Triage the first dependabot batch (#34–#41): merge six, fix two, hold the dev-tools group

[gregoryfoster]

The first dependabot batch since #33 landed the config: eight open PRs (#34–#41).
Each was reviewed against CI status, the diff, and the upstream changelog. This
issue records the verdicts and tracks the work through to a green main.

Verdicts

Merge as-is — CI green, risk understood

PR	Bump	Why it is safe
#39	pydantic 2.13.3 → 2.13.4	Patch.
#40	mistune 3.2.1 → 3.3.4	Highest value in the batch. 3.3.0 fixes four CWE-400 quadratic-DoS parses (parse_link_text, bracket parsing, ref-link scans, formatting markers); 3.3.3 swaps link filtering from a HARMFUL_PROTOCOLS denylist to a SAFE_PROTOCOLS allowlist. src/core/notifications/html_render.py renders consumer-supplied markdown, so this is effectively a security bump. Behaviour to watch: exotic link schemes in existing templates are now dropped.
#34	actions/checkout v4 → v7	Clears the Node 20 deprecation. v7's breaking change blocks fork checkout under pull_request_target/workflow_run; neither is used here.
#35	astral-sh/setup-uv v5 → v7	Node 24, plus removal of the deprecated server-url input, which is not used.
#38	python-ulid 3.1.0 → 4.0.1 (service)	4.0 removes ValueProvider/ULID.provider; nothing here touches either — src/core/models/base.py calls ULID()/ULID.from_str, src/api/schemas/types.py reads base32.ENCODE. The new default StrictMonotonicPolicy helps index locality, and no code treats a ULID as unguessable (API key secrets are SHA-256 hashes).
#41	python-ulid <4 → <5 (SDK)	The SDK's only use is str(ULID()) in clients/python/src/notifier_client/idempotency.py, compatible with both majors. See the spec note below.

Merge, then verify the running service

#37 — uvicorn 0.46.0 → 0.52.4. Six 0.x minors at once, on the process
serving 9000 and 9001. Each reviewed: 0.48's SSL-cipher default and 0.49's
proxy-header handling are irrelevant (plain HTTP on the tailnet, no
--proxy-headers in scripts/serve.sh or scripts/dev_server.sh); 0.50
deprecates the legacy websockets implementation, unused; 0.51 drops colorama
from the standard extra, and no extra is declared; 0.52's zttp parser is
opt-in behind --http zttp. 0.50 also adds a dedicated startup-failure exit
code that stops the supervisor, which helps Restart=on-failure. Cap <0.53
satisfies the 0.x rule from #30.

After merging: sudo systemctl restart notifier notifier-dev, then curl both
/health on the tailnet address.

Hold — the bump alone cannot go green

#36 — dev-tools group, 8 updates across 2 directories. test and
migrations pass (pytest 9 and pytest-asyncio 1.4 are fine); lint and
staleness fail for reasons the version bump cannot fix on its own:

• lint (exit 2). ruff 0.16 formats Python code blocks inside Markdown
  by default — 4 files would be reformatted. It also aborts with
  io: No such file or directory on skills/brainstorming/visual-companion.md,
  a symlink into skills-vendor/ that dangles because the lint job checks
  out without submodules. Fix: add skills/ to [tool.ruff] extend-exclude
  (today only skills-vendor/ and alembic/versions/), then
  uv run ruff format . and commit. The 413-rules-by-default change is
  inert here — select is explicit.
• staleness. openapi-python-client 0.29 emits
  datetime.datetime.fromisoformat(...) where 0.28 emitted
  dateutil.parser.isoparse(...), across four generated models. Fix: run
  clients/python/scripts/regen.sh and commit. Then check whether
  python-dateutil is still reachable from the generated output; if not,
  drop it from clients/python/pyproject.toml rather than leave the
  "required by openapi-python-client output" comment lying.
• Spec nit. pytest>=8.0,<10 spans a major with only 9.1.1 locked.
  Tighten the floor to >=9.1.1,<10.

Push those commits onto dependabot/uv/dev-tools-fad3384c4f rather than closing
and redoing by hand — dependabot stops rebasing once a human pushes.

Loose ends

• chore(deps): bump actions/checkout from 4 to 7 #34 leaves .github/workflows/context-cadence.yml at actions/checkout@v5
  — dependabot only rewrote the v4 occurrences. Bump it in the same pass or
  the repo carries a three-way spread.
• chore(deps): bump uvicorn from 0.46.0 to 0.52.4 #37–chore(deps): bump mistune from 3.2.1 to 3.3.4 #40 all edit root pyproject.toml + uv.lock, so each merge
  invalidates the rest. Merge one at a time and let dependabot rebase.
• chore(deps): bump python-ulid from 3.1.0 to 4.0.1 in /clients/python #41 widens the SDK cap to <5 while keeping the floor at >=3.0.0, so a
  published client permits two majors with only 4.0.1 exercised. Either
  narrow to >=4.0.1,<5 to match chore(deps): bump python-ulid from 3.1.0 to 4.0.1 #38, or record in the file why both are
  permitted.

Merge order

#39 → #40 → #38 → #37 (root table, increasing risk), then #34 + #35
(workflows, independent), then #41 (SDK table, independent), then #36 once
the three fixes above are on its branch.

[gregoryfoster]

Done — all eight merged

Dependabot superseded #36 with #46 mid-flight (the group's contents changed as the
root-table PRs landed); the fixes were rebased onto the new branch and pushed there.

PR	Landed as	Notes
#39	0f3eb9e	pydantic 2.13.4
#34	9c8c099	actions/checkout v7
#38	311c126	python-ulid 4.0.1 (service)
#37	83183d9	uvicorn 0.52.4
#35	40fc77d	setup-uv v7
#41	1c2a953	python-ulid <5 (SDK), + the comment recording why both majors are permitted
#40	edb1844	mistune 3.3.4
#36 → #46	c3430b4	dev-tools group, with the three fixes below
—	4a7480d (#48)	context-cadence checkout v5 → v7, the last loose end

What #46 needed on top of the bump

• ruff 0.16 Markdown formatting. Excluded skills/ (symlinks into the
  already-excluded skills-vendor/, dangling in every CI job that does not
  check out submodules — the exit-2 cause) and docs/plans/ (dated snapshots;
  reformatting rewrites the record). AGENTS.md and clients/python/README.md
  took the formatting.
• openapi-python-client 0.29. Regenerated. 0.29.1 also returns Self from
  the client context managers. python-dateutil is now unimported by anything
  the SDK ships, so it was dropped from clients/python/pyproject.toml rather
  than left behind a comment claiming the generator requires it —
  requires-python is >=3.12, where fromisoformat parses the Z suffix.
• Loose SDK dev floors. Correction to the original triage: the loose
  specifiers were in the SDK table, not the service's — the service's floors
  came out of the bump already tight. Raised pytest, pytest-asyncio,
  respx, openapi-python-client and ruff to what clients/python/uv.lock
  resolves.

Verification

• uv run pytest: 397 passed, 2 skipped, 93.11% coverage.
• SDK: 87 passed; ruff check and ruff format --check clean in both trees.
• systemctl restart notifier notifier-dev; both /health return
  {"status":"ok","build":"fc8d124"}, /ready reports db: true.
• Deployed versions confirmed: uvicorn 0.52.4, mistune 3.3.4, pydantic 2.13.4,
  python-ulid 4.0.1.
• The mistune 3.3.3 protocol change behaves as expected through
  src/core/notifications/html_render.py: https: and mailto: links survive,
  javascript: is rewritten to #harmful-link.

No open dependabot PRs remain.

[gregoryfoster]

Review round 1 — three fixes shipped in dd91d36

A code review of the nine merged commits turned up three things; all fixed on main, CI and the staleness gate green.

• SDK released as 0.3.1. c3430b4 shipped a changed artifact under a chore(deps-dev) heading — 32 regenerated files and python-dateutil dropped from [project.dependencies] — with the version left at 0.3.0. Every prior regeneration here got a release (the 0.3.0 entry documents a generated/-only change), and a narrowed dependency set is something a consumer can trip over. Bumped across pyproject.toml, notifier_client.__version__ and CHANGELOG.md.
• Two SDK dev floors raised to what the lock resolves — openapi-python-client>=0.29.1 (was >=0.29.0) and ruff>=0.16.5 (was >=0.16.4, while the service table already said 0.16.5). The committed generated/ tree is a function of the generator version and sdk-staleness.yml is what notices, so a floor beneath the lock is the gap an upgrade walks through.
• The skills/ ruff exclusion narrowed to the one path that actually breaks. Measured rather than assumed: ruff does not descend into symlinked directories, so the twenty whole-skill links were never walked — only skills/brainstorming/visual-companion.md, the single file-level symlink, was read, and only that dangles in CI. Excluding it alone puts the two committed SKILL.md overrides back under the formatter (both already clean, 121 → 123 files), and a future file symlink fails loudly naming its own path instead of being silently skipped.

One finding was reviewed and stet'd: openapi-python-client 0.29's switch from (str, Enum) to enum.StrEnum on the generated status enums is not observable — str(), f-string interpolation and == "succeeded" behave identically before and after on 3.12, checked both ways.

Noted, not fixed: clients/python/pyproject.toml's description still claims the SDK is "pinned 1:1 with server version", but the server is 0.1.0 and the SDK is 0.3.1. That drift predates this work.

Verification: 397 passed / 2 skipped at 93.11% coverage, SDK 87 passed, ruff clean in both trees, regen.sh a no-op against the committed tree.