Skip to content

chore(deps): batch the October Dependabot updates - #895

Merged
rainmanjam merged 11 commits into
mainfrom
chore/deps-batch-oct
Oct 14, 2026
Merged

rainmanjam merged 11 commits into
mainfrom
chore/deps-batch-oct

Conversation

@rainmanjam

Copy link
Copy Markdown
Owner

Batches the remaining Dependabot updates into one PR to save CI (they would otherwise conflict on the lockfiles and rebase/re-run after every merge).

Local: go build/vet, go test srtserver/rtmpserver/relay/db; ui tsc -b, lint, vitest 1113/1113, build; web astro check, build; osv-scanner 0/0.

Supersedes #893, #891, #889, #887, #886, #885, #884, #883, #882, #880, #873.

https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL

dependabot Bot and others added 11 commits October 5, 2026 22:16
Bumps [SonarSource/sonarqube-scan-action](https://github.com/sonarsource/sonarqube-scan-action) from 8.2.2 to 8.3.0.
- [Release notes](https://github.com/sonarsource/sonarqube-scan-action/releases)
- [Commits](SonarSource/sonarqube-scan-action@ba9859e...d209202)

---
updated-dependencies:
- dependency-name: SonarSource/sonarqube-scan-action
  dependency-version: 8.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps ubuntu from `da6fc2b` to `f144425`.

---
updated-dependencies:
- dependency-name: ubuntu
  dependency-version: '26.04'
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 7.0.1 to 7.0.2.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](actions/upload-artifact@043fb46...cf430e0)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
…h 9 updates

Bumps the go-minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/bluenviron/gortmplib](https://github.com/bluenviron/gortmplib) | `1.0.3` | `1.0.4` |
| [github.com/datarhei/gosrt](https://github.com/datarhei/gosrt) | `0.11.0` | `0.12.0` |
| [github.com/shirou/gopsutil/v4](https://github.com/shirou/gopsutil) | `4.26.8` | `4.26.9` |
| [golang.org/x/crypto](https://github.com/golang/crypto) | `0.57.0` | `0.58.0` |
| [golang.org/x/net](https://github.com/golang/net) | `0.59.0` | `0.60.0` |
| [golang.org/x/sys](https://github.com/golang/sys) | `0.48.0` | `0.49.0` |
| [golang.org/x/term](https://github.com/golang/term) | `0.46.0` | `0.47.0` |
| [golang.org/x/tools](https://github.com/golang/tools) | `0.49.0` | `0.51.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) | `1.59.0` | `1.60.1` |



Updates `github.com/bluenviron/gortmplib` from 1.0.3 to 1.0.4
- [Commits](bluenviron/gortmplib@v1.0.3...v1.0.4)

Updates `github.com/datarhei/gosrt` from 0.11.0 to 0.12.0
- [Release notes](https://github.com/datarhei/gosrt/releases)
- [Commits](datarhei/gosrt@v0.11.0...v0.12.0)

Updates `github.com/shirou/gopsutil/v4` from 4.26.8 to 4.26.9
- [Release notes](https://github.com/shirou/gopsutil/releases)
- [Commits](shirou/gopsutil@v4.26.8...v4.26.9)

Updates `golang.org/x/crypto` from 0.57.0 to 0.58.0
- [Commits](golang/crypto@v0.57.0...v0.58.0)

Updates `golang.org/x/net` from 0.59.0 to 0.60.0
- [Commits](golang/net@v0.59.0...v0.60.0)

Updates `golang.org/x/sys` from 0.48.0 to 0.49.0
- [Commits](golang/sys@v0.48.0...v0.49.0)

Updates `golang.org/x/term` from 0.46.0 to 0.47.0
- [Commits](golang/term@v0.46.0...v0.47.0)

Updates `golang.org/x/tools` from 0.49.0 to 0.51.0
- [Release notes](https://github.com/golang/tools/releases)
- [Commits](golang/tools@v0.49.0...v0.51.0)

Updates `modernc.org/sqlite` from 1.59.0 to 1.60.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.59.0...v1.60.1)

---
updated-dependencies:
- dependency-name: github.com/bluenviron/gortmplib
  dependency-version: 1.0.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: github.com/datarhei/gosrt
  dependency-version: 0.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: github.com/shirou/gopsutil/v4
  dependency-version: 4.26.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/crypto
  dependency-version: 0.58.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/net
  dependency-version: 0.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/sys
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/term
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: golang.org/x/tools
  dependency-version: 0.51.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
- dependency-name: modernc.org/sqlite
  dependency-version: 1.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [actions/setup-node](https://github.com/actions/setup-node) from 7.0.0 to 7.1.0.
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](actions/setup-node@8207627...949feb2)

---
updated-dependencies:
- dependency-name: actions/setup-node
  dependency-version: 7.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
…s/setup-node-7.1.0' into chore/deps-batch-oct
…s/upload-artifact-7.0.2' into chore/deps-batch-oct
…ource/sonarqube-scan-action-8.3.0' into chore/deps-batch-oct
…nd-patch-cf96728e55' into chore/deps-batch-oct

# Conflicts:
#	go.mod
#	go.sum
Applies #893, #891, #889, #887, #886 and #885 in one change (one lockfile
regeneration per package instead of six rebases):
- ui: @playwright/test 1.64, @types/node 24.19.2, @vitejs/plugin-react 6.1.2,
  @vitest/coverage-v8 5.0.3, jsdom 30.1.2, oxlint 1.87, vite 8.3.4,
  lucide-react 1.55, driver.js 1.9.0 (exact, as before), radix group (15).
- web: @vitest/coverage-v8 5.0.3, jsdom 30.1.2, wrangler 4.149.0 and
  @astrojs/markdown-satteri 0.4.3 (both exact, as before).

wrangler 4.149's miniflare now depends on undici 7.29.1 and sharp 0.35.5
itself, which is the removal condition recorded for both version-keyed
overrides, so they are removed; resolved versions are unchanged.

ui: tsc -b, lint, vitest 1113/1113, build. web: astro check, build.
osv-scanner 0 for both lockfiles.

Claude-Session: https://claude.ai/code/session_01A8N3W5ct9SZtHK9sCDD9cL
Copilot AI balanced review requested due to automatic review settings October 14, 2026 17:19

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​@​radix-ui/​react-label@​2.1.15 ⏵ 2.1.171001006699100
Updatednpm/​@​radix-ui/​react-separator@​1.1.15 ⏵ 1.2.010010067 +199100
Updatednpm/​@​radix-ui/​react-progress@​1.1.16 ⏵ 1.2.11001006899 +1100
Updatednpm/​@​radix-ui/​react-slot@​1.3.3 ⏵ 1.5.0100 +110069 +199 +1100
Updatednpm/​@​radix-ui/​react-tabs@​1.1.21 ⏵ 1.2.19910070 +199100
Updatedgolang/​modernc.org/​sqlite@​v1.59.0 ⏵ v1.60.17910010010070 -10
Updatednpm/​@​radix-ui/​react-dropdown-menu@​2.1.24 ⏵ 2.2.1991007199100
Updatednpm/​@​radix-ui/​react-switch@​1.3.7 ⏵ 1.4.19910071 +199100
Updatednpm/​@​radix-ui/​react-checkbox@​1.3.11 ⏵ 1.4.199 +110071 +199 +1100
Updatednpm/​@​radix-ui/​react-dialog@​1.1.23 ⏵ 1.3.19910071 +199100
Updatednpm/​@​radix-ui/​react-accordion@​1.2.20 ⏵ 1.3.199 +110071 +199 +1100
Updatednpm/​@​radix-ui/​react-popover@​1.1.23 ⏵ 1.3.19910071 +199 +1100
Updatednpm/​@​radix-ui/​react-tooltip@​1.2.16 ⏵ 1.4.19910072 +199100
Updatednpm/​@​radix-ui/​react-toast@​1.2.23 ⏵ 1.3.19910072 +199100
Updatednpm/​@​radix-ui/​react-slider@​1.4.7 ⏵ 1.6.19910072 +199 +1100
Updatednpm/​@​radix-ui/​react-select@​2.3.7 ⏵ 2.4.199 +110073 +199 +1100
Updatedgolang/​golang.org/​x/​crypto@​v0.57.0 ⏵ v0.58.074 +1100100100100
Updatedgolang/​golang.org/​x/​tools@​v0.49.0 ⏵ v0.51.075 +1100100100100
Updatednpm/​@​vitest/​coverage-v8@​5.0.2 ⏵ 5.0.499 +110079 +198100
Updatednpm/​vitest@​5.0.2 ⏵ 5.0.49810079 +198 -1100
Updatednpm/​lucide-react@​1.48.0 ⏵ 1.57.010010098 +196 +180
Updatednpm/​@​types/​node@​24.19.0 ⏵ 24.19.2100 +110081 +196100
Updatednpm/​driver.js@​1.8.0 ⏵ 1.9.0100 +110093 +183 -8100
Updatedgolang/​golang.org/​x/​sys@​v0.48.0 ⏵ v0.49.084 +1100100100100
Updatednpm/​oxlint@​1.85.0 ⏵ 1.88.099 +110091 +196100
Updatedgolang/​github.com/​shirou/​gopsutil/​v4@​v4.26.8 ⏵ v4.26.991100100100100
Updatednpm/​wrangler@​4.142.0 ⏵ 4.149.0981009296100
Updatednpm/​@​vitejs/​plugin-react@​6.1.1 ⏵ 6.1.2100 +1100100 +193 -1100
Updatednpm/​jsdom@​30.1.1 ⏵ 30.1.29810010095100
Updatedgolang/​github.com/​datarhei/​gosrt@​v0.11.0 ⏵ v0.12.098 +1100100100100
Updatedgolang/​github.com/​bluenviron/​gortmplib@​v1.0.3 ⏵ v1.0.498100100100100
Updatednpm/​@​playwright/​test@​1.63.0 ⏵ 1.64.110010010099100
See 1 more rows in the dashboard

View full report

@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants