⬆️(dependencies) update python dependencies

.dockerignore

@@ -3,8 +3,8 @@ __pycache__
 *.pyc
 **/__pycache__
 **/*.pyc
-**/venv
-**/.venv
+venv
+.venv
 
 # System-specific files
 .DS_Store

CHANGELOG.md

@@ -13,15 +13,6 @@ and this project adheres to
 - ✨(back) add projects with custom LLM instructions
 - ✨(front) projects management UI
 
-### Changed
-
-- ⬆️(dependencies) upgrade Next.js 15 to 16, upgrade python dependencies
-- ⬆️(dependencies) switch base docker image to upgrade markitdown
- 
-### Fixed
-
-- 🐛(back) add missing color option for project colors
-
 ## [0.0.14] - 2026-03-11
 
 ### Added

Dockerfile

@@ -1,12 +1,11 @@
 # Django conversations
 
 # ---- base image to inherit from ----
-FROM python:3.13.3-slim AS base
+FROM python:3.13.3-alpine AS base
 
 # Upgrade system packages to install security updates
-RUN apt-get update && \
-  apt-get upgrade -y && \
-  rm -rf /var/lib/apt/lists/*
+RUN apk update && \
+  apk upgrade
 
 # ---- Back-end builder image ----
 FROM base AS back-builder
@@ -18,13 +17,14 @@ ENV UV_PYTHON_DOWNLOADS=0
 
 COPY --from=ghcr.io/astral-sh/uv:0.9.26 /uv /uvx /bin/
 
-# Install build dependencies
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  build-essential \
+# Install Rust and Cargo using Alpine's package manager
+RUN apk add --no-cache \
+  build-base \
   libffi-dev \
   libxml2-dev \
-  libxslt1-dev \
-  && rm -rf /var/lib/apt/lists/*
+  libxslt-dev \
+  rust \
+  cargo
 
 WORKDIR /app
 
@@ -52,10 +52,9 @@ FROM base AS link-collector
 ARG CONVERSATIONS_STATIC_ROOT=/data/static
 
 # Install pango & rdfind
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  libpango-1.0-0 \
-  rdfind \
-  && rm -rf /var/lib/apt/lists/*
+RUN apk add \
+  pango \
+  rdfind
 
 WORKDIR /app
 
@@ -81,20 +80,18 @@ FROM base AS core
 ENV PYTHONUNBUFFERED=1
 
 # Install required system libs
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  libcairo2 \
+RUN apk add \
+  cairo \
   file \
-  fonts-noto-core \
-  fonts-noto-color-emoji \
+  font-noto \
+  font-noto-emoji \
   gettext \
-  libgdk-pixbuf-2.0-0 \
-  libffi8 \
+  gdk-pixbuf \
+  libffi-dev \
   libxml2 \
-  libxslt1.1 \
-  libpango-1.0-0 \
-  libpangocairo-1.0-0 \
-  shared-mime-info \
-  && rm -rf /var/lib/apt/lists/*
+  libxslt \
+  pango \
+  shared-mime-info
 
 COPY ./docker/files/etc/mime.types /etc/mime.types
 
@@ -131,9 +128,7 @@ FROM core AS backend-development
 USER root:root
 
 # Install psql
-RUN apt-get update && apt-get install -y --no-install-recommends \
-  postgresql-client \
-  && rm -rf /var/lib/apt/lists/*
+RUN apk add postgresql-client
 
  # Install development dependencies
 RUN --mount=from=ghcr.io/astral-sh/uv:0.9.26,source=/uv,target=/bin/uv \
@@ -154,8 +149,8 @@ CMD ["python", "manage.py", "runserver", "0.0.0.0:8000"]
 # ---- Production image ----
 FROM core AS backend-production
 
-# Remove apt lists, we don't need them anymore
-RUN rm -rf /var/lib/apt/lists/*
+# Remove apk cache, we don't need it anymore
+RUN rm -rf /var/cache/apk/*
 
 ARG CONVERSATIONS_STATIC_ROOT=/data/static
 

src/backend/chat/migrations/0006_chatproject_chatconversation_project.py

@@ -87,7 +87,6 @@ class Migration(migrations.Migration):
                             ("color_7", "Color 7"),
                             ("color_8", "Color 8"),
                             ("color_9", "Color 9"),
-                            ("color_10", "Color 10"),
                         ],
                         help_text="Project icon color",
                         max_length=20,

src/backend/chat/models.py

@@ -52,7 +52,6 @@ class ChatProjectColor(models.TextChoices):
     COLOR_7 = "color_7", "Color 7"
     COLOR_8 = "color_8", "Color 8"
     COLOR_9 = "color_9", "Color 9"
-    COLOR_10 = "color_10", "Color 10"
 
 
 class ChatProject(BaseModel):

src/backend/chat/tests/views/projects/test_create.py

@@ -78,24 +78,6 @@ def test_create_project_with_llm_instructions(api_client):
     assert project.llm_instructions == "Always answer in French."
 
 
-@pytest.mark.parametrize("color", ChatProjectColor)
-def test_create_project_with_each_color(api_client, color):
-    """Test creating a project with each available color."""
-    user = UserFactory()
-    url = "/api/v1.0/projects/"
-    data = {
-        "title": "Color Project",
-        "icon": ChatProjectIcon.FOLDER,
-        "color": color,
-    }
-    api_client.force_login(user)
-    response = api_client.post(url, data, format="json")
-
-    assert response.status_code == status.HTTP_201_CREATED
-    project = ChatProject.objects.get(id=response.data["id"])
-    assert project.color == color
-
-
 def test_create_project_anonymous(api_client):
     """Test creating a project as an anonymous user returns a 401 error."""
     url = "/api/v1.0/projects/"

src/backend/conversations/settings.py

@@ -368,7 +368,6 @@ class Base(BraveSettings, Configuration):
         "django.contrib.staticfiles",
         # OIDC third party
         "mozilla_django_oidc",
-        "lasuite.malware_detection",
     ]
 
     # Cache

src/backend/pyproject.toml

@@ -23,15 +23,15 @@ description = "An application to chat with your own AI."
 keywords = ["Django", "AI", "Chatbot", "OpenAI", "Pydantic AI", "Conversations"]
 license = { file = "LICENSE" }
 readme = "README.md"
-requires-python = "~=3.13.0"
+requires-python = "~=3.14.3"
 dependencies = [
     "deprecated",
-    "beautifulsoup4==4.14.2",
-    "boto3==1.40.73",
+    "beautifulsoup4==4.14.3",
+    "boto3==1.42.68",
     "Brotli==1.2.0",
     "django-configurations==2.5.1",
     "django-cors-headers==4.9.0",
-    "django-countries==8.1.0",
+    "django-countries==8.2.0",
     "django-filter==25.2",
     "django-lasuite[all]==0.0.25",
     "django-parler==2.3",
@@ -39,35 +39,35 @@ dependencies = [
     "django-redis==6.0.0",
     "django-storages[s3]==1.14.6",
     "django-timezone-field>=5.1",
-    "django==5.2.12",
+    "django==6.0.3",
     "djangorestframework==3.16.1",
     "drf_spectacular==0.29.0",
-    "dockerflow==2024.4.2",
+    "dockerflow==2026.3.4",
     "easy_thumbnails==2.10.1",
     "factory_boy==3.3.3",
-    "gunicorn==23.0.0",
+    "gunicorn==25.1.0",
     "jaraco.context>=6.1.0",
-    "jsonschema==4.25.1",
-    "langfuse==3.10.0",
+    "jsonschema==4.26.0",
+    "langfuse==4.0.0",
     "lxml==5.4.0",
-    "markdown==3.10",
-    "markitdown==0.1.5",
-    "mozilla-django-oidc==4.0.1",
+    "markdown==3.10.2",
+    "markitdown==0.0.2",
+    "mozilla-django-oidc==5.0.2",
     "nested-multipart-parser==1.6.0",
-    "posthog==7.0.0",
-    "pydantic==2.12.4",
-    "pydantic-ai-slim[openai,mistral,mcp,evals,logfire]==1.62.0",
-    "psycopg[binary]==3.2.12",
-    "PyJWT==2.12.0",
+    "posthog==7.9.12",
+    "pydantic==2.12.5",
+    "pydantic-ai-slim[openai,mistral,mcp,evals,logfire]==1.68.0",
+    "psycopg[binary]==3.3.3",
+    "PyJWT==2.10.1",
     "python-magic==0.4.27",
     "redis<6.0.0",
     "requests==2.32.5",
     "semchunk==3.2.5",
-    "sentry-sdk==2.44.0",
+    "sentry-sdk==2.54.0",
     "trafilatura==2.0.0",
-    "uvicorn==0.38.0",
-    "whitenoise==6.11.0",
-    "pypdf==6.9.1",
+    "uvicorn==0.41.0",
+    "whitenoise==6.12.0",
+    "pypdf==6.8.0",
 ]
 
 [project.urls]
@@ -78,27 +78,27 @@ dependencies = [
 
 [project.optional-dependencies]
 dev = [
-    "dirty-equals==0.10.0",
+    "dirty-equals==0.11",
     "django-extensions==4.1",
     "django-test-migrations==1.5.0",
-    "drf-spectacular-sidecar==2025.10.1",
+    "drf-spectacular-sidecar==2026.3.1",
     "freezegun==1.5.5",
     "ipdb==0.13.13",
-    "ipython==9.7.0",
-    "pyfakefs==5.10.2",
-    "pylint-django==2.6.1",
+    "ipython==9.11.0",
+    "pyfakefs==6.1.5",
+    "pylint-django==2.7.0",
     "pylint==3.3.9",
     "pylint-pydantic==0.4.1",
     "pytest-asyncio==1.3.0",
     "pytest-cov==7.0.0",
-    "pytest-django==4.11.1",
-    "pytest==9.0.1",
+    "pytest-django==4.12.0",
+    "pytest==9.0.2",
     "pytest-icdiff==0.9",
     "pytest-xdist==3.8.0",
-    "responses==0.25.8",
+    "responses==0.26.0",
     "respx==0.22.0",
-    "ruff==0.14.5",
-    "types-requests==2.32.4.20250913",
+    "ruff==0.15.6",
+    "types-requests==2.32.4.20260107",
 ]
 
 [tool.setuptools]
@@ -115,7 +115,6 @@ required-environments = [
 ]
 override-dependencies = [
     "cryptography>=46.0.5", # CVE-2026-26007
-    "joserfc>=1.6.3", # CVE-2026-27932
     "pillow>=12.1.1", #CVE-2026-25990
 ]
 

src/frontend/apps/conversations/next-env.d.ts

@@ -1,6 +1,5 @@
 /// <reference types="next" />
 /// <reference types="next/image-types/global" />
-import "./.next/dev/types/routes.d.ts";
 
 // NOTE: This file should not be edited
 // see https://nextjs.org/docs/pages/api-reference/config/typescript for more information.

src/frontend/apps/conversations/next.config.js

@@ -1,5 +1,7 @@
 const crypto = require('crypto');
 
+const { InjectManifest } = require('workbox-webpack-plugin');
+
 const buildId = crypto.randomBytes(256).toString('hex').slice(0, 8);
 
 /** @type {import('next').NextConfig} */
@@ -10,22 +12,44 @@ const nextConfig = {
     unoptimized: true,
   },
   compiler: {
+    // Enables the styled-components SWC transform
     styledComponents: true,
   },
   generateBuildId: () => buildId,
   env: {
     NEXT_PUBLIC_BUILD_ID: buildId,
   },
-  turbopack: {
-    rules: {
-      '*.svg': {
-        loaders: ['@svgr/webpack'],
-        as: '*.js',
+  webpack(config, { isServer }) {
+    // Grab the existing rule that handles SVG imports
+    const fileLoaderRule = config.module.rules.find((rule) =>
+      rule.test?.test?.('.svg'),
+    );
+
+    config.module.rules.push(
+      // Reapply the existing rule, but only for svg imports ending in ?url
+      {
+        ...fileLoaderRule,
+        test: /\.svg$/i,
+        resourceQuery: /url/, // *.svg?url
       },
-    },
-    resolveAlias: {
-      'micromark-extension-math': 'micromark-extension-llm-math',
-    },
+      // Convert all other *.svg imports to React components
+      {
+        test: /\.svg$/i,
+        issuer: fileLoaderRule.issuer,
+        resourceQuery: { not: [...fileLoaderRule.resourceQuery.not, /url/] }, // exclude if *.svg?url
+        use: ['@svgr/webpack'],
+      },
+    );
+
+    // Modify the file loader rule to ignore *.svg, since we have it handled now.
+    fileLoaderRule.exclude = /\.svg$/i;
+
+    // Formula rendering in markdown, replace dollar-sign with \(...\) and \[...\]
+    // https://github.com/remarkjs/remark-math/issues/39#issuecomment-2636184992
+    config.resolve.alias['micromark-extension-math'] =
+      'micromark-extension-llm-math';
+
+    return config;
   },
 };
 

src/frontend/apps/conversations/package.json

@@ -37,11 +37,11 @@
     "lottie-react": "^2.4.1",
     "luxon": "3.6.1",
     "micromark-extension-llm-math": "3.1.1-20250610",
-    "next": "16.2.0",
+    "next": "15.3.9",
     "posthog-js": "1.249.3",
-    "react": "19.2.4",
+    "react": "19.2.1",
     "react-aria-components": "1.9.0",
-    "react-dom": "19.2.4",
+    "react-dom": "19.2.1",
     "react-i18next": "15.5.2",
     "react-intersection-observer": "9.16.0",
     "react-markdown": "10.1.0",
@@ -65,23 +65,22 @@
     "@types/lodash": "4.17.17",
     "@types/luxon": "3.6.2",
     "@types/node": "*",
-    "@types/react": "19.2.14",
-    "@types/react-dom": "19.2.3",
+    "@types/react": "*",
+    "@types/react-dom": "*",
+    "cross-env": "7.0.3",
     "dotenv": "16.5.0",
-    "eslint": "^9",
     "eslint-config-conversations": "*",
-    "eslint-config-next": "16.2.0",
     "fetch-mock": "9.11.0",
     "jest": "29.7.0",
     "jest-environment-jsdom": "29.7.0",
+    "node-fetch": "2.7.0",
     "prettier": "3.5.3",
+    "sass": "^1.97.3",
     "stylelint": "16.20.0",
     "stylelint-config-standard": "38.0.0",
     "stylelint-prettier": "5.0.3",
-    "typescript": "*"
-  },
-  "resolutions": {
-    "@types/react": "19.2.14",
-    "@types/react-dom": "19.2.3"
+    "typescript": "*",
+    "webpack": "5.99.9",
+    "workbox-webpack-plugin": "7.1.0"
   }
 }

src/frontend/apps/conversations/tsconfig.json

@@ -11,7 +11,7 @@
     "moduleResolution": "bundler",
     "resolveJsonModule": true,
     "isolatedModules": true,
-    "jsx": "react-jsx",
+    "jsx": "preserve",
     "incremental": true,
     "plugins": [
       {

src/frontend/apps/e2e/package.json

@@ -12,10 +12,14 @@
     "test:ui::chromium": "yarn test:ui --project=chromium"
   },
   "devDependencies": {
-    "@playwright/test": "1.56.0",
+    "@playwright/test": "1.52.0",
     "@types/node": "*",
+    "@types/pdf-parse": "1.1.5",
     "eslint-config-conversations": "*",
     "typescript": "*"
   },
-  "dependencies": {}
+  "dependencies": {
+    "convert-stream": "1.0.2",
+    "pdf-parse": "1.1.1"
+  }
 }

src/frontend/apps/e2e/type/convert-stream.d.ts

@@ -0,0 +1,5 @@
+declare module 'convert-stream' {
+  export function toBuffer(
+    readableStream: NodeJS.ReadableStream,
+  ): Promise<Buffer>;
+}

src/frontend/package.json

@@ -27,17 +27,14 @@
   },
   "resolutions": {
     "@types/node": "22.15.29",
-    "@types/react": "19.2.14",
-    "@types/react-dom": "19.2.3",
+    "@types/react": "19.1.6",
+    "@types/react-dom": "19.1.6",
     "@typescript-eslint/eslint-plugin": "8.33.1",
     "@typescript-eslint/parser": "8.33.1",
     "eslint": "^9.0.0",
-    "react": "19.2.4",
-    "react-dom": "19.2.4",
+    "react": "19.2.1",
+    "react-dom": "19.2.1",
     "typescript": "5.8.3",
-    "minimatch": ">=10.2.1",
-    "flatted": ">=3.4.0",
-    "rollup": ">=4.59.0",
-    "undici": ">=7.24.0"
+    "minimatch": ">=10.2.1"
   }
 }