chore(deps): port the august bumps to develop and fix the audit gate - #142
Merged
Conversation
Dependabot opened #139, #140 and #141 against main, which is 64 commits behind develop. Their lockfiles conflict with develop (next-auth removed, better-auth added), so the bumps are redone here against the develop tree. Ported: - github/codeql-action 4.37.4 to 4.37.6 - @aws-sdk/client-identitystore, @base-ui/react, lucide-react, next 16.3.0 - @types/node, @types/pg, eslint-config-next, tsx Left out: @tanstack/react-table 8 to 9. It is a breaking major that renames the row model factories (getCoreRowModel to createCoreRowModel) and needs a migration of EmployeeTable.tsx. Tracked separately. The Dependency audit job was already failing on develop before these PRs, on two high advisories reaching us through transitives: - js-yaml 4.3.0 via @eslint/eslintrc (GHSA-5p4m-2wfm-xmqj) - nanoid 3.3.16 via postcss (GHSA-2v37-7h3g-55p8) Both are pinned through overrides, so npm audit --audit-level=high is clean.
This was referenced Aug 11, 2026
Next 16.3 ships an `agentRules` option, on by default, that makes `next dev` append a Next-authored block to AGENTS.md on every run. Two problems here: the block contains a non-ASCII character, which the pre-push ASCII gate rejects, and the working tree goes dirty on each dev start. AGENTS.md is ours, so the option is turned off.
Owner
Author
|
Heads up on the red
Fixed in #144. Merge that first, then this branch needs a rebase for the job to go green. Every other check here is passing, including the |
…min (#144) require-permission.itest.ts reassigned the shared admin account to Viewer, then restored Administrator at the end. That only holds if suites run one at a time. Vitest runs test files in parallel against the same database, so any suite reading the admin's role inside that window sees the read-only Viewer set instead. This is what broke Integration (DB) on the deps branch: roles/route.itest.ts reported the admin missing exactly the ten non-read permissions of the SOC Analyst preset, which is the Viewer set. Forcing the admin to Viewer and running that suite reproduces the CI output character for character. The suite now seeds its own company and asserts on that company's Viewer role. It never touched the admin user for its assertions anyway, the reassignment was dead weight that only created the race.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replaces the three Dependabot pull requests opened against
main(#139, #140, #141).Why they could not be merged as-is
Dependabot targets the default branch,
main, which is 64 commits behinddevelop. Their lockfiles conflict withdevelop(next-auth removed, better-auth added), so a retarget was not an option. The bumps are redone here against thedeveloptree.Ported
From #139:
github/codeql-action4.37.4 to 4.37.6From #140 (production):
@aws-sdk/client-identitystoreto ^3.1106.0@base-ui/reactto ^1.7.0lucide-reactto ^1.30.0nextto ^16.3.0From #141 (development):
@types/nodeto ^26.2.0@types/pgto ^8.21.0eslint-config-nextto ^15.5.23tsxto ^4.23.11Left out on purpose
@tanstack/react-table8 to 9, from #140. Breaking major: the row model factories are renamed (getCoreRowModeltocreateCoreRowModel, and so on) anduseReactTableis gone. It broke the type-check on #140 with 13 errors insrc/components/employees/EmployeeTable.tsx. Needs a proper migration, tracked separately.Audit gate
The
Dependency auditjob was already red ondevelopbefore these pull requests, on two high advisories reaching the tree through transitives:js-yaml4.3.0 via@eslint/eslintrc, GHSA-5p4m-2wfm-xmqjnanoid3.3.16 viapostcss, GHSA-2v37-7h3g-55p8Both are pinned with an override (
js-yaml^4.3.1,nanoid^3.3.18), following the pattern already used forbrace-expansionandfast-uri.Verified locally
npm run lint: passnpx tsc --noEmit: passnpm test: 37 files, 192 tests, passnpm run build: passnpm audit --audit-level=high:found 0 vulnerabilities