Repository navigation
Commit 076bceb
![dependabot[bot]](/web-api/iframe-proxy?url=https://avatars.githubusercontent.com/in/29110?v=4&size=40){kind=avatar}
Claude/GitHub push issues review b21urh (#589)
* ci: bump actions/setup-node v4 -> v6 (keep pnpm caching)
setup-node v6's breaking change ("Limit automatic caching to npm",
actions/setup-node#1374) only narrows the NO-input auto-detection path so
it auto-enables caching for npm projects. An explicit `cache: pnpm` input is
still honored: v6 src/main.ts passes the input value straight to
restoreCache('pnpm', ...) without overriding it, and the v6 README still lists
pnpm (>=6.10) as a supported cache value.
All three setup-node steps in this repo already set `cache: pnpm` explicitly,
with pnpm/action-setup@v4 running first so the store path resolves. They are
therefore unaffected by the breaking change; only the action version needed to
move. No caching pattern change was required and caching is preserved.
Steps bumped:
- tests.yml (node 22)
- deploy-frontend.yml test job (node 24)
- deploy-frontend.yml deploy job (node 24)
Co-Authored-By: Claude <[email protected]>
* build(deps): bump pnpm/action-setup from 4 to 6
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: '6'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected]>
* test: discover tests by glob so new test files can't be silently skipped
The api-server and scent-cast `test` scripts hand-enumerated every test
file; six api-server tests (including corsOrigins.test.ts, the test for
the CORS allowlist) existed on disk but never ran. Quote the glob so the
runner expands it (same pattern @workspace/db already uses).
Re-including the orphans surfaced one drifted assertion:
orientationEngine.test.ts expected the visible base exactly at
baselineOffset, but the 2px anti-clip bbox margin scales with the bottle
and intentionally seats the base a few px above — the same accepted
drift the "~88% height" test documents. Bound the assertion to that
documented behavior instead of changing live render geometry (which
would bump ORIENTATION_VERSION and invalidate cached packshots).
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_014cEQ87SG31DEkaacGtGtH6
* ci: lint gate, dependency scanning, Docker build check, Node 22 parity
Production-readiness F2:
- ESLint flat config scoped to api-server runtime sources with two rules
at error: @typescript-eslint/no-floating-promises (dropped promises in
handlers/workers are silent failures) and no-console (post-A6 pino
regression stop). CLI/MCP entrypoints and offline verification scripts
keep stdout deliberately. Baseline is clean — the gate starts green.
- `pnpm run lint` root script + CI step.
- CI Node 24 → 22 in tests.yml and deploy-frontend.yml to match the
node:22-bookworm-slim runtime image and the engines field.
- Dependabot (npm weekly grouped minor/patch + github-actions) and a
report-only `pnpm audit --prod` step; flip to blocking after triage.
- docker-build PR job (push:false, gha layer cache) gated on image-input
paths, so Dockerfile/lockfile breakage fails at PR time, not deploy.
- PR guard requiring a lib/db/migrations/ file whenever
lib/db/src/schema/** changes (E1 enforcement half).
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_014cEQ87SG31DEkaacGtGtH6
* feat(build): stamp SPA builds with VITE_GIT_SHA (web-vitals build tag)
The webVitalsTelemetry build tag lost its source when Vercel's injected
VITE_VERCEL_GIT_COMMIT_SHA went away with the CloudFront cutover; main
already reads VITE_GIT_SHA as the fallback but nothing set it. Inject
github.sha in deploy-frontend.yml builds and accept an optional ARG in
the Dockerfile (empty default keeps Railway builds unchanged).
Adapted from PR #539 (claude/production-critical-impl-odvdqt); its ECR/
App Runner deploy job was NOT carried over — docs/aws-migration/ records
the accepted architecture as S3+CloudFront for the SPA with backends
staying on Railway.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7
* build(deps): bump the minor-and-patch group across 1 directory with 48 updates
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.5
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: axios
dependency-version: 1.18.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: sharp
dependency-version: 0.35.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: esbuild
dependency-version: 0.28.1
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-accordion"
dependency-version: 1.2.16
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-alert-dialog"
dependency-version: 1.1.19
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-aspect-ratio"
dependency-version: 1.1.11
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-avatar"
dependency-version: 1.2.2
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-checkbox"
dependency-version: 1.3.7
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-collapsible"
dependency-version: 1.1.16
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-context-menu"
dependency-version: 2.3.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-dialog"
dependency-version: 1.1.19
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-dropdown-menu"
dependency-version: 2.1.20
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-hover-card"
dependency-version: 1.1.19
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-label"
dependency-version: 2.1.11
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-menubar"
dependency-version: 1.1.20
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-navigation-menu"
dependency-version: 1.2.18
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-popover"
dependency-version: 1.1.19
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-progress"
dependency-version: 1.1.12
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-radio-group"
dependency-version: 1.4.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-scroll-area"
dependency-version: 1.2.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-select"
dependency-version: 2.3.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-separator"
dependency-version: 1.1.11
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-slider"
dependency-version: 1.4.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-slot"
dependency-version: 1.3.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-switch"
dependency-version: 1.3.3
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-tabs"
dependency-version: 1.1.17
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toast"
dependency-version: 1.2.19
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toggle"
dependency-version: 1.1.14
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toggle-group"
dependency-version: 1.1.15
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-tooltip"
dependency-version: 1.2.12
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: react-hook-form
dependency-version: 7.81.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: react-router-dom
dependency-version: 7.18.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/typography"
dependency-version: 0.5.20
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: orval
dependency-version: 8.20.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: pg
dependency-version: 8.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@types/pg"
dependency-version: 8.20.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@types/pg"
dependency-version: 8.20.0
dependency-type: direct:development
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: drizzle-kit
dependency-version: 0.31.10
dependency-type: direct:development
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: "@replit/vite-plugin-cartographer"
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/vite"
dependency-version: 4.3.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
dependency-version: 5.101.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: framer-motion
dependency-version: 12.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: react-dom
dependency-version: 19.2.7
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: react
dependency-version: 19.2.7
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: "@types/react"
dependency-version: 19.2.17
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: minor-and-patch
- dependency-name: tailwind-merge
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: tailwindcss
dependency-version: 4.3.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
- dependency-name: tsx
dependency-version: 4.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: minor-and-patch
...
Signed-off-by: dependabot[bot] <[email protected]>
* fix: adapt to sharp 0.35 types and esbuild 0.28 PWA target
The minor-and-patch group surfaces two breaking changes:
1. sharp 0.35 no longer exposes its namespace via a default import, so
`sharp.Metadata` fails (TS2503). Import the Metadata type by name in
adminBottleImageUpload.ts and packshotTrimCore.ts.
2. esbuild 0.28 (pulled in via the tsx/esbuild bumps) now refuses to
transform the PWA service worker's destructuring for the Safari 14.0
target — Safari 14.0 has a destructuring bug that 14.1 fixed. Bump the
scent-cast build target safari14 -> safari14.1 (still es2020 + iOS 14).
Verified: full typecheck + both frontend builds (incl. PWA SW) pass.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* build(deps): bump @vitejs/plugin-react from 5.1.4 to 6.0.3
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 5.1.4 to 6.0.3.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/[email protected]/packages/plugin-react)
---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected]>
* build(deps): migrate to vite 8 to satisfy @vitejs/plugin-react 6 peer
plugin-react 6.0.3 imports vite/internal and requires vite ^8.0.0; on
vite 7 the build fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Bump the catalog
vite to ^8.1.4. Verified: scent-cast + mockup-sandbox both build and the
full typecheck passes; @tailwindcss/vite and vite-plugin-pwa already
support vite 8, and tests use node --test (not vite).
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* build(deps-dev): bump recharts from 2.15.4 to 3.9.2
Bumps [recharts](https://github.com/recharts/recharts) from 2.15.4 to 3.9.2.
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v2.15.4...v3.9.2)
---
updated-dependencies:
- dependency-name: recharts
dependency-version: 3.9.2
dependency-type: direct:development
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected]>
* fix(chart): adapt shadcn chart.tsx to recharts v3 API
recharts v3 moved active/payload/label onto TooltipContentProps and legend
payload/verticalAlign onto DefaultLegendContentProps; retype
ChartTooltipContent/ChartLegendContent and coerce the DataKey<any> React key.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* build(deps): bump pino-http from 10.5.0 to 11.0.0
Bumps [pino-http](https://github.com/pinojs/pino-http) from 10.5.0 to 11.0.0.
- [Release notes](https://github.com/pinojs/pino-http/releases)
- [Commits](pinojs/pino-http@v10.5.0...v11.0.0)
---
updated-dependencies:
- dependency-name: pino-http
dependency-version: 11.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <[email protected]>
* fix(api): satisfy pino-http v11 generics in app.ts
pino-http v11 tightened its call generics so CustomLevels infers as
string, rejecting our default pino.Logger<never>. Pin the
Request/Response generics (keeps the req.id serializer valid) and let
CustomLevels fall back to its never default.
Co-Authored-By: Claude Opus 4.8 <[email protected]>
* build(deps): regenerate lockfile for combined bumps; declare react-is peer
The four dependency PRs (#579, #571, #565, #572) each carried a lockfile
generated against main in isolation; combining them needs one consistent
resolve. Also declare react-is in mockup-sandbox — recharts 3 requires it
as a peer and autoInstallPeers is off.
Verified: pnpm install clean, full typecheck, workspace build, 981-test
API suite green, eslint 0 errors, pnpm audit --prod has no high findings.
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7
* ci: drop docker-build job duplicated by the standalone docker-build.yml workflow
Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7
---------
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Claude <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>1 parent a67cd13 commit 076bceb
0 file changed
0 commit comments