chore(deps): rollup of 11 Dependabot PRs (api-service, memvid, frontend)

[schwichtgit]

Summary

Rollup of 11 open Dependabot PRs into a single PR to consolidate review and CI burn. All updates are minor/patch (no major bumps).

The five api-service PRs each touch the same pyproject.toml constraints on adjacent lines, so individual cherry-picks would conflict; combined as one commit. The two frontend PRs both touch @opentelemetry/exporter-trace-otlp-http — resolved by taking the newer 0.218.x and keeping the bumped instrumentation-fetch 0.217.x from the minor-and-patch group.

Subsumed PRs (close on merge)

api-service:

• Closes build(deps): bump urllib3 from 2.6.3 to 2.7.0 in /api-service #244 — urllib3 2.6.3 -> 2.7.0 (fixes HIGH CVE-2026-44431, CVE-2026-44432 — unblocks the api container build, which was failing on every dependabot PR until this lands)
• Closes build(deps): bump authlib from 1.6.11 to 1.6.12 in /api-service #245 — authlib 1.6.11 -> 1.6.12
• Closes build(deps): update python-multipart requirement from >=0.0.27 to >=0.0.28 in /api-service #233 — python-multipart >=0.0.27 -> >=0.0.28
• Closes build(deps): update structlog requirement from >=24.4.0 to >=25.5.0 in /api-service #234 — structlog >=24.4.0 -> >=25.5.0
• Closes build(deps): update pydantic requirement from >=2.13.3 to >=2.13.4 in /api-service #235 — pydantic >=2.13.3 -> >=2.13.4
• Closes build(deps-dev): update black requirement from >=24.10.0 to >=26.3.1 in /api-service #236 — black (dev) >=24.10.0 -> >=26.3.1
• Closes build(deps-dev): update ruff requirement from >=0.8.6 to >=0.15.12 in /api-service #237 — ruff (dev) >=0.8.6 -> >=0.15.12
• Closes build(deps): bump python-multipart from 0.0.26 to 0.0.27 in /api-service #232 — superseded by build(deps): update python-multipart requirement from >=0.0.27 to >=0.0.28 in /api-service #233 (older python-multipart 0.0.26 -> 0.0.27)

frontend (npm):

• Closes build(deps): bump the minor-and-patch group in /frontend with 12 updates #240 — minor-and-patch group, 12 updates
• Closes build(deps): bump protobufjs and @opentelemetry/exporter-trace-otlp-http in /frontend #246 — protobufjs removed (no longer needed) + @opentelemetry/exporter-trace-otlp-http 0.216 -> 0.218

memvid-service (Cargo):

• Closes build(deps): bump the minor-and-patch group in /memvid-service with 6 updates #238 — minor-and-patch group, 6 updates

Excluded from this rollup

• build(deps): bump react-day-picker from 9.14.0 to 10.0.0 in /frontend #242 — react-day-picker 9.14.0 -> 10.0.0. Major version, deserves a focused PR with a UI smoke test of the calendar component.
• build(deps): bump opentelemetry from 0.31.0 to 0.32.0 in /memvid-service #239 / build(deps): bump opentelemetry-otlp from 0.31.1 to 0.32.0 in /memvid-service #241 / build(deps): bump opentelemetry_sdk from 0.31.0 to 0.32.0 in /memvid-service #243 — opentelemetry / opentelemetry-otlp / opentelemetry_sdk 0.31 -> 0.32. These must move as a triple, but tracing-opentelemetry 0.32.1 (latest published) still depends on opentelemetry 0.31. Bumping the triple introduces two concurrent opentelemetry versions in the dep graph and a Tracer trait mismatch in src/otel.rs. Park until tracing-opentelemetry 0.33 is released.

Commits

1. 3b7ba79 — frontend minor-and-patch group (cherry-pick of build(deps): bump the minor-and-patch group in /frontend with 12 updates #240)
2. 2fe77e4 — frontend protobufjs/otel-http (cherry-pick of build(deps): bump protobufjs and @opentelemetry/exporter-trace-otlp-http in /frontend #246; resolved conflict with build(deps): bump the minor-and-patch group in /frontend with 12 updates #240 by keeping the newer exporter-trace-otlp-http 0.218 and the bumped instrumentation-fetch 0.217; lock regenerated via npm install)
3. 768fb9a — memvid Cargo minor-and-patch group (cherry-pick of build(deps): bump the minor-and-patch group in /memvid-service with 6 updates #238)
4. 7b1bac8 — api-service urllib3 (cherry-pick of build(deps): bump urllib3 from 2.6.3 to 2.7.0 in /api-service #244)
5. e6043c5 — api-service authlib (cherry-pick of build(deps): bump authlib from 1.6.11 to 1.6.12 in /api-service #245)
6. 7779b22 — combined api-service pyproject constraints (build(deps): update python-multipart requirement from >=0.0.27 to >=0.0.28 in /api-service #233 + build(deps): update structlog requirement from >=24.4.0 to >=25.5.0 in /api-service #234 + build(deps): update pydantic requirement from >=2.13.3 to >=2.13.4 in /api-service #235 + build(deps-dev): update black requirement from >=24.10.0 to >=26.3.1 in /api-service #236 + build(deps-dev): update ruff requirement from >=0.8.6 to >=0.15.12 in /api-service #237 manually merged — adjacent-line conflicts made cherry-pick impractical)

Local verification

• frontend: npm run lint -- 0 errors, 10 pre-existing shadcn/ui react-refresh warnings (matches main)
• frontend: npm test -- 74/74 passing, 12 files
• api-service: uv pip install -e ".[test,lint,sbom]" resolves cleanly, all 5 constraint bumps satisfied (pydantic==2.13.4, pydantic-core==2.46.4, python-multipart==0.0.28, ruff==0.15.13; structlog and black already at or above floor)
• api-service: pytest -q --no-cov -- 501 passed, 4 skipped, 5 xfailed
• memvid-service: cargo check clean
• memvid-service: cargo test --lib -- 61 passed, 0 failed, 2 ignored (incl. test_real_searcher_loads_valid_file which was flagged pre-existing in PR chore(deps): rollup of 8 Dependabot PRs (sonarqube, api-service, memvid, frontend) #229 -- now passes here)

Test plan

• CI green across all matrix jobs (frontend, api-service, memvid-service, ingest, container-build amd64+arm64, cross-service, e2e-real)
• api container-build passes (urllib3 CVE-2026-44431/44432 fix in this rollup resolves the previously failing HIGH-severity Trivy gate)
• No new code-scanning alerts surfaced by the security workflow
• Dependabot closes build(deps): bump python-multipart from 0.0.26 to 0.0.27 in /api-service #232, build(deps): update python-multipart requirement from >=0.0.27 to >=0.0.28 in /api-service #233, build(deps): update structlog requirement from >=24.4.0 to >=25.5.0 in /api-service #234, build(deps): update pydantic requirement from >=2.13.3 to >=2.13.4 in /api-service #235, build(deps-dev): update black requirement from >=24.10.0 to >=26.3.1 in /api-service #236, build(deps-dev): update ruff requirement from >=0.8.6 to >=0.15.12 in /api-service #237, build(deps): bump the minor-and-patch group in /memvid-service with 6 updates #238, build(deps): bump the minor-and-patch group in /frontend with 12 updates #240, build(deps): bump urllib3 from 2.6.3 to 2.7.0 in /api-service #244, build(deps): bump authlib from 1.6.11 to 1.6.12 in /api-service #245, build(deps): bump protobufjs and @opentelemetry/exporter-trace-otlp-http in /frontend #246 automatically once this merges

[github-actions]

CI Summary

Job	Status
Base (lint)	pass
Frontend	pass
API Service	pass
Ingest	skip
Memvid Service	pass
Memvid Integration	pass
Cross-Service	pass
E2E Real	pass
Commit Standards	pass
Container Build	pass
Release Gate	skip

All checks passed | Full run details