Refresh framework frontend pins and locked backend dependencies

docs/app/pyproject.toml

@@ -28,7 +28,7 @@ dependencies = [
     "ruff-format",
     "sqlalchemy",
     "sqlmodel",
-    "xy==0.0.7",
+    "xy==0.0.8",
     "griffelib>=2.0.1",
 ]
 

docs/app/reflex.lock/package.json

@@ -16,9 +16,9 @@
     "@hugeicons/react": "1.1.10",
     "@mantine/core": "8.3.9",
     "@masenf/hello-react": "github:masenf/hello-react",
-    "@radix-ui/react-accordion": "1.2.20",
-    "@radix-ui/react-dialog": "1.1.23",
-    "@radix-ui/react-form": "0.1.16",
+    "@radix-ui/react-accordion": "1.3.1",
+    "@radix-ui/react-dialog": "1.3.1",
+    "@radix-ui/react-form": "0.3.0",
     "@radix-ui/themes": "3.3.0",
     "@react-router/node": "8.4.0",
     "@splinetool/react-spline": "4.1.0",
@@ -43,12 +43,12 @@
     "moment-timezone": "0.6.5",
     "plotly.js": "3.7.0",
     "plotly.js-locales": "3.7.0",
-    "react": "19.3.0",
+    "react": "19.3.1",
     "react-colorful": "5.7.0",
     "react-debounce-input": "3.3.0",
     "react-dnd": "^16.0.1",
     "react-dnd-html5-backend": "^16.0.1",
-    "react-dom": "19.3.0",
+    "react-dom": "19.3.1",
     "react-helmet": "6.1.0",
     "react-leaflet": "5.0.0",
     "react-markdown": "10.1.0",
@@ -57,7 +57,7 @@
     "react-plotly.js": "4.1.0",
     "react-responsive-carousel": "3.2.23",
     "react-router": "8.4.0",
-    "react-syntax-highlighter": "16.1.1",
+    "react-syntax-highlighter": "16.1.2",
     "reactflow": "^11.11.4",
     "recharts": "3.10.1",
     "rehype-autolink-headings": "7.1.0",
@@ -72,7 +72,7 @@
     "shiki": "4.5.0",
     "socket.io-client": "4.8.4",
     "sonner": "2.0.8",
-    "tailwind-merge": "3.6.0",
+    "tailwind-merge": "3.7.0",
     "tailwindcss-animated": "2.1.0",
     "tailwindcss-scroll-mask": "0.0.5",
     "universal-cookie": "8.1.2",
@@ -85,10 +85,10 @@
     "@tailwindcss/postcss": "4.3.0",
     "@tailwindcss/typography": "0.5.20",
     "autoprefixer": "10.6.1",
-    "postcss": "8.5.29",
-    "postcss-import": "17.0.0",
+    "postcss": "8.5.30",
+    "postcss-import": "17.0.1",
     "tailwindcss": "4.3.0",
-    "vite": "8.3.2"
+    "vite": "8.3.4"
   },
   "overrides": {}
 }

packages/reflex-base/news/+refresh-dependencies.misc.md

@@ -0,0 +1 @@
+Update generated apps to React 19.3.1, Vite 8.3.4, PostCSS 8.5.30, and postcss-import 17.0.1.

packages/reflex-base/src/reflex_base/constants/installer.py

@@ -106,7 +106,7 @@ def _determine_react_router_version() -> str:
 
 
 def _determine_react_version() -> str:
-    default_version = "19.3.0"
+    default_version = "19.3.1"
     if (version := os.getenv("REACT_VERSION")) and version != default_version:
         logger.warning(
             f"You have requested react@{version} but the supported version is {default_version}, abandon all hope ye who enter here."
@@ -156,11 +156,11 @@ def DEPENDENCIES(cls) -> dict[str, str]:
     DEV_DEPENDENCIES = {
         "@emotion/react": "11.14.0",
         "autoprefixer": "10.6.1",
-        "postcss": "8.5.29",
-        "postcss-import": "17.0.0",
+        "postcss": "8.5.30",
+        "postcss-import": "17.0.1",
         "@react-router/dev": _react_router_version,
         "@react-router/fs-routes": _react_router_version,
-        "vite": "8.3.2",
+        "vite": "8.3.4",
     }
 
     REACT_COMPILER_DEV_DEPENDENCIES = {

packages/reflex-components-code/news/+refresh-dependencies.misc.md

@@ -0,0 +1 @@
+Update react-syntax-highlighter to 16.1.2.

packages/reflex-components-code/src/reflex_components_code/code.py

@@ -382,7 +382,7 @@ class Theme:
 class CodeBlock(Component, MarkdownComponentMap):
     """A code block."""
 
-    library = "react-syntax-highlighter@16.1.1"
+    library = "react-syntax-highlighter@16.1.2"
 
     tag = "PrismAsyncLight"
 

packages/reflex-components-internal/news/+refresh-dependencies.misc.md

@@ -0,0 +1 @@
+Update tailwind-merge to 3.7.0 and @icons-pack/react-simple-icons to 13.15.1.

packages/reflex-components-internal/src/reflex_components_internal/components/icons/simple_icon.py

@@ -7,7 +7,7 @@
 class SimpleIcon(rx.Component):
     """Simple Icon component wrapper for @icons-pack/react-simple-icons."""
 
-    library = "@icons-pack/react-simple-icons@13.13.0"
+    library = "@icons-pack/react-simple-icons@13.15.1"
 
     tag = "SiReact"
 

packages/reflex-components-internal/src/reflex_components_internal/utils/twmerge.py

@@ -11,7 +11,7 @@
 
 TW_MERGE = Var(
     "twMerge",
-    _var_data=VarData(imports={"tailwind-merge@3.6.0": ImportVar(tag="twMerge")}),
+    _var_data=VarData(imports={"tailwind-merge@3.7.0": ImportVar(tag="twMerge")}),
 ).to(FunctionVar)
 
 

packages/reflex-components-radix/news/+refresh-dependencies.misc.md

@@ -0,0 +1 @@
+Update the Radix primitives to the versions bundled with the current `radix-ui` release that Radix Themes depends on (accordion 1.3.1, dialog 1.3.1, form 0.3.0, progress 1.2.1, slider 1.6.1), so apps load a single copy of each primitive.

packages/reflex-components-radix/src/reflex_components_radix/primitives/accordion.py

@@ -53,7 +53,7 @@ def _inherited_variant_selector(
 class AccordionComponent(RadixPrimitiveComponent):
     """Base class for all @radix-ui/accordion components."""
 
-    library = "@radix-ui/react-accordion@1.2.20"
+    library = "@radix-ui/react-accordion@1.3.1"
 
     color_scheme: Var[LiteralAccentColor] = field(
         doc="The color scheme of the component."

packages/reflex-components-radix/src/reflex_components_radix/primitives/dialog.py

@@ -14,7 +14,7 @@
 class DialogElement(RadixPrimitiveComponent):
     """Base class for all @radix-ui/react-dialog components."""
 
-    library = "@radix-ui/react-dialog@1.1.23"
+    library = "@radix-ui/react-dialog@1.3.1"
 
 
 class DialogRoot(DialogElement):

packages/reflex-components-radix/src/reflex_components_radix/primitives/drawer.py

@@ -22,7 +22,7 @@ class DrawerComponent(RadixPrimitiveComponent):
 
     library = "vaul@1.1.2"
 
-    lib_dependencies: list[str] = ["@radix-ui/react-dialog@1.1.23"]
+    lib_dependencies: list[str] = ["@radix-ui/react-dialog@1.3.1"]
 
 
 LiteralDirectionType = Literal["top", "bottom", "left", "right"]

packages/reflex-components-radix/src/reflex_components_radix/primitives/form.py

@@ -19,7 +19,7 @@
 class FormComponent(RadixPrimitiveComponentWithClassName):
     """Base class for all @radix-ui/react-form components."""
 
-    library = "@radix-ui/react-form@0.1.16"
+    library = "@radix-ui/react-form@0.3.0"
 
 
 class FormRoot(FormComponent, HTMLForm):

packages/reflex-components-radix/src/reflex_components_radix/primitives/progress.py

@@ -16,7 +16,7 @@
 class ProgressComponent(RadixPrimitiveComponentWithClassName):
     """A Progress component."""
 
-    library = "@radix-ui/react-progress@1.1.16"
+    library = "@radix-ui/react-progress@1.2.1"
 
 
 class ProgressRoot(ProgressComponent):

packages/reflex-components-radix/src/reflex_components_radix/primitives/slider.py

@@ -18,7 +18,7 @@
 class SliderComponent(RadixPrimitiveComponentWithClassName):
     """Base class for all @radix-ui/react-slider components."""
 
-    library = "@radix-ui/react-slider@1.4.7"
+    library = "@radix-ui/react-slider@1.6.1"
 
 
 class SliderRoot(SliderComponent):

packages/reflex-release/news/+refresh-dependencies.misc.md

@@ -0,0 +1 @@
+Allow towncrier 26.

packages/reflex-release/pyproject.toml

@@ -18,7 +18,7 @@ classifiers = [
 ]
 dependencies = [
   "packaging >=24.2,<27",
-  "towncrier >=24.8.0,<26",
+  "towncrier >=24.8.0,<27",
   "tzdata >=2024.1; sys_platform == 'win32'",
 ]
 

packages/reflex-workflow/news/+refresh-dependencies.misc.md

@@ -0,0 +1 @@
+Type-check cleanly against SQLAlchemy 2.1.

packages/reflex-workflow/src/reflex_workflow/engine/claim.py

@@ -8,7 +8,7 @@
 from collections.abc import Collection
 from typing import TYPE_CHECKING, Any, NamedTuple
 
-from sqlalchemy import and_, case, func, null, or_, select, update
+from sqlalchemy import Update, and_, case, func, null, or_, select, update
 from sqlalchemy.dialects.postgresql import insert as pg_insert
 from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy.orm import aliased
@@ -191,7 +191,7 @@ def lease(
     cls: type[Workflow],
     picked: Any,
     steps: Collection[str] | None,
-):
+) -> Update:
     """Build the update that leases the picked rows.
 
     Args:

pyproject.toml

@@ -483,10 +483,9 @@ showcontent = true
 # checked.
 [tool.check-outdated-deps]
 backend_held = [
-    # Exact-pinned by pydantic and playwright respectively, so they can only move when
-    # their parent does. Drop these once the parent releases pick up the newer version.
-    "pydantic-core",
-    "pyee",
+    # plotly.py 7 targets plotly.js 4, which is held below in `frontend_held` (#7002);
+    # figures built with it would render against the older plotly.js bundle.
+    "plotly",
     # Held at 7.x: redis-py 8 hangs three redis-backed tests on Python 3.10/3.11
     # (including `get_state`, so it is not test-only). See #7026 for the reproduction
     # and the A/B that isolated it; requested in #6764.

tests/integration/test_urls.py

@@ -4,8 +4,8 @@
 import re
 from pathlib import Path
 
+import httpx
 import pytest
-import requests
 
 
 def check_urls(repo_dir: Path):
@@ -40,11 +40,9 @@ def check_urls(repo_dir: Path):
                             )
                         url = url.strip('"\n')
                         try:
-                            response = requests.head(
-                                url, allow_redirects=True, timeout=5
-                            )
+                            response = httpx.head(url, follow_redirects=True, timeout=5)
                             response.raise_for_status()
-                        except requests.RequestException as e:
+                        except httpx.HTTPError as e:
                             errors.append(
                                 f"Error accessing URL: {url} in {file_path} | Error: {e}, , Check your path ends with a /"
                             )

tests/units/reflex_base/vars/test_base.py

@@ -2421,21 +2421,24 @@ def test_get_leaf_vars_sorts_every_cached_operation() -> None:
     Classes are compared by name: a ``slots=True`` dataclass is a rebuilt copy
     of the class first defined, and the discarded original stays in
     ``__subclasses__`` until it is garbage collected.
+
+    The walk stops at classes defined outside Reflex: an installed package's
+    var subclass gets a ``*CastedVar`` generated in ``reflex_base.vars.base``,
+    which would otherwise be counted as one of Reflex's own operations.
     """
 
     def subclasses(cls: type) -> set[type]:
-        return set(cls.__subclasses__()).union(
-            *(subclasses(sub) for sub in cls.__subclasses__())
-        )
+        own = {
+            sub
+            for sub in cls.__subclasses__()
+            if sub.__module__.startswith(("reflex_base.", "reflex."))
+        }
+        return own.union(*(subclasses(sub) for sub in own))
 
     def names(classes: Iterable[type]) -> set[str]:
         return {f"{cls.__module__}.{cls.__qualname__}" for cls in classes}
 
-    operations = {
-        cls
-        for cls in subclasses(CachedVarOperation)
-        if cls.__module__.startswith(("reflex_base.", "reflex."))
-    }
+    operations = subclasses(CachedVarOperation)
 
     assert names(operations) == names({
         CustomVarOperation,

tests/units/reflex_components_internal/utils/test_twmerge.py

@@ -20,5 +20,5 @@ def test_cn_uses_clsx_and_tailwind_merge() -> None:
     assert var_data is not None
     assert dict(var_data.imports) == {
         "clsx@2.1.1": (ImportVar(tag="clsx", is_default=True),),
-        "tailwind-merge@3.6.0": (ImportVar(tag="twMerge"),),
+        "tailwind-merge@3.7.0": (ImportVar(tag="twMerge"),),
     }

tests/units/reflex_workflow/engine/test_runner.py

@@ -1503,7 +1503,8 @@ async def claim_row(
     )
     async with runtime.current().session_factory() as session, session.begin():
         version, until = (await session.execute(stmt)).one()
-        return claim.Claimed(pk, version, until)
+    assert until is not None
+    return claim.Claimed(pk, version, until)
 
 
 async def pk_of(