fix(deps): update all non-major dependencies (!29) · Merge requests · Information Services / DevOps / Research Systems / Staff On-Costs Calculator / Staff On-Costs Calculator Webapp

This MR contains the following updates:

Package	Change	Type	Update	Pending
@tanstack/react-query (source)	`5.90.16` → `5.90.20`	dependencies	patch
@testing-library/react	`16.3.1` → `16.3.2`	devDependencies	patch
@types/node (source)	`24.10.7` → `24.10.11`	devDependencies	patch	`24.10.12`
@types/react (source)	`19.2.8` → `19.2.13`	devDependencies	patch
@vitejs/plugin-react (source)	`5.1.2` → `5.1.3`	devDependencies	patch
coverage	`7.13.1` → `7.13.3`	dev	patch
cypress (source)	`15.8.2` → `15.10.0`	devDependencies	minor
debugpy (source)	`1.8.19` → `1.8.20`	dev	patch
django (changelog)	`5.2.10` → `5.2.11`	dependencies	patch
django-debug-toolbar (changelog)	`6.1.0` → `6.2.0`	dev	minor
externalsettings	`2.0.4` → `2.0.10`	dependencies	patch
faker (changelog)	`40.1.2` → `40.4.0`	dev	minor
ipython	`9.9.0` → `9.10.0`	dev	minor
mkdocstrings (changelog)	`1.0.0` → `1.0.3`	docs	patch
msw (source)	`2.12.7` → `2.12.8`	devDependencies	patch	`2.12.9`
poetry (changelog)	`2.2.1` → `2.3.2`		minor
python-poetry/poetry	`2.2.1` → `2.3.2`	repository	minor
react (source)	`19.2.3` → `19.2.4`	dependencies	patch
react-dom (source)	`19.2.3` → `19.2.4`	dependencies	patch
salaries	`1.2.21` → `1.2.22`	dependencies	patch
uis/devops/continuous-delivery/ci-templates	`v7.25.11` → `v7.27.8`	repository	minor
undici (source)	`7.18.2` → `7.20.0`	devDependencies	minor	`7.21.0`
vite-tsconfig-paths	`6.0.4` → `6.0.5`	dependencies	patch	`6.1.0`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

TanStack/query (@tanstack/react-query)

`v5.90.20`

Compare Source

Patch Changes

Updated dependencies [e7258c5]:
- @tanstack/query-core@5.90.20

`v5.90.19`

Compare Source

Patch Changes

Updated dependencies [53fc74e]:
- @tanstack/query-core@5.90.19

`v5.90.18`

Compare Source

Patch Changes

Updated dependencies [dea1614]:
- @tanstack/query-core@5.90.18

`v5.90.17`

Compare Source

Patch Changes

Updated dependencies [269351b]:
- @tanstack/query-core@5.90.17

testing-library/react-testing-library (@testing-library/react)

`v16.3.2`

Compare Source

Bug Fixes

Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

vitejs/vite-plugin-react (@vitejs/plugin-react)

`v5.1.3`

Compare Source

coveragepy/coveragepy (coverage)

`v7.13.3`

Compare Source

Fix: in some situations, third-party code was measured when it shouldn't have been, slowing down test execution. This happened with layered virtual environments such as uv sometimes makes. The problem is fixed, closing issue 2082_. Now any directory on sys.path that is inside a virtualenv is considered third-party code.

.. _issue 2082: #2082

.. _changes_7-13-2:

`v7.13.2`

Compare Source

Fix: when Python is installed via symlinks, for example with Homebrew, the standard library files could be incorrectly included in coverage reports. This is now fixed, closing issue 2115_.
Fix: if a data file is created with no read permissions, the combine step would fail completely. Now a warning is issued and the file is skipped. Closes issue 2117_.

.. _issue 2115: #2115 .. _issue 2117: #2117

.. _changes_7-13-1:

cypress-io/cypress (cypress)

`v15.10.0`

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-10-0

`v15.9.0`

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-9-0

microsoft/debugpy (debugpy)

`v1.8.20`: debugpy v1.8.20

Compare Source

Fixes for:

annotate in 3.14 causing exceptions: #1971

Enhancements:

Use remote_exec if available: c7e86a1
Support more architectures: 1bbecdf

Infrastructure work:

Support devcontainers for development: 7dbc229

Thanks to @rameshvarun, @Xeonacid, and @pdepetro for the commits

django/django (django)

`v5.2.11`

Compare Source

django-commons/django-debug-toolbar (django-debug-toolbar)

`v6.2.0`

Compare Source

What's Changed

Deprecate RedirectsPanel in favor of the HistoryPanel by @JohananOppongAmoateng in #2223
Add cache view to example app by @federicobond in #2243
Add zizmor for GHA security analysis by @tim-schilling in #2201
Add indent size of 2 for yml files. by @tim-schilling in #2244
Reduce the number of test runs in CI. by @tim-schilling in #2248
Store the code coverage files on each test run for CI. by @tim-schilling in #2245
Use double-quotes for GITHUB_REF_NAME shell variable. by @tim-schilling in #2250
Add Django 6.0 to testing matrix by @adamchainz in #2249
Add Django 6.0 to testing matrix by @adamchainz in #2251
Persist the credentials because coverage_comment needs them. by @tim-schilling in #2252
Show cache alias instead of backend repr in calls table by @federicobond in #2219
Remove Django 5.0 to save some CI resources by @matthiask in #2253
Bye Python 39 by @matthiask in #2254
Add support for enabling/disabling SQLPanel tracking of toolbar model queries by @theShinigami in #2211
Enforce toolbar vs panel organization of configs. by @tim-schilling in #2257
Restore monospace font for templates and stacktraces by @federicobond in #2261
Added test to confirm assertNumQueries by @tim-schilling in #2259
Add Django built-in CSP nonce support by @ahumeau in #2267
Set a dependabot cooldown. by @tim-schilling in #2270
Update the hash and version of python-coverage-comment-action by @tim-schilling in #2269
Fix string representation of values in settings panel by @federicobond in #2263
Declare support for Django 6.0 by @ulgens in #2272
Exclude dependabot and pre-commit bot commits from GitHub release notes by @tim-schilling in #2278
Remove comment for clarity in DebugToolbarMiddleware call method by @rnazali in #2283
Add type hints for History Panel by @JohananOppongAmoateng in #2247
Optimize CI with concurrency by @p-r-a-v-i-n in #2287
Add LLM usage checkbox to MR template by @yeongbin05 in #2294
Version 6.2.0 by @tim-schilling in #2298

New Contributors

@theShinigami made their first contribution in #2211
@ahumeau made their first contribution in #2267
@rnazali made their first contribution in #2283
@p-r-a-v-i-n made their first contribution in #2287
@yeongbin05 made their first contribution in #2294

Full Changelog: https://github.com/django-commons/django-debug-toolbar/compare/6.1.0...6.2.0

joke2k/faker (faker)

`v40.4.0`

Compare Source

Add passport and cie for it_IT. Thanks @ElektroDuck.

`v40.3.0`

Compare Source

Add major Greek banks to el_GR bank provider. Thanks @bon12-gr.

`v40.2.0`

Compare Source

Update internet pt_bR provider (domains, tlds, slugify). Thanks @MorganaSilva.

`v40.1.3`

Compare Source

fix pyfloat TypeError when combining positive=True with max_value. Thanks @odrigobnogueira.

ipython/ipython (ipython)

`v9.10.0`

Compare Source

mkdocstrings/mkdocstrings (mkdocstrings)

`v1.0.3`

Compare Source

Compare with 1.0.2

Bug Fixes

Forward extension instances directly passed from Zensical (65b27ec by Timothée Mazzucotelli).
Propagate Zensical's zrelpath processor (dbf263d by Timothée Mazzucotelli).

`v1.0.2`

Compare Source

Compare with 1.0.1

Code Refactoring

Use global instances for handlers and autorefs (9f79141 by Timothée Mazzucotelli).

`v1.0.1`

Compare Source

Compare with 1.0.1

Code Refactoring

Use global instances for handlers and autorefs (9f79141 by Timothée Mazzucotelli).

mswjs/msw (msw)

`v2.12.8`

Compare Source

v2.12.8 (2026-02-03)

Bug Fixes

update @mswjs/interceptors to fix a memory leak (#2659) (e5e905f) @kettanaito
update rettime (#2657) (3a7b451) @kettanaito

python-poetry/poetry (poetry)

`v2.3.2`

Compare Source

Changed

Allow dulwich>=1.0 (#10701).

poetry-core (`2.3.1`)

Fix an issue where platform_release could not be parsed on Windows Server (#911).

`v2.3.1`

Compare Source

Fixed

Fix an issue where cached information about each package was always considered outdated (#10699).

Docs

Document SHELL_VERBOSITY environment variable (#10678).

`v2.3.0`

Compare Source

Added

Add support for exporting pylock.toml files with poetry-plugin-export (#10677).
Add support for specifying build constraints for dependencies (#10388).
Add support for publishing artifacts whose version is determined dynamically by the build-backend (#10644).
Add support for editable project plugins (#10661).
Check requires-poetry before any other validation (#10593).
Validate the content of project.readme when running poetry check (#10604).
Add the option to clear all caches by making the cache name in poetry cache clear optional (#10627).
Automatically update the cache for packages where the locked files differ from cached files (#10657).
Suggest to clear the cache if running a command with --no-cache solves an issue (#10585).
Propose poetry init when trying poetry new for an existing directory (#10563).
Add support for poetry publish --skip-existing for new Nexus OSS versions (#10603).
Show Poetry's own Python's path in poetry debug info (#10588).

Changed

Drop support for Python 3.9 (#10634).
Change the default of installer.re-resolve from true to false (#10622).
PEP 735 dependency groups are considered in the lock file hash (#10621).
Deprecate poetry.utils._compat.metadata, which is sometimes used in plugins, in favor of importlib.metadata (#10634).
Improve managing free-threaded Python versions with poetry python (#10606).
Prefer JSON API to HTML API in legacy repositories (#10672).
When running poetry init, only add the readme field in the pyproject.toml if the readme file exists (#10679).
Raise an error if no hash can be determined for any distribution link of a package (#10673).
Require dulwich>=0.25.0 (#10674).

Fixed

Fix an issue where poetry remove did not work for PEP 735 dependency groups with include-group items (#10587).
Fix an issue where poetry remove caused dangling include-group references in PEP 735 dependency groups (#10590).
Fix an issue where poetry add did not work for PEP 735 dependency groups with include-group items (#10636).
Fix an issue where PEP 735 dependency groups were not considered in the lock file hash (#10621).
Fix an issue where wrong markers were locked for a dependency that was required by several groups with different markers (#10613).
Fix an issue where non-deterministic markers were created in a method used by poetry-plugin-export (#10667).
Fix an issue where wrong wheels were chosen for installation in free-threaded Python environments if Poetry itself was not installed with free-threaded Python (#10614).
Fix an issue where poetry publish used the metadata of the project instead of the metadata of the build artifact (#10624).
Fix an issue where poetry env use just used another Python version instead of failing when the requested version was not supported by the project (#10685).
Fix an issue where poetry env activate returned the wrong command for dash (#10696).
Fix an issue where data-dir and python.installation-dir could not be set (#10595).
Fix an issue where Python and pip executables were not correctly detected on Windows (#10645).
Fix an issue where invalid template variables in virtualenvs.prompt caused an incomprehensible error message (#10648).

Docs

Add a warning about ~/.netrc for Poetry credential configuration (#10630).
Clarify that the local configuration takes precedence over the global configuration (#10676).
Add an explanation in which cases packages are automatically detected (#10680).

poetry-core (`2.3.0`)

Normalize versions (#893).
Fix an issue where unsatisfiable requirements did not raise an error (#891).
Fix an issue where the implicit main group did not exist if it was explicitly declared as not having any dependencies (#892).
Fix an issue where python_full_version markers with pre-release versions were parsed incorrectly (#893).

facebook/react (react)

`v19.2.4`: 19.2.4 (January 26th, 2026)

Compare Source

React Server Components

Add more DoS mitigations to Server Actions, and harden Server Components (#35632 by @gnoff, @lubieowoce, @sebmarkbage, @unstubbable)

uis/devops/continuous-delivery/ci-templates (uis/devops/continuous-delivery/ci-templates)

`v7.27.8`: 7.27.8

Compare Source

7.27.8 (2026-02-05)

`v7.27.7`: 7.27.7

Compare Source

7.27.7 (2026-02-05)

`v7.27.6`: 7.27.6

Compare Source

7.27.6 (2026-02-05)

Bug Fixes

deps: update alpine/httpie:3.2.4 docker digest to bc4c7bc (d7ce92f)
deps: update python:3 docker digest to 1c4c033 (856a122)
deps: update python:3.14 docker digest to 1c4c033 (0182a8c)

`v7.27.5`: 7.27.5

Compare Source

7.27.5 (2026-02-04)

Bug Fixes

deps: update alpine/httpie:3.2.4 docker digest to 1f8c9cd (60f854e)

`v7.27.4`: 7.27.4

Compare Source

7.27.4 (2026-02-04)

`v7.27.3`: 7.27.3

Compare Source

7.27.3 (2026-02-04)

Bug Fixes

deps: update docker:dind docker digest to 8bcbad4 (4ccc9c3)
deps: update python:3 docker digest to fbf695a (134b929)
deps: update python:3.14 docker digest to fbf695a (da47b1e)

`v7.27.2`: 7.27.2

Compare Source

7.27.2 (2026-02-03)

`v7.27.1`: 7.27.1

Compare Source

7.27.1 (2026-02-03)

Bug Fixes

deps: update alpine/httpie:3.2.4 docker digest to bf0a912 (2fe852d)

`v7.27.0`: 7.27.0

Compare Source

7.27.0 (2026-02-02)

Features

gitlab-ci: include mandatory jobs (2342bab), closes #192

`v7.26.3`: 7.26.3

Compare Source

7.26.3 (2026-02-02)

Bug Fixes

deps: update alpine/httpie:3.2.4 docker digest to e8b8b9e (2bb77ff)

`v7.26.2`: 7.26.2

Compare Source

7.26.2 (2026-01-29)

`v7.26.1`: 7.26.1

Compare Source

7.26.1 (2026-01-29)

Bug Fixes

deps: update docker:dind docker digest to a284d31 (ab440ee)

`v7.26.0`: 7.26.0

Compare Source

7.26.0 (2026-01-28)

Features

use gitlab runner cache for pre-commit jobs (fe53b0d)

`v7.25.17`: 7.25.17

Compare Source

7.25.17 (2026-01-28)

Bug Fixes

deps: update docker:dind docker digest to 6a58fe0 (123bec6)

`v7.25.16`: 7.25.16

Compare Source

7.25.16 (2026-01-26)

Bug Fixes

deps: update alpine/httpie:3.2.4 docker digest to d3265ad (929aa91)

`v7.25.15`: 7.25.15

Compare Source

7.25.15 (2026-01-22)

`v7.25.14`: 7.25.14

Compare Source

7.25.14 (2026-01-22)

Bug Fixes

deps: update python:3 docker digest to 17bc9f1 (9106fe0)
deps: update python:3.14 docker digest to 17bc9f1 (9ae614e)

`v7.25.13`: 7.25.13

Compare Source

7.25.13 (2026-01-19)

`v7.25.12`: 7.25.12

Compare Source

7.25.12 (2026-01-19)

Bug Fixes

deps: update alpine/httpie:3.2.4 docker digest to de3d0ab (8fcb386)
deps: update docker:dind docker digest to 3a33fc8 (4d1f0cb)

nodejs/undici (undici)

`v7.20.0`

Compare Source

What's Changed

fix: preserve fetch stack traces by @mcollina in #4778
Fix error handling in MockPool example by @dave-kennedy in #4781
feat: expose statusText in request() ResponseData by @domenic in #4784
test: reduce retry-after invalid date flake by @mcollina in #4788
extractBody fixes by @KhafraDev in #4791
fix: MockAgent delayed response with AbortSignal (#4693) by @mcollina in #4772
fix: onParserTimeout potentially accessing undefined by @vbfox in #4758

New Contributors

@dave-kennedy made their first contribution in #4781
@vbfox made their first contribution in #4758

Full Changelog: https://github.com/nodejs/undici/compare/v7.19.2...v7.20.0

`v7.19.2`

Compare Source

What's Changed

Minor code cleanups to decompress interceptor by @domenic in #4754
fix(h2): fix flaky stream end handling on macOS by @mcollina in #4762
return response when receiving 401 instead of network error by @KhafraDev in #4769
fix: properly close idle connections in test server cleanup by @mcollina in #4764
fix: decode HTTP headers as latin1 instead of utf8 by @mcollina in #4768
fix: submodule update by @Uzlopak in #4648
build(deps): bump peter-evans/create-pull-request from 7.0.8 to 8.0.0 by @dependabot[bot] in #4720

New Contributors

@domenic made their first contribution in #4754

Full Changelog: https://github.com/nodejs/undici/compare/v7.19.1...v7.19.2

`v7.19.1`

Compare Source

What's Changed

fix: use commit hash when generating release (#4757) by @fenichelar in #4759
fix fetch 401 loop by @KhafraDev in #4761

New Contributors

@fenichelar made their first contribution in #4759

Full Changelog: https://github.com/nodejs/undici/compare/v7.19.0...v7.19.1

`v7.19.0`

Compare Source

What's Changed

fix: Handle FormData body type correctly in RetryAgent retried requests by @eliotschu in #4692
feat(client): expose HTTP/2 flow-control options by @pabloelisseo in #4706
Implement origin normalization in MockAgent for case-insensitivity and URL handling by @SksOp in #4731
fix websocket basic auth by @KhafraDev in #4747
fix(cache): regenerate stream from source when cache.match is called after GC by @mcollina in #4713
chore: use testcontext for test:cache by @Uzlopak in #4571
chore: use testcontext for subresource integrity tests by @Uzlopak in #4575
feat(cache): add origins option for whitelist filtering by @mcollina in #4739
ci: test shared-builtin only on Node.js 24 and 25 by @mcollina in #4746
fix websocketstream open error by @KhafraDev in #4748

New Contributors

@eliotschu made their first contribution in #4692
@pabloelisseo made their first contribution in #4706
@SksOp made their first contribution in #4731

Full Changelog: https://github.com/nodejs/undici/compare/v7.18.2...v7.19.0

aleclarson/vite-tsconfig-paths (vite-tsconfig-paths)

`v6.0.5`

Compare Source

Configuration

📅 Schedule: Branch creation - Monday through Friday ( * * * * 1-5 ) in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited Feb 08, 2026 by uis-devops-renovatebot

fix(deps): update all non-major dependencies

Release Notes

Patch Changes

Patch Changes

Patch Changes

Patch Changes

Bug Fixes

v1.8.20: debugpy v1.8.20

What's Changed

New Contributors

Bug Fixes

Code Refactoring

Code Refactoring

v2.12.8 (2026-02-03)

Bug Fixes

Changed

poetry-core (2.3.1)

Fixed

Docs

Added

Changed

Fixed

Docs

poetry-core (2.3.0)

v19.2.4: 19.2.4 (January 26th, 2026)

React Server Components

v7.27.8: 7.27.8

7.27.8 (2026-02-05)

v7.27.7: 7.27.7

7.27.7 (2026-02-05)

v7.27.6: 7.27.6

7.27.6 (2026-02-05)

Bug Fixes

v7.27.5: 7.27.5

7.27.5 (2026-02-04)

Bug Fixes

v7.27.4: 7.27.4

7.27.4 (2026-02-04)

v7.27.3: 7.27.3

7.27.3 (2026-02-04)

Bug Fixes

v7.27.2: 7.27.2

7.27.2 (2026-02-03)

v7.27.1: 7.27.1

7.27.1 (2026-02-03)

Bug Fixes

v7.27.0: 7.27.0

7.27.0 (2026-02-02)

Features

v7.26.3: 7.26.3

7.26.3 (2026-02-02)

Bug Fixes

v7.26.2: 7.26.2

7.26.2 (2026-01-29)

v7.26.1: 7.26.1

7.26.1 (2026-01-29)

Bug Fixes

v7.26.0: 7.26.0

7.26.0 (2026-01-28)

Features

v7.25.17: 7.25.17

7.25.17 (2026-01-28)

Bug Fixes

v7.25.16: 7.25.16

7.25.16 (2026-01-26)

Bug Fixes

v7.25.15: 7.25.15

7.25.15 (2026-01-22)

v7.25.14: 7.25.14

7.25.14 (2026-01-22)

Bug Fixes

v7.25.13: 7.25.13

7.25.13 (2026-01-19)

v7.25.12: 7.25.12

7.25.12 (2026-01-19)

Bug Fixes

What's Changed

New Contributors

What's Changed

New Contributors

`v1.8.20`: debugpy v1.8.20

poetry-core (`2.3.1`)

poetry-core (`2.3.0`)

`v19.2.4`: 19.2.4 (January 26th, 2026)

`v7.27.8`: 7.27.8

`v7.27.7`: 7.27.7

`v7.27.6`: 7.27.6

`v7.27.5`: 7.27.5

`v7.27.4`: 7.27.4

`v7.27.3`: 7.27.3

`v7.27.2`: 7.27.2

`v7.27.1`: 7.27.1

`v7.27.0`: 7.27.0

`v7.26.3`: 7.26.3

`v7.26.2`: 7.26.2

`v7.26.1`: 7.26.1

`v7.26.0`: 7.26.0

`v7.25.17`: 7.25.17

`v7.25.16`: 7.25.16

`v7.25.15`: 7.25.15

`v7.25.14`: 7.25.14

`v7.25.13`: 7.25.13

`v7.25.12`: 7.25.12