Dependency refresh: every line current, five advisories closed, snapshot comparison in-repo - #16
Merged
Merged
Conversation
Every catalog line moves to the newest stable release at least a day old: Next.js 16.3.5, React 19.3.0, Vitest 5.0.1 with vite 8.3.0 stated as the peer it now asks for, lucide-react 1.46.0, zod 4.6.5, next-intl 4.14.5, TanStack Query 5.103.1, ESLint 10.10.0, Biome 2.5.14, Playwright 1.63.0 and the rest. Regenerating the lockfile with ee/ present drops next 16.3.1, sharp 0.35.3 and vitest 4.1.10, which closes all five open advisories: GHSA-p293-qw3h-jr36 and GHSA-2xp9-vwfh-vxw4 (next), GHSA-rgj7-g3m4-5g8c (sharp), GHSA-82fw-gwwq-j7x9 (vitest and @vitest/mocker). The minimumReleaseAgeExclude list empties because every version it named has left the lockfile. Both Next applications set images.unoptimized. Nothing renders next/image, and without the setting the framework answers /_next/image for anybody and loads an image decoder on the first request, which is the surface of both critical advisories. Vitest 5 renames its assertion interface, so jest-dom's own type augmentation no longer merges: src/test/jest-dom.d.ts re-attaches the matchers through the interface Vitest documents for it, and the setup file registers them directly. Its clearMocks default makes the manual mockClear calls dead, so they go. lucide's deprecated icon aliases move to their canonical names. The tracker's budget test compiles once for the whole file, because the first esbuild start timed out under parallel coverage. @types/node moves to the 24 line, the major the images and the build run on, with a Dependabot ignore on its major so it moves with the base images rather than by proposal. pnpm is pinned at 11.26.0, the latest-11 dist-tag. Supersedes #6, #7, #8, #9 and #10. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…wn responses Every pin moves to the newest stable release at least a day old, and the families that pin each other move together: Microsoft.AspNetCore.*, Microsoft.EntityFrameworkCore.* and Microsoft.Extensions.* 10.0.12, with Caching.Hybrid, TimeProvider.Testing and Diagnostics.Testing at 10.10.0; the five OpenTelemetry packages 1.18.0; OpenIddict.EntityFrameworkCore 7.7.0; ClickHouse.Driver 1.4.0; MaxMind.Db 5.2.0; MailKit 4.18.0; Stripe.net 52.4.2; Testcontainers 4.15.0; xunit.v3 4.0.1; AwesomeAssertions 9.6.0; SonarAnalyzer.CSharp 10.34.0.3385. The SDK becomes 10.0.401, the one carrying runtime 10.0.12. Four PackageVersion entries that nothing referenced are gone: OpenIddict.AspNetCore, Microsoft.Extensions.Http.Resilience, Microsoft.Extensions.DependencyInjection.Abstractions and Microsoft.EntityFrameworkCore.Relational. With transitive pinning on, a pin nothing references is what stops Dependabot's trial restore and leaves a family half-moved. The header of the version table says what the tree enforces: the excluded-package list is held by review, and the edition boundary by the architecture tests. ClickHouse.Driver 1.4.0 asks the store for compressed result sets and unpacks them itself, and documents that a handler it is given should be left without automatic decompression: a handler that unpacks adds its own codecs to every request's Accept-Encoding and redoes a step the driver already does. The registration drops it. The driver compiles K4os.Compression.LZ4, K4os.Hash.xxHash and ZstdSharp into its own assembly, so their notices travel through NOTICE, and Zstandard's BSD-3-Clause text is reproduced there as its terms require of a binary. Supersedes #5, #11, #12, #13 and #15. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Fifty-two tests across the SQL compiler and mail suites render text and compare it with a file
approved beside the test. The package that did the comparing charges an Open Source Maintenance
Fee from its 33rd release, which the public repository's dependency rule treats as a defect, and
staying on its last release under the old licence would pin a test adapter against a framework
that keeps moving. Dewiride.Analytics.Testing takes its place: Snapshot.Matches finds
{Class}.{Method}.verified.txt in the test project's directory, compares with line endings set
aside and everything else exact, writes {Class}.{Method}.received.txt on a difference, and fails
with a message that carries the first differing line and the whole rendering, because on a build
agent the received file is discarded with the machine. The 52 approved files are unchanged, and
approving a change is what it was: read the received file and move it over the approved one.
The project directory is recorded into every test assembly as assembly metadata by
backend/tests/Directory.Build.props rather than read from the compiler, because the root build
properties turn on reproducible source paths on GitHub Actions and the compiler then maps the
checkout to a placeholder. The package had switched that protection off in its own build
properties; nothing does now.
ADR 0044 records the decision. The version table's header names Verify 33+ among the packages
excluded by name, Dependabot's testing group no longer lists it, S2699 is silenced because a
snapshot test asserts by comparing, and both build workflows run the new suite first.
Supersedes #14.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…oard image The framework names an image decoder as an optional dependency and reaches it from its server entry, so the standalone trace copied the decoder and the native imaging library beneath it into the image: about nineteen megabytes of code the server never loads, because it never resizes a picture, and a library under the LGPL, which this product does not ship. The trace now leaves both out. Two things about the shape of the exclusion, both learnt from the tracer's source. The key is `**` rather than the `/**` the include uses, because the server entry's own trace is matched by its bare name without a leading slash. And the patterns climb to the workspace root first, exactly as the include does, because each is resolved from the application's directory and the packages are installed at the root; written without that prefix the exclusion matches nothing and the build says nothing about it. Proved on the built image: the decoder is absent, the server starts, serves the beacon and the sign-in screen, and answers a request for a resized picture with a page that does not exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
An audit of the file against the two package graphs, the container images and the run-time fetches, with every proposed change checked three ways from disk. Named and not shipped, so removed: Vercel AI SDK, echarts-for-react, TanStack Table and Virtual, shadcn/ui, crawler-user-agents, ai.robots.txt, and the paragraph claiming cloud providers' address ranges are fetched — hosting networks are recognised from the ip2asn data already listed. Shipped and not named, so added: the Lucide icon set (ISC) and the Feather icons it derives from (MIT); ZRender (BSD-3-Clause), the renderer ECharts draws through, compiled into the dashboard's scripts and so carrying its notice only here; the Inter and IBM Plex typefaces (SIL Open Font License 1.1), compiled into the images at build time, with the licence reproduced as its terms require; Node.js, the runtime of the dashboard image; the Azure SDK, EFCore.NamingConventions, next-themes, clsx, tailwind-merge and class-variance-authority; BouncyCastle, which reaches the engine through MimeKit; and Stripe.net, marked as the commercial edition's alone. Corrected: NSubstitute is BSD-3-Clause, not MIT; ClickHouse.Driver and Npgsql carry the copyright holders their licences name; the crawler range files are the ones the engine fetches — Google's current path and third file, Anthropic's current address, no Amazon file, and the seven operators the list omitted. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Sep 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Moves every dependency in the tree to its current release, closes the five open Dependabot alerts, and replaces the snapshot-comparison package with code of this repository. Supersedes #5, #6, #7, #8, #9, #10, #11, #12, #13, #14 and #15, none of which could merge as proposed: the JavaScript ones rewrote the lockfile without the private edition's importers (ADR 0043), the NuGet ones stopped part-way because of pins nothing referenced, and all of them proposed versions already behind the registries.
One commit per concern, each leaving both editions building and every suite green.
JavaScript (
846642b)pnpm-lock.yamlregenerated withee/present, so it carries all five importers.next< 16.3.3), GHSA-rgj7-g3m4-5g8c (sharp< 0.35.4) and GHSA-82fw-gwwq-j7x9 (vitest,@vitest/mocker< 4.1.11).images.unoptimizedin both Next applications: nothing rendersnext/image, and the optimiser endpoint the two critical advisories target otherwise answers for anybody.vitedeclared as the peer it now asks for;src/test/jest-dom.d.tsre-attaches jest-dom's matchers to the renamed assertion interface; deadmockClearcalls removed under the newclearMocksdefault.@types/nodeon the 24 line, the runtime major, with a Dependabot ignore on its major..NET (
68c590c)PackageVersionentries nothing referenced are deleted; they are what stopped Dependabot's restore.AutomaticDecompression: the 1.4.0 driver unpacks its own responses and documents the handler should be left alone.NOTICEcarries the notices of what the driver compiles into its own assembly (K4os, ZstdSharp) and Zstandard's BSD-3-Clause text.Snapshot comparison (
498ced6)Dewiride.Analytics.Testingtakes its place:Snapshot.Matchescompares against{Class}.{Method}.verified.txt, writes.received.txton a difference, and fails with the first differing line and the whole rendering so a CI log is enough to read. The 52 approved files are byte-identical tomain.backend/tests/Directory.Build.props, becauseContinuousIntegrationBuildmaps source paths to a placeholder on GitHub Actions. Nothing switches the compiler's reproducibility off.Dashboard image (
12671a2)outputFileTracingExcludeskeeps both out; the key is**and the patterns climb to the workspace root, for reasons the comment gives from the tracer's source. Proved on the built image: decoder absent, server starts, beacon and sign-in served,/_next/imageis a 404.NOTICE (
abdf277)Verified locally
Both editions build with zero warnings. All eleven suites pass in both editions (Community: Testing 11, Domain 113, Application 289, Classification 277, Architecture 26, Api 13, SqlTests 250, MailTests 18, Integration 827 on real containers; Cloud: Ee.Tests 73, Ee.Integration.Tests 86).
pnpm verifygreen (1,346 tests). All three Node images build in full with no decoder and no shared library inside, and both engine image build stages succeed. No*.received.*left behind.The private repository's matching change builds against
mainonce this is merged.🤖 Generated with Claude Code