From bbf3993d89a1f91903b90b0deb00c43a26981853 Mon Sep 17 00:00:00 2001 From: Andrew Chin Date: Mon, 24 Aug 2026 21:25:12 -0400 Subject: [PATCH 1/4] chore(deps): bump astral-sh/setup-uv from 9.0.0 to 10.0.1 Combines Dependabot PR #363. Signed-off-by: Andrew Chin --- .github/workflows/ci.yml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0d54098c..7214bdfe 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - run: uv sync --frozen --dev @@ -41,7 +41,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - name: sync @@ -60,7 +60,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - run: uv sync --frozen --dev @@ -171,7 +171,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - run: uv sync --frozen --dev @@ -315,7 +315,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - run: uv sync --frozen --dev @@ -442,7 +442,7 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 + - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1 with: enable-cache: true - run: uv sync --frozen --dev From 7ae8e83fe53d98e049e1f28e6092cd3865e17685 Mon Sep 17 00:00:00 2001 From: Andrew Chin Date: Mon, 24 Aug 2026 21:25:16 -0400 Subject: [PATCH 2/4] chore(deps): update uvicorn requirement from >=0.52.1 to >=0.52.3 Combines Dependabot PRs #364 (builder-sidecar) and #365 (runner-sidecar). Signed-off-by: Andrew Chin --- oss-crs-infra/builder-sidecar/requirements.txt | 2 +- oss-crs-infra/runner-sidecar/requirements.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/oss-crs-infra/builder-sidecar/requirements.txt b/oss-crs-infra/builder-sidecar/requirements.txt index 37149f8b..d62f6e21 100644 --- a/oss-crs-infra/builder-sidecar/requirements.txt +++ b/oss-crs-infra/builder-sidecar/requirements.txt @@ -1,5 +1,5 @@ fastapi>=0.141.1 -uvicorn>=0.52.1 +uvicorn>=0.52.3 docker>=7.2.0 pydantic>=2.13.4 python-multipart>=0.0.32 diff --git a/oss-crs-infra/runner-sidecar/requirements.txt b/oss-crs-infra/runner-sidecar/requirements.txt index 5c86160d..6b798654 100644 --- a/oss-crs-infra/runner-sidecar/requirements.txt +++ b/oss-crs-infra/runner-sidecar/requirements.txt @@ -1,4 +1,4 @@ fastapi>=0.141.1 -uvicorn>=0.52.1 +uvicorn>=0.52.3 pydantic>=2.13.4 python-multipart>=0.0.32 From 38852afbad5591c97c581c3584606b6a0d369a90 Mon Sep 17 00:00:00 2001 From: Andrew Chin Date: Mon, 24 Aug 2026 21:25:19 -0400 Subject: [PATCH 3/4] chore(deps): bump js-yaml from 5.2.3 to 5.3.0 in /site Combines Dependabot PR #366. Signed-off-by: Andrew Chin --- site/package-lock.json | 8 ++++---- site/package.json | 2 +- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/site/package-lock.json b/site/package-lock.json index 307d9fbc..7f07d81c 100644 --- a/site/package-lock.json +++ b/site/package-lock.json @@ -12,7 +12,7 @@ "@docusaurus/preset-classic": "^3.10.2", "@mdx-js/react": "^3.0.0", "clsx": "^2.1.0", - "js-yaml": "^5.2.3", + "js-yaml": "^5.3.0", "prism-react-renderer": "^2.4.0", "react": "^19.2.8", "react-dom": "^19.2.8" @@ -10393,9 +10393,9 @@ "license": "MIT" }, "node_modules/js-yaml": { - "version": "5.2.3", - "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz", - "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==", + "version": "5.3.0", + "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.3.0.tgz", + "integrity": "sha512-muutsYr+e2+d3rTgUGslq5rxbBlUy3cJ61IsHag2QNDQV+7zXWjkUpmALIajhrlLlrgRUiymj6U3zUr/TMK84Q==", "funding": [ { "type": "github", diff --git a/site/package.json b/site/package.json index cb1e4539..3e67e0b6 100644 --- a/site/package.json +++ b/site/package.json @@ -16,7 +16,7 @@ "@docusaurus/preset-classic": "^3.10.2", "@mdx-js/react": "^3.0.0", "clsx": "^2.1.0", - "js-yaml": "^5.2.3", + "js-yaml": "^5.3.0", "prism-react-renderer": "^2.4.0", "react": "^19.2.8", "react-dom": "^19.2.8" From c2d932d0e144a01bfb5421c471314cde5b51c3d1 Mon Sep 17 00:00:00 2001 From: Andrew Chin Date: Mon, 24 Aug 2026 21:25:38 -0400 Subject: [PATCH 4/4] chore(deps): bump postgres from 18.4 to 18.6 in /oss-crs-infra Combines Dependabot PR #362. Resolves the new digest to its version tag (18.6, not 18.4 as Dependabot carried over) and syncs it to constants.py. Signed-off-by: Andrew Chin --- oss-crs-infra/dependabot-pins.Dockerfile | 2 +- oss_crs/src/constants.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/oss-crs-infra/dependabot-pins.Dockerfile b/oss-crs-infra/dependabot-pins.Dockerfile index 20b81d60..e3bcb8dd 100644 --- a/oss-crs-infra/dependabot-pins.Dockerfile +++ b/oss-crs-infra/dependabot-pins.Dockerfile @@ -8,4 +8,4 @@ # NIX_BUILDER_IMAGE feeds libCRS/deps.Dockerfile as a build-arg, and ALPINE_IMAGE # is commented only "3.x latest", so its real version needs pinning down first. FROM ghcr.io/berriai/litellm-database@sha256:8075b09298dc2453316ebe6152603da34d4b1a0661a3cd756a11191a5b40d59c # v1.94.0 -FROM postgres@sha256:a02db8cac496f15b094798a38254f14d6e00741f709360e5e00bb6668ea31636 # 18.4 +FROM postgres@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941 # 18.6 diff --git a/oss_crs/src/constants.py b/oss_crs/src/constants.py index dbf0df3b..44280b64 100644 --- a/oss_crs/src/constants.py +++ b/oss_crs/src/constants.py @@ -1,7 +1,7 @@ # SPDX-License-Identifier: MIT # Container images used by the infrastructure sidecar stack. LITELLM_IMAGE = "ghcr.io/berriai/litellm-database@sha256:8075b09298dc2453316ebe6152603da34d4b1a0661a3cd756a11191a5b40d59c" # v1.94.0 -POSTGRES_IMAGE = "postgres@sha256:a02db8cac496f15b094798a38254f14d6e00741f709360e5e00bb6668ea31636" # 18.4 +POSTGRES_IMAGE = "postgres@sha256:06cad38a5d9f5d24b4d83d86def30795d5e4b757fedbf5281172b576dedcd941" # 18.6 # Stable local tags for the internal LiteLLM stack images. ``prepare`` pulls # each by its immutable digest and applies the local tag; the run template