Pin dependencies

[Coldaine]

Agent review expected: verify the dependency impact, summarize CI status, and merge only when the update is coherent for this repo.

This PR contains the following updates:

Package	Type	Update	Change
@types/cors (source)	devDependencies	pin	^2.8.17 → 2.8.19
@types/express (source)	devDependencies	pin	^5.0.0 → 5.0.6
@types/node (source)	devDependencies	pin	^22.13.10 → 22.20.1
@types/node (source)	devDependencies	pin	^22.14.0 → 22.20.1
@​types/uuid	devDependencies	pin	^10.0.0 → 10.0.0
@types/winreg (source)	devDependencies	pin	^1.2.36 → 1.2.36
@types/ws (source)	devDependencies	pin	^8.18.0 → 8.18.1
black (changelog)	dev	pin	^23.0.0 → 23.12.1
flake8 (changelog)	dev	pin	^6.0.0 → 6.1.0
isort (changelog)	dev	pin	^5.12.0 → 5.13.2
mypy (changelog)	dev	pin	^1.5.0 → 1.17.0
node (source)	final	pinDigest	→ 8d6421d
node (source)	stage	pinDigest	→ 8d6421d
pre-commit	dev	pin	^3.3.0 → 3.8.0
pytest (changelog)	dev	pin	^7.0.0 → 7.4.4
pytest-cov (changelog)	dev	pin	^4.0.0 → 4.1.0
typescript (source)	devDependencies	pin	^5.8.2 → 5.9.3
typescript (source)	devDependencies	pin	~5.7.2 → 5.7.3
vite (source)	devDependencies	pin	^6.2.0 → 6.4.3

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

---

Configuration

📅 Schedule: (in timezone America/Chicago)

• Branch creation
  • Between 04:00 AM and 08:59 AM, Monday through Friday (* 4-8 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[codeant-ai]

🤖 CodeAnt AI — Review Status

Status	Commit	Started (UTC)	Finished (UTC)
✅ Reviewed your PR	82ced86	Aug 19, 2026 · 10:24	10:25

[codeant-ai]

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_9080a2d8-a9c8-4a23-ab29-91277661e5e0)

[qodo-code-review]

PR Summary by Qodo

Pin development dependencies and Node container image

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Pins JavaScript and Python development dependencies for deterministic toolchain resolution.
• Pins both Docker stages to one immutable Node 18 Alpine image digest.
• Synchronizes Poetry lock metadata with exact development dependency constraints.

Diagram

graph TD
  R["Renovate update"] --> N["Node manifests"] --> T["TypeScript builds"]
  R --> P["Poetry manifests"] --> L["Lock metadata"]
  R --> D["Docker stages"] --> C["Container image"]

Loading

High-Level Assessment

Exact direct-version pins, synchronized Poetry hashes, and one shared Docker digest provide a coherent reproducibility improvement with minimal complexity. Retaining version ranges and relying only on lockfiles was considered, but it would not pin the Docker base image or enforce the repository’s manifest-level dependency policy.

Files changed (7) +28 / -28

Other (7) +28 / -28

package.jsonPin archived spatial application build tools +3/-3

Pin archived spatial application build tools

• Pins Node typings, TypeScript 5.7.3, and Vite 6.4.3 to exact versions for reproducible builds of the archived reference application.

Docs/Archive/Reference/GeminiVision reference/spatial-understanding/package.json

DockerfilePin Node Alpine image by digest +2/-2

Pin Node Alpine image by digest

• Pins the builder and production stages to the same immutable Node 18 Alpine digest, preventing tag drift between container builds.

ProjectBroadside/MCPUnityRockstar/Server~/Dockerfile

package.jsonPin MCP server TypeScript toolchain +7/-7

Pin MCP server TypeScript toolchain

• Replaces semver ranges with exact versions for TypeScript and all development type packages. The update includes newer Node, Express, CORS, WebSocket, and related typings.

ProjectBroadside/MCPUnityRockstar/Server~/package.json

poetry.lockRefresh PDFScans Poetry content hash +1/-1

Refresh PDFScans Poetry content hash

• Updates the lockfile content hash to reflect the exact development dependency constraints in the associated Poetry manifest. No locked package records change in this diff.

ProjectBroadside/PDFScans/poetry.lock

pyproject.tomlPin PDFScans Python development tools +7/-7

Pin PDFScans Python development tools

• Pins pytest, coverage, formatting, linting, type-checking, and pre-commit tools to exact resolved versions.

ProjectBroadside/PDFScans/pyproject.toml

poetry.lockRefresh root Poetry content hash +1/-1

Refresh root Poetry content hash

• Updates the root lockfile content hash after development dependencies are changed from compatible ranges to exact versions. No locked package records change in this diff.

poetry.lock

pyproject.tomlPin root Python development tools +7/-7

Pin root Python development tools

• Pins the root project's testing, coverage, formatting, linting, typing, and pre-commit dependencies to exact versions.

pyproject.toml

[Copilot]

Pull request overview

This PR pins several Python and Node.js development dependencies (and a Docker base image digest) to exact versions to improve build reproducibility across the repo. CI status is not available from the provided PR context.

Changes:

• Pin Python dev tooling versions in Poetry (pytest, black, flake8, mypy, etc.) in both Python projects.
• Pin Node.js TypeScript/type dependencies to exact versions in two package.json files.
• Pin the Node 18 Alpine Docker base image by digest in the MCPUnityRockstar server Dockerfile.

Reviewed changes

Copilot reviewed 5 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
pyproject.toml	Pins Poetry dev dependencies to exact versions.
ProjectBroadside/PDFScans/pyproject.toml	Mirrors Poetry dev dependency pinning for the PDFScans project.
poetry.lock	Updates lock metadata hash to reflect dependency spec changes.
ProjectBroadside/PDFScans/poetry.lock	Updates lock metadata hash to reflect dependency spec changes in PDFScans.
ProjectBroadside/MCPUnityRockstar/Server~/package.json	Pins TypeScript and @types/* devDependencies to exact versions.
ProjectBroadside/MCPUnityRockstar/Server~/Dockerfile	Pins Node base images by digest for builder/production stages.
Docs/Archive/Reference/GeminiVision reference/spatial-understanding/package.json	Pins @types/node, typescript, and vite to exact versions for the archived Vite project.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can show, collapse, or hide each part of a finding: code, evidence, and all

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[kilo-code-bot]

Code Review Summary

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	2
WARNING	0
SUGGESTION	0

Review performed by Kilo (AI code review agent). Existing Copilot findings remain unresolved. Stale plan noted: FLORENCE_2_WARSHIP_EXTRACTION_PLAN.md at the repo root describes an architecture that has already been implemented (the src/warship_extractor/ package and all its modules now exist). Per repo conventions, executed plans should be removed and their content migrated into live documentation.

Issue Details (click to expand)

CRITICAL

File	Line	Issue
ProjectBroadside/MCPUnityRockstar/Server~/package.json	35	@types/node is pinned to v22, but the container image is pinned to Node 18 (node:18-alpine). This mismatch can let TypeScript accept Node 22-only APIs that won't exist at runtime in the container.
ProjectBroadside/MCPUnityRockstar/Server~/Dockerfile	2	The Dockerfile runs npm ci and copies package-lock.json, but there is no package-lock.json in ProjectBroadside/MCPUnityRockstar/Server~ (so docker build will fail at the COPY package.json package-lock.json ./ step).

Files Reviewed (7 files)

• Docs/Archive/Reference/GeminiVision reference/spatial-understanding/package.json - 0 issues
• ProjectBroadside/MCPUnityRockstar/Server~/Dockerfile - 1 issue (existing)
• ProjectBroadside/MCPUnityRockstar/Server~/package.json - 1 issue (existing)
• ProjectBroadside/PDFScans/poetry.lock - 0 issues
• ProjectBroadside/PDFScans/pyproject.toml - 0 issues
• poetry.lock - 0 issues
• pyproject.toml - 0 issues

Fix these issues in Kilo Cloud

---

_{Reviewed by step-3.7-flash:free · Input: 155.2K · Output: 15.4K · Cached: 626.6K}

[Coldaine]

Verified: diff is Renovate's 'Pin dependencies' pattern across dev-only tooling and a base image — @types/node/typescript/vite pinned to exact resolved patch/minor versions in the Gemini Vision reference package, node:18-alpine digest-pinned in the MCP Unity server Dockerfile, @types/*/typescript pinned in the MCP Unity server package.json, and Poetry dev-tooling (pytest, black, isort, flake8, mypy, pre-commit) pinned to exact resolved versions (all within their existing major version) in both pyproject.toml copies. No production runtime dependency is touched. Matches the title. Merging.