Latest Results
Replace the outdated-dependency shell filters with a configured script
The check lived as two inline shell blocks in
check_outdated_dependencies.yml, so it could not be run outside CI, and the
ignored package names were baked into grep patterns over the rendered report.
`scripts/check_outdated_deps.py {backend,frontend}` now does the work and the
workflow is two one-line steps. Held names move to `[tool.check-outdated-deps]`
in the root pyproject.toml, so changing what is ignored is a config edit.
Matching is on parsed package names rather than a regex over the table, which
removes the anchoring the grep needed to avoid swallowing siblings: a bare
`tailwindcss` entry cannot match `tailwindcss-animated`, and a `plotly.js`
entry cannot match `plotly.js-locales` or `react-plotly.js`. Entries ending in
`*` opt into prefix matching for the cases that need it -- `@chakra-ui/*` for
the scope, `ag-grid*` for the three packages that release in lockstep, which
the shell filter covered with both `ag-grid` and `ag-grid-react`.
Two config keys rather than one, because the two reasons a package is ignored
want different treatment:
- `*_held` -- blocked on work we own. A held package that is already at its
latest version means the blocker is gone, so the entry should be deleted:
that errors, which keeps the list from accumulating dead entries.
- `*_pinned` -- pinned by policy or owned by another repo (pyright, ruff, the
reflex-enterprise packages, the ag-grid family). Reaching latest says nothing
about whether the entry can go, so staleness is not checked.
Both lists start out as the filters main already had, all of which are
`*_pinned`; `*_held` is where blocker-driven entries land.
Two details the parser has to get right, both verified against a real bun
1.4.0 install rather than assumed:
- bun right-pads the package column, so the name needs trimming out of the
cell rather than matching a fixed-width field.
- bun annotates rows outside `dependencies` in that cell -- `tailwindcss
(dev)`, `react (peer)`, `clsx (optional)`. The annotation is stripped before
matching; npm names cannot contain spaces, so the suffix is unambiguous.
Correspondingly, the declared-name set used for staleness covers all four
sections bun reports on, not just dependencies and devDependencies.
Note this job only triggers on release/** pushes and workflow_dispatch, so it
does not run on this pull request. That is part of why running it locally
matters; `uv run python scripts/check_outdated_deps.py backend` and
`--web-dir <app>/.web` for the frontend side both work against a checkout.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RKQ4ARC2vkE5iKoULyaczzclaude/check-outdated-deps-script Latest Branches
0%
farhan/eng-9166-reflex-otel-4 +5%
FarhanAliRaza:dirty-tracking-cutoff 0%
claude/outdated-dependencies-release-t26evx © 2026 CodSpeed Technology