Promote anonymous discovery and dependency upgrades - #97
Merged
Conversation
Consolidate compatible Dependabot updates, migrate ESLint and AG Grid, and apply CI-discovered compatibility and thumbnail-resize fixes.
* Restore watchlist dark theme contrast * Fix nightly e2e rate limiting and Scorecard branch trigger The nightly browser suites were failing with 429s: the e2e server runs in production mode and nothing ever set PLAYWRIGHT_TEST_BASE_URL, so the rate-limit relaxation in server/index.ts was dead and the whole suite shared production limits (10 auth POSTs/min). Set the marker in the Playwright webServer env so test runs get the intended multiplier. The OpenSSF Scorecard workflow triggered on pushes to main, but scorecard-action only supports the default branch (develop), so every push run failed with "only default branch is supported".
Adopt execa 10, helmet 8, cuid2 3, faker 10, remix-utils 10, and @epic-web/totp 4. The totp move to Web Crypto requires dashed algorithm names, so new verifications generate SHA-256 and stored SHA256 rows are normalized during verification to keep enrolled 2FA users working. ESLint 10 is deferred until eslint-plugin-react supports it, and Prisma 7 is deferred because its driver-adapter model needs a dedicated migration.
Anonymous searches previously fell back to catalog matching because every AI gate required a signed-in viewer. Tip of My Tongue now runs its AI path for signed-out visitors on the home demo, the discover page, and the global search, keyed to a per-address rate limit bucket instead of a viewer id. Also clarify the Describe what you want hint in advanced search settings.
The repo default branch is main again, and scorecard-action only runs on
the default branch, so the push trigger moves back from develop to main.
Also rephrase the describe-mode search hint: it contained the word
description, which made the advanced-search checkbox collide with
getByLabel('Description') lookups and broke the collections suite.
Squash promotions leave main's history disconnected from develop, so direct develop-to-main pull requests conflict on every overlapping hunk. Recording main as merged (keeping develop's tree unchanged) moves the merge base forward and lets promotions merge cleanly.
Records main as an ancestor of develop (ours strategy, tree unchanged) so develop-to-main promotions merge cleanly.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes develop to main, now conflict-free after the #96 history reconciliation.
Carries since the last promotion:
Prisma 7 and ESLint 10 remain deferred (#82/#83, #85/#86) pending ecosystem support.