Bump the frontend-dependencies group across 1 directory with 31 updates

.github/dependabot.yml

@@ -18,7 +18,8 @@ updates:
           - "*"
 
   - package-ecosystem: "npm"
-    directory: "/frontend"
+    # pnpm lockfile lives at repository root for this workspace.
+    directory: "/"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5

.github/workflows/dependabot-refresh-lockfiles.yml

@@ -0,0 +1,92 @@
+name: Dependabot Lockfile Refresh
+
+on:
+  pull_request_target:
+    branches:
+      - main
+    types:
+      - opened
+      - synchronize
+      - reopened
+
+permissions:
+  contents: write
+  pull-requests: write
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  refresh-lockfiles:
+    name: Refresh lockfiles for Dependabot PRs
+    if: github.actor == 'dependabot[bot]' && github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v7
+        with:
+          repository: ${{ github.event.pull_request.head.repo.full_name }}
+          ref: ${{ github.event.pull_request.head.ref }}
+          token: ${{ github.token }}
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
+        with:
+          version: "0.8.17"
+          enable-cache: true
+
+      - name: Install Python 3.13
+        run: uv python install 3.13
+
+      - name: Initialize Pants
+        uses: pantsbuild/actions/init-pants@0aaef864bd133c4055feb6adad0bfdce0de1c2e4 # v11
+        with:
+          gha-cache-key: cache0-py313
+          named-caches-hash: ${{ hashFiles('3rdparty/python/default.lock', 'pants.toml') }}
+          pants-ci-config: ""
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+        with:
+          version: 11.1.2
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+
+      - name: Refresh lockfiles
+        run: |
+          corepack enable
+          corepack prepare pnpm@11.1.2 --activate
+          uv lock
+          pants generate-lockfiles --resolve=python-default
+          pnpm install --lockfile-only
+
+      - name: Commit lockfile updates
+        env:
+          PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          set -euo pipefail
+
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          # Reject unexpected ref values before using them in git commands.
+          if [[ ! "$PR_HEAD_REF" =~ ^[A-Za-z0-9._/-]+$ ]] || [[ "$PR_HEAD_REF" == -* ]] || [[ "$PR_HEAD_REF" == *..* ]]; then
+            echo "Invalid pull request head ref: $PR_HEAD_REF"
+            exit 1
+          fi
+
+          if git diff --quiet -- uv.lock 3rdparty/python/default.lock pnpm-lock.yaml; then
+            echo "No lockfile updates needed"
+            exit 0
+          fi
+
+          git add uv.lock 3rdparty/python/default.lock pnpm-lock.yaml
+          git commit -m "chore: refresh lockfiles for dependabot"
+          git push origin "HEAD:$PR_HEAD_REF"

frontend/eslint.config.mjs

@@ -4,9 +4,8 @@ import nextCoreWebVitals from "eslint-config-next/core-web-vitals"
 import eslintConfigPrettier from "eslint-config-prettier/flat"
 import simpleImportSortPlugin from "eslint-plugin-simple-import-sort"
 import storybook from "eslint-plugin-storybook"
-import tseslint from "typescript-eslint"
 
-export default tseslint.config(
+const config = [
   {
     ignores: [
       ".next/**",
@@ -18,7 +17,6 @@ export default tseslint.config(
     ],
   },
   js.configs.recommended,
-  ...tseslint.configs.recommended,
   ...nextCoreWebVitals,
   {
     files: ["**/*.{js,mjs,cjs,jsx,ts,tsx}"],
@@ -37,12 +35,22 @@ export default tseslint.config(
       "simple-import-sort/exports": "error",
     },
   },
+  {
+    files: ["**/*.{ts,tsx}"],
+    rules: {
+      // TypeScript handles undefined names and unused symbols more accurately.
+      "no-undef": "off",
+      "no-unused-vars": "off",
+    },
+  },
   eslintConfigPrettier,
-  storybook.configs["flat/recommended"],
+  ...storybook.configs["flat/recommended"],
   {
     files: [".storybook/main.ts"],
     rules: {
       "storybook/no-uninstalled-addons": "off",
     },
   },
-)
+]
+
+export default config

frontend/package.json

@@ -27,61 +27,61 @@
     "build-storybook": "storybook build"
   },
   "dependencies": {
-    "@base-ui/react": "^1.4.1",
+    "@base-ui/react": "^1.6.0",
     "@eslint/js": "9.39.4",
-    "@tailwindcss/postcss": "^4.3.0",
+    "@tailwindcss/postcss": "^4.3.2",
     "@tailwindcss/forms": "^0.5.11",
-    "@tailwindcss/typography": "^0.5.19",
-    "@tanstack/react-query": "^5.100.10",
-    "axios": "^1.16.1",
+    "@tailwindcss/typography": "^0.5.20",
+    "@tanstack/react-query": "^5.101.2",
+    "axios": "^1.18.1",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
     "eslint": "9.39.4",
-    "eslint-config-next": "^16.2.6",
+    "eslint-config-next": "^16.2.10",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-jsx-a11y": "^6.10.2",
     "eslint-plugin-react": "^7.37.5",
     "eslint-plugin-simple-import-sort": "^13.0.0",
-    "lucide-react": "^1.16.0",
-    "next": "16.2.6",
+    "lucide-react": "^1.23.0",
+    "next": "16.2.10",
     "next-auth": "^4.24.14",
     "next-themes": "^0.4.6",
-    "postcss": "^8.5.14",
-    "prettier": "^3.8.3",
-    "react": "19.2.6",
-    "react-dom": "19.2.6",
+    "postcss": "^8.5.16",
+    "prettier": "^3.9.4",
+    "react": "19.2.7",
+    "react-dom": "19.2.7",
     "react-dropzone": "^15.0.0",
-    "react-hook-form": "^7.75.0",
+    "react-hook-form": "^7.80.0",
     "tailwind-merge": "^3.6.0",
-    "tailwindcss": "^4.3.0",
+    "tailwindcss": "^4.3.2",
     "tw-animate-css": "^1.4.0",
-    "typescript-eslint": "^8.59.3"
+    "typescript-eslint": "^8.62.1"
   },
   "devDependencies": {
     "@chromatic-com/storybook": "^5.2.1",
-    "@storybook/addon-a11y": "^10.4.0",
-    "@storybook/addon-docs": "^10.4.0",
-    "@storybook/addon-themes": "^10.4.0",
-    "@storybook/addon-vitest": "^10.4.0",
-    "@storybook/nextjs-vite": "^10.4.0",
+    "@storybook/addon-a11y": "^10.4.6",
+    "@storybook/addon-docs": "^10.4.6",
+    "@storybook/addon-themes": "^10.4.6",
+    "@storybook/addon-vitest": "^10.4.6",
+    "@storybook/nextjs-vite": "^10.4.6",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/node": "25.8.0",
-    "@types/react": "19.2.14",
+    "@types/node": "26.1.0",
+    "@types/react": "19.2.17",
     "@types/react-dom": "19.2.3",
-    "@vitejs/plugin-react": "^6.0.2",
-    "@vitest/browser-playwright": "^4.1.6",
-    "@vitest/coverage-v8": "^4.1.6",
+    "@vitejs/plugin-react": "^6.0.3",
+    "@vitest/browser-playwright": "^4.1.9",
+    "@vitest/coverage-v8": "^4.1.9",
     "eslint-formatter-compact": "^9.0.1",
-    "eslint-plugin-storybook": "^10.4.0",
+    "eslint-plugin-storybook": "^10.4.6",
     "jsdom": "^29.1.1",
-    "playwright": "^1.60.0",
-    "storybook": "^10.4.0",
-    "typescript": "5.9.3",
-    "vite": "^8.0.16",
+    "playwright": "^1.61.1",
+    "storybook": "^10.4.6",
+    "typescript": "6.0.3",
+    "vite": "^8.1.3",
     "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "^4.1.6"
+    "vitest": "^4.1.9"
   }
 }

justfile

@@ -32,6 +32,13 @@ backend-install:
 bootstrap:
     @bash scripts/bootstrap_dev.sh
 
+# Refresh Python and frontend lockfiles after dependency manifest updates
+refresh-lockfiles:
+    @{{pnpm_setup}}
+    @uv lock
+    @{{backend_pants}} generate-lockfiles --resolve=python-default
+    @{{pnpm_exec}} install --lockfile-only
+
 # Ensure pnpm is enabled, then install frontend dependencies
 frontend-install:
     @{{frontend_env}}