[MuhammadKhalilzadeh]

Describe your changes

One consolidated dependency-update PR that supersedes all 19 open dependencies-labelled dependabot PRs and resolves the open Dependabot security alert, so the whole dependency surface lands in a single CI-validated merge with no inter-PR conflicts.

npm — Servers (backend)

• backend-minor-patch group, 18 updates: @ai-sdk/anthropic, @ai-sdk/openai, @aws-sdk/client-ses, @azure/msal-node, @daytonaio/sdk, @e2b/code-interpreter, @opentelemetry/exporter-logs-otlp-http 0.300→0.301, @opentelemetry/exporter-metrics-otlp-http 0.300→0.301, @opentelemetry/resources 3.0→3.1, @opentelemetry/sdk-logs 3.0→3.1, @opentelemetry/sdk-metrics 3.0→3.1, @smithy/node-http-handler 4.3→4.14.2, ai, bullmq 6.5→6.7, docx, express-rate-limit, google-auth-library, playwright 1.64→1.65
• jsdom 30.1.3 → 31.0.0 (major, test-environment only)
• package-lock.json regenerated

npm — Clients (frontend)

• frontend-minor-patch group, 27 updates: @ai-sdk/react, @reduxjs/toolkit 2.13→2.14, @tanstack/react-query (+devtools) 5.105→5.106, all 17 @tiptap/* packages 3.32.1→3.33.0, lucide-react, vite 8.3.5→8.3.7, @playwright/test, vitest (+@vitest/coverage-v8) 5.0→5.1, baseline-browser-mapping
• jsdom 30.1.3 → 31.0.0 (major, test-environment only)
• package-lock.json regenerated

pip — AIGateway

sqlalchemy[asyncio]>=2.1.8, opentelemetry-api/sdk/exporter-otlp-proto-http>=1.45.2, pydantic>=2.14.3

pip — EvalServer

hf-xet==1.8.0, narwhals==2.28.0, annotated-types==0.8.0, zipp==4.1.2 (requirements.txt); pytest-asyncio==1.4.1.post1 (requirements-test.txt)

pip — EvaluationModule

pandas>=3.1.1, openai>=3.46.0, deepeval>=4.3.3, cryptography>=50.0.2, pydantic>=2.14.3

Security impact

• Dependabot alert on @tiptap/core (GHSA: mergeAttributes() prototype pollution, vulnerable < 3.30.4, patched 3.30.4) — resolved: all @tiptap/* packages move to ^3.33.0, lock pins @tiptap/core@3.33.0.
• zipp 3.23→4.1.2 and cryptography 50.0.1→50.0.2 carry the latest CVE fixes.

Superseded dependabot PRs (to close on merge)

PR	Change
#5289	Servers jsdom 31
#5288	Clients jsdom 31
#5287	frontend-minor-patch group
#5286	backend-minor-patch group
#5285	EvalServer hf-xet 1.8.0
#5284	EvalServer narwhals 2.28.0
#5283	AIGateway sqlalchemy >=2.1.8
#5282	EvalServer annotated-types 0.8.0
#5281	EvalServer zipp 4.1.2
#5280	AIGateway opentelemetry-api >=1.45.2
#5279	EvalServer pytest-asyncio 1.4.1.post1
#5278	AIGateway opentelemetry-sdk >=1.45.2
#5277	AIGateway opentelemetry-exporter-otlp-proto-http >=1.45.2
#5276	AIGateway pydantic >=2.14.3
#5275	EvaluationModule pandas >=3.1.1
#5274	EvaluationModule openai >=3.46.0
#5273	EvaluationModule deepeval >=4.3.3
#5272	EvaluationModule cryptography >=50.0.2
#5271	EvaluationModule pydantic >=2.14.3

Risk assessment (review-team sign-off)

• Breaking-change exposure: only two major bumps, both dev/test-environment: jsdom 30→31 (Servers + Clients) — validated by the full jest/vitest suites in CI; zipp 4.x is API-compatible for its importlib-metadata use.
• No production code changed — manifests and locks only; every runtime bump is semver-minor/patch within the project's ^/>= ranges.
• pip-audit: AIGateway CI's audit step now resolves sqlalchemy>=2.1.8, pydantic>=2.14.3, opentelemetry>=1.45.2 — no new ignores needed; the existing cryptography>=50.0.0 and filelock pins are unaffected.

Checklist

• All changes are dependency-manifest/lock only (no source changes)
• Lock files regenerated with npm install --package-lock-only (npm exit 0, lockfile v3)
• One commit per file for clean revert granularity
• Full CI matrix will validate install (npm ci), lint, typecheck, and all test suites

[github-actions]

✅ Coverage Gate Passed

All coverage thresholds are met.