Skip to content

chore(deps): combined web dependency update (react 19.3.0, AG Grid 36.2.0, jsdom 30.1.1, @types/node 26.6.2) - #309

Merged
Roddygithub merged 2 commits into
mainfrom
audit/web-deps-combined
Sep 25, 2026
Merged

Roddygithub merged 2 commits into
mainfrom
audit/web-deps-combined

Conversation

@Roddygithub

@Roddygithub Roddygithub commented Sep 25, 2026 •

Copy link
Copy Markdown
Owner

Supersedes #303, #305, #306, #307, #308.

Why a single PR

Each Dependabot PR is safe in isolation except where they interact:

Landing them one by one turns main red in between. This PR carries all five plus the two fixes that make them coherent.

Changes vs main

web/package.json:

  • react 19.2.7 → 19.3.0
  • react-dom 19.2.7 → 19.3.0 (required: React enforces an exact react/react-dom version match)
  • @types/node ^26.5 → ^26.6

web/pnpm-lock.yaml regenerated so that:

  • ag-grid-community / ag-grid-react / ag-stack all resolve to 36.2.0 (single copy each), ag-charts-types 14.1.0 → 14.2.0
  • jsdom 30.1.0 → 30.1.1 (plus its own transitive subtree)
  • react / react-dom 19.3.0, @types/react 19.3.0
  • @types/node 26.6.2

No unrelated packages were changed; pnpm-workspace.yaml overrides is byte-identical to main.

Verification (local, isolated worktree)

  • pnpm install --frozen-lockfile ✅
  • pnpm exec tsc --noEmit ✅ 0 errors
  • pnpm exec eslint . ✅ 0 errors (16 pre-existing warnings)
  • pnpm exec vitest run --coverage ✅ 384 pass / 0 fail / 3 skip (lines 79.5, branches 68.3, functions 73.6)
  • API_BASE_URL=http://api:8000 pnpm run build ✅
  • pnpm audit --audit-level=high --ignore GHSA-mh99-v99m-4gvg ✅

Review checklist

CI infrastructure fix (included)

  • The MinIO registry failure was independently confirmed: quay.io now denies anonymous
    pull for minio/minio and the repository was deleted from Docker Hub on 2026-09-11,
    which had been reding Test Python and ARQ worker integration on every run
    including main.
  • Commit f8f3171 replaces the unavailable registry image with the pinned official
    GitHub Release binary for the same tag (RELEASE.2025-09-07T16-13-09Z), verified
    against a SHA-256 pinned inline before execution.
  • Test Python and ARQ worker integration are now green.
  • Final CI for this PR is fully green: 10 passed / 0 failed, mergeState=CLEAN.

Closes #303
Closes #305
Closes #306
Closes #307
Closes #308

…#307 #308 + react-dom pin)

Signed-off-by: Roland Salardon <r.salardon@gmail.com>
The "Start MinIO" step exits 125 on every CI run, including main, and
reds both Test Python and ARQ worker integration:

  docker: Error response from daemon: unauthorized: access to the
  requested resource is not authorized
  (quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z)

Root cause is upstream distribution, not this repo:
- quay.io now grants anonymous pulls an empty action list for
  minio/minio (401),
- minio/minio and minio/mc were deleted from Docker Hub on 2026-09-11,
- the upstream repo was archived 2026-04-25 (Community Edition is
  source-only) and dl.min.io/server/ returns 410.

github.com/minio/minio GitHub Releases still serves the official binary
for this exact tag, together with a published .sha256sum. Download it,
verify a checksum pinned inline, and run it directly.

The test contract is unchanged and verified locally: localhost:9000,
localhost:9001, MINIO_ROOT_USER/MINIO_ROOT_PASSWORD, and
/minio/health/live, with the identical step in both jobs. The readiness
loop now fails the step (and dumps the server log) instead of silently
passing when MinIO never starts.

Signed-off-by: Roland Salardon <r.salardon@gmail.com>
@Roddygithub
Roddygithub merged commit 7dee5a7 into main Sep 25, 2026
11 checks passed
@Roddygithub
Roddygithub deleted the audit/web-deps-combined branch September 25, 2026 16:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant