build(deps): dependabot sweep 2 (rust, actions, react-email, pulumi, pi) by raivieiraadriano92 · Pull Request #1106 · thunderbird/thunderbolt

raivieiraadriano92 · 2026-07-22T14:19:06Z

Second Dependabot sweep — the next wave after #1099/#1100/#1101 merged. One commit per PR.

Adopts	Change	Dir
#1102	serde, serde_json, anyhow, tokio, tauri-plugin-store	`src-tauri` (lock-only)
#1103	actions group: setup-java 5.6, ruby/setup-ruby, claude-code-action, taiki-e/install-action (all same-major)	`.github/workflows`
#1104	`@react-email/ui` 6.6.8 → 6.8.1	`backend` (dev)
#946	`@pulumi/docker-build` 0.0.17 → 0.0.20	`deploy/pulumi`
#1105	`@earendil-works/pi-` 0.80.3 → 0.80.7 (partial*)	root

#1105 handled partially — two exclusions

@anthropic-ai/sdk 0.91.1 → 0.111.0 excluded: pi-ai 0.80.7 still hard-pins @anthropic-ai/sdk@0.91.1; bumping ours would break the shared client handed to pi-ai. Same block as build(deps): adopt frontend & backend minor-and-patch groups (excl. anthropic-sdk) #1100.
katex 0.16.47 → 0.17.0 excluded: held at ^0.16 to match rehype-katex's bundled engine (avoids the CSS/engine split).

Only the pi-* patch bumps are taken; a single @anthropic-ai/sdk copy remains (no skew).

Verified

root typecheck ✓, backend typecheck ✓ (react-email 6.8.1)
anthropic-model test 12/0 (pi 0.80.7), cargo tree --locked ✓

Supersedes #1102, #1103, #1104, #946. #1105 stays open (its anthropic-sdk + katex items are intentionally deferred).

… updates Bumps the minor-and-patch group with 5 updates in the /src-tauri directory: | Package | From | To | | --- | --- | --- | | [serde](https://github.com/serde-rs/serde) | `1.0.228` | `1.0.229` | | [serde_json](https://github.com/serde-rs/json) | `1.0.150` | `1.0.151` | | [anyhow](https://github.com/dtolnay/anyhow) | `1.0.103` | `1.0.104` | | [tokio](https://github.com/tokio-rs/tokio) | `1.52.4` | `1.53.1` | | [tauri-plugin-store](https://github.com/tauri-apps/plugins-workspace) | `2.4.3` | `2.4.4` | Updates `serde` from 1.0.228 to 1.0.229 - [Release notes](https://github.com/serde-rs/serde/releases) - [Commits](serde-rs/serde@v1.0.228...v1.0.229) Updates `serde_json` from 1.0.150 to 1.0.151 - [Release notes](https://github.com/serde-rs/json/releases) - [Commits](serde-rs/json@v1.0.150...v1.0.151) Updates `anyhow` from 1.0.103 to 1.0.104 - [Release notes](https://github.com/dtolnay/anyhow/releases) - [Commits](dtolnay/anyhow@1.0.103...1.0.104) Updates `tokio` from 1.52.4 to 1.53.1 - [Release notes](https://github.com/tokio-rs/tokio/releases) - [Commits](tokio-rs/tokio@tokio-1.52.4...tokio-1.53.1) Updates `tauri-plugin-store` from 2.4.3 to 2.4.4 - [Release notes](https://github.com/tauri-apps/plugins-workspace/releases) - [Commits](tauri-apps/plugins-workspace@fs-v2.4.3...fs-v2.4.4) --- updated-dependencies: - dependency-name: anyhow dependency-version: 1.0.104 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: serde dependency-version: 1.0.229 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: serde_json dependency-version: 1.0.151 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tauri-plugin-store dependency-version: 2.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: tokio dependency-version: 1.53.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the actions group with 4 updates in the / directory: [actions/setup-java](https://github.com/actions/setup-java), [ruby/setup-ruby](https://github.com/ruby/setup-ruby), [anthropics/claude-code-action](https://github.com/anthropics/claude-code-action) and [taiki-e/install-action](https://github.com/taiki-e/install-action). Updates `actions/setup-java` from 5.5.0 to 5.6.0 - [Release notes](https://github.com/actions/setup-java/releases) - [Commits](actions/setup-java@0f481fc...03ad4de) Updates `ruby/setup-ruby` from 1.316.0 to 1.318.0 - [Release notes](https://github.com/ruby/setup-ruby/releases) - [Changelog](https://github.com/ruby/setup-ruby/blob/master/release.rb) - [Commits](ruby/setup-ruby@d45b1a4...8e41b36) Updates `anthropics/claude-code-action` from 1.0.169 to 1.0.174 - [Release notes](https://github.com/anthropics/claude-code-action/releases) - [Commits](anthropics/claude-code-action@37b464c...1253134) Updates `taiki-e/install-action` from 2.82.11 to 2.83.2 - [Release notes](https://github.com/taiki-e/install-action/releases) - [Changelog](https://github.com/taiki-e/install-action/blob/main/CHANGELOG.md) - [Commits](taiki-e/install-action@5ebac0d...43aecc8) --- updated-dependencies: - dependency-name: actions/setup-java dependency-version: 5.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: ruby/setup-ruby dependency-version: 1.318.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions - dependency-name: anthropics/claude-code-action dependency-version: 1.0.174 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: actions - dependency-name: taiki-e/install-action dependency-version: 2.83.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: actions ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the minor-and-patch group with 1 update in the /backend directory: [@react-email/ui](https://github.com/resend/react-email/tree/HEAD/packages/ui). Updates `@react-email/ui` from 6.6.8 to 6.8.1 - [Release notes](https://github.com/resend/react-email/releases) - [Changelog](https://github.com/resend/react-email/blob/canary/packages/ui/CHANGELOG.md) - [Commits](https://github.com/resend/react-email/commits/@react-email/ui@6.8.1/packages/ui) --- updated-dependencies: - dependency-name: "@react-email/ui" dependency-version: 6.8.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Bumps the minor-and-patch group with 1 update in the /deploy/pulumi directory: [@pulumi/docker-build](https://github.com/pulumi/pulumi-docker-build). Updates `@pulumi/docker-build` from 0.0.17 to 0.0.20 - [Release notes](https://github.com/pulumi/pulumi-docker-build/releases) - [Changelog](https://github.com/pulumi/pulumi-docker-build/blob/main/CHANGELOG.md) - [Commits](pulumi/pulumi-docker-build@v0.0.17...v0.0.20) --- updated-dependencies: - dependency-name: "@pulumi/docker-build" dependency-version: 0.0.18 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

Adopts #1105's pi bumps only. Excludes @anthropic-ai/sdk (pi-ai 0.80.7 still hard-pins 0.91.1, so bumping ours would break the shared client) and katex (held at ^0.16 to match rehype-katex's engine).

github-actions · 2026-07-22T14:19:48Z

Semgrep Security Scan

No security issues found.

github-actions · 2026-07-22T14:24:42Z

Preview environment destroyed 🧹

Stack preview-pr-1106 and its Cloudflare subdomain have been cleaned up.

github-actions · 2026-07-22T14:25:18Z

PR Metrics

Metric	Value
Lines changed (prod code)	`+10 / -10`
JS bundle size (gzipped)	🟢 644.4 KB → 644.3 KB (-145 B, -0.0%)
Test coverage	🟢 78.78% → 78.74% (+-0.0%)
Performance (preview)	Preview not ready — Render deploy may have timed out
Accessibility	—
Best Practices	—
SEO	—

Updated Wed, 22 Jul 2026 14:25:18 GMT · run #2367

github-actions

🔭 thunder-deep-review (advisory)

Reviewed the diff — no issues to report. ✅ Never approves, never requests changes, never gates merge.
_{head: 61667ffb2735 · mode: single · deferred 0 item(s) already reported by other bots (best-effort dedup)}

dependabot Bot and others added 5 commits July 22, 2026 11:14

build(deps): bump pi packages to 0.80.7

61667ff

Adopts #1105's pi bumps only. Excludes @anthropic-ai/sdk (pi-ai 0.80.7 still hard-pins 0.91.1, so bumping ours would break the shared client) and katex (held at ^0.16 to match rehype-katex's engine).

raivieiraadriano92 self-assigned this Jul 22, 2026

raivieiraadriano92 temporarily deployed to preview July 22, 2026 14:23 — with GitHub Actions Inactive

github-actions Bot reviewed Jul 22, 2026

View reviewed changes

raivieiraadriano92 merged commit 74c2928 into main Jul 22, 2026
36 of 38 checks passed

raivieiraadriano92 deleted the raivieiraadriano92/thu-667-dependabot-sweep-2 branch July 22, 2026 16:52

raivieiraadriano92 mentioned this pull request Jul 22, 2026

build(deps): bump @pulumi/docker-build from 0.0.17 to 0.0.20 in /deploy/pulumi in the minor-and-patch group across 1 directory #946

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): dependabot sweep 2 (rust, actions, react-email, pulumi, pi)#1106

build(deps): dependabot sweep 2 (rust, actions, react-email, pulumi, pi)#1106
raivieiraadriano92 merged 5 commits into
mainfrom
raivieiraadriano92/thu-667-dependabot-sweep-2

raivieiraadriano92 commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 22, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

raivieiraadriano92 commented Jul 22, 2026

#1105 handled partially — two exclusions

Verified

Uh oh!

github-actions Bot commented Jul 22, 2026

Semgrep Security Scan

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 22, 2026

PR Metrics

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

🔭 thunder-deep-review (advisory)

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions Bot commented Jul 22, 2026 •

edited

Loading