's break is by-ID only). v8 errors on digest mismatch by default; uploads stay zipped.
actions/create-github-app-token	v2	v3	Node 24. app-id is kept: it's deprecated in favor of client-id but still supported. See notes.
astral-sh/setup-uv	v4	v10.3.0 (SHA)	No floating major tags since v8, hence the SHA pin. Caching is on by default since v5, which speeds up test jobs; enable-cache: false keeps release.yaml/nightly.yaml (publishing) uncached as before.
codecov/codecov-action	v5	v7	Node 24, signing-key move.
getsentry/action-release	v1	v3	version renamed to release. v3's debug-ID inject only acts when sourcemaps is set, which we don't pass.
stefanzweifel/git-auto-commit-action	v4	v7	Removed the token input: no version of this action has accepted it, and the push authenticates via checkout's app token, as it has since checkout@v6 (2025-12).
pnpm/setup	v2.0.2 (SHA)	v3.1.1 (SHA)	package-json-file → working-directory: js. node-version-file: false stops v3 auto-installing a second Node from js/.nvmrc on top of setup-node.
actions/stale	v10.2.0 (SHA)	v11.0.0 (SHA)	ESM migration only.
setup-node v7, claude-code-action v1, workflow-dispatch v1	—	—	Floating tags already resolve to latest (v7.1.0, v1.0.253, v1.3.3).

Verification:

• Every with: key in every step was checked against the target version's action.yml: no unknown or missing-required inputs remain.
• All floating tags were verified to resolve to the latest release commit.
• The SHA pins were verified against the release-tag commits.
• actionlint reports the same 46 findings as on main, all pre-existing shellcheck style notes, and nothing new.
• The recce_cloud/README.md CI example was bumped to checkout v7 and setup-python v7.

pre-commit hook	From	To
pre-commit-hooks	v5.0.0	v6.0.0 (removed hooks aren't ones we use)
black	26.3.1	26.10.1
isort	6.0.1	9.0.2 (autoupdate picked 10.0.0b1; pinned to latest stable instead)
flake8	7.2.0	7.4.1

The only reformatting the new hook versions cause is one isort reflow in recce/cli.py. To isolate it, I formatted the repo with the old hooks and the new hooks on identical trees and diffed the results. pre-commit run --all-files also surfaces pre-existing whitespace/black drift in about 40 files, including test fixtures and recce/event/SENTRY_DNS. Those files were left untouched because that drift exists under the old versions too. The locked dev tools (black 26.10.1, isort 9.0.2, flake8 7.4.1) now match the hook revisions.

Which issue(s) this PR fixes:

Closes #1569
Closes #1570
Closes #1571
Closes #1572

Follow-up: DRC-4901 (lift the sqlglot cap)

Special notes for your reviewer:

1. sqlglot cap (<30.22) restores product behavior. Starting with 30.22.0 (2026-10-09), qualify() stops attributing an unqualified column to the sole source table when that table has no schema entry. It raises Column 'a' could not be resolved instead. 35 of the 50 tests/util/test_cll.py tests fail. In production, CLL fails for any model whose upstream table is missing from catalog.json. The old <31.0 range meant fresh installs were already pulling 30.23, and our tox dbtlatest env (which resolves fresh) would have gone red on its next run. DRC-4901 tracks adapting cll() and lifting the cap.

2. Sentry 11. The OSS app never calls Sentry.init or withSentryConfig. It only uses captureException, ErrorBoundary and FallbackRender, and none of those changed in v11. v11's new data-collection defaults therefore don't apply here.

3. @datarecce/ui consumer contract. The optional peer @sentry/react is widened from ^10.0.0 to ^10.0.0 || ^11.0.0, so consumers on 10 aren't broken. Caret floors in ui dependencies are deliberately left alone, and pnpm dedupe keeps a single copy of each package in the monorepo. The exact pins (@amplitude/unified, posthog-js, @zumer/snapdom) move in lockstep with the root overrides, as in previous consolidations.

4. msw 3: worker.start({ onUnhandledRequest }) is renamed to onUnhandledFrame. public/mockServiceWorker.js was regenerated, and it's byte-identical to the msw 3.0.3 package copy.

5. Biome guard: 2.5.15 was re-verified on macOS arm64 (708-file pnpm lint plus biome check src/, no stack overflow), and EXPECTED_BIOME was bumped in this same commit.

6. New transitive packages reviewed for supply-chain risk.

   • sentry is Sentry's new CLI SDK, which replaces @sentry/cli. It's maintained by zeeg and sentry-bot and has no install scripts.
   • yuku-* arrives via tsdown → rolldown-plugin-dts 0.28.8. It's a declared dependency, build-time only, with no install scripts.
   • The new Python packages trace to mcp 2.x (httpx2, mcp-types, truststore), mypy, tox and tox-uv.
   • Every lockfile source is registry.npmjs.org or pypi.org.

7. Pre-existing, not caused by this PR:

   • The storybook browser suite has 3 failing stories and 1 import error. These are identical on main, and the suite isn't run in CI.
   • black --check flags the same 22 files under the pinned 26.3.1 and the newly locked 26.10.1.

8. Late-arriving Dependabot PRs: daily-release packages (boto3, posthog, Sentry, AWS SDKs) may get re-filed shortly after merge. That's expected churn, not an audit miss.

9. Release-path workflows can't run in PR CI. release, nightly, release-ui, bump, stale and address-dependabot trigger only on tags, schedules or dispatch. Their action changes were verified statically (inputs checked against action.yml, plus actionlint), so watch the next nightly run.

10. Follow-up: an org secret RECCE_ACTION_BOT_CLIENT_ID exists, so create-github-app-token could switch from app-id to client-id. I didn't make that switch because I couldn't confirm the secret's value and repo visibility from a PR run, and a wrong value would only show up as a failed release. Switch it once someone can test it with a manual address-dependabot dispatch.

Test plan

• pnpm lint (708 files), pnpm type:check, pnpm test: 211 files, 4444 passed
• pnpm --filter @datarecce/ui build + pnpm test:dist (19/19), pnpm build
• CI=true pnpm install --frozen-lockfile
• Storybook vitest: 282/285, the same 3 failures as main
• pytest tests/: 2034 passed, 5 skipped; pytest recce_cloud/tests: 361 passed
• uv run flake8 (recce, tests, recce_cloud); uv lock --check
• pnpm audit, pip-audit on the exported lock
• gh pr checks on commit 1: all green (tox for every dbt/Python version, MCP smoke tests on mcp 1.29/2.0, CodeQL, codecov)
• pre-commit run with the new hook versions on all changed files; pytest tests/test_cli.py (23 passed) after the isort reflow
• gh pr checks on commit 2 (new action versions)

Does this PR introduce a user-facing change?:

Pin sqlglot below 30.22 to keep column-level lineage working when upstream tables are missing from the catalog. Bump mcp to 2.x in the lock (CVE-2026-59951) and refresh frontend/backend dependencies.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

Files with missing lines	Coverage Δ
recce/cli.py	68.93% <100.00%> (ø)

... and 3 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kentwelcome]

LGTM