chore(deps): apply safe Dependabot updates on staging by biodrone · Pull Request #645 · dangeroustech/StreamDL

biodrone · 2026-09-01T10:09:22Z

There is no dev branch in this repo. Dependabot is configured to target staging, so these updates are bundled there the same way as #629.

Included (CI-green on the source PRs)

Update	Source
`yt-dlp` 2026.7.4 → 2026.8.19 (extractor/YouTube client maintenance; highest-value bump)	#635
`curl-cffi` 0.16.0 → 0.16.2	#643
`grpcio` 1.83.0 → 1.83.1	#642
`protobuf` 7.35.1 → 7.36.1 (Dependabot proposed 7.36.0; lock resolved the 7.36.1 patch from 2026-08-31). Existing 7.35.0 gencode stubs kept; runtime is backward-compatible and Dependabot CI was green.	#633
`google.golang.org/grpc` 1.83.0 → 1.83.2 (also pulls `golang.org/x/{crypto,net,text}` patch transitives)	#641
`github.com/sirupsen/logrus` 1.9.4 → 1.10.2 (Go 1.23+; StreamDL already uses Go 1.25. `TextFormatter` `[]byte` rendering change does not affect this repo)	#640
`modernc.org/sqlite` 1.56.0 → 1.57.0 (opt-in `_defensive` DSN only; default connection behavior unchanged)	#637
`github/codeql-action` 4.37.4 → 4.37.9	#644
`docker/login-action` 4.5.2 → 4.6.0	#632

Held back

chore(deps): bump yt-dlp from 2026.6.9 to 2026.7.4 #618 yt-dlp 2026.6.9 → 2026.7.4 — targets master; this PR takes staging to 2026.8.19.
chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 #617 google.golang.org/grpc 1.82.0 → 1.82.1 — targets master; staging already has 1.83.0 (this PR goes to 1.83.2).
chore(deps): bump setuptools from 82.0.1 to 83.0.0 #616 setuptools 82.0.1 → 83.0.0 — targets master; already applied on staging in chore(deps): apply safe Dependabot updates on staging #629.
chore(deps): upgrade protobuf to 7.35.1 on staging #614 protobuf 5 → 7 — leftover from the previous cycle; already landed via chore(deps): apply safe Dependabot updates on staging #629.

Test plan

go test ./... (pass, including sqlite VOD DB tests against 1.57.0)
uv run pytest (34 passed on Python 3.13.15; bandit clean)
CI on this PR (all checks green)

Summary by CodeRabbit

Chores
- Updated deployment and security tooling to newer versions.
- Refreshed runtime and supporting library versions across the project.
- Raised minimum supported versions for selected Python dependencies.
- Removed an unused indirect dependency.

Bundle CI-green patch/minor bumps from Dependabot into staging: Python curl-cffi, grpcio, protobuf, and yt-dlp; Go grpc, logrus, and modernc.org/sqlite; GitHub Actions codeql-action and login-action. Co-authored-by: Josh J <josh@joshjacobs.net>

coderabbitai · 2026-09-01T10:09:30Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: b13a0c88-e879-4423-92d1-d0739059dee8

📥 Commits

Reviewing files that changed from the base of the PR and between 406e731 and d6b33e7.

⛔ Files ignored due to path filters (2)

go.sum is excluded by !**/*.sum
uv.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

.github/workflows/deploy_master.yml
.github/workflows/deploy_staging.yml
go.mod
pyproject.toml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

Walkthrough

The pull request updates Go and Python dependency constraints and upgrades Docker login and CodeQL SARIF upload actions in the master and staging deployment workflows.

Changes

Maintenance updates

Layer / File(s)	Summary
Runtime dependency constraints `go.mod`, `pyproject.toml`	Go and Python dependency minimum versions were updated. An unused indirect Go dependency was removed.
Deployment action pins `.github/workflows/deploy_master.yml`, `.github/workflows/deploy_staging.yml`	The Docker login and CodeQL SARIF upload actions were upgraded in both deployment workflows.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to d6b33

This PR updates pinned dependencies and CI actions with the stated checks passing; no actionable merge-blocking risk remains beyond normal review and checks.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a dependency update and specifies that the changes target staging.
Description check	✅ Passed	The description provides detailed update lists, held-back changes, rationale, source references, and a completed test plan. It does not include the template's `Fixes #` line or exact section headings,…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides detailed update lists, held-back changes, rationale, source references, and a completed test plan. It does not include the template's Fixes # line or exact section headings, but it contains the required change and validation information.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (4 skipped: 4 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/dependabot-safe-staging-56b3

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

biodrone marked this pull request as ready for review September 1, 2026 10:10

cursor Bot merged commit c310dfc into staging Sep 1, 2026
7 checks passed

cursor Bot deleted the cursor/dependabot-safe-staging-56b3 branch September 1, 2026 10:38

Navigation Menu

Uh oh!

chore(deps): apply safe Dependabot updates on staging - #645

chore(deps): apply safe Dependabot updates on staging#645
cursor[bot] merged 1 commit into
stagingfrom
cursor/dependabot-safe-staging-56b3

biodrone commented Sep 1, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

biodrone commented Sep 1, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Included (CI-green on the source PRs)

Held back

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

biodrone commented Sep 1, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Sep 1, 2026 •

edited

Loading