Skip to content

docs(park): correct the unpark steps and record the park's loose ends - #129

Merged
sgharlow merged 1 commit into
masterfrom
docs/park-record-2026-10-25
Oct 26, 2026
Merged

sgharlow merged 1 commit into
masterfrom
docs/park-record-2026-10-25

Conversation

@sgharlow

Copy link
Copy Markdown
Owner

Docs only (PROJECT.yaml → parked). Merging redeploys the same paused site.

  • unpark corrected: the scheduler line was a command the AWS CLI refuses (update-schedule needs the expression, window and target). Also: enable ci.yml + a11y.yml first, because master's required checks come from them.
  • also_done_at_park: Dependabot security fixes off; build(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 #118/build(deps-dev): bump vite from 8.3.0 to 8.3.4 #123 closed; www was never a Vercel domain here.
  • next_advisories: relay's next 16.4.0 is inside GHSA-p3m5 and GHSA-673q, but neither is reachable while parked (every path, POST included, 307s before a handler, re-measured live; no use cache). sharp 0.35.5 already locked. >= 16.4.3 is an unpark prerequisite.

CI and Accessibility were re-enabled only so this PR's required checks can report; they are disabled again after merge.

- unpark: the scheduler line ("update-schedule --name ... --state ENABLED")
  is refused by the AWS CLI, because update-schedule replaces the schedule
  and needs the expression, flexible window and target. Now: re-run
  infra/heartbeat-lambda/deploy.sh, or pass all of them. Also: enable ci.yml
  and a11y.yml FIRST, since master's required checks come from them and no PR
  can merge while they are off (true for the whole park, by design).
- also_done_at_park: Dependabot automated security fixes OFF; #118 and #123
  (dev-only bumps) closed with a note; www was never a Vercel domain here.
- next_advisories: relay is on next 16.4.0, inside GHSA-p3m5 (Server Actions
  DoS) and GHSA-673q (use-cache RCE). Not reachable while parked: every path,
  POST included, 307s before any handler (re-measured live: POST /, /api/vault,
  /api/auth/signup -> 307), and there is no 'use cache' function. sharp 0.35.5
  is already locked. So no upgrade while parked; >= 16.4.3 before unparking.

Tests that read PROJECT.yaml: 31 files, 325 pass.
@vercel

vercel Bot commented Oct 26, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
relay Ready Ready Preview Oct 26, 2026 3:25am UTC

Request Review

@sgharlow
sgharlow merged commit 11fecca into master Oct 26, 2026
4 checks passed

This branch was successfully deployed

1 active deployment
Preview — cbc11511 Deployed Oct 26, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant