Bundle the open dependency bumps into one round #218

Merged

robbertbos merged 7 commits from deps/bundle-version-bumps into main 2026-08-05 10:07:34 +00:00

Conversation 0 Commits 7 Files changed 11 +558 -624

robbertbos commented 2026-08-05 09:42:28 +00:00

Owner

Copy link

Bundles the open Renovate bump PRs into one branch, so the whole round gets one
review and one CI run. Supersedes #211, #213, #214, #215, #216 and #217. One
commit per lane, so git log still shows which bump came from where.

Included

Lane	Change
CI toolchain (#211)	uv 0.11.32 -> 0.12.1, trivy 0.72.0 -> 0.73.0, renovate 43.280.5 -> 43.288.0, nginx-unprivileged digest refresh
Container base (#213)	node 24.18.0-alpine -> 24.19.0-alpine
Python (#216)	fastapi 0.141.1, uvicorn 0.52.1, alembic 1.19.0, typer 0.27.1, cachetools 7.1.7, ruff 0.16.1, ty 0.0.66, pip 26.2.1
cryptography (#217)	49.0.0 -> 50.0.0, security advisory
npm (#214)	tiptap 3.29.0 -> 3.29.2, dompurify 3.4.12 -> 3.4.13
npm dev (#215)	vite 8.2.0, typescript-eslint 8.66.0, playwright 1.62.1, vue-tsc 3.3.9, globals 17.9.0, @testing-library/user-event 14.6.3

Held back on purpose

Two bumps in the round break something, and neither is caught by any gate we
run. Both were reproduced before deciding.

marked stays on ^18.0.7

In 18.0.9 an empty nested blockquote swallows the paragraph that lazily
continues after it. Measured against 18.0.7, 18.0.8 and 18.0.9 side by side
with our own {gfm: true, breaks: true} options:

input   : ">>\ntekst"
18.0.7  : <blockquote><blockquote></blockquote></blockquote><p>tekst</p>
18.0.8  : <blockquote><blockquote></blockquote></blockquote><p>tekst</p>
18.0.9  : <blockquote><blockquote></blockquote></blockquote>          <-- "tekst" gone

Same for >>> and for > citaat followed by a bare >>. Every Mattermost
message we render goes through marked.parse in renderSafeMarkdown, so this
is silent content loss in the card modal, the reading-list preview, the outbox
rows and the drafts page. It comes from the blockquote-continuation fix in
18.0.9; there is no upstream issue for it yet. The rest of the npm lane is
included.

@nldd/design-system stays on ^0.8.70, #212 stays open

0.8.75 removed the four --primitives-font-family-*-fallback tokens.
frontend/src/styles/tokens.css:46-47 points the family chain at them on
purpose, because we may not use RijksSans (the licensing note is in that file).
Without those tokens the var() reference is invalid at computed-value time,
so --primitives-font-family-sans-serif and the downstream
--primitives-font-family-body both compute to the empty string, which takes
out the body { font: ...; font-family: ... } rule in base.css wholesale.

Measured on the built bundle in Chromium:

	0.8.70	0.8.77
font-family	system-ui, sans-serif	Times
font-size	18px	16px
line-height	27px	normal

Typecheck, eslint, vitest, the e2e suite and the build all pass on 0.8.77, so
nothing we run would have flagged it.

0.8.77 also carries two visual changes beyond that: nldd-card's
--components-card-box-shadow default went from level-1 to none, and
CardShell.vue relies on that default for the resting state, so cards lose
their resting shadow; and the banner frame moved off :host into a shadow
wrapper, which double-pads RetentionIntroBanner while giving the other seven
banners the interior padding they currently lack. Those are design calls, not
dependency maintenance, so #212 is better handled on its own with the tokens
fix alongside it.

Verification

Every CI job was run locally against the final tree:

• pre-commit run --all-files (pinned ruff 0.8.6, ty, gitleaks): pass
• backend pytest on SQLite, -n auto, 100% coverage gate: 1610 passed, 100.00%
• backend pytest on Postgres: 1610 passed
• ty check: pass
• vue-tsc typecheck, eslint (0 errors), vitest: 570 passed in 77 files
• vite build: pass
• Playwright e2e: 63 passed, 3 skipped
• test-release-scripts.sh: 20/20 after the changelog edit
• both container images build (containers/frontend, containers/backend)

Two extra checks worth naming:

• The fail-closed sha256 pins were verified against upstream, not trusted.
  refresh-release-sha.sh is best-effort and exits 0 on a fetch failure, so a
  bumped version can ship with a stale pin. Both were matched against the
  upstream checksum files: uv 0.12.1 against its .sha256 sidecar, trivy
  0.73.0 against trivy_0.73.0_checksums.txt. Both match.
• The merged lockfiles were proven consistent, not assumed. npm ci (which
  fails when package.json and package-lock.json disagree) and
  uv lock --check both pass, and neither rewrote its lockfile.

npm audit is unchanged from main: the same 6 pre-existing high-severity dev
transitives (@axe-core/cli -> chromedriver -> adm-zip, brace-expansion,
ip-address, undici), with one moderate cleared.

The ruff bump does not change any lint outcome: ruff 0.16.0 and 0.16.1 produce
identical output on this tree, and this PR touches no Python source.

Bundles the open Renovate bump PRs into one branch, so the whole round gets one review and one CI run. Supersedes #211, #213, #214, #215, #216 and #217. One commit per lane, so `git log` still shows which bump came from where. ## Included | Lane | Change | |---|---| | CI toolchain (#211) | uv 0.11.32 -> 0.12.1, trivy 0.72.0 -> 0.73.0, renovate 43.280.5 -> 43.288.0, nginx-unprivileged digest refresh | | Container base (#213) | node 24.18.0-alpine -> 24.19.0-alpine | | Python (#216) | fastapi 0.141.1, uvicorn 0.52.1, alembic 1.19.0, typer 0.27.1, cachetools 7.1.7, ruff 0.16.1, ty 0.0.66, pip 26.2.1 | | cryptography (#217) | 49.0.0 -> 50.0.0, security advisory | | npm (#214) | tiptap 3.29.0 -> 3.29.2, dompurify 3.4.12 -> 3.4.13 | | npm dev (#215) | vite 8.2.0, typescript-eslint 8.66.0, playwright 1.62.1, vue-tsc 3.3.9, globals 17.9.0, @testing-library/user-event 14.6.3 | ## Held back on purpose Two bumps in the round break something, and neither is caught by any gate we run. Both were reproduced before deciding. ### marked stays on `^18.0.7` In 18.0.9 an empty nested blockquote swallows the paragraph that lazily continues after it. Measured against 18.0.7, 18.0.8 and 18.0.9 side by side with our own `{gfm: true, breaks: true}` options: ``` input : ">>\ntekst" 18.0.7 : <blockquote><blockquote></blockquote></blockquote><p>tekst</p> 18.0.8 : <blockquote><blockquote></blockquote></blockquote><p>tekst</p> 18.0.9 : <blockquote><blockquote></blockquote></blockquote> <-- "tekst" gone ``` Same for `>>>` and for `> citaat` followed by a bare `>>`. Every Mattermost message we render goes through `marked.parse` in `renderSafeMarkdown`, so this is silent content loss in the card modal, the reading-list preview, the outbox rows and the drafts page. It comes from the blockquote-continuation fix in 18.0.9; there is no upstream issue for it yet. The rest of the npm lane is included. ### @nldd/design-system stays on `^0.8.70`, #212 stays open 0.8.75 removed the four `--primitives-font-family-*-fallback` tokens. `frontend/src/styles/tokens.css:46-47` points the family chain at them on purpose, because we may not use RijksSans (the licensing note is in that file). Without those tokens the `var()` reference is invalid at computed-value time, so `--primitives-font-family-sans-serif` and the downstream `--primitives-font-family-body` both compute to the empty string, which takes out the `body { font: ...; font-family: ... }` rule in `base.css` wholesale. Measured on the built bundle in Chromium: | | 0.8.70 | 0.8.77 | |---|---|---| | `font-family` | `system-ui, sans-serif` | `Times` | | `font-size` | 18px | 16px | | `line-height` | 27px | normal | Typecheck, eslint, vitest, the e2e suite and the build all pass on 0.8.77, so nothing we run would have flagged it. 0.8.77 also carries two visual changes beyond that: `nldd-card`'s `--components-card-box-shadow` default went from level-1 to `none`, and `CardShell.vue` relies on that default for the resting state, so cards lose their resting shadow; and the banner frame moved off `:host` into a shadow wrapper, which double-pads `RetentionIntroBanner` while giving the other seven banners the interior padding they currently lack. Those are design calls, not dependency maintenance, so #212 is better handled on its own with the tokens fix alongside it. ## Verification Every CI job was run locally against the final tree: - `pre-commit run --all-files` (pinned ruff 0.8.6, ty, gitleaks): pass - backend pytest on SQLite, `-n auto`, 100% coverage gate: 1610 passed, 100.00% - backend pytest on Postgres: 1610 passed - `ty check`: pass - `vue-tsc` typecheck, `eslint` (0 errors), vitest: 570 passed in 77 files - `vite build`: pass - Playwright e2e: 63 passed, 3 skipped - `test-release-scripts.sh`: 20/20 after the changelog edit - both container images build (`containers/frontend`, `containers/backend`) Two extra checks worth naming: - **The fail-closed sha256 pins were verified against upstream, not trusted.** `refresh-release-sha.sh` is best-effort and exits 0 on a fetch failure, so a bumped version can ship with a stale pin. Both were matched against the upstream checksum files: uv 0.12.1 against its `.sha256` sidecar, trivy 0.73.0 against `trivy_0.73.0_checksums.txt`. Both match. - **The merged lockfiles were proven consistent, not assumed.** `npm ci` (which fails when `package.json` and `package-lock.json` disagree) and `uv lock --check` both pass, and neither rewrote its lockfile. `npm audit` is unchanged from main: the same 6 pre-existing high-severity dev transitives (`@axe-core/cli` -> `chromedriver` -> `adm-zip`, `brace-expansion`, `ip-address`, `undici`), with one moderate cleared. The ruff bump does not change any lint outcome: ruff 0.16.0 and 0.16.1 produce identical output on this tree, and this PR touches no Python source.

robbertbos added 6 commits 2026-08-05 09:42:29 +00:00

Update CI images and actions 36c9af1592

Update Node.js to v24.19.0 71aade37f4

Update Python dependencies 6825f4895f

Update dependency cryptography to v50 [SECURITY] a3f611e274

Update npm dependencies ... 4be4f17451

Tiptap 3.29.0 -> 3.29.2 and dompurify 3.4.12 -> 3.4.13.

marked stays on ^18.0.7. In 18.0.9 an empty nested blockquote swallows the
paragraph that lazily continues after it: ">>\ntekst" renders the blockquote
and drops "tekst". Every Mattermost message we render goes through
marked.parse, so that is silent content loss.

Update npm dev dependencies 5e2a05c99b

robbertbos referenced this pull request 2026-08-05 09:42:52 +00:00

Update CI images and actions #211

robbertbos referenced this pull request 2026-08-05 09:42:53 +00:00

Update Node.js to v24.19.0 #213

robbertbos referenced this pull request 2026-08-05 09:42:53 +00:00

Update npm dev dependencies #215

robbertbos referenced this pull request 2026-08-05 09:42:53 +00:00

Update Python dependencies #216

robbertbos referenced this pull request 2026-08-05 09:42:53 +00:00

Update dependency cryptography to v50 [SECURITY] #217

robbertbos referenced this pull request 2026-08-05 09:42:53 +00:00

Update npm dependencies #214

robbertbos referenced this pull request 2026-08-05 09:43:28 +00:00

Update dependency @nldd/design-system to ^0.8.77 #212

robbertbos force-pushed deps/bundle-version-bumps from 17d410220d to 38e24ac92f 2026-08-05 09:56:51 +00:00 Compare

robbertbos merged commit 38e24ac92f into main 2026-08-05 10:07:34 +00:00

robbertbos deleted branch deps/bundle-version-bumps 2026-08-05 10:07:34 +00:00

robbertbos referenced this pull request 2026-08-05 12:16:42 +00:00

Update @nldd/design-system to 0.8.77 and adapt to it #219

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

help wanted

Need some help

  

invalid

Something is wrong

  

nldd ds

  

question

More information is needed

  

wontfix

This won't be fixed

No labels

bug

duplicate

enhancement

help wanted

invalid

nldd ds

question

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

robbertbos/waggle!218

No description provided.