Dependencies: 2026-06-26

[lkacenja]

Consolidates the safe + reviewed Dependabot updates into grouped commits. Once merged, Dependabot will auto-close the superseded individual PRs.

GitHub Actions

• actions/checkout 6 → 7 (Bump actions/checkout from 6 to 7 #456)
• actions/setup-python 6 → 6.2.0 (Bump actions/setup-python from 6 to 6.2.0 #455)
• ruby/setup-ruby 1 → 1.313.0 (Bump ruby/setup-ruby from 1 to 1.313.0 #453)
• aws-actions/amazon-ecr-login 2 → 2.1.5 (Bump aws-actions/amazon-ecr-login from 2 to 2.1.5 #448)
• aws-actions/configure-aws-credentials 6 → 6.1.3 (Bump aws-actions/configure-aws-credentials from 6 to 6.1.3 #446)

Ruby gems

Majors (reviewed, full suite passing):

• puma 7.2.0 → 8.0.2 (Bump puma from 7.2.0 to 8.0.1 #435)
• grape 2.4.0 → 3.3.0 (Bump grape from 2.4.0 to 3.2.1 #418)
• brakeman 7.1.2 → 8.0.5 (Bump brakeman from 7.1.2 to 8.0.4 #411)

Minor/patch:

• view_component 4.6.0 → 4.12.0 (Bump view_component from 4.6.0 to 4.8.0 #421)
• selenium-webdriver 4.41.0 → 4.45.0 (Bump selenium-webdriver from 4.41.0 to 4.43.0 #416)
• aws-sdk-s3 1.218.0 → 1.226.0 (Bump aws-sdk-s3 from 1.218.0 to 1.220.0 #434)
• aws-sdk-lambda 1.176.0 → 1.185.0 (Bump aws-sdk-lambda from 1.176.0 to 1.178.0 #431)
• smarter_csv 1.16.2 → 1.18.0 (Bump smarter_csv from 1.16.2 to 1.16.4 #436)
• overcommit 0.68.0 → 0.69.0 (Bump overcommit from 0.68.0 to 0.69.0 #409)

JS packages

• esbuild 0.25.0 → 0.28.1 (Bump esbuild from 0.25.0 to 0.28.1 #452)
• swagger-ui-dist 5.27.1 → 5.32.8 (Bump swagger-ui-dist from 5.27.1 to 5.32.6 #439)
• chart.js 4.4.9 → 4.5.1 (Bump chart.js from 4.4.9 to 4.5.1 #430)
• postcss 8.5.1 → 8.5.15 (Bump postcss from 8.5.1 to 8.5.15 #442)
• autoprefixer 10.4.20 → 10.5.1 (Bump autoprefixer from 10.4.20 to 10.5.0 #429)

Verification

• rspec (models/requests/tasks/helpers): 58 examples, 0 failures
• rspec spec/features: passing (one flaky chromedriver crash under full-suite load, passes in isolation — pre-existing)
• brakeman -q -w2: no warnings
• yarn build + yarn build:css: succeed

Notes

• grape 3: grape-swagger 2.1.4 (latest) emits a desc() positional-Hash deprecation under grape 3. Upstream lag; Swagger docs still generate and all API specs pass.

Deliberately excluded

• thruster 0.1.20 (Bump thruster from 0.1.15 to 0.1.20 #408) — held at 0.1.15; 0.1.17+ breaks ECS deploy (port binding). Closing that PR.
• tailwindcss 4 (Bump tailwindcss from 3.4.19 to 4.3.1 #454) + daisyui 5 (Bump daisyui from 4.12.23 to 5.5.23 #450) — coupled major migration, deferred to its own effort.
• @fortawesome/fontawesome-free 7 (Bump @fortawesome/fontawesome-free from 6.7.2 to 7.2.0 #426) — deferred with the frontend migration.

🤖 Generated with Claude Code