[masenf]

Type of change

• Bug fix (non-breaking change which fixes an issue)

Routine dependency sweep: framework frontend pins plus the locked backend environment. I applied one rule throughout: take the newest release that is at least seven days old. The backend lock already enforces this with exclude-newer = "7 days". This PR applies it to npm pins as well, with one exception noted below.

Frontend

Package	From	To	Where
react / react-dom	19.3.0	19.3.1	reflex-base
vite	8.3.2	8.3.4	reflex-base
postcss	8.5.29	8.5.30	reflex-base
postcss-import	17.0.0	17.0.1	reflex-base
@radix-ui/react-accordion	1.2.20	1.3.1	radix
@radix-ui/react-dialog (dialog, drawer)	1.1.23	1.3.1	radix
@radix-ui/react-form	0.1.16	0.3.0	radix
@radix-ui/react-progress	1.1.16	1.2.1	radix
@radix-ui/react-slider	1.4.7	1.6.1	radix
react-syntax-highlighter	16.1.1	16.1.2	code
tailwind-merge	3.6.0	3.7.0	internal
@icons-pack/react-simple-icons	13.13.0	13.15.1	internal

• React 19.3.1 contains one commit, a React Server Components (Flight) transport fix. Reflex doesn't use RSC; taking it keeps React current.
• Radix: the old pins matched exactly the primitives inside radix-ui@1.6.7, which @radix-ui/themes depends on, so apps loaded one copy of each primitive. The new set matches radix-ui@1.8.1, the current release a fresh Themes install resolves to. Bumping them individually would load two copies of the Radix internals (separate dismissable-layer and focus stacks). This set is about 3 hours inside the 7-day window; keeping a single copy seemed worth the exception. The upstream changelogs list type fixes and additive features only.
• Held for the next sweep (too new): react-router 8.5.0 (published Oct 19) and vite 8.3.5.
• Unchanged: the existing holds in [tool.check-outdated-deps] (plotly.js, tailwind, react-dropzone, lucide-react, ag-grid and others), @babel/core (8.x is a major), and Bun 1.4.4 from Upgrade default Bun to 1.4.4 #7639.
• Regenerated docs/app/reflex.lock. It resolves radix-ui@1.8.1 with no nested duplicate @radix-ui/* copies.

Backend

• uv lock --upgrade within the existing window, keeping ruff and pyright at their pinned versions. Notable moves: SQLAlchemy 2.1.4, pydantic 2.14.1, Starlette 1.8.0, granian 2.8.4, FastAPI 0.143.2, python-engineio 4.14.0, playwright 1.64.0, reflex-enterprise 0.9.8, towncrier 26.9.0.
• Main is merged in, so the lock keeps virtualenv 21.14.12 from chore(deps): bump virtualenv to 21.14.12 for Dependabot alert #7644 (the Dependabot security fix).
• reflex-release: widened towncrier from <26 to <27. Version 26 is CalVer with no breaking changes.
• docs app: xy 0.0.7 → 0.0.8. It's a single bugfix that restores live chart rendering on Reflex 0.10.
• [tool.check-outdated-deps]:
  • Hold the Python plotly package, because plotly.py 7 targets plotly.js 4, which is still held at 3.x (Migrate to plotly.js 4.x (removes the mapbox traces rx.plotly.mapbox wraps) #7002).
  • Drop the pydantic-core and pyee holds; both now resolve to their latest versions, so the script flagged them as stale.
• scripts/check_outdated_deps.py backend passes.

Fixes the upgrades required

• SQLAlchemy 2.1 typing: its catch-all returning(*cols) overload types rows as one-element tuples, which broke pyright in reflex-workflow. lease() is now annotated -> Update, so execute() returns untyped rows. I checked this with pyright on both SQLAlchemy 2.0.52 and 2.1.4. One test helper gets an assert until is not None.
• test_get_leaf_vars_sorts_every_cached_operation (from feat(vars): add get_leaf_vars #7606):
  • reflex-enterprise 0.9.8 registers a reflex_app pytest plugin that imports its LambdaVar.
  • Var.__init_subclass__ then generates a LambdaCastedVar inside reflex_base.vars.base, and the test counted it as one of Reflex's own operations.
  • The subclass walk now stops at classes defined outside Reflex. The test passes with the plugin loaded and with -p no:reflex_app.
• tests/integration/test_urls.py now uses httpx instead of requests:
  • pytest-playwright 0.10 dropped its pytest-base-url dependency, which was the only thing installing requests in the integration environment.
  • Without it, collecting the module failed and took every app-harness job down. httpx is already a reflex runtime dependency.

Validation

• Unit suite: 13,177 passed. The only failures are 14 tests in tests/units/reflex_bench/drivers/test_browser.py. They fail identically with the previous Playwright, because this container's preinstalled Chromium (build 1194) is older than Playwright needs.
• ruff check, ruff format --check, pyright reflex tests, full pyright, the pre-commit ty check, uv lock --check, reflex-release changelog-check and reflex-release sync --check all pass. Stub regeneration leaves pyi_hashes.json unchanged.
• Real app: built a production app with Bun 1.4.4 on React 19.3.1, Vite 8.3.4 and PostCSS 8.5.30. In Chromium, checked the accordion, dialog, drawer, form submit (backend round trip), slider (state update), progress bar, code block and markdown code. No page errors.
• I left out docs-only frontend packages outside the framework (@mantine/core, @xyflow/react, rehype-sanitize, react-colorful).

News fragments were added for reflex-base, components-radix, components-code, components-internal, reflex-release and reflex-workflow.

---

Generated by Claude Code

<source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img alt="View guided diff" src="https://www.cubic.dev/buttons/review-in-cubic-light.svg"> <source media="(prefers-color-scheme: dark)" srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-dark.svg"><source media="(prefers-color-scheme: light)" srcset="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg"><img alt="Turn on auto-fix" src="https://www.cubic.dev/buttons/turn-on-auto-fix-light.svg">

[cubic-dev-ai]

No issues found across 26 files

_{View guided diff | Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge; no actionable findings remain in this review.

Summary

Refreshes frontend pins and locked Python dependencies, with small typing and test updates.

• Generated apps use refreshed frontend packages across the framework.
• The Python environment and release tools use newer dependency versions.
• The docs app restores live chart rendering on Reflex 0.10.
• Workflow lease typing stays compatible with SQLAlchemy 2.1.
• Variable tests skip subclasses created outside Reflex.
• URL integration tests use the HTTP client already included at runtime.

_{Reviews (4) · Last reviewed commit: "Pair each Radix primitive with its versi..." · Reviewed by Greptile}

[codspeed]

Merging this PR will degrade performance by 0.02%

2 warnings

⚠️ 12 benchmarks are dominated by system calls

System calls cannot be simulated consistently and are left out of the measure. The reported value understates the real cost. Switch to the Walltime instrument to measure them.

Learn more about system calls

See affected benchmarks

⚠️ Base and head ran on different runner types

Some benchmarks with significant performance changes were compared across different runner types, so the changes might not come from the code. Run base and head on the same runner type, or use CodSpeed Macro Runners for more stable results.

Learn more about Macro Runners

Open the report in CodSpeed to investigate

⚡ 1 improved benchmark
❌ 1 regressed benchmark
✅ 146 untouched benchmarks

Warning

Please fix the performance issues or acknowledge them on CodSpeed.

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
❌	test_route_argument_extraction	115.2 µs	120.1 µs	-4.11%
⚡	test_iteration_operations	13.6 ms	13.1 ms	+4.25%

Tip

Investigate this regression by commenting @codspeedbot fix this regression on this PR, or directly use the CodSpeed MCP with your agent.

---

_{Comparing claude/friendly-wozniak-xqla31 (7c56b16) with main (114312a)}

[masenf]

CodSpeed Performance Analysis on 26d1a3b flagged test_state_access[write_inherited] at −4.4%. I'm treating it as measurement noise, not a regression from this PR:

• The same benchmark came back unchanged on 7832c9b, which had the identical code and lock this benchmark depends on. The only change in 26d1a3b is tests/integration/test_urls.py, which the benchmarks never import.
• CodSpeed's own report warns that base and head ran on different runner types.

CodSpeed isn't a required check. The push of cd3b8d6 (a merge of main, which brings in the virtualenv 21.14.12 security bump from #7644) produces a fresh measurement; if write_inherited regresses again there, I'll dig into it.

---

Generated by Claude Code

[masenf]

unit-tests (ubuntu-latest, 3.15) on cd3b8d6 failed in the "Run unit tests w/ redis and OPLOCK_ENABLED" step: 1 test failed and 13,183 passed. The failure was tests/units/istate/manager/test_redis.py::test_oplock_contention_queue (assert interim_state.count == 1, got 2). Every other unit-test leg passed, including the same oplock step on 3.11–3.14, and every other gate on this commit is green.

This is an existing timing race in the oplock contention tests, not something this PR introduced:

• This PR changes neither the Redis state manager nor these tests, and redis (7.4.1) and pytest-asyncio are locked at the same versions as main.
• Locally on Python 3.15 against a real Redis, the oplock tests passed all 70 runs without load. With the CPU saturated, I alternated main's code and lock with this branch, 40 runs each:
  • main: 1 failure (test_oplock_contention_no_lease)
  • this branch: 2 failures (test_oplock_contention_queue and test_oplock_contention_no_lease)

I don't know of an existing fix for the race. I'm re-running the failed job once.

---

Generated by Claude Code

[masenf]

CodSpeed Performance Analysis on 7c56b16 flags test_route_argument_extraction. That commit changes only one sentence in packages/reflex-components-radix/news/+refresh-dependencies.misc.md, with no code or dependency changes, so this is measurement noise. CodSpeed's report again warns that base and head ran on different runner types. The previous code commit, cd3b8d6, had no regressions. CodSpeed isn't a required check, so I'm not changing anything for it.

---

Generated by Claude Code