Consolidate dependency upgrades (#662)

* fix: invalidate template fragments cached with Bootstrap 4 markup

* chore: consolidate pending dependency upgrades

Python: refresh uv.lock; widen pins for simplejson (<5), pytz (<2027), reportlab (<6)
Docker: node 24 -> 26
Actions: docker/login, setup-qemu, setup-buildx -> v4; github-script -> v9; setup-node -> v7

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -55,7 +55,7 @@ jobs:
           python-version-file: ".python-version"
           enable-cache: true
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7
         with:
           node-version: 24
           cache: npm

.github/workflows/combine-prs.yml

@@ -30,7 +30,7 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
-      - uses: actions/github-script@v6
+      - uses: actions/github-script@v9
         id: create-combined-pr
         name: Create Combined PR
         with:

Dockerfile

@@ -8,7 +8,7 @@
 # apt packages, Python dependencies and node modules are all cached separately.
 
 # ---- Frontend assets (multi-arch: official node image) ----
-FROM node:24-slim AS assets
+FROM node:26-slim AS assets
 WORKDIR /app
 
 COPY package.json package-lock.json ./

assets/templates/cable_type_detail.html

@@ -25,7 +25,8 @@
             <div class="col mt-2 text-end">
                 {% button 'edit' url='cable_type_update' pk=object.id %}
             </div>
-            {% cache None cable_type_assets object %}
+            {# cached indefinitely: bump the "bs5" suffix whenever this markup changes #}
+            {% cache None cable_type_assets_bs5 object %}
                 <div class="col mt-2">
                     <div class="card">
                         <div class="card-header">Associated Assets</div>

pyproject.toml

@@ -20,9 +20,9 @@ dependencies = [
     "premailer~=3.10",
     "psycopg2-binary~=2.9",
     "pypdf~=6.19",
-    "pytz~=2025.2",
-    "reportlab~=4.4",
-    "simplejson~=3.20",
+    "pytz>=2025.2,<2027.0",
+    "reportlab>=4.4,<6.0",
+    "simplejson>=3.20,<5.0",
     "whitenoise~=6.12",
     "sentry-sdk~=2.68",
     "diff-match-patch>=20241021,<20300000",

versioning/templates/activity_feed_data.html

@@ -7,7 +7,8 @@
 {% load cache %}
 
 {% block content %}
-{% cache None feed_data request.user %}
+{# The fragment is cached indefinitely (in the database in production), so bump the "bs5" suffix whenever its markup changes #}
+{% cache None feed_data_bs5 request.user %}
 <div class="list-group-item">
     <div class="d-flex">
     {% for version in object_list %}