chore(deps): apply safe Dependabot updates on staging by biodrone · Pull Request #629 · dangeroustech/StreamDL

biodrone · 2026-08-15T05:41:22Z

There is no dev branch in this repo. Dependabot is configured to target staging, so these updates are bundled there the same way as #602.

Included (CI-green on the source PRs)

Update	Source
Python `protobuf` 5.29.6 → 7.35.1, with regenerated `stream_pb2*.py` stubs and `grpcio-tools>=1.82.1`	#614 (supersedes Dependabot #598)
`wheel` 0.47.0 → 0.48.0	#628
`google.golang.org/protobuf` 1.36.11 → 1.36.12	#627
`modernc.org/sqlite` 1.54.0 → 1.56.0 (includes SQLite 3.53.3 journal-rollback corruption fix; pins `modernc.org/libc` 1.74.4)	#626
`streamlink` 8.4.0 → 8.5.0	#625
`curl-cffi` 0.15.0 → 0.16.0	#624
`github/codeql-action` v4 → v4.37.4	#623
`google.golang.org/grpc` 1.82.1 → 1.83.0	#622
`docker/login-action` v4 → v4.5.2	#620
`grpcio` 1.82.1 → 1.83.0	#615
`setuptools` 82.0.1 → 83.0.0 (lockfile only; same bump as master #616)	#616

Held back

chore 🤖(deps): bump protobuf from 5.29.6 to 7.35.1 #598 protobuf 5.29.6 → 7.35.1 as-is — raw pin bump without stub regeneration. Landed via chore(deps): upgrade protobuf to 7.35.1 on staging #614 instead.
chore(deps): bump yt-dlp from 2026.6.9 to 2026.7.4 #618 yt-dlp 2026.6.9 → 2026.7.4 — targets master; staging already has 2026.7.4.
chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 #617 google.golang.org/grpc 1.82.0 → 1.82.1 — targets master; staging already has 1.82.1 (this PR goes to 1.83.0).
chore(deps): bump setuptools from 82.0.1 to 83.0.0 #616 on master — lockfile bump applied on staging here so it can promote with the rest.

Notes

Streamlink 8.5.0 removes the Trovo plugin. StreamDL uses the public Streamlink session API and already falls back to yt-dlp when Streamlink has no plugin, so Trovo should still resolve via yt-dlp.
GitHub Actions are pinned from floating @v4 to the current patch tags Dependabot proposed.

Test plan

go test ./...
uv run pytest
CI on this PR

Summary by CodeRabbit

Chores
- Updated deployment tooling and security-reporting integrations.
- Refreshed core Go and Python dependencies to newer supported versions.
- Updated protocol compatibility metadata for improved gRPC and protobuf support.
- Maintained existing deployment workflow behavior and dependency version limits.

Supersedes Dependabot #598. Drop the intentional protobuf<6 pin, bump grpcio-tools to 1.82.1 (requires protobuf>=7.35.1), and regenerate Python gRPC stubs for the new runtime. Co-authored-by: Josh J <josh@joshjacobs.net>

Bundle green patch/minor Dependabot bumps for Go, Python, and GitHub Actions. Co-authored-by: Josh J <josh@joshjacobs.net>

coderabbitai · 2026-08-15T05:41:34Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 118eb765-4b59-4017-b19a-8e5e09c25df9

📥 Commits

Reviewing files that changed from the base of the PR and between 1fc11cf and aba2ea6.

⛔ Files ignored due to path filters (4)

go.sum is excluded by !**/*.sum
stream_pb2.py is excluded by !stream_pb2.py
stream_pb2_grpc.py is excluded by !stream_pb2_grpc.py
uv.lock is excluded by !**/*.lock

📒 Files selected for processing (6)

.github/workflows/deploy_master.yml
.github/workflows/deploy_staging.yml
go.mod
protos/stream_pb2.py
protos/stream_pb2_grpc.py
pyproject.toml

📝 Walkthrough

Walkthrough

The pull request updates Python and Go dependency versions, refreshes generated protobuf and gRPC compatibility metadata, and pins Docker login and SARIF upload actions in both deployment workflows.

Changes

Dependency and generated-code updates

Layer / File(s)	Summary
Python dependency and generated-code compatibility `pyproject.toml`, `protos/stream_pb2.py`, `protos/stream_pb2_grpc.py`	Python dependency minimums and generated protobuf and gRPC compatibility values are updated. Generated classes no longer explicitly inherit from `object`.
Go module dependency updates `go.mod`	Direct and indirect gRPC, protobuf, SQLite, libc, genproto, and `go-isatty` versions are updated.
Deployment action version pins `.github/workflows/deploy_master.yml`, `.github/workflows/deploy_staging.yml`	Docker login uses `v4.5.2`, and SARIF upload uses `v4.37.4` in both deployment workflows.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to aba2e

This dependency update and regenerated protobuf code introduce no actionable merge-blocking risk at the current head; it is merge-ready after normal checks and review.

Possibly related PRs

dangeroustech/StreamDL#602: Updates overlapping Go and Python dependencies.
dangeroustech/StreamDL#614: Updates the same protobuf and gRPC dependencies and generated files.

Suggested reviewers: cursoragent

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a dependency update applied to the staging branch.
Description check	✅ Passed	The description explains the dependency updates, exclusions, notes, and completed tests, but it omits the template's issue reference.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/dependabot-safe-staging-49e4

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

cursoragent and others added 2 commits August 15, 2026 05:40

chore(deps): upgrade protobuf to 7.35.1 on staging

6eeccf2

Supersedes Dependabot #598. Drop the intentional protobuf<6 pin, bump grpcio-tools to 1.82.1 (requires protobuf>=7.35.1), and regenerate Python gRPC stubs for the new runtime. Co-authored-by: Josh J <josh@joshjacobs.net>

chore(deps): apply remaining safe Dependabot updates on staging

aba2ea6

Bundle green patch/minor Dependabot bumps for Go, Python, and GitHub Actions. Co-authored-by: Josh J <josh@joshjacobs.net>

biodrone marked this pull request as ready for review August 15, 2026 05:43

cursor Bot merged commit 406e731 into staging Aug 15, 2026
7 checks passed

Navigation Menu

Uh oh!

chore(deps): apply safe Dependabot updates on staging - #629

chore(deps): apply safe Dependabot updates on staging#629
cursor[bot] merged 2 commits into
stagingfrom
cursor/dependabot-safe-staging-49e4

biodrone commented Aug 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 15, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

biodrone commented Aug 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Included (CI-green on the source PRs)

Held back

Notes

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

biodrone commented Aug 15, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 15, 2026 •

edited

Loading