From d22f8f411546512082703078f97018e4593e2527 Mon Sep 17 00:00:00 2001 From: ScriptSmith Date: Thu, 2 Jul 2026 20:50:27 +1000 Subject: [PATCH 1/5] Bump pnpm to v11 and ignore unfixable quick-xml advisories - pnpm 9 -> 11 in all workflows; pin packageManager pnpm@11.9.0 in ui/, docs/, and deploy/tests package.json - Migrate ui settings (overrides, auditConfig) from the package.json "pnpm" field, which pnpm 11 no longer reads, to ui/pnpm-workspace.yaml - Add allowBuilds to each package root: pnpm 11 blocks dependency build scripts by default (sharp, esbuild, ssh2, msw, ...) - Ignore RUSTSEC-2026-0194/0195 (quick-xml < 0.41 DoS) in audit.toml and deny.toml: samael, calamine, and the xberg tree all pin pre-0.41 quick-xml and none has a fixed release yet; drop when upstream bumps land - Add the ui/public/wasm/.gitignore that vendor-wasm.mjs says should exist; without it the vendored pyodide/duckdb artifacts get committed --- .cargo/audit.toml | 11 ++++++++++ .github/workflows/ci.yml | 10 ++++----- .github/workflows/deploy-wasm.yml | 2 +- .github/workflows/docs.yml | 2 +- .github/workflows/release.yml | 4 ++-- CLAUDE.md | 4 ++++ deny.toml | 9 ++++++++ deploy/tests/package.json | 1 + deploy/tests/pnpm-workspace.yaml | 6 ++++++ docs/package.json | 1 + docs/pnpm-workspace.yaml | 5 +++++ ui/package.json | 36 +------------------------------ ui/pnpm-workspace.yaml | 35 ++++++++++++++++++++++++++++++ ui/public/wasm/.gitignore | 2 ++ 14 files changed, 84 insertions(+), 44 deletions(-) create mode 100644 deploy/tests/pnpm-workspace.yaml create mode 100644 docs/pnpm-workspace.yaml create mode 100644 ui/pnpm-workspace.yaml create mode 100644 ui/public/wasm/.gitignore diff --git a/.cargo/audit.toml b/.cargo/audit.toml index b479ab3f..df4a7d80 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -16,4 +16,15 @@ ignore = [ # microsandbox bump. Hadrian's own resolver uses hickory-resolver 0.26.1. "RUSTSEC-2026-0118", "RUSTSEC-2026-0119", + # quick-xml < 0.41 DoS: quadratic duplicate-attribute check (0194) and unbounded + # namespace-declaration allocation in NsReader (0195). Both fixed only in 0.41.0 + # (published 2026-06-29); no dependent has released a 0.41 bump yet: + # - 0.37.5 via samael ^0.37.2 (latest 0.0.21, git master unchanged) — SAML SSO + # - 0.39.2 via calamine ^0.39 (latest 0.35.0) — xberg excel extraction + # - 0.40.1 via xberg/pdf_oxide/office_oxide ^0.40 (all latest) — xberg office/pdf + # DoS only (CPU/memory exhaustion), no memory unsafety or code execution. SAML and + # document extraction do parse untrusted XML, so drop these ignores as soon as + # upstream releases pick up quick-xml 0.41. + "RUSTSEC-2026-0194", + "RUSTSEC-2026-0195", ] diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d789090c..0c00921e 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -153,7 +153,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Install UI dependencies working-directory: ui @@ -281,7 +281,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Get pnpm store directory shell: bash @@ -346,7 +346,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Install dependencies run: pnpm install --frozen-lockfile @@ -369,7 +369,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Get pnpm store directory shell: bash @@ -533,7 +533,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Get pnpm store directory shell: bash diff --git a/.github/workflows/deploy-wasm.yml b/.github/workflows/deploy-wasm.yml index 11578e94..a8ab5999 100644 --- a/.github/workflows/deploy-wasm.yml +++ b/.github/workflows/deploy-wasm.yml @@ -47,7 +47,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Get pnpm store directory shell: bash diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index d6bd9841..9d485f02 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -34,7 +34,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Get pnpm store directory shell: bash diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index db0395cd..cb3e9129 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Install UI dependencies working-directory: ui @@ -97,7 +97,7 @@ jobs: - name: Setup pnpm uses: pnpm/action-setup@v4 with: - version: 9 + version: 11 - name: Install UI dependencies working-directory: ui diff --git a/CLAUDE.md b/CLAUDE.md index 7ac0ff9e..fa436a1b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -96,6 +96,10 @@ Server runs on `http://0.0.0.0:8080` by default. The UI is in `ui/` — React 19, TypeScript, TailwindCSS, Storybook, @tanstack/react-query, hey-api. +pnpm 11 no longer reads the `"pnpm"` field in package.json: settings (`overrides`, `auditConfig`) and +build-script allowances (`allowBuilds` — pnpm 11 blocks dependency build scripts by default) live in +`pnpm-workspace.yaml` next to each package.json (`ui/`, `docs/`, `deploy/tests/`). + ```bash cd ui pnpm install # Install dependencies diff --git a/deny.toml b/deny.toml index 3375fca6..fea708e9 100644 --- a/deny.toml +++ b/deny.toml @@ -38,6 +38,15 @@ ignore = [ # allowlist. Fixed in hickory-proto 0.26.1, which microsandbox 0.4.5 cannot adopt. # Mirrors .cargo/audit.toml. { id = "RUSTSEC-2026-0119", reason = "limited reach: microsandbox-network in-microVM DNS only; no 0.25.x fix until microsandbox bump" }, + # quick-xml < 0.41 quadratic duplicate-attribute check. Fixed only in quick-xml + # 0.41.0 (2026-06-29); every dependent still pins an older series: samael ^0.37.2 + # (SAML SSO), calamine ^0.39 and xberg/pdf_oxide/office_oxide ^0.40 (document + # extraction). All are at their latest releases, so no upgrade path exists yet. + # DoS only (CPU exhaustion). Drop when upstream bumps land. Mirrors .cargo/audit.toml. + { id = "RUSTSEC-2026-0194", reason = "no fixed upstream releases: samael/calamine/xberg all pin pre-0.41 quick-xml; DoS only" }, + # quick-xml < 0.41 unbounded namespace-declaration allocation in NsReader. Same + # provenance and status as RUSTSEC-2026-0194. Mirrors .cargo/audit.toml. + { id = "RUSTSEC-2026-0195", reason = "no fixed upstream releases: samael/calamine/xberg all pin pre-0.41 quick-xml; DoS only" }, ] # Licenses - ensure all dependencies use acceptable licenses diff --git a/deploy/tests/package.json b/deploy/tests/package.json index dd833c71..4e6ec826 100644 --- a/deploy/tests/package.json +++ b/deploy/tests/package.json @@ -3,6 +3,7 @@ "version": "1.0.0", "private": true, "type": "module", + "packageManager": "pnpm@11.9.0", "scripts": { "generate-client": "openapi-ts -f openapi-ts.config.ts", "test": "vitest run", diff --git a/deploy/tests/pnpm-workspace.yaml b/deploy/tests/pnpm-workspace.yaml new file mode 100644 index 00000000..353d25e9 --- /dev/null +++ b/deploy/tests/pnpm-workspace.yaml @@ -0,0 +1,6 @@ +# pnpm 11 blocks dependency build scripts unless allowed here. +allowBuilds: + cpu-features: true + esbuild: true + protobufjs: true + ssh2: true diff --git a/docs/package.json b/docs/package.json index ae63ea3f..94f4ae2f 100644 --- a/docs/package.json +++ b/docs/package.json @@ -3,6 +3,7 @@ "version": "0.0.0", "private": true, "type": "module", + "packageManager": "pnpm@11.9.0", "scripts": { "build": "next build", "dev": "next dev", diff --git a/docs/pnpm-workspace.yaml b/docs/pnpm-workspace.yaml new file mode 100644 index 00000000..9b3c20e7 --- /dev/null +++ b/docs/pnpm-workspace.yaml @@ -0,0 +1,5 @@ +# pnpm 11 blocks dependency build scripts unless allowed here. +allowBuilds: + esbuild: true + sharp: true + unrs-resolver: true diff --git a/ui/package.json b/ui/package.json index 57a32455..44443d71 100644 --- a/ui/package.json +++ b/ui/package.json @@ -3,6 +3,7 @@ "private": true, "version": "0.1.0", "type": "module", + "packageManager": "pnpm@11.9.0", "scripts": { "vendor-wasm": "node ../scripts/vendor-wasm.mjs", "predev": "node ../scripts/vendor-wasm.mjs", @@ -105,40 +106,5 @@ "workerDirectory": [ "public" ] - }, - "pnpm": { - "auditConfig": { - "ignoreCves": [ - "CVE-2025-69873", - "CVE-2026-26996" - ] - }, - "overrides": { - "glob>minimatch": ">=10.2.3", - "filelist>minimatch": ">=10.2.3", - "@typescript-eslint/typescript-estree>minimatch": ">=10.2.3", - "eslint>minimatch": "~3.1.4", - "@eslint/config-array>minimatch": "~3.1.4", - "@eslint/eslintrc>minimatch": "~3.1.4", - "eslint-plugin-jsx-a11y>minimatch": "~3.1.4", - "@rollup/plugin-terser>serialize-javascript": ">=7.0.3", - "qs": ">=6.14.2", - "workbox-build>ajv": ">=8.18.0", - "@modelcontextprotocol/sdk>ajv": ">=8.18.0", - "hono": ">=4.12.25", - "@modelcontextprotocol/sdk>@hono/node-server": ">=1.19.10", - "@modelcontextprotocol/sdk>express-rate-limit": ">=8.2.2", - "flatted": ">=3.4.2", - "picomatch": ">=4.0.4", - "@rollup/pluginutils>picomatch": ">=2.3.2 <4.0.0 || >=4.0.4", - "lodash": ">=4.18.1", - "lodash-es": ">=4.18.1", - "defu": ">=6.1.7", - "vite": ">=7.3.5 <8", - "ws": ">=8.21.0", - "fast-uri": ">=3.1.2", - "@babel/plugin-transform-modules-systemjs": ">=7.29.4", - "esbuild": ">=0.28.1" - } } } \ No newline at end of file diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml new file mode 100644 index 00000000..2b2da6ff --- /dev/null +++ b/ui/pnpm-workspace.yaml @@ -0,0 +1,35 @@ +# pnpm settings (moved from the package.json "pnpm" field, which pnpm 11 no longer reads). +allowBuilds: + "@modelcontextprotocol/ext-apps": true + esbuild: true + msw: true +auditConfig: + ignoreCves: + - CVE-2025-69873 + - CVE-2026-26996 +overrides: + "glob>minimatch": ">=10.2.3" + "filelist>minimatch": ">=10.2.3" + "@typescript-eslint/typescript-estree>minimatch": ">=10.2.3" + "eslint>minimatch": "~3.1.4" + "@eslint/config-array>minimatch": "~3.1.4" + "@eslint/eslintrc>minimatch": "~3.1.4" + "eslint-plugin-jsx-a11y>minimatch": "~3.1.4" + "@rollup/plugin-terser>serialize-javascript": ">=7.0.3" + qs: ">=6.14.2" + "workbox-build>ajv": ">=8.18.0" + "@modelcontextprotocol/sdk>ajv": ">=8.18.0" + hono: ">=4.12.25" + "@modelcontextprotocol/sdk>@hono/node-server": ">=1.19.10" + "@modelcontextprotocol/sdk>express-rate-limit": ">=8.2.2" + flatted: ">=3.4.2" + picomatch: ">=4.0.4" + "@rollup/pluginutils>picomatch": ">=2.3.2 <4.0.0 || >=4.0.4" + lodash: ">=4.18.1" + lodash-es: ">=4.18.1" + defu: ">=6.1.7" + vite: ">=7.3.5 <8" + ws: ">=8.21.0" + fast-uri: ">=3.1.2" + "@babel/plugin-transform-modules-systemjs": ">=7.29.4" + esbuild: ">=0.28.1" diff --git a/ui/public/wasm/.gitignore b/ui/public/wasm/.gitignore new file mode 100644 index 00000000..d6b7ef32 --- /dev/null +++ b/ui/public/wasm/.gitignore @@ -0,0 +1,2 @@ +* +!.gitignore From 5795d5b55ec1b10a8b48387ead4c7873100b2c05 Mon Sep 17 00:00:00 2001 From: ScriptSmith Date: Thu, 2 Jul 2026 21:09:37 +1000 Subject: [PATCH 2/5] Review fixes --- ui/pnpm-workspace.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ui/pnpm-workspace.yaml b/ui/pnpm-workspace.yaml index 2b2da6ff..33443939 100644 --- a/ui/pnpm-workspace.yaml +++ b/ui/pnpm-workspace.yaml @@ -4,9 +4,9 @@ allowBuilds: esbuild: true msw: true auditConfig: - ignoreCves: - - CVE-2025-69873 - - CVE-2026-26996 + ignoreGhsas: + - GHSA-2g4f-4pwh-qvx6 # CVE-2025-69873: ajv ReDoS via $data option + - GHSA-3ppc-4f35-3m26 # CVE-2026-26996: minimatch ReDoS via repeated wildcards overrides: "glob>minimatch": ">=10.2.3" "filelist>minimatch": ">=10.2.3" From f816e52272ec3138519dbb0ebd48dd7307226c49 Mon Sep 17 00:00:00 2001 From: ScriptSmith Date: Thu, 2 Jul 2026 21:09:37 +1000 Subject: [PATCH 3/5] Fix CI for pnpm 11: Node 24 and node24 action runtimes - pnpm 11 uses the node:sqlite built-in, which Node 20 lacks; bump node-version to 24 everywhere (Frontend, Security Audit, Documentation, and WASM Build jobs all crashed with ERR_UNKNOWN_BUILTIN_MODULE) - Docker Build failed with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH because the dependency-caching COPY layer lacked the new pnpm-workspace.yaml files (where the overrides now live); also corepack-prepare pnpm@11 instead of 9 - Bump every action pinned to a node20 runtime to its current node24 major: checkout v7, setup-node v6, cache v6, pnpm/action-setup v6, upload-artifact v7, download-artifact v8, buildx v4, build-push v7, metadata v6, login v4, setup-helm v5, wrangler v4, gh-release v3, setup-uv v7, deploy-pages v5, upload-pages-artifact v5 --- .github/workflows/ci.yml | 76 +++++++++++++++---------------- .github/workflows/deploy-wasm.yml | 12 ++--- .github/workflows/docs.yml | 20 ++++---- .github/workflows/helm.yml | 24 +++++----- .github/workflows/release.yml | 58 +++++++++++------------ Dockerfile | 6 +-- 6 files changed, 98 insertions(+), 98 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0c00921e..113fee7c 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -16,7 +16,7 @@ jobs: name: Backend runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Configure Docker Hub mirror run: | @@ -73,7 +73,7 @@ jobs: matrix: features: [tiny, minimal, standard, full, headless] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Configure Docker Hub mirror run: | @@ -121,7 +121,7 @@ jobs: name: WASM Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -146,12 +146,12 @@ jobs: run: ./scripts/build-wasm.sh --release - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: "20" + node-version: "24" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -193,7 +193,7 @@ jobs: os: windows-latest features: minimal steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -242,7 +242,7 @@ jobs: name: Security Audit (cargo-audit) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install cargo-audit run: cargo install cargo-audit --locked @@ -255,7 +255,7 @@ jobs: name: Dependency Check (cargo-deny) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install cargo-deny run: cargo install cargo-deny --locked @@ -271,15 +271,15 @@ jobs: run: working-directory: ui steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: '20' + node-version: '24' - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -288,7 +288,7 @@ jobs: run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Cache pnpm - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-store-${{ hashFiles('**/pnpm-lock.yaml') }} @@ -336,15 +336,15 @@ jobs: run: working-directory: ui steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: '20' + node-version: '24' - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -359,15 +359,15 @@ jobs: name: Documentation runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: '20' + node-version: '24' - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -376,7 +376,7 @@ jobs: run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Cache pnpm - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-docs-${{ hashFiles('docs/pnpm-lock.yaml', 'ui/pnpm-lock.yaml') }} @@ -422,10 +422,10 @@ jobs: name: OpenAPI Conformance runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install uv - uses: astral-sh/setup-uv@v4 + uses: astral-sh/setup-uv@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -463,7 +463,7 @@ jobs: - name: Upload conformance report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: openapi-conformance-report path: conformance-report.json @@ -473,7 +473,7 @@ jobs: name: Docker Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Configure Docker Hub mirror run: | @@ -482,10 +482,10 @@ jobs: sudo systemctl restart docker - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build and export Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . tags: hadrian:local @@ -494,7 +494,7 @@ jobs: cache-to: type=gha,mode=max,scope=docker - name: Upload Docker image artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: docker-image path: ${{ runner.temp }}/hadrian.tar @@ -508,7 +508,7 @@ jobs: timeout-minutes: 60 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Configure Docker Hub mirror run: | @@ -517,7 +517,7 @@ jobs: sudo systemctl restart docker - name: Download Docker image artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-image path: ${{ runner.temp }} @@ -526,12 +526,12 @@ jobs: run: docker load --input ${{ runner.temp }}/hadrian.tar - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: '20' + node-version: '24' - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -540,7 +540,7 @@ jobs: run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Cache pnpm - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-e2e-${{ hashFiles('deploy/tests/pnpm-lock.yaml') }} @@ -593,7 +593,7 @@ jobs: - name: Upload coverage report if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: e2e-api-coverage path: deploy/tests/coverage/api-coverage.json @@ -601,7 +601,7 @@ jobs: - name: Upload test artifacts on failure if: failure() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: e2e-test-artifacts path: | diff --git a/.github/workflows/deploy-wasm.yml b/.github/workflows/deploy-wasm.yml index a8ab5999..83a48d28 100644 --- a/.github/workflows/deploy-wasm.yml +++ b/.github/workflows/deploy-wasm.yml @@ -24,7 +24,7 @@ jobs: contents: read deployments: write steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -40,12 +40,12 @@ jobs: shared-key: wasm - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: "20" + node-version: "24" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -54,7 +54,7 @@ jobs: run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Cache pnpm - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-wasm-${{ hashFiles('ui/pnpm-lock.yaml') }} @@ -106,7 +106,7 @@ jobs: EOF - name: Deploy to Cloudflare Pages - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9d485f02..06d0781f 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -24,15 +24,15 @@ jobs: name: Build runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: "20" + node-version: "24" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -41,7 +41,7 @@ jobs: run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV - name: Cache pnpm - uses: actions/cache@v4 + uses: actions/cache@v6 with: path: ${{ env.STORE_PATH }} key: ${{ runner.os }}-pnpm-docs-deploy-${{ hashFiles('docs/pnpm-lock.yaml', 'ui/pnpm-lock.yaml') }} @@ -78,12 +78,12 @@ jobs: run: echo "docs.hadriangateway.com" > docs/out/CNAME - name: Upload Pages artifact - uses: actions/upload-pages-artifact@v3 + uses: actions/upload-pages-artifact@v5 with: path: docs/out - name: Upload docs artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: docs-out path: docs/out @@ -99,7 +99,7 @@ jobs: steps: - name: Deploy to GitHub Pages id: deployment - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@v5 deploy-cloudflare: name: Deploy to Cloudflare Pages @@ -110,13 +110,13 @@ jobs: deployments: write steps: - name: Download docs artifact - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docs-out path: docs-out - name: Deploy to Cloudflare Pages - uses: cloudflare/wrangler-action@v3 + uses: cloudflare/wrangler-action@v4 with: apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }} accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }} diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml index d1cbf640..2fda5586 100644 --- a/.github/workflows/helm.yml +++ b/.github/workflows/helm.yml @@ -18,10 +18,10 @@ jobs: name: Helm Lint runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@v5 with: version: v3.14.0 @@ -228,10 +228,10 @@ jobs: api_versions: "" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@v5 with: version: v3.14.0 @@ -286,7 +286,7 @@ jobs: fi - name: Upload rendered manifests - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: rendered-${{ matrix.scenario }} path: /tmp/rendered.yaml @@ -298,10 +298,10 @@ jobs: runs-on: ubuntu-latest needs: [helm-lint, helm-template] steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@v5 with: version: v3.14.0 @@ -329,10 +329,10 @@ jobs: run: helm dependency update helm/hadrian - name: Set up Docker Buildx - uses: docker/setup-buildx-action@v3 + uses: docker/setup-buildx-action@v4 - name: Build Docker image - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . load: true @@ -437,10 +437,10 @@ jobs: needs: [helm-lint, helm-template] if: github.ref == 'refs/heads/main' steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Set up Helm - uses: azure/setup-helm@v4 + uses: azure/setup-helm@v5 with: version: v3.14.0 @@ -454,7 +454,7 @@ jobs: run: helm package helm/hadrian -d /tmp/charts - name: Upload packaged chart - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: helm-chart path: /tmp/charts/*.tgz diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index cb3e9129..eb462be0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -23,15 +23,15 @@ jobs: name: Build Frontend runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: "20" + node-version: "24" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -60,7 +60,7 @@ jobs: run: pnpm build - name: Upload frontend assets - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: frontend-assets path: | @@ -74,7 +74,7 @@ jobs: needs: build-frontend runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -90,12 +90,12 @@ jobs: shared-key: wasm - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@v6 with: - node-version: "20" + node-version: "24" - name: Setup pnpm - uses: pnpm/action-setup@v4 + uses: pnpm/action-setup@v6 with: version: 11 @@ -126,7 +126,7 @@ jobs: ls -lh artifacts/ - name: Upload WASM artifact - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: build-wasm path: artifacts/ @@ -157,7 +157,7 @@ jobs: os: windows-latest features: "standard minimal tiny" steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -186,7 +186,7 @@ jobs: shared-key: release-${{ matrix.target }} - name: Download frontend assets - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: frontend-assets @@ -240,7 +240,7 @@ jobs: done - name: Upload build artifacts - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: build-${{ matrix.target }} path: artifacts/ @@ -253,10 +253,10 @@ jobs: if: github.ref_type == 'tag' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Download all build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: pattern: build-* path: all-artifacts @@ -279,7 +279,7 @@ jobs: ls -lh release/ - name: Create GitHub Release - uses: softprops/action-gh-release@v2 + uses: softprops/action-gh-release@v3 with: generate_release_notes: true files: release/* @@ -290,7 +290,7 @@ jobs: if: github.ref_type == 'tag' && !(github.event_name == 'workflow_dispatch' && inputs.dry_run) runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Install Rust toolchain uses: dtolnay/rust-toolchain@stable @@ -324,15 +324,15 @@ jobs: runner: ubuntu-24.04-arm suffix: arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - name: Lowercase image name id: image run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT" - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - - uses: docker/login-action@v3 + - uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -340,12 +340,12 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ steps.image.outputs.name }} - name: Build and push - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ matrix.platform }} @@ -366,9 +366,9 @@ jobs: id: image run: echo "name=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT" - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - - uses: docker/login-action@v3 + - uses: docker/login-action@v4 with: registry: ghcr.io username: ${{ github.actor }} @@ -376,7 +376,7 @@ jobs: - name: Extract metadata id: meta - uses: docker/metadata-action@v5 + uses: docker/metadata-action@v6 with: images: ${{ steps.image.outputs.name }} tags: | @@ -415,12 +415,12 @@ jobs: runner: ubuntu-24.04-arm suffix: arm64 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v7 - - uses: docker/setup-buildx-action@v3 + - uses: docker/setup-buildx-action@v4 - name: Build (no push) - uses: docker/build-push-action@v6 + uses: docker/build-push-action@v7 with: context: . platforms: ${{ matrix.platform }} @@ -436,7 +436,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Download all build artifacts - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: pattern: build-* path: all-artifacts diff --git a/Dockerfile b/Dockerfile index 54ded2a0..f249f7ac 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,13 +4,13 @@ FROM node:24-slim AS frontend-builder # Install pnpm -RUN corepack enable && corepack prepare pnpm@9 --activate +RUN corepack enable && corepack prepare pnpm@11 --activate WORKDIR /app # Copy package files for dependency caching -COPY ui/package.json ui/pnpm-lock.yaml ./ui/ -COPY docs/package.json docs/pnpm-lock.yaml docs/next.config.mjs docs/source.config.ts ./docs/ +COPY ui/package.json ui/pnpm-lock.yaml ui/pnpm-workspace.yaml ./ui/ +COPY docs/package.json docs/pnpm-lock.yaml docs/pnpm-workspace.yaml docs/next.config.mjs docs/source.config.ts ./docs/ # Install UI dependencies WORKDIR /app/ui From dd7a200a699b2450cbd9d75a0fafa15340ae794c Mon Sep 17 00:00:00 2001 From: ScriptSmith Date: Thu, 2 Jul 2026 21:37:19 +1000 Subject: [PATCH 4/5] Pin exact pnpm version in Dockerfile to match packageManager --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index f249f7ac..32f074fb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,7 +4,7 @@ FROM node:24-slim AS frontend-builder # Install pnpm -RUN corepack enable && corepack prepare pnpm@11 --activate +RUN corepack enable && corepack prepare pnpm@11.9.0 --activate WORKDIR /app From 99b60bca0aa60b5b637452bef94336237040df3b Mon Sep 17 00:00:00 2001 From: ScriptSmith Date: Thu, 2 Jul 2026 21:38:42 +1000 Subject: [PATCH 5/5] Fix dropdown --- ui/public/mockServiceWorker.js | 2 +- ui/src/components/Dropdown/Dropdown.tsx | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/ui/public/mockServiceWorker.js b/ui/public/mockServiceWorker.js index daa58d0f..973d6ee8 100644 --- a/ui/public/mockServiceWorker.js +++ b/ui/public/mockServiceWorker.js @@ -1,4 +1,4 @@ -/* eslint-disable */ + /* tslint:disable */ /** diff --git a/ui/src/components/Dropdown/Dropdown.tsx b/ui/src/components/Dropdown/Dropdown.tsx index f9566c74..bd5093ee 100644 --- a/ui/src/components/Dropdown/Dropdown.tsx +++ b/ui/src/components/Dropdown/Dropdown.tsx @@ -431,9 +431,11 @@ export function DropdownItem({ setItemIndex(index); }, [registerItem]); - // Focus management when highlighted + // Focus management when highlighted. Guard on itemIndex >= 0: before + // registration both itemIndex and highlightedIndex are -1, and without the + // guard every item would steal focus on mount (the last one winning). useEffect(() => { - if (highlightedIndex === itemIndex && itemRef.current) { + if (itemIndex >= 0 && highlightedIndex === itemIndex && itemRef.current) { itemRef.current.focus(); } }, [highlightedIndex, itemIndex]);