chore(deps): consolidate dependabot updates

[kentwelcome]

Summary

Consolidates the following Dependabot PRs into a single tested update:

• Closes chore(deps): Bump python-multipart from 0.0.20 to 0.0.26 #1317 -- chore(deps): Bump python-multipart from 0.0.20 to 0.0.26
• Closes chore(deps): Bump pytest from 8.4.2 to 9.0.3 #1307 -- chore(deps): Bump pytest from 8.4.2 to 9.0.3
• Closes chore(deps): Bump uv from 0.9.10 to 0.11.6 #1296 -- chore(deps): Bump uv from 0.9.10 to 0.11.6
• Closes chore(deps): Bump the all-minor-patch group across 1 directory with 16 updates #1292 -- chore(deps): Bump the all-minor-patch group across 1 directory with 16 updates

Changes

Package	From	To	Ecosystem
python-multipart	0.0.20	0.0.26	pip
pytest	8.4.2	9.0.3	pip
pytest-asyncio	0.26.0	1.3.0	pip
uv	0.9.10	0.11.7	pip
ag-grid-community	^35.2.0	^35.2.1	npm
ag-grid-react	^35.2.0	^35.2.1	npm
import-in-the-middle	^3.0.0	^3.0.1	npm
@amplitude/analytics-core	^2.44.1	^2.45.0	npm
@types/node	^25.5.0	^25.6.0	npm
@vitest/coverage-v8	^4.1.2	^4.1.4	npm
postcss	^8.5.8	^8.5.9	npm
vitest	^4.1.2	^4.1.4	npm
@vitest/browser-playwright	^4.1.2	^4.1.4	npm
msw	^2.12.14	^2.13.2	npm

Breaking change fixes

• pytest 9 collection failure: pytest 9 made collection errors fatal. The vendored tests/adapter/dbt_adapter/test_proj/dbt_packages/dbt_utils/tests directory triggered a ModuleNotFoundError that was previously non-fatal in pytest 8 but now aborts test collection entirely. Fixed by adding addopts = "--ignore=tests/adapter/dbt_adapter/test_proj/dbt_packages" to [tool.pytest.ini_options] in pyproject.toml.
• @datarecce/ui postcss floor: Reverted the postcss devDependency floor in js/packages/ui/package.json from ^8.5.9 back to ^8.5.0. The root lockfile still resolves to 8.5.10 via pnpm overrides — the floor bump was unnecessary and violated the convention of not bumping @datarecce/ui dependency floors during Dependabot consolidation.

@datarecce/ui Impact

No consumer-facing dependency changes. All @datarecce/ui dependency floors remain unchanged — the root lockfile resolves newer versions but consumers on existing minimum versions are unaffected.

Test plan

• Python tests pass (1061 passed, 1106 warnings)
• Frontend tests pass (153 files, 3681 passed)
• Lint passes (biome + flake8)
• Type-check passes (tsc)
• Build succeeds (Next.js static export)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Consolidates multiple Dependabot updates into a single dependency refresh across the Python (uv/pytest stack) and JS (Next.js workspace) parts of the monorepo.

Changes:

• Updated Python dependency lockfile (uv.lock) to newer versions of pytest, pytest-asyncio, python-multipart, and uv (plus newly introduced transitive deps).
• Updated JS lockfile (js/pnpm-lock.yaml) to newer patch/minor versions for several frontend dependencies and test tooling.
• Updated JS workspace package.json files to reflect the bumped dependency ranges (root app, Storybook package, and UI package dev tooling).

Reviewed changes

Copilot reviewed 3 out of 5 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
uv.lock	Bumps Python tool/test/runtime deps (notably pytest, pytest-asyncio, python-multipart, uv) and updates resolved artifacts.
js/pnpm-lock.yaml	Updates resolved dependency graph for the JS workspace after version bumps.
js/packages/ui/package.json	Updates UI package dev tooling version range for postcss.
js/packages/storybook/package.json	Bumps Storybook package testing/tooling deps (vitest, msw, vitest browser tooling).
js/package.json	Bumps root JS workspace deps/devDeps and aligns pnpm.overrides with the updated versions.

Files not reviewed (1)

• js/pnpm-lock.yaml: Language not supported

[gcko]

Code Review — PR #1318

Summary

Dependency consolidation PR upgrading Python and frontend packages. Two critical issues found: pytest 9 breaks make test, and @datarecce/ui postcss floor was bumped unnecessarily.

Findings

[Critical] pytest 9 breaks make test — collection error is now fatal

File: uv.lock (pytest 8.4.2 → 9.0.3)
Issue: pytest 9 changed error handling during test collection. The pre-existing ModuleNotFoundError from tests/adapter/dbt_adapter/test_proj/dbt_packages/dbt_utils/tests was previously non-fatal (pytest 8 collected 1061 tests despite the error). In pytest 9, this same error causes Interrupted: 1 error during collection — zero tests run.

Running make test (which executes python3 -m pytest tests) now fails outright:

ERROR tests/adapter/dbt_adapter/test_proj/dbt_packages/dbt_utils/tests - ModuleNotFoundError: No module named 'tests.conftest'
!!!!!!!!!!!!!!!!!!!! Interrupted: 1 error during collection !!!!!!!!!!!!!!!!!!!!

Suggestion: Either:

1. Add --ignore=tests/adapter/dbt_adapter/test_proj/dbt_packages to the make test command, or
2. Add the path to [tool.pytest.ini_options] testpaths / collect_ignore_glob in pyproject.toml, or
3. Add a conftest.py / __init__.py exclusion to prevent pytest from descending into vendored packages.

This is the highest-priority fix — CI will fail on this PR as-is.

[Warning] @datarecce/ui postcss devDependency floor bumped from ^8.5.0 to ^8.5.9

File: js/packages/ui/package.json:181
Issue: The postcss floor in @datarecce/ui was raised from ^8.5.0 to ^8.5.9. Per project conventions, @datarecce/ui dependency floors should not be bumped during Dependabot consolidation unless API changes require it. This is a devDependency so impact is limited to package development, but it's inconsistent with the PR's own claim: "All @datarecce/ui dependency floors remain unchanged."

Suggestion: Revert to "postcss": "^8.5.0" in js/packages/ui/package.json. The root lockfile will still resolve to 8.5.10 via the pnpm override — the floor bump is unnecessary.

Verification Results

Check	Result
make test (python3 -m pytest tests)	FAIL — collection error from dbt_packages
pytest --ignore=dbt_packages	PASS — 1061 passed
pnpm test	PASS — 3681 passed (153 files)
pnpm lint (biome)	PASS
pnpm type:check (tsc)	PASS
make flake8	PASS

Verdict

⚠️ Issues Found — The pytest 9 collection breakage must be fixed before merge. The @datarecce/ui postcss floor bump should be reverted per project convention.

[gcko]

Claude Code Review: Critical issues found — pytest 9 breaks make test (collection error now fatal), and @datarecce/ui postcss floor was bumped against project convention. See review comment for details.

[gcko]

Code Review — PR #1318

Summary

Dependency consolidation PR bumping 14 packages (4 Python, 10 npm) including two major Python version bumps (pytest 8→9, pytest-asyncio 0.26→1.3). All verification passes — no critical issues found.

Antagonistic Review — Dependency Risk Analysis

pytest 8 → 9 (Major)

The addopts = "--ignore=tests/adapter/dbt_adapter/test_proj/dbt_packages" fix in pyproject.toml:110 is the correct approach for pytest 9's stricter collection. Verified: 1061 tests pass with no collection errors.

pytest-asyncio 0.26 → 1.3 (Major)

This is the highest-risk change. The asyncio_default_fixture_loop_scope = "function" config (pyproject.toml:109) is still supported in 1.x. Checked tests/apis/test_check_api.py:37, test_check_events_api.py:33, and test_run_func.py:333 — they use asyncio.get_event_loop().run_until_complete() in sync helpers, not as fixtures, so they're unaffected by the event loop management changes. New transitive dep backports-asyncio-runner is correctly scoped to Python < 3.11 only.

python-multipart 0.0.20 → 0.0.26

Patch bump within 0.x range. This is a FastAPI dependency for multipart form parsing. Tests cover the API surface adequately — no runtime concerns.

uv 0.9.10 → 0.11.7 (Major)

Build/dev tool only — no runtime impact. Lock file regenerated cleanly.

@datarecce/ui Impact

Confirmed: js/packages/ui/package.json has zero changes in this PR. The postcss devDependency floor remains at ^8.5.0. Root lockfile resolves to 8.5.10 via pnpm overrides. Convention correctly followed.

npm Minor/Patch Bumps

ag-grid 35.2.0→35.2.1, vitest 4.1.2→4.1.4, msw 2.12→2.13, postcss 8.5.8→8.5.9 — all minor/patch. 3681 frontend tests pass, type-check clean, biome lint clean.

Verification Results

Check	Result
Python tests	1061 passed
flake8	Clean
Frontend tests	153 files, 3681 passed, 5 skipped
TypeScript type-check	Clean
Biome lint	606 files checked, no issues

Verdict

✅ Approved — All dependency bumps are safe. Both major Python version jumps have been properly mitigated. No @datarecce/ui floors were modified. Full test suite green.

[gcko]

Claude Code Review: No critical issues found. All dependency bumps verified safe — full test suite green.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.