Files

T

Build & Push Docker Image / build (push) Failing after 1m18s

Details

chore(deps): upgrade all dependencies to latest and pin exact

Policy: every direct dependency is now an exact pin; lockfile + --frozen-lockfile keep builds reproducible; save-exact=true enforced.

Toolchain:
- pnpm 10.26 -> 11.18 (lockfile migrated; supportedArchitectures moved to pnpm-workspace.yaml)
- typescript 5.9 -> 7.0, vite 7 -> 8, @vitejs/plugin-react 5 -> 6
- esbuild override 0.27.3 -> 0.28.1 (closes GHSA-g7r4-m6w7-qqqr); added @esbuild/darwin-arm64 for local dev
- orval 8.9 -> 8.23, regenerated clients

Backend (prod image):
- openid-client 5.7 -> 6.8 (rewritten OIDC flow in routes/auth.ts: discovery + functional API, PKCE/state, fetchUserInfo, buildEndSessionUrl)
- pino 9 -> 10, pino-http 10 -> 11, thread-stream 3 -> 4
- zod 3.25 -> 4.4 (catalog; supported by drizzle-zod 0.8.3)
- pg 8.20 -> 8.22; removed deprecated @types/bcryptjs

Frontend:
- react/react-dom 19.1.0 -> 19.2.8 (catalog pin lifted; expo note removed)
- react-day-picker 9 -> 10 (table classname -> month_grid)
- recharts 2 -> 3 (TooltipContentProps + DefaultLegendContentProps typing; safe keys)
- react-resizable-panels 2 -> 4 (Group/Separator rename)
- date-fns 3 -> 4, @hookform/resolvers 3 -> 5, lucide-react 0.545 -> 1.28
- all @radix-ui/*, tailwind, types, and remaining patch/minor deps bumped to latest

Security/process:
- overrides for body-parser >=2.3.0 (GHSA-v422-hmwv-36x6) + markdown-it/linkify-it/brace-expansion/fast-uri (dev tooling)
- pnpm audit now reports 0 vulnerabilities (prod and full)
- CI audit gate added to build.yaml; docs/dependency-policy.md; renovate.json
- Dockerfile pins node:24.18.1-alpine and pnpm@11.18.0

2026-08-03 12:56:00 +02:00

2.7 KiB

Raw Permalink Blame History

Dependency Policy

How this workspace keeps npm dependencies current, safe and reproducible.

Principles

Exact pins – Every direct dependency in package.json is pinned to an exact version (1.2.3, never ^1.2.3). save-exact=true is set in .npmrc so pnpm add follows this rule automatically.
Committed lockfile – pnpm-lock.yaml is committed. CI and the Docker build install with --frozen-lockfile, so builds are reproducible.
Security gates – CI runs pnpm audit --prod (fails on any finding) and pnpm audit --audit-level high (fails on high/critical). A non-zero exit blocks the release pipeline.
Supply-chain protection – minimumReleaseAge: 1440 (1 day) in pnpm-workspace.yaml blocks freshly published versions. Do not lower or disable it; only allowlist trusted publishers via minimumReleaseAgeExclude for urgent security fixes.
Pinned critical packages – react, react-dom and esbuild are intentionally excluded from automated updates (see renovate.json). Bump them deliberately, one release at a time, with a test pass.

Update cadence

Frequency	Scope	Who
Weekly	Patch + minor (grouped by Renovate)	Renovate PR, human merge after green CI
Monthly	One major version at a time	Human, own commit + release tag
As needed	Security advisories	Immediate fix + patch release
Yearly	Infrastructure review (Node LTS, Postgres major, k3s)	Human

Rules

Patch/minor: merge freely once CI (typecheck + build + audit) is green.
Major: never bundle multiple majors into one release. One major per commit so regressions can be bisected to the responsible change.
"Safe intermediate": if a package has a newer major that is not yet absorbed, stay on the latest patch/minor of the current major line. The exact-pin guarantees we never float into a new major by accident.
Node/Infra: Node base image and pnpm version in the Dockerfile are pinned exactly. Update them together with a build + live smoke test.
Postgres: image tag is managed in the admin/apps repository (apps/system/toolrate). Major upgrades run through a backup/restore flow.

Process for applying updates

pnpm install to refresh the lockfile.
Regenerate clients if the API changed: pnpm --filter @workspace/api-spec run codegen.
Run pnpm run typecheck, pnpm run build (with PORT=8080 BASE_PATH=/), and pnpm audit.
Fix any code that the new majors require (the common ones are openid-client, recharts, react-day-picker, date-fns, @hookform/resolvers, react-resizable-panels).
Commit, tag vX.Y.Z, push. CI builds, audits and deploys to k3s.

2.7 KiB Raw Permalink Blame History Unescape Escape

Dependency Policy

Principles

Update cadence

Rules

Process for applying updates

2.7 KiB

Raw Permalink Blame History