6 Commits

Author	SHA1	Message	Date
opencode	4b1274e34a	fix(ci): use pnpm 11 allowBuilds instead of onlyBuiltDependencies ... pnpm 11 treats ignored build scripts as a hard error during fresh installs (CI/Docker), while the old onlyBuiltDependencies list is deprecated. The stray 'allowBuilds: esbuild: set this to true or false' placeholder was invalid YAML semantics and blocked the esbuild postinstall, failing 'pnpm install --frozen-lockfile' in the Docker builder stage (ERR_PNPM_IGNORED_BUILDS).	2026-08-03 13:06:43 +02:00
opencode	2f66fff993	chore(deps): upgrade all dependencies to latest and pin exact ... Policy: every direct dependency is now an exact pin; lockfile + --frozen-lockfile keep builds reproducible; save-exact=true enforced. Toolchain: - pnpm 10.26 -> 11.18 (lockfile migrated; supportedArchitectures moved to pnpm-workspace.yaml) - typescript 5.9 -> 7.0, vite 7 -> 8, @vitejs/plugin-react 5 -> 6 - esbuild override 0.27.3 -> 0.28.1 (closes GHSA-g7r4-m6w7-qqqr); added @esbuild/darwin-arm64 for local dev - orval 8.9 -> 8.23, regenerated clients Backend (prod image): - openid-client 5.7 -> 6.8 (rewritten OIDC flow in routes/auth.ts: discovery + functional API, PKCE/state, fetchUserInfo, buildEndSessionUrl) - pino 9 -> 10, pino-http 10 -> 11, thread-stream 3 -> 4 - zod 3.25 -> 4.4 (catalog; supported by drizzle-zod 0.8.3) - pg 8.20 -> 8.22; removed deprecated @types/bcryptjs Frontend: - react/react-dom 19.1.0 -> 19.2.8 (catalog pin lifted; expo note removed) - react-day-picker 9 -> 10 (table classname -> month_grid) - recharts 2 -> 3 (TooltipContentProps + DefaultLegendContentProps typing; safe keys) - react-resizable-panels 2 -> 4 (Group/Separator rename) - date-fns 3 -> 4, @hookform/resolvers 3 -> 5, lucide-react 0.545 -> 1.28 - all @radix-ui/*, tailwind, types, and remaining patch/minor deps bumped to latest Security/process: - overrides for body-parser >=2.3.0 (GHSA-v422-hmwv-36x6) + markdown-it/linkify-it/brace-expansion/fast-uri (dev tooling) - pnpm audit now reports 0 vulnerabilities (prod and full) - CI audit gate added to build.yaml; docs/dependency-policy.md; renovate.json - Dockerfile pins node:24.18.1-alpine and pnpm@11.18.0	2026-08-03 12:56:00 +02:00
opencode	78244c3197	feat: user-chosen browse views with grid/list toggle and profile sync ... - view modes grid | table | rows + density cozy/compact, persisted via localStorage and shareable ?view=?density= URL params (URL wins) - table view: sortable columns (name, rating, reviews), new sort options name_asc/name_desc/recently_updated (backend enum + handler) - live debounced search, removable filter chips, '/' focuses search - virtualization via @tanstack/react-virtual for table and rows views - profile sync: users.preferences jsonb + GET/PUT /api/auth/me/preferences; preference precedence URL > server profile > localStorage > default - add local rollup/lightningcss/tailwindcss oxide native binaries for macos dev	2026-08-02 09:34:53 +02:00
Replit Agent	bfd20e30b7	Update dependencies and workspace configuration ... Replit-Commit-Author: Agent	2026-07-29 18:06:00 +00:00
cheffe01	e03c51a75e	Fix qs vulnerability (GHSA-q8mj-m7cp-5q26) ... Task: Fix medium-severity qs DoS vulnerability in the dependency chain. The vulnerability affects qs >=6.11.1 <=6.15.1 — qs.stringify crashes with a TypeError when null/undefined entries appear in comma-format arrays with encodeValuesOnly set. The fix requires upgrading to qs >=6.15.2. The affected path was: artifacts/api-server > express > qs@6.15.1 Fix: Added a pnpm workspace override in pnpm-workspace.yaml to force qs to >=6.15.2 across all packages: qs: ">=6.15.2" Ran `pnpm install` to apply the override (+1/-1 package). Confirmed with `pnpm audit` — no known vulnerabilities found after the fix. No code changes were required; only the lockfile and workspace config were updated. Replit-Task-Id: 59fbfd17-c5e4-4330-b97c-49a9e383db2e	2026-05-25 13:10:23 +00:00
agent	1de22a6979	Initial commit	2026-05-14 20:25:38 +00:00