[withrvr]

Summary

One job: get every dependency onto its true latest stable version, verified, falling back only where genuinely broken with the reason documented. Full detail: docs/development/dependency-audit.md.

• Backend: uv lock --upgrade (small remainder after Phase 9.5); raised the redis[hiredis]/psycopg[binary] version floors in pyproject.toml to match Dependabot PRs ⬆ update redis[hiredis] requirement from >=5.2 to >=8.1.0 #8/⬆ update psycopg[binary] requirement from <4.0.0,>=3.3.4 to >=3.3.5,<4.0.0 #9.
• Frontend: attempted every deferral Phase 9.5 left, per this phase's "actually try the real fix" mandate:
  • axios and @hey-api/openapi-ts upgraded clean.
  • @tanstack/react-table v8→v9 migrated for real (not a version bump) — DataTable.tsx and its two consumers rewritten for the new useTable/tableFeatures API, table.state replacing table.getState(), getAllCells() replacing getVisibleCells(). Verified via build, lint, and starting the dev server to exercise @tanstack/router-plugin's live route generation.
  • react-email/@react-email/ui in packages/react-email/ bumped to true latest 6.9.5 — found via a Dependabot PR mentioning packages neither this nor the Phase 9.5 audit had looked at. Verified via byte-identical template export output.
  • typescript v6→v7 attempted, then reverted: it works fine on its own, but @hey-api/openapi-ts crashes under it — a confirmed, currently-open upstream bug (hey-api/hey-api#4235). This is the one genuine "latest is broken" case this phase hit.
• Docker/CI: confirmed postgres:18/redis:8-alpine are each technology's current major via a live check (PostgreSQL 19 is still beta); bumped zizmorcore/zizmor-action to v0.6.3 (Dependabot PR ⬆ bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 in the github-actions group #5's exact target).
• Found in passing, flagged not fixed: .github/workflows/zizmor.yml's advanced-security gate still checks github.repository_owner == 'fastapi' (a template-org leftover) — out of scope for a version-only phase, .github/workflows/* stays a standing Phase 14 deferral.
• Housekeeping: packages/react-email/.react-email/ (build cache) had no .gitignore entry anywhere — added one.

Dependabot reconciliation

Closing all 5 open PRs (#4, #5, #8, #9, #16) after this merges — each covered at the same or a truer-latest version except typescript (documented exception above, not a security advisory).

Verification

• Backend: ruff check/mypy app/ty check app clean, full suite 753 tests green.
• Frontend: bun run build/bun run lint clean; emails workspace build/export verified byte-identical.
• prek run --all-files clean across the whole repo.

https://claude.ai/code/session_01WACAxnAd7w5uk12Y58EHqz