build(deps): merge the nine open dependency updates (#979)

Nine dependabot pull requests were open. Five of them touched `uv.lock`
and two touched
`package-lock.json`, so landing them one at a time meant a rebase and a
fresh CI run per
collision. This branch carries all nine and regenerates both lockfiles
from the merged
manifests.

Closes #970, #971, #972, #973, #974, #975, #976, #977, #978.

**Python.** The seven-package group (#973) brings its own `uv.lock`. The
four single bumps
(#975 types-pyyaml, #976 hatchling, #977 uvicorn, #978 pwdlib) are one
line of
`pyproject.toml` each, and `uv lock` resolved them together. Two floors
resolved above what
dependabot asked for, because a release landed since it opened the PR:
uvicorn to 0.52.4 and
typescript-eslint to 8.68.0.

**Frontend.** The three-package group (#972) brings its own lock.
typescript-eslint (#971) is
one line of `package.json`, resolved by `npm install
--package-lock-only`.

**Actions and image.** The actions group (#974) and the node digest
(#970) touch no lockfile
and came across unchanged, with one correction. Dependabot moved
`claude.yml`'s checkout from
`@v4` to `@v7` and left it on a floating tag. It was the only unpinned
action in the tree, so
it now carries the same digest the other thirteen do.

Tested: `ruff check`, `ruff format --check`, `mypy src/reaper tests/`,
`pytest -n 4`
(4907 passed, 1 skipped), `alembic upgrade head` then `alembic check`,
and the frontend's
lint, format check, test (1661 passed) and build. All green.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: samwiseg0

.github/workflows/binaries.yml

@@ -165,7 +165,7 @@ jobs:
           npm run build
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 

.github/workflows/ci.yml

@@ -190,7 +190,7 @@ jobs:
       # misses is far from free: it once cost this job ~40s and `frontend` ~9m per run, to
       # fetch nothing. If those timeouts reappear, suspect the runner's network, not this.
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 
@@ -344,7 +344,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install uv
-        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
 

.github/workflows/claude.yml

@@ -44,7 +44,7 @@ jobs:
         }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history so the verify step can check whether a later commit already fixed
           # the reported bug. The PR path deepens a shallow clone on its own.

.github/workflows/codeql.yml

@@ -100,7 +100,7 @@ jobs:
       # this repository fixed seven and dismissed four, and a suite chosen to raise recall would
       # spend that ratio on a backlog nobody triages. Re-read the ratio before adding it, not the
       # argument.
-      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: ${{ matrix.language }}
           # Stated rather than left to the default, because it is only correct while every
@@ -114,6 +114,6 @@ jobs:
       # `category` keeps each language's results in their own lane. Without it the second upload
       # is read as a replacement for the first, and the tree that finished earliest is the one
       # that appears to have no findings.
-      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: "/language:${{ matrix.language }}"

Dockerfile

@@ -2,7 +2,7 @@
 
 # ---- Stage 1: frontend -------------------------------------------------------
 # Digest-pinned: the tag documents intent, the digest is what actually builds.
-FROM node:24-alpine@sha256:d32cdf619f63fe0471182d08996dd516c6275bb5fd31ae06e55a570bd9e1ad43 AS frontend
+FROM node:24-alpine@sha256:e67514e5d0f6c46656005e1b693b2ec9d52e80b641307de684d4a015ba7a4eaf AS frontend
 WORKDIR /app/frontend
 
 # Lockfile first, so a source-only change does not reinstall the dependency tree.