chore(deps): apply pending Dependabot updates

[ChiefGyk3D]

Summary

Consolidates all currently-open Dependabot version bumps into a single PR, applied on top of the latest main. This supersedes the individual Dependabot PRs (they should auto-close once these versions land on main).

pip (requirements.txt + docker/requirements-no-tiktok.txt)

Package	From	To
google-api-python-client	2.193.0	2.196.0
google-auth	2.49.1	2.52.0
google-auth-httplib2	0.3.1	0.4.0
Mastodon.py	2.1.4	2.2.1
playwright	1.58.0	1.59.0
protobuf	>=5.29.6,<8.0.0	>=7.34.1,<8.0.0
google-genai	>=1.65.0	>=2.0.1
ollama	0.6.1	0.6.2
pytest	9.0.2	9.0.3
ruff	0.15.9 (docker floor 0.1.0)	0.15.12

github-actions

Action	From	To
actions/checkout	v6	v7
actions/dependency-review-action	v4	v5
codecov/codecov-action	v5	v7

Note on the Snyk PRs

The 2 open Snyk PRs (snyk-fix-*) are not included and I recommend closing them without merging. They are branched from a much older main and merging them would regress the repo (~2,100 deletions: they revert main.py/youtube_videos.py/bluesky.py, delete docker-compose.macvlan.example.yml and update.sh, downgrade requests/playwright/atproto/python-dotenv/ruff/bandit, and revert google-genai back to the deprecated google-generativeai). Their only real intent — pinning protobuf against an advisory — is already satisfied by the protobuf>=7.34.1 floor in this PR.

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 10 package(s) with unknown licenses.

See the Details below.

License Issues

.github/workflows/docker-build-publish.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

.github/workflows/snyk-security.yml

Package	Version	License	Issue Type
actions/checkout	7.*.*	Null	Unknown License

docker/requirements-no-tiktok.txt

Package	Version	License	Issue Type
Mastodon.py	2.2.1	Null	Unknown License
google-genai	>= 2.0.1	Null	Unknown License
protobuf	>= 7.34.1,< 8.0.0	Null	Unknown License
ruff	>= 0.15.12	Null	Unknown License

requirements.txt

Package	Version	License	Issue Type
Mastodon.py	2.2.1	Null	Unknown License
google-genai	>= 2.0.1	Null	Unknown License
playwright	1.59.0	Null	Unknown License
protobuf	>= 7.34.1,< 8.0.0	Null	Unknown License

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/checkout	7.*.*	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 20 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Packaging ⚠️ -1 packaging workflow not detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
pip/Mastodon.py	2.2.1	Unknown	Unknown
pip/google-api-python-client	2.196.0	🟢 6.9	Details Check Score Reason Maintained 🟢 10 15 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/google-auth	2.52.0	🟢 7.3	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Maintained ⚠️ 0 project is archived Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Code-Review 🟢 10 all changesets reviewed Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration SAST 🟢 5 SAST tool is not run on all commits -- score normalized to 5
pip/google-auth-httplib2	0.4.0	🟢 8.3	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10 Code-Review 🟢 10 all changesets reviewed CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Signed-Releases ⚠️ -1 no releases found Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Fuzzing 🟢 10 project is fuzzed
pip/google-genai	>= 2.0.1	Unknown	Unknown
pip/ollama	0.6.2	Unknown	Unknown
pip/protobuf	>= 7.34.1,< 8.0.0	Unknown	Unknown
pip/ruff	>= 0.15.12	Unknown	Unknown
pip/Mastodon.py	2.2.1	Unknown	Unknown
pip/google-api-python-client	2.196.0	🟢 6.9	Details Check Score Reason Maintained 🟢 10 15 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 10 all changesets reviewed Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0
pip/google-genai	>= 2.0.1	Unknown	Unknown
pip/ollama	0.6.2	Unknown	Unknown
pip/playwright	1.59.0	Unknown	Unknown
pip/protobuf	>= 7.34.1,< 8.0.0	Unknown	Unknown
pip/pytest	9.0.3	Unknown	Unknown
pip/ruff	0.15.12	Unknown	Unknown

Scanned Files

• .github/workflows/docker-build-publish.yml
• .github/workflows/snyk-security.yml
• docker/requirements-no-tiktok.txt
• requirements.txt