perf(core): batch stockLevels lookups per request

.github/dependabot.yml

@@ -44,6 +44,26 @@ updates:
           semver-patch-days: 7
           semver-minor-days: 7
           semver-major-days: 14
+      # Major updates are held back for production dependencies, the same rule
+      # the bun workspace entry below applies across the workspace.
+      # @vendure-io/docs-provider is the only name this entry needs.
+      # @types/node, tsx and typescript are development dependencies and keep
+      # offering majors.
+      #
+      # This is an ignore rule where the bun entry uses an allow list, and the
+      # difference is deliberate. An allow list narrows security updates as
+      # well as version updates. npm is an ecosystem where Dependabot raises
+      # security updates, and the documented default covers every vulnerable
+      # dependency in the lock file, transitive ones included. No
+      # `dependency-type` names that set for npm — `all` stops at explicitly
+      # declared dependencies — so an allow list here would have dropped
+      # advisories for anything transitive under @vendure-io/docs-provider.
+      # `update-types` under ignore applies to version updates only, so this
+      # rule leaves security updates untouched.
+      ignore:
+          - dependency-name: '@vendure-io/docs-provider'
+            update-types:
+                - version-update:semver-major
       groups:
           docs:
               patterns:
@@ -83,6 +103,162 @@ updates:
       # range, so a patch update always falls inside the existing range and no
       # strategy rewrites the manifest.
       versioning-strategy: increase-if-necessary
+      # Major updates are raised for development tooling only. A major version
+      # of a package that ships to users is a migration for every Vendure
+      # project downstream, so it belongs in a planned release.
+      #
+      # The rule is written as a list of dependency names rather than
+      # `dependency-type: development`, for two independent reasons.
+      #
+      # First, GitHub documents the `dependency-type` values `production` and
+      # `development` for bundler, composer, mix, maven, npm, pip and uv. bun
+      # is absent. That list differs from the one above for
+      # versioning-strategy, because Dependabot documents support per option
+      # rather than per ecosystem.
+      #
+      # Second, the workspace manifests do not split along that line, in either
+      # direction. eslint, eslint-config-prettier and the @typescript-eslint
+      # packages are production dependencies of the root manifest, typescript
+      # and ts-node of packages/cli, @types/express of core and
+      # asset-server-plugin, so a rule scoped to development dependencies
+      # would block tooling majors. dependabot_auto_merge.yml rejected
+      # dependency-type as an auto-merge gate for the same reason.
+      #
+      # The reverse holds too, which is why this list names tooling rather
+      # than every development dependency. bullmq, ioredis, pg, mysql2 and
+      # better-sqlite3 are declared as development dependencies here, but
+      # plugins peer-depend on them, so a major is a downstream migration.
+      #
+      # An allow list replaces the default set rather than narrowing it, so the
+      # first entry has to restate the default: every dependency gets minor and
+      # patch updates. Each entry after it adds majors back for one tooling
+      # family. The runtime families — nestjs, graphql, typeorm, opentelemetry
+      # and the dashboard packages — are absent on purpose.
+      #
+      # A tooling package with no entry here stops offering majors, and the
+      # symptom is a pull request that never arrives, which nobody notices.
+      # When adding a development tool to any manifest, add it here too.
+      #
+      # ignore beats allow: a dependency matched by both is ignored. The
+      # Angular families in the ignore block below therefore stay ignored at
+      # every level, and the '*' entry here does not re-enable them.
+      #
+      # Narrowing the set costs nothing here, because Dependabot raises no
+      # security updates for bun at all, as noted above. That is not true of
+      # npm, which is why the /docs entry states its rule as an ignore.
+      allow:
+          - dependency-name: '*'
+            update-types:
+                - version-update:semver-minor
+                - version-update:semver-patch
+          - dependency-name: 'typescript'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@types/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'eslint'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'eslint-*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@typescript-eslint/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'prettier'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'prettier-*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'vitest'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@vitest/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'rimraf'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'concurrently'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'cross-env'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'ts-node'
+            update-types:
+                - version-update:semver-major
+          # Tooling that belongs to no group above, so a major arrives on its
+          # own. @eslint/js and globals are listed because the flat config
+          # requires them to move with an eslint major.
+          - dependency-name: '@eslint/js'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'globals'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@commitlint/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'husky'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'lint-staged'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'lerna'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'conventional-changelog-core'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@playwright/test'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'playwright'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'jsdom'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'tinybench'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'storybook'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@storybook/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@graphql-codegen/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@gql.tada/cli-utils'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@swc/core'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'unplugin-swc'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'rollup'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@rollup/*'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'rollup-plugin-typescript2'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: 'vite-plugin-dts'
+            update-types:
+                - version-update:semver-major
+          - dependency-name: '@typescript/native-preview'
+            update-types:
+                - version-update:semver-major
       ignore:
           # Workspace-internal packages are versioned by the release process.
           - dependency-name: '@vendure/*'

.github/workflows/back_merge.yml

@@ -57,7 +57,7 @@ jobs:
         steps:
             - name: Generate CI Bot Token
               id: app-token
-              uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+              uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
               with:
                   app-id: ${{ secrets.CI_BOT_APP_ID }}
                   private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
@@ -66,7 +66,7 @@ jobs:
                   permission-contents: write
 
             - name: Checkout target branch
-              uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   token: ${{ steps.app-token.outputs.token }}
                   ref: ${{ needs.resolve-branches.outputs.target }}

.github/workflows/build_and_test.yml

@@ -38,7 +38,7 @@ jobs:
             packages: ${{ steps.check.outputs.packages }}
             dashboard: ${{ steps.check.outputs.dashboard }}
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   fetch-depth: 0
             - name: Detect changed paths
@@ -82,7 +82,7 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
             - name: Build
               run: bun run build
@@ -98,7 +98,7 @@ jobs:
             matrix:
                 node: [20.x, 22.x, 24.x]
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
               with:
                   node-version: ${{ matrix.node }}
@@ -114,7 +114,7 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
             - name: Check i18n catalogs are in sync
               working-directory: packages/dashboard
@@ -131,13 +131,13 @@ jobs:
             matrix:
                 shard: [1, 2, 3, 4]
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
             - name: Build
               run: bunx lerna run ci --scope @vendure/testing --include-dependencies
             - name: Cache Playwright browsers
               id: playwright-cache
-              uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+              uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
               with:
                   path: ~/.cache/ms-playwright
                   # The key version prefix (v2) lets us evict caches poisoned by an
@@ -182,11 +182,11 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   fetch-depth: 0
             - name: SonarQube Scan
-              uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
+              uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
               env:
                   SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
     e2e-sqljs:
@@ -206,7 +206,7 @@ jobs:
             matrix:
                 node: ${{ github.event_name == 'pull_request' && fromJSON('["22.x"]') || fromJSON('["20.x", "22.x", "24.x"]') }}
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
               with:
                   node-version: ${{ matrix.node }}
@@ -243,7 +243,7 @@ jobs:
             matrix:
                 node: ${{ github.event_name == 'pull_request' && fromJSON('["22.x"]') || fromJSON('["20.x", "22.x", "24.x"]') }}
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
               with:
                   node-version: ${{ matrix.node }}
@@ -291,7 +291,7 @@ jobs:
             matrix:
                 node: ${{ github.event_name == 'pull_request' && fromJSON('["22.x"]') || fromJSON('["20.x", "22.x", "24.x"]') }}
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
               with:
                   node-version: ${{ matrix.node }}
@@ -328,7 +328,7 @@ jobs:
             matrix:
                 node: ${{ github.event_name == 'pull_request' && fromJSON('["22.x"]') || fromJSON('["20.x", "22.x", "24.x"]') }}
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - uses: ./.github/actions/setup
               with:
                   node-version: ${{ matrix.node }}

.github/workflows/cla.yml

@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Generate CI Bot Token
         id: app-token
-        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.CI_BOT_APP_ID }}
           private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
@@ -36,7 +36,7 @@ jobs:
       # via mutable version tags. See https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
-        uses: contributor-assistant/github-action@9340315624c6e16cef1f2c63bdeb0f0c49c6f474 # v2.4.0
+        uses: contributor-assistant/github-action@ca4a40a7d1004f18d9960b404b97e5f30a505a08 # v2.6.1
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         with:

.github/workflows/codegen.yml

@@ -12,9 +12,9 @@ jobs:
         permissions:
             contents: read
         steps:
-            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+            - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
             - name: Use Node.js 22
-              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
               with:
                   node-version: 22
             - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0

.github/workflows/deploy_dashboard.yml

@@ -36,7 +36,7 @@ jobs:
             pull-requests: write
         steps:
             - name: Checkout repository
-              uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Setup environment
               uses: ./.github/actions/setup

.github/workflows/docs_ci.yml

@@ -49,7 +49,7 @@ jobs:
                 working-directory: docs
         steps:
             - name: Checkout
-              uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Setup Bun
               uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
@@ -78,15 +78,15 @@ jobs:
         steps:
             - name: Generate CI Bot Token
               id: app-token
-              uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
+              uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
               with:
                   app-id: ${{ secrets.CI_BOT_APP_ID }}
                   private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
                   # Least privilege: token is only used to commit & push the regenerated manifest.
                   permission-contents: write
 
             - name: Checkout
-              uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
               with:
                   token: ${{ steps.app-token.outputs.token }}
                   # Check out the branch by name rather than the pushed SHA so the