[shedowe19]

Automated Dependency Updates

This PR updates direct frontend and backend dependencies to their latest published versions.

Frontend Updates

Using yarn
Upgrading /home/runner/work/ShieldPM/ShieldPM/frontend/package.json

Patch   Backwards-compatible bug fixes
 @formatjs/cli                   ^6.16.33  →  ^6.16.34
 @radix-ui/react-label            ^2.1.16  →   ^2.1.17
 @tanstack/react-query           ^5.104.1  →  ^5.104.2
 @tanstack/react-query-devtools  ^5.104.1  →  ^5.104.2
 @types/node                      ^26.6.4  →   ^26.6.5
 i18next                          ^26.4.2  →   ^26.4.4
 postcss                          ^8.5.29  →   ^8.5.30
 vite                               8.3.3  →     8.3.4
 vitest                             5.0.3  →     5.0.4
 zod                               ^4.6.5  →    ^4.6.7

Minor   Backwards-compatible features
 @radix-ui/react-avatar          ^1.2.7  →   ^1.3.1
 @radix-ui/react-checkbox       ^1.3.12  →   ^1.4.1
 @radix-ui/react-dialog          ^1.2.0  →   ^1.3.1
 @radix-ui/react-dropdown-menu  ^2.1.25  →   ^2.2.1
 @radix-ui/react-popover         ^1.2.0  →   ^1.3.1
 @radix-ui/react-scroll-area     ^1.3.0  →   ^1.4.0
 @radix-ui/react-select          ^2.3.8  →   ^2.4.1
 @radix-ui/react-separator      ^1.1.16  →   ^1.2.0
 @radix-ui/react-slot            ^1.4.0  →   ^1.5.0
 @radix-ui/react-switch          ^1.3.8  →   ^1.4.1
 @radix-ui/react-tabs           ^1.1.22  →   ^1.2.1
 @radix-ui/react-toast          ^1.2.24  →   ^1.3.1
 @radix-ui/react-toggle         ^1.1.19  →   ^1.2.1
 @radix-ui/react-toggle-group   ^1.1.20  →   ^1.2.1
 @radix-ui/react-tooltip         ^1.3.0  →   ^1.4.1
 @tanstack/react-table            9.2.6  →    9.3.1
 framer-motion                  ^14.0.0  →  ^14.2.0
 lucide-react                   ^1.52.0  →  ^1.56.0
 react-hook-form                ^7.89.0  →  ^7.90.0

Major   Potentially breaking API changes
 happy-dom  ^20.14.5  →  ^21.0.1

Run yarn install to install new versions.

Backend Updates

Using yarn
Upgrading /home/runner/work/ShieldPM/ShieldPM/backend/package.json

Patch   Backwards-compatible bug fixes
 @apidevtools/json-schema-ref-parser  ^16.0.3  →  ^16.0.5
 @types/node                          ^26.6.4  →  ^26.6.5
 basic-ftp                              6.2.2  →    6.2.3
 mysql2                               ^3.24.5  →  ^3.24.6
 vite                                  ^8.3.3  →   ^8.3.4
 vitest                                ^5.0.3  →   ^5.0.4

Minor   Backwards-compatible features
 express           5.2.1  →    5.3.0
 isomorphic-git  ^1.43.1  →  ^1.44.2
 objection         3.1.5  →    3.9.0

Major version zero   Anything may change
 @electric-sql/pglite  0.5.8  →  0.5.9

Run yarn install to install new versions.

Verification

• Validated the installed Vite/Rolldown dependency baseline against the internal wiki.
• Regenerated THIRD-PARTY-NOTICES.md after all license scans succeeded.
• Ran backend types/tests, frontend tests/locales/build, and the compressed bundle budget.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T21:38:10.994551Z	d40928d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d40928d614

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Update authoritative dependency docs with these bumps

After this manifest update, agents and maintainers consulting the documented dependency baseline receive incorrect versions: GEMINI.md:42-43 still identifies Express 5.2 and Objection 3.1, while docs/wiki-intern/architektur/externe-abhaengigkeiten.md:13-17 still lists Express 5.2.1, Objection 3.1.5, and mysql2 3.24.5; that page also retains numerous old frontend and tooling versions through lines 69-96. Only the Vite marker in entwicklung/tests.md was synchronized, so update both authoritative inventories alongside the manifests to prevent future compatibility work from using a stale baseline.

AGENTS.md reference: AGENTS.md:L3-L9

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Stop forcing NanoID below PostCSS's supported range

PostCSS 8.5.30 now declares nanoid ^3.3.20 here, but backend/package.json:69 still overrides the vitest/vite/postcss/nanoid path to 3.3.18, and the regenerated lockfile consequently retains nanoid@3.3.18. On a fresh backend install this selective override is outside the parent's supported range; Yarn Classic documents that such incompatibilities only produce a warning, so the frozen install and verification workflow can pass while the test/build stack runs an unsupported transitive version. Remove the obsolete security pin or raise it to a version satisfying ^3.3.20, and update the corresponding constraint test.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Revert the untraceable Objection release

Every production backend install now loads objection@3.9.0, but this version is not traceable to the project's published source: the official npm package page and the upstream changelog still identify 3.1.5 as the latest release, while the first post-3.1 package visible to independent indexing was 3.3.0 published only three days earlier with zero downloads and a changed maintainer count. Tests can verify API behavior but cannot establish the provenance of a registry-only artifact that executes with database and filesystem access; keep 3.1.5 pinned until 3.9.0 has a verifiable upstream tag, changelog, and source diff.

Useful? React with 👍 / 👎.