chore(deps): batch dependabot patches (#879, #899, #900, #901)

[raivieiraadriano92]

Summary

Lands four safe patch-level dependabot PRs in a single batch — same shape as #893. Lockfiles regenerated locally with bun (dependabot doesn't support bun).

Commit

• 60058a7c — chore(deps): batch dependabot patches (chore(deps): bump @pulumi/docker-build from 0.0.16 to 0.0.17 in /deploy/pulumi in the minor-and-patch group across 1 directory #879, chore(deps-dev): bump @react-email/ui from 6.1.4 to 6.1.5 in /backend in the minor-and-patch group across 1 directory #899, chore(deps): bump serde_json from 1.0.149 to 1.0.150 in /src-tauri in the minor-and-patch group across 1 directory #900, chore(deps): bump the actions group across 1 directory with 4 updates #901)

Landed PRs

npm — deploy/pulumi

• chore(deps): bump @pulumi/docker-build from 0.0.16 to 0.0.17 in /deploy/pulumi in the minor-and-patch group across 1 directory #879 — @pulumi/docker-build ^0.0.16 → ^0.0.17 — patch bump in the pulumi docker-build provider

npm — backend

• chore(deps-dev): bump @react-email/ui from 6.1.4 to 6.1.5 in /backend in the minor-and-patch group across 1 directory #899 — @react-email/ui 6.1.4 → 6.1.5 — patch bump in the dev-only react-email UI kit. No transitive churn (same esbuild@0.28.0 + next@16.2.6 deps)

Cargo — src-tauri

• chore(deps): bump serde_json from 1.0.149 to 1.0.150 in /src-tauri in the minor-and-patch group across 1 directory #900 — serde_json 1.0.149 → 1.0.150 — patch bump in Cargo.toml, Cargo.lock refreshed

GitHub Actions

• chore(deps): bump the actions group across 1 directory with 4 updates #901 — actions group across 1 directory with 4 updates:
  • github/codeql-action/upload-sarif v4.35.3 → v4.35.5 (.github/workflows/security.yml)
  • actions/create-github-app-token v3.1.1 → v3.2.0 (.github/workflows/version-bump.yml)
  • ruby/setup-ruby SHA bump, still tagged v1 (.github/workflows/ios-release.yml)
  • taiki-e/install-action SHA bump, still tagged v2 (.github/workflows/version-bump.yml)

Verification

• ✅ cargo check in src-tauri/ — compiles cleanly with serde_json@1.0.150 (full tauri tree, 25.95s)
• ✅ bun run type-check in backend/ — clean
• ✅ bun run lint in backend/ — 0 errors (81 pre-existing warnings, unchanged)
• ✅ Both bun.lock diffs reviewed — minimal: just the version + integrity hash bumps, no transitive churn

Side notes

While running bun install in backend/, two small lockfile drifts surfaced and were captured (no package.json edits made):

• @opentelemetry/exporter-trace-otlp-proto@0.218.0 — added to the lockfile (already in package.json, just missing from the lockfile)
• @types/bun / bun-types resolved minor patch within their existing ^ ranges

Not in this PR

• chore(deps): bump exa-js from 1.10.3 to 2.12.1 in /backend #841 — exa-js 1.10.3 → 2.12.1 (backend): major SDK rewrite, not attempted. Separate PR.
• chore(deps-dev): bump vite from 7.3.3 to 8.0.13 #881 — vite 7.3.3 → 8.0.13: already in flight as PR chore(deps): bump vite to 8 (#881) #898.

Test plan

• CI: workflows pass (especially security.yml with the new codeql v4.35.5 SARIF uploader and version-bump.yml with the new app-token v3.2.0)
• iOS release workflow: confirm ruby/setup-ruby still resolves ruby-version: '3.0' correctly

---

Note

Low Risk
Patch-only version and CI action SHA updates with no product code changes; release/version-bump workflows use updated tokens but remain the same steps.

Overview
This PR batches four patch-level dependency updates (Dependabot-style) with matching lockfile refreshes—no application logic changes.

GitHub Actions pins move forward in security.yml (upload-sarif to CodeQL v4.35.5), version-bump.yml (create-github-app-token v3.2.0, taiki-e/install-action SHA), and ios-release.yml (ruby/setup-ruby SHA, still v1).

npm: backend bumps dev-only @react-email/ui 6.1.4 → 6.1.5; deploy/pulumi bumps @pulumi/docker-build ^0.0.16 → ^0.0.17 with bun.lock updates.

Rust: src-tauri bumps direct serde_json 1.0.149 → 1.0.150 in Cargo.toml and Cargo.lock.

^{Reviewed by Cursor Bugbot for commit 60058a7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Semgrep Security Scan

No security issues found.

[github-actions]

Preview environment destroyed 🧹

Stack preview-pr-904 and its Cloudflare subdomain have been cleaned up.

[github-actions]

PR Metrics

Metric	Value
Lines changed (prod code)	+7 / -7
JS bundle size (gzipped)	🟢 1.14 MB → 1.13 MB (-5.9 KB, -0.5%)
Test coverage	🟢 72.22% → 72.22% (+0.0%)
Performance (preview)	Preview not ready — Render deploy may have timed out
Accessibility	—
Best Practices	—
SEO	—

Updated Tue, 26 May 2026 21:33:23 GMT · run #1617