[cjimti]

Description

Thirteen version bumps from fourteen Dependabot PRs (#2316 through #2329), in go.mod, bench/go.mod, ui/package.json, ui/package-lock.json, and four workflows: codeql.yml, scorecard.yml, e2e-nightly.yml and release.yml. One older Dependabot PR is not taken.

Closes #2334

Taken

Package	From	To	Dependabot PR
github.com/aws/smithy-go	1.28.5	1.28.6	#2316
github.com/klippa-app/go-pdfium	1.21.3	1.21.4	#2317
golang.org/x/image	0.46.0	0.47.0	#2318
github.com/vektah/gqlparser/v2	2.5.63	2.5.64	#2319
github.com/getkin/kin-openapi (root module)	0.151.0	0.152.0	#2320
github.com/getkin/kin-openapi (bench module)	0.150.0	0.152.0	none; taken to match the root module
github/codeql-action init, autobuild, upload-sarif	4.39.0	4.39.1 (9b325408)	#2325, #2322, #2321
github/codeql-action/analyze	4.39.0	4.39.1 (9b325408)	none; moved with the other three, which share one commit
actions/download-artifact	8.0.1	8.0.2 (9000827c)	#2324
docker/login-action	4.6.0	4.7.0 (81c6f93d)	#2323
hyparquet	^1.31.1	^1.31.5	#2326
papaparse	^5.5.3	^5.7.0	#2327
@tanstack/react-query	^5.75.0	^5.104.5	#2328
@eslint/js	^9.27.0	^10.0.1	#2329

• Indirect: go mod tidy also moves the indirect github.com/agnivade/levenshtein to 1.2.2 in the root module.
• Unchanged: the go directive (go 1.27.0) and the toolchain (go1.27.3).
• Action SHAs: each matches its release tag (gh api repos/<owner>/<repo>/commits/<tag>) and the SHA Dependabot proposed.
• @eslint/js 10: this is the major that matches the installed eslint 10.13.0.
• Lockfile: the package-lock.json change is limited to these four packages and their dependencies: 35 lines added, 21 removed.

Not taken

typescript 5.9.3 to 7.0.2 (#2155), held back for the same reasons as in #2166:

• typescript-eslint 8.72.0, its latest release, declares the peer range >=4.8.4 <6.1.0.
• openapi-typescript 7.13.0, which npm run generate-api-types runs, declares ^5.x.
• ui/tsconfig.json sets baseUrl, which TypeScript 7 removed. When deps: roll up open Dependabot PRs (#2152-#2165) #2163's rollup tried 7.0.2, tsc -b failed with TS5102: Option 'baseUrl' has been removed and npm run lint failed inside eslint-plugin-sonarjs.

TypeScript 6.0.3 is within typescript-eslint's range but outside openapi-typescript's ^5.x, so it is blocked too.

Merging this leaves #2155 open; Dependabot closes the others once their versions are on main.

Testing

• make verify passed ("All checks passed").
• npm run lint, npm run build and the full vitest suite (309 files, 3,363 tests) passed after the UI bumps.
• go test ./... passed, and the bench module builds and vets.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.79%. Comparing base (96a6438) to head (3f1a3ca).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2335      +/-   ##
==========================================
- Coverage   94.79%   94.79%   -0.01%     
==========================================
  Files        1417     1422       +5     
  Lines      115071   115639     +568     
==========================================
+ Hits       109087   109623     +536     
- Misses       5965     5996      +31     
- Partials       19       20       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.