chore(deps): apply safe Dependabot updates on staging

[biodrone]

There is no dev branch in this repo. Dependabot is configured to target staging, so these updates are bundled there the same way as #629.

Included (CI-green on the source PRs)

Update	Source
yt-dlp 2026.7.4 → 2026.8.19 (extractor/YouTube client maintenance; highest-value bump)	#635
curl-cffi 0.16.0 → 0.16.2	#643
grpcio 1.83.0 → 1.83.1	#642
protobuf 7.35.1 → 7.36.1 (Dependabot proposed 7.36.0; lock resolved the 7.36.1 patch from 2026-08-31). Existing 7.35.0 gencode stubs kept; runtime is backward-compatible and Dependabot CI was green.	#633
google.golang.org/grpc 1.83.0 → 1.83.2 (also pulls golang.org/x/{crypto,net,text} patch transitives)	#641
github.com/sirupsen/logrus 1.9.4 → 1.10.2 (Go 1.23+; StreamDL already uses Go 1.25. TextFormatter []byte rendering change does not affect this repo)	#640
modernc.org/sqlite 1.56.0 → 1.57.0 (opt-in _defensive DSN only; default connection behavior unchanged)	#637
github/codeql-action 4.37.4 → 4.37.9	#644
docker/login-action 4.5.2 → 4.6.0	#632

Held back

• chore(deps): bump yt-dlp from 2026.6.9 to 2026.7.4 #618 yt-dlp 2026.6.9 → 2026.7.4 — targets master; this PR takes staging to 2026.8.19.
• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 #617 google.golang.org/grpc 1.82.0 → 1.82.1 — targets master; staging already has 1.83.0 (this PR goes to 1.83.2).
• chore(deps): bump setuptools from 82.0.1 to 83.0.0 #616 setuptools 82.0.1 → 83.0.0 — targets master; already applied on staging in chore(deps): apply safe Dependabot updates on staging #629.
• chore(deps): upgrade protobuf to 7.35.1 on staging #614 protobuf 5 → 7 — leftover from the previous cycle; already landed via chore(deps): apply safe Dependabot updates on staging #629.

Test plan

• go test ./... (pass, including sqlite VOD DB tests against 1.57.0)
• uv run pytest (34 passed on Python 3.13.15; bandit clean)
• CI on this PR (all checks green)

  

Summary by CodeRabbit

• Chores
  • Updated deployment and security tooling to newer versions.
  • Refreshed runtime and supporting library versions across the project.
  • Raised minimum supported versions for selected Python dependencies.
  • Removed an unused indirect dependency.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: b13a0c88-e879-4423-92d1-d0739059dee8

📥 Commits

Reviewing files that changed from the base of the PR and between 406e731 and d6b33e7.

⛔ Files ignored due to path filters (2)

• go.sum is excluded by !**/*.sum
• uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/deploy_master.yml
• .github/workflows/deploy_staging.yml
• go.mod
• pyproject.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates Go and Python dependency constraints and upgrades Docker login and CodeQL SARIF upload actions in the master and staging deployment workflows.

Changes

Maintenance updates

Layer / File(s)	Summary
Runtime dependency constraints go.mod, pyproject.toml	Go and Python dependency minimum versions were updated. An unused indirect Go dependency was removed.
Deployment action pins .github/workflows/deploy_master.yml, .github/workflows/deploy_staging.yml	The Docker login and CodeQL SARIF upload actions were upgraded in both deployment workflows.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d6b33

This PR updates pinned dependencies and CI actions with the stated checks passing; no actionable merge-blocking risk remains beyond normal review and checks.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a dependency update and specifies that the changes target staging.
Description check	✅ Passed	The description provides detailed update lists, held-back changes, rationale, source references, and a completed test plan. It does not include the template's Fixes # line or exact section headings,…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides detailed update lists, held-back changes, rationale, source references, and a completed test plan. It does not include the template's Fixes # line or exact section headings, but it contains the required change and validation information.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch cursor/dependabot-safe-staging-56b3

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}