deps: zbiorcza aktualizacja 8 PR-ów dependabota (uv + actions + yarn) — zamyka 4 CVE i odblokowuje pip-audit

.github/workflows/build-docker-images.yml

@@ -129,7 +129,7 @@ jobs:
           password: ${{ secrets.DOCKER_PAT }}
 
       - name: Set up Docker Buildx Action
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           # PRZYPIĘTE do konkretnej wersji lab (buildx-desktop) zamiast ruchomego
           # "lab:latest". "lab:latest" ściąga binarkę buildx z kanału lab, którego
@@ -502,7 +502,7 @@ jobs:
           password: ${{ secrets.DOCKER_PAT }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Promote staging tag to canonical tag(s)
         env:

.github/workflows/claude.yml

@@ -32,7 +32,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@9d7150bc8a3dae8149739a88019d192b579ad90c # v1.0.193
+        uses: anthropics/claude-code-action@d75b94d5ad426cb8546e6628b6f5f19b84e5cce1 # v1.0.216
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
 

.github/workflows/docs.yml

@@ -104,4 +104,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/promote.yml

@@ -94,7 +94,7 @@ jobs:
           password: ${{ secrets.DOCKER_PAT }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Pre-flight — obrazy RC istnieją w rejestrze
         env:

.github/workflows/release-candidate.yml

@@ -253,7 +253,7 @@ jobs:
       # tests.yml → prepare-image.
       - name: Set up Docker Buildx
         if: ${{ !inputs.skip_tests && steps.bump.outputs.should_test == 'true' }}
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           driver: docker-container
 

.github/workflows/tests.yml

@@ -247,7 +247,7 @@ jobs:
     # drifcie jest tanszy niz 37s na kazdym runie.
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       with:
         driver: docker-container
 

.pre-commit-config.yaml

@@ -8,7 +8,7 @@ repos:
       # A lower pin here caused pre-commit to accept an I001 layout that
       # ruff 0.15.x (used by CI) rejected — the diff was invisible
       # locally until GitHub Actions failed.
-      rev: v0.16.3
+      rev: v0.16.6
       hooks:
         - id: ruff
           args: ["--fix", "--exit-non-zero-on-fix"]

pyproject.toml

@@ -41,13 +41,13 @@ dependencies = [
     "pygad>=3.7.0",
     "django-denorm-iplweb>=1.14.0",
     "django-tabular-permissions==2.9.3",
-    "simplejson>=4.1.1,<5",
+    "simplejson>=4.1.2,<5",
     "django-reversion>=6.3.0,<7",
     "django-reversion-compare>=0.19.2",
     "channels[daphne]>=4.3.2,<5",
-    "uvicorn[standard]>=0.52.3",
+    "uvicorn[standard]>=0.52.4",
     "channels-redis>=4,<5",
-    "django-flexible-reports>=0.4.2",
+    "django-flexible-reports>=0.5.0",
     "django-dsl>=0.1.15",
     "django-group-by==0.3.1",
     "django-columns==0.1.0",
@@ -62,15 +62,15 @@ dependencies = [
     "xlrd==2.0.2",
     "celery>=5.6.3",
     "django-celery-results==2.6.0",
-    "django-tables2>=3.0.0,<3.1",
+    "django-tables2>=3.0.1,<3.1",
     "django-sendfile2>=0.7.2",
     "Unidecode>=1.3,<2",
     "django-cookie-law==2.2.0",
     "django-classy-tags==4.1.0",
     "django-crispy-forms>=2.7,<3",
     "crispy-forms-foundation>=1.1.0,<2",
     "django-compressor==4.6.0",
-    "nh3>=0.3.6",
+    "nh3>=0.3.7",
     "django-session-security>=2.6.8",
     "django-password-policies-iplweb==0.9.4",
     "dj-pagination==2.5.0",
@@ -121,13 +121,13 @@ dependencies = [
     "urllib3>=2.7.0,<3.0.0",
     "pandas>=3.0.5",
     "django-tinymce>=5.0.0",
-    "crispy-bootstrap5>=2026.3",
+    "crispy-bootstrap5>=2026.9",
     "crispy-bootstrap3>=2022.1",
     "twisted[http2,tls]>=26.4.0",
     "django-dbtemplates-iplweb>=4.4.1",
     "django-soft-delete>=1.0.23",
     "tqdm>=4.70.0",
-    "xhtml2pdf>=0.2.16",
+    "xhtml2pdf>=0.2.18",
     "isbnlib>=3.10.14",
     "chardet>=7.6.0",
     "python-dateutil>=2.9.0.post0",
@@ -142,7 +142,7 @@ dependencies = [
     "bibtexparser>=2.0.0b7", # BibTeX import
     "langdetect>=1.0.9", # Language detection for imports
     "beautifulsoup4>=4.15.0", # importer_publikacji.providers.www imports at app-ready time
-    "gunicorn>=26.0.0", # authserver WSGI runner (moved from docker/authserver build-time uv pip install)
+    "gunicorn>=26.2.0", # authserver WSGI runner (moved from docker/authserver build-time uv pip install)
     "watchdog>=5.0.3", # --reload mode dla uvicorn/celery w dev compose (moved from entrypoint `uv pip install`)
     # Transitive via Django, pinowany zeby wymusic wersje z fixem. 0.6.0 zamyka
     # CVE-2026-71491, CVE-2026-59894, CVE-2026-59893 i CVE-2026-54284 (wszystkie
@@ -173,7 +173,7 @@ dependencies = [
     # django-liveops: framework dla dlugo-dzialajacych operacji z live UI
     # (WebSocket + HTMX). Nastepca wewnetrznego `src/long_running`.
     "django-liveops[celery]>=0.4.1,<0.5",
-    "django-oauth-toolkit==3.4.0",
+    "django-oauth-toolkit==3.4.1",
     "django-altcha>=1.0.0",
 ]
 
@@ -247,7 +247,40 @@ tag = false
 push = false
 
 [tool.uv]
-environments = ["python_version >= '3.10' and python_version < '3.15' and platform_python_implementation != 'PyPy'"]
+# Zawezenie universal resolution uv. uv domyslnie rozwiazuje JEDEN lock
+# poprawny dla KAZDEJ platformy i KAZDEGO interpretera - takze tych,
+# ktorych nigdy nie uruchomimy. Wystarczy wtedy jeden pakiet z warunkiem
+# `platform_python_implementation == "PyPy"`, zeby scagnac w dol caly graf.
+#
+# Wykluczenie PyPy wjechalo commitem 0f3f049e0 ("Prepare fix, maybe",
+# 2025-10-14) razem z `urllib3>=2.2.3` i `vcrpy>=6.0.2` - i to byl wlasnie
+# ten fix, tylko nieopisany. vcrpy 6.0.2 deklarowalo:
+#
+#     urllib3;   platform_python_implementation != "PyPy" and python_version >= "3.10"
+#     urllib3<2; platform_python_implementation == "PyPy"     <- konflikt
+#
+# czyli galaz PyPy zadala `urllib3<2`, co jest nie do pogodzenia
+# z `urllib3>=2.2.3`. Skasowanie galezi PyPy odblokowalo rezolucje.
+#
+# STAN NA 2026-09-08: ten konkretny pozar wygasl - vcrpy 8.3.0 nie ma juz
+# tego warunku. Przeskanowany zostal CALY graf (364 pakiety z rejestru,
+# zero bledow pobrania): warunki `== "PyPy"` maja tylko celery (brotlipy),
+# fonttools (munkres) i jaraco-functools (mypy), a wszystkie trzy siedza
+# za extrasami, ktorych nie wlaczamy - `brotlipy`, `munkres` ani `mypy`
+# nie wystepuja w uv.lock (z fonttools bierzemy wylacznie extra `woff`).
+# Zdjecie wykluczenia daje dzis DOKLADNIE te same wersje (367 pakietow,
+# zero roznic w parach nazwa/wersja).
+#
+# Zostaje mimo to, jako tanie ubezpieczenie: kosztuje 13 linii
+# `resolution-markers` w naglowku locka, a chroni przed powtorka klasy
+# problemu, ktora juz raz zablokowala rezolucje. Bez niego trzy pakiety
+# (cryptography, pynacl, uvicorn[standard]) odzyskuja markery PyPy na
+# krawedziach do cffi/uvloop - wiec lock i tak nie robi sie prostszy.
+#
+# Dolna granica trzymana rownolegle do `requires-python` wyzej (>=3.11).
+# Do 2026-09 stalo tu `>= '3.10'` - martwe, bo przeciecie z requires-python
+# i tak dawalo 3.11, ale mylnie sugerowalo wsparcie dla 3.10.
+environments = ["python_version >= '3.11' and python_version < '3.15' and platform_python_implementation != 'PyPy'"]
 
 # Security floors dla zaleznosci TRANZYTYWNYCH (nie deklarujemy ich jako
 # direct deps - przychodza przez inne pakiety). constraint-dependencies
@@ -509,7 +542,7 @@ dev = [
     # (CI / agent / pipe = non-TTY = no-op), sam wylacza sugara gdy aktywny.
     # https://github.com/mpasternak/pytest-tqdm
     "pytest-tqdm>=0.4.0",
-    "pytest-rerunfailures>=16.5",
+    "pytest-rerunfailures>=16.6.1",
     "django-debug-toolbar>=7.1.1",
     "model-bakery>=1.24.0",
     "django-dynamic-fixture>=1.8.0",
@@ -534,7 +567,7 @@ dev = [
     # .pre-commit-config.yaml. CI lints via pre-commit (that rev is the
     # source of truth); this `==` pin only keeps ad-hoc `uv run ruff`
     # producing identical output. Bump both together, never one alone.
-    "ruff==0.16.3",
+    "ruff==0.16.6",
     "djlint>=1.44.1,<2",
     "pre-commit>=4.6.2",
     "twine>=7.0.0",