Upgrade versions where applicable.

Author: stephenlienharrell

.github/workflows/monitor-verify.yaml

@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install build dependencies
         run: |
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install cross-compile dependencies
         run: |

.github/workflows/security-audit.yaml

@@ -16,7 +16,7 @@ jobs:
   audits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Build web image for production-context pip-audit
         run: docker-compose build web

docs/SECURITY_AUDIT.md

@@ -27,7 +27,7 @@ HPCPerfStats combines a Django + DRF backend, session-based OAuth (Tapis) and ha
 | pillow       | 12.2.0          | Clean |
 | gunicorn     | 26.0.0          | Clean |
 
-`pyproject.toml` runtime floors: `Django>=6.0.5,<7`, `requests>=2.34.2`, `cryptography>=48.0.0`, `pillow>=12.2.0`.
+`pyproject.toml` runtime floors: `Django>=6.0.6,<7`, `requests>=2.34.2`, `cryptography>=48.0.0`, `pillow>=12.2.0`.
 
 **Host dev venv** (not shipped): `idna` 3.13 (CVE-2026-45409 → 3.15+), `pip` 26.1.1 (PYSEC-2026-196 → 26.1.2+). Treat as developer-workstation hygiene only.
 

hpcperfstats/site/frontend/package-lock.json

@@ -13,14 +13,14 @@
     "test:coverage": "vitest run --coverage"
   },
   "dependencies": {
-    "@bokeh/bokehjs": "3.9.0",
+    "@bokeh/bokehjs": "3.9.1",
     "@fontsource/open-sans": "^5.2.7",
     "bootstrap": "^5.3.8",
     "bootswatch": "^5.3.8",
     "react": "^19.2.6",
     "react-dom": "^19.2.6",
     "react-paginate": "^8.3.0",
-    "react-router-dom": "^7.16.0"
+    "react-router-dom": "^7.17.0"
   },
   "devDependencies": {
     "@testing-library/jest-dom": "^6.9.1",

hpcperfstats/site/frontend/package.json

@@ -1,7 +1,7 @@
 """Playwright + real BokehJS: job-list json_item fixtures must not log known failure strings.
 
 Loads committed fixtures from ``site/frontend/src/test-fixtures/`` (generated from
-Django ``json_item`` after range fixes). Uses the public Bokeh 3.9.0 CDN so
+Django ``json_item`` after range fixes). Uses the public Bokeh 3.9.1 CDN so
 Chromium has a real canvas (jsdom/Vitest cannot run ``embed_item``).
 
 A second test serves the **Vite production build** via ``vite preview`` and embeds
@@ -33,7 +33,7 @@
     pytest.skip("playwright is required for Bokeh browser embed tests", allow_module_level=True)
 
 # Pin to the same major.minor as package.json @bokeh/bokehjs.
-_BOKEH_CDN_JS = "https://cdn.jsdelivr.net/npm/@bokeh/bokehjs@3.9.0/build/js/bokeh.min.js"
+_BOKEH_CDN_JS = "https://cdn.jsdelivr.net/npm/@bokeh/bokehjs@3.9.1/build/js/bokeh.min.js"
 
 _FAILURE_SUBSTRINGS = (
     "could not set initial ranges",

hpcperfstats/site/machine/tests/test_bokeh_job_list_embed_browser_e2e.py

@@ -29,8 +29,8 @@ dependencies = [
   "numexpr",
   "psycopg==3.3.4",
   "pandas==3.0.3",
-  "bokeh==3.9.0",
-  "Django>=6.0.5,<7.0",
+  "bokeh==3.9.1",
+  "Django>=6.0.6,<7.0",
   "python-hostlist",
   "pika==1.4.1",
   "mysqlclient",
@@ -54,7 +54,7 @@ test = [
   "psycopg[binary]",
 ]
 dev = [
-  "ruff>=0.15.15",
+  "ruff>=0.15.16",
   "pylint>=4.0.5",  # optional; Ruff is the primary linter (see docs/TESTING.md)
 ]
 

pyproject.toml

@@ -6,7 +6,7 @@ set -euo pipefail
 
 pip_compose_test_extras_fallback() {
   pip install -q \
-    "Django>=6.0.5,<7.0" \
+    "Django>=6.0.6,<7.0" \
     "pytest>=9.0" \
     "pytest-django>=4.12.0" \
     "pytest-cov>=7.1.0"