deps: batching and compatibility plan for the 13 open PRs (corrects #308 snapshot)

[WalksWithASwagger]

Summary

Single tracking issue for the 13 currently-open pull requests (12 Dependabot + Fellowship handoff #403), with a classification and a compatibility-aware batching plan. Corrects the stale "zero open pull requests" line in epic #308's 2026-07-20 snapshot. No merges are performed here.

Context

• As of 2026-08-02 there are 13 open PRs. Epic epic: repository health and release-readiness swarm #308's snapshot (2026-07-20) predates all of them and still says the tree is PR-free.
• Repo convention (from epic: repository health and release-readiness swarm #308 "Completed Foundation"): minor/patch → batched (e.g. root batch PR build(deps): bump the root-npm group across 1 directory with 2 updates #365, frontend batch PR build(deps): bump the frontend-npm group across 1 directory with 11 updates #366); each major → a dedicated deps(…) land PR #XXX issue (e.g. deps(frontend): upgrade to TypeScript 7 (land PR #383) #388 TypeScript 7, deps: migrate OpenAI provider to python SDK 2.x (land PR #374) #392 OpenAI SDK 2.x, deps: migrate CLI to commander 15 (land PR #379) #389 commander 15).

Open-PR classification

PR	Bump	Kind	Classification
#404 puppeteer 25.3.0→25.4.0 (root group)	minor	runtime tool	Safe / batchable (puppeteer-25 E2E validated in #391)
#406 pip-audit ≥2.7→≥2.10.1	minor	dev	Safe / batchable
#405 chalk 5→6 (root)	major	runtime	Breaking-major → dedicated issue
#407 google-genai 1→2	major	core runtime (Gemini provider)	Breaking-major → dedicated migration issue
#410 mcp 1→2	major	core runtime (MCP surface)	Breaking-major → dedicated migration issue
#408 tenacity 8→9	major	runtime (retry)	Breaking-major → dedicated issue
#413 eslint 9→10 (frontend)	major	dev	Breaking-major, mutually blocking with #414
#414 eslint-plugin-react-hooks 5→7 (frontend)	major	dev	Breaking-major, mutually blocking with #413
#412 jsdom 29→30 (frontend)	major	dev-test	Breaking-major (frontend dev-tooling group)
#409 @testing-library/jest-dom 6→7 (frontend)	major	dev-test	Breaking-major (frontend dev-tooling group)
#411 pytest 8→9	major	dev-test	Breaking-major (python dev-tooling)
#383 typescript 5.9→7 (frontend)	major	dev	Superseded — already tracked by #388
#403 Fellowship handoff docs	—	non-dependency	Human review required (merge decision)

No two PRs bump the same package → no duplicates. Only coupling: #413 ⇄ #414 (eslint 10 and its react-hooks plugin must land as one set).

Proposed batches (all merges require human approval — no unreviewed dependency merge)

1. Safe-minor batch: build(deps): bump puppeteer from 25.3.0 to 25.4.0 in the root-npm group #404, build(deps-dev): update pip-audit requirement from >=2.7.0 to >=2.10.1 #406.
2. Python runtime majors (sequential, each needs-human, dedicated issue): build(deps): update google-genai requirement from >=1.0.0 to >=2.16.0 #407 google-genai 2.x → build(deps): update mcp requirement from >=1.0.0 to >=2.0.0 #410 mcp 2.x → build(deps): update tenacity requirement from >=8.0.0 to >=9.1.4 #408 tenacity 9.x. Highest risk; mirror the deps: migrate OpenAI provider to python SDK 2.x (land PR #374) #392 migration pattern.
3. Root runtime major: build(deps): bump chalk from 5.6.2 to 6.0.0 #405 chalk 6 — dedicated issue.
4. Frontend lint set (coupled): build(deps-dev): bump eslint from 9.39.5 to 10.8.0 in /frontend #413 + build(deps-dev): bump eslint-plugin-react-hooks from 5.2.0 to 7.1.1 in /frontend #414 land together.
5. Frontend dev-test group: build(deps-dev): bump jsdom from 29.1.1 to 30.0.1 in /frontend #412 jsdom 30, build(deps-dev): bump @testing-library/jest-dom from 6.9.1 to 7.0.0 in /frontend #409 jest-dom 7 — validate via npm test.
6. Python dev-test: build(deps-dev): update pytest requirement from >=8.0 to >=9.1.1 #411 pytest 9.
7. TypeScript 7 (build(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /frontend #383): no new issue — tracked by deps(frontend): upgrade to TypeScript 7 (land PR #383) #388.

Acceptance Criteria

• Each major has (or gets, on maintainer go-ahead) a dedicated deps(…) land PR #XXX issue before merge.
• The build(deps-dev): bump eslint from 9.39.5 to 10.8.0 in /frontend #413 ⇄ build(deps-dev): bump eslint-plugin-react-hooks from 5.2.0 to 7.1.1 in /frontend #414 coupling is honored (landed together or not at all).
• The safe-minor batch is merged only after human approval.
• No dependency PR is merged without review.

Notes

• Dedicated migration issues for build(deps): update google-genai requirement from >=1.0.0 to >=2.16.0 #407 / build(deps): update mcp requirement from >=1.0.0 to >=2.0.0 #410 / build(deps): update tenacity requirement from >=8.0.0 to >=9.1.4 #408 / build(deps): bump chalk from 5.6.2 to 6.0.0 #405 to be spawned once KK approves the sequencing.
• Rolls up under epic epic: repository health and release-readiness swarm #308.

[WalksWithASwagger]

Progress — 2026-08-02 (Kris approved: prep majors + merge safe-minor)

Safe-minor batch — merging now (strict branch protection requires up-to-date + test/secret-scan green, so these are being brought up to date and squash-merged one at a time):

• build(deps): bump puppeteer from 25.3.0 to 25.4.0 in the root-npm group #404 puppeteer 25.4.0
• build(deps-dev): update pip-audit requirement from >=2.7.0 to >=2.10.1 #406 pip-audit ≥2.10.1

Dedicated major-migration issues created (mirroring #388/#392; each needs-human, no merge without review):

• deps: migrate google-genai to 2.x (land PR #407) #421 — google-genai 2.x (lands PR build(deps): update google-genai requirement from >=1.0.0 to >=2.16.0 #407)
• deps: migrate mcp SDK to 2.x (land PR #410) #422 — mcp SDK 2.x (lands PR build(deps): update mcp requirement from >=1.0.0 to >=2.0.0 #410)
• deps: migrate tenacity to 9.x (land PR #408) #423 — tenacity 9.x (lands PR build(deps): update tenacity requirement from >=8.0.0 to >=9.1.4 #408)
• deps: migrate chalk to 6.x (land PR #405) #424 — chalk 6.x (lands PR build(deps): bump chalk from 5.6.2 to 6.0.0 #405)
• deps(frontend): land eslint 10 + react-hooks 7 as one set (PRs #413/#414) #425 — eslint 10 + react-hooks 7 as one coupled set (lands PRs build(deps-dev): bump eslint from 9.39.5 to 10.8.0 in /frontend #413/build(deps-dev): bump eslint-plugin-react-hooks from 5.2.0 to 7.1.1 in /frontend #414)

Sequencing: Python runtime majors land in order #421 → #422 → #423. #424 (chalk) is standalone. #425 lands #413/#414 together.

Still grouped, not yet individually ticketed (dev-test majors — validate via npm test): #412 jsdom 30, #409 jest-dom 7, #411 pytest 9. #383 typescript 7 remains tracked by #388.

[WalksWithASwagger]

Swarm outcome — Lane 1 low-risk tier + held items (2026-08-02)

All work below was produced as review-ready PRs, verified on GitHub Actions CI (Node 22.13 / Python 3.11) — none merged or auto-merged.

✅ Green & review-ready (ready for your merge):

PR	Bump	Supersedes	test
#405	chalk 6	—	pass
#411	pytest 9	—	pass
#426	jsdom 30 + @testing-library/jest-dom 7	#412, #409	pass
#427	eslint 10 + eslint-plugin-react-hooks 7	#413, #414	pass

#426 and #427 are consolidated PRs that supersede their Dependabot pairs — close #412/#409 and #413/#414 when you merge these. (#427 downgraded react-hooks 7's new set-state-in-effect rule to warn for intentional SSR-safe mount effects — targeted, no source changes.)

⛔ Held — blocked upstream (do not force):

• deps(frontend): TypeScript 7 (lands #383, issue #388) #428 TypeScript 7 — CI fails at install: typescript-eslint peers typescript <6.1; no released typescript-eslint supports TS7 yet (upstream typescript-eslint#10940, targets TS ≥7.1). Locally tsc/vite build/vitest all pass under TS7 — purely an ecosystem gap, zero source type errors. Issue deps(frontend): upgrade to TypeScript 7 (land PR #383) #388 labeled blocked; recommend holding on TS 5.9.x. Dependabot build(deps-dev): bump typescript from 5.9.3 to 7.0.2 in /frontend #383 left open.

Core-runtime majors (held for a careful serial pass):

• 🟢 build(deps): update tenacity requirement from >=8.0.0 to >=9.1.4 #408 tenacity 9 — unexpectedly GREEN/CLEAN as-is; can be fast-tracked (issue deps: migrate tenacity to 9.x (land PR #408) #423).
• 🔴 build(deps): update google-genai requirement from >=1.0.0 to >=2.16.0 #407 google-genai 2 (deps: migrate google-genai to 2.x (land PR #407) #421) and build(deps): update mcp requirement from >=1.0.0 to >=2.0.0 #410 mcp 2 (deps: migrate mcp SDK to 2.x (land PR #410) #422) — CI red; genuine migration work needed; correctly held.

Ops learning (applies to every future frontend dep PR): regenerate frontend/package-lock.json with npm 10.9.2 (CI's version), not the local npm 11 — a lockfile from npm 11 fails CI's npm ci with "Missing … from lock file." This bit both frontend PRs until corrected.