Skip to content

build(deps): bump @vitejs/plugin-react from 5.1.4 to 6.0.3 - #571

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/vitejs/plugin-react-6.0.3
Closed

dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/npm_and_yarn/vitejs/plugin-react-6.0.3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 9, 2026

Copy link
Copy Markdown
Contributor

Bumps @vitejs/plugin-react from 5.1.4 to 6.0.3.

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.0.3

No release notes provided.

plugin-react@6.0.2

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

plugin-react@6.0.1

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

plugin-react@6.0.0

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [
</tr></table>

... (truncated)

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.0.3 (2026-06-23)

6.0.2 (2026-05-14)

Allow all options in reactCompilerPreset (#1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

6.0.1 (2026-03-13)

Expand @rolldown/plugin-babel peer dep range (#1146)

Expanded @rolldown/plugin-babel peer dep range to include ^0.2.0.

6.0.0 (2026-03-12)

6.0.0-beta.0 (2026-03-03)

Remove Babel Related Features (#1123)

Vite 8+ can handle React Refresh Transform by Oxc and doesn't need Babel for it. With that, there are no transform applied that requires Babel. To reduce the installation size of this plugin, babel is no longer a dependency of this plugin and the related features are removed.

If you are using Babel, you can use @rolldown/plugin-babel together with this plugin:

 import { defineConfig } from 'vite'
 import react from '@vitejs/plugin-react'
+import babel from '@rolldown/plugin-babel'
export default defineConfig({
plugins: [


react({



  babel: {



    plugins: ['@babel/plugin-proposal-throw-expressions'],



  },



}),





react(),



babel({



  plugins: ['@babel/plugin-proposal-throw-expressions'],



}),

]
})

For React compiler users, you can use reactCompilerPreset for easier setup with preconfigured filter to improve build performance:

 import { defineConfig } from 'vite'
-import react from '@vitejs/plugin-react'
+import react, { reactCompilerPreset } from '@vitejs/plugin-react'
</tr></table> 

... (truncated)

Commits
  • 640fd35 release: plugin-react@6.0.3
  • 889efb0 fix(deps): update all non-major dependencies (#1249)
  • 6c57dd4 fix(plugin-react): use '/' base in bundledDev preamble to fix non-root base p...
  • 3cc33a7 fix(deps): update react-related dependencies (#1245)
  • c0f7c7f docs: mention the Biome rule in the "Consistent components exports" section (...
  • cd80f0f fix(deps): update all non-major dependencies (#1241)
  • e38acca fix(deps): update all non-major dependencies (#1227)
  • 9a9bb26 perf(react): improve react compiler preset so that slightly more modules are ...
  • 6535b55 release: plugin-react@6.0.2
  • bf0e43b feat(react): whitelist debugging-options (#1189)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 9, 2026
@dependabot
dependabot Bot requested a review from cloudURBANE as a code owner July 9, 2026 13:22
@vercel

vercel Bot commented Jul 9, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
scent-cast-explore Ready Ready Preview, Comment Jul 9, 2026 11:20pm

Request Review

@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/vitejs/plugin-react-6.0.3 branch from 75f743a to 5f206fa Compare July 9, 2026 18:17
Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 5.1.4 to 6.0.3.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/npm_and_yarn/vitejs/plugin-react-6.0.3 branch from 5f206fa to c022e71 Compare July 9, 2026 21:15
plugin-react 6.0.3 imports vite/internal and requires vite ^8.0.0; on
vite 7 the build fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Bump the catalog
vite to ^8.1.4. Verified: scent-cast + mockup-sandbox both build and the
full typecheck passes; @tailwindcss/vite and vite-plugin-pwa already
support vite 8, and tests use node --test (not vite).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cloudURBANE added a commit that referenced this pull request Jul 10, 2026
* ci: bump actions/setup-node v4 -> v6 (keep pnpm caching)

setup-node v6's breaking change ("Limit automatic caching to npm",
actions/setup-node#1374) only narrows the NO-input auto-detection path so
it auto-enables caching for npm projects. An explicit `cache: pnpm` input is
still honored: v6 src/main.ts passes the input value straight to
restoreCache('pnpm', ...) without overriding it, and the v6 README still lists
pnpm (>=6.10) as a supported cache value.

All three setup-node steps in this repo already set `cache: pnpm` explicitly,
with pnpm/action-setup@v4 running first so the store path resolves. They are
therefore unaffected by the breaking change; only the action version needed to
move. No caching pattern change was required and caching is preserved.

Steps bumped:
- tests.yml (node 22)
- deploy-frontend.yml test job (node 24)
- deploy-frontend.yml deploy job (node 24)

Co-Authored-By: Claude <noreply@anthropic.com>

* build(deps): bump pnpm/action-setup from 4 to 6

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* test: discover tests by glob so new test files can't be silently skipped

The api-server and scent-cast `test` scripts hand-enumerated every test
file; six api-server tests (including corsOrigins.test.ts, the test for
the CORS allowlist) existed on disk but never ran. Quote the glob so the
runner expands it (same pattern @workspace/db already uses).

Re-including the orphans surfaced one drifted assertion:
orientationEngine.test.ts expected the visible base exactly at
baselineOffset, but the 2px anti-clip bbox margin scales with the bottle
and intentionally seats the base a few px above — the same accepted
drift the "~88% height" test documents. Bound the assertion to that
documented behavior instead of changing live render geometry (which
would bump ORIENTATION_VERSION and invalidate cached packshots).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014cEQ87SG31DEkaacGtGtH6

* ci: lint gate, dependency scanning, Docker build check, Node 22 parity

Production-readiness F2:
- ESLint flat config scoped to api-server runtime sources with two rules
  at error: @typescript-eslint/no-floating-promises (dropped promises in
  handlers/workers are silent failures) and no-console (post-A6 pino
  regression stop). CLI/MCP entrypoints and offline verification scripts
  keep stdout deliberately. Baseline is clean — the gate starts green.
- `pnpm run lint` root script + CI step.
- CI Node 24 → 22 in tests.yml and deploy-frontend.yml to match the
  node:22-bookworm-slim runtime image and the engines field.
- Dependabot (npm weekly grouped minor/patch + github-actions) and a
  report-only `pnpm audit --prod` step; flip to blocking after triage.
- docker-build PR job (push:false, gha layer cache) gated on image-input
  paths, so Dockerfile/lockfile breakage fails at PR time, not deploy.
- PR guard requiring a lib/db/migrations/ file whenever
  lib/db/src/schema/** changes (E1 enforcement half).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014cEQ87SG31DEkaacGtGtH6

* feat(build): stamp SPA builds with VITE_GIT_SHA (web-vitals build tag)

The webVitalsTelemetry build tag lost its source when Vercel's injected
VITE_VERCEL_GIT_COMMIT_SHA went away with the CloudFront cutover; main
already reads VITE_GIT_SHA as the fallback but nothing set it. Inject
github.sha in deploy-frontend.yml builds and accept an optional ARG in
the Dockerfile (empty default keeps Railway builds unchanged).

Adapted from PR #539 (claude/production-critical-impl-odvdqt); its ECR/
App Runner deploy job was NOT carried over — docs/aws-migration/ records
the accepted architecture as S3+CloudFront for the SPA with backends
staying on Railway.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7

* build(deps): bump the minor-and-patch group across 1 directory with 48 updates

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-accordion"
  dependency-version: 1.2.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-alert-dialog"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-aspect-ratio"
  dependency-version: 1.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-avatar"
  dependency-version: 1.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-checkbox"
  dependency-version: 1.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-collapsible"
  dependency-version: 1.1.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-context-menu"
  dependency-version: 2.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-dropdown-menu"
  dependency-version: 2.1.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-hover-card"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-label"
  dependency-version: 2.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-menubar"
  dependency-version: 1.1.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-navigation-menu"
  dependency-version: 1.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-popover"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-progress"
  dependency-version: 1.1.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-radio-group"
  dependency-version: 1.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-scroll-area"
  dependency-version: 1.2.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-select"
  dependency-version: 2.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-separator"
  dependency-version: 1.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-slider"
  dependency-version: 1.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-slot"
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-switch"
  dependency-version: 1.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-tabs"
  dependency-version: 1.1.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toast"
  dependency-version: 1.2.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toggle"
  dependency-version: 1.1.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toggle-group"
  dependency-version: 1.1.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-tooltip"
  dependency-version: 1.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-hook-form
  dependency-version: 7.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/typography"
  dependency-version: 0.5.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: orval
  dependency-version: 8.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pg
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/pg"
  dependency-version: 8.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/pg"
  dependency-version: 8.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: drizzle-kit
  dependency-version: 0.31.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@replit/vite-plugin-cartographer"
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: framer-motion
  dependency-version: 12.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: adapt to sharp 0.35 types and esbuild 0.28 PWA target

The minor-and-patch group surfaces two breaking changes:

1. sharp 0.35 no longer exposes its namespace via a default import, so
   `sharp.Metadata` fails (TS2503). Import the Metadata type by name in
   adminBottleImageUpload.ts and packshotTrimCore.ts.

2. esbuild 0.28 (pulled in via the tsx/esbuild bumps) now refuses to
   transform the PWA service worker's destructuring for the Safari 14.0
   target — Safari 14.0 has a destructuring bug that 14.1 fixed. Bump the
   scent-cast build target safari14 -> safari14.1 (still es2020 + iOS 14).

Verified: full typecheck + both frontend builds (incl. PWA SW) pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps): bump @vitejs/plugin-react from 5.1.4 to 6.0.3

Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 5.1.4 to 6.0.3.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): migrate to vite 8 to satisfy @vitejs/plugin-react 6 peer

plugin-react 6.0.3 imports vite/internal and requires vite ^8.0.0; on
vite 7 the build fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Bump the catalog
vite to ^8.1.4. Verified: scent-cast + mockup-sandbox both build and the
full typecheck passes; @tailwindcss/vite and vite-plugin-pwa already
support vite 8, and tests use node --test (not vite).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps-dev): bump recharts from 2.15.4 to 3.9.2

Bumps [recharts](https://github.com/recharts/recharts) from 2.15.4 to 3.9.2.
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v2.15.4...v3.9.2)

---
updated-dependencies:
- dependency-name: recharts
  dependency-version: 3.9.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(chart): adapt shadcn chart.tsx to recharts v3 API

recharts v3 moved active/payload/label onto TooltipContentProps and legend
payload/verticalAlign onto DefaultLegendContentProps; retype
ChartTooltipContent/ChartLegendContent and coerce the DataKey<any> React key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps): bump pino-http from 10.5.0 to 11.0.0

Bumps [pino-http](https://github.com/pinojs/pino-http) from 10.5.0 to 11.0.0.
- [Release notes](https://github.com/pinojs/pino-http/releases)
- [Commits](pinojs/pino-http@v10.5.0...v11.0.0)

---
updated-dependencies:
- dependency-name: pino-http
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(api): satisfy pino-http v11 generics in app.ts

pino-http v11 tightened its call generics so CustomLevels infers as
string, rejecting our default pino.Logger<never>. Pin the
Request/Response generics (keeps the req.id serializer valid) and let
CustomLevels fall back to its never default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps): regenerate lockfile for combined bumps; declare react-is peer

The four dependency PRs (#579, #571, #565, #572) each carried a lockfile
generated against main in isolation; combining them needs one consistent
resolve. Also declare react-is in mockup-sandbox — recharts 3 requires it
as a peer and autoInstallPeers is off.

Verified: pnpm install clean, full typecheck, workspace build, 981-test
API suite green, eslint 0 errors, pnpm audit --prod has no high findings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7

* ci: drop docker-build job duplicated by the standalone docker-build.yml workflow

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@dependabot @github

dependabot Bot commented on behalf of github Jul 10, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/vitejs/plugin-react-6.0.3 branch July 10, 2026 15:15
cloudURBANE added a commit that referenced this pull request Jul 10, 2026
* ci: bump actions/setup-node v4 -> v6 (keep pnpm caching)

setup-node v6's breaking change ("Limit automatic caching to npm",
actions/setup-node#1374) only narrows the NO-input auto-detection path so
it auto-enables caching for npm projects. An explicit `cache: pnpm` input is
still honored: v6 src/main.ts passes the input value straight to
restoreCache('pnpm', ...) without overriding it, and the v6 README still lists
pnpm (>=6.10) as a supported cache value.

All three setup-node steps in this repo already set `cache: pnpm` explicitly,
with pnpm/action-setup@v4 running first so the store path resolves. They are
therefore unaffected by the breaking change; only the action version needed to
move. No caching pattern change was required and caching is preserved.

Steps bumped:
- tests.yml (node 22)
- deploy-frontend.yml test job (node 24)
- deploy-frontend.yml deploy job (node 24)

Co-Authored-By: Claude <noreply@anthropic.com>

* build(deps): bump pnpm/action-setup from 4 to 6

Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 4 to 6.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v4...v6)

---
updated-dependencies:
- dependency-name: pnpm/action-setup
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* test: discover tests by glob so new test files can't be silently skipped

The api-server and scent-cast `test` scripts hand-enumerated every test
file; six api-server tests (including corsOrigins.test.ts, the test for
the CORS allowlist) existed on disk but never ran. Quote the glob so the
runner expands it (same pattern @workspace/db already uses).

Re-including the orphans surfaced one drifted assertion:
orientationEngine.test.ts expected the visible base exactly at
baselineOffset, but the 2px anti-clip bbox margin scales with the bottle
and intentionally seats the base a few px above — the same accepted
drift the "~88% height" test documents. Bound the assertion to that
documented behavior instead of changing live render geometry (which
would bump ORIENTATION_VERSION and invalidate cached packshots).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014cEQ87SG31DEkaacGtGtH6

* ci: lint gate, dependency scanning, Docker build check, Node 22 parity

Production-readiness F2:
- ESLint flat config scoped to api-server runtime sources with two rules
  at error: @typescript-eslint/no-floating-promises (dropped promises in
  handlers/workers are silent failures) and no-console (post-A6 pino
  regression stop). CLI/MCP entrypoints and offline verification scripts
  keep stdout deliberately. Baseline is clean — the gate starts green.
- `pnpm run lint` root script + CI step.
- CI Node 24 → 22 in tests.yml and deploy-frontend.yml to match the
  node:22-bookworm-slim runtime image and the engines field.
- Dependabot (npm weekly grouped minor/patch + github-actions) and a
  report-only `pnpm audit --prod` step; flip to blocking after triage.
- docker-build PR job (push:false, gha layer cache) gated on image-input
  paths, so Dockerfile/lockfile breakage fails at PR time, not deploy.
- PR guard requiring a lib/db/migrations/ file whenever
  lib/db/src/schema/** changes (E1 enforcement half).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014cEQ87SG31DEkaacGtGtH6

* feat(build): stamp SPA builds with VITE_GIT_SHA (web-vitals build tag)

The webVitalsTelemetry build tag lost its source when Vercel's injected
VITE_VERCEL_GIT_COMMIT_SHA went away with the CloudFront cutover; main
already reads VITE_GIT_SHA as the fallback but nothing set it. Inject
github.sha in deploy-frontend.yml builds and accept an optional ARG in
the Dockerfile (empty default keeps Railway builds unchanged).

Adapted from PR #539 (claude/production-critical-impl-odvdqt); its ECR/
App Runner deploy job was NOT carried over — docs/aws-migration/ records
the accepted architecture as S3+CloudFront for the SPA with backends
staying on Railway.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7

* build(deps): bump the minor-and-patch group across 1 directory with 48 updates

---
updated-dependencies:
- dependency-name: prettier
  dependency-version: 3.9.5
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: axios
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: sharp
  dependency-version: 0.35.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: esbuild
  dependency-version: 0.28.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-accordion"
  dependency-version: 1.2.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-alert-dialog"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-aspect-ratio"
  dependency-version: 1.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-avatar"
  dependency-version: 1.2.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-checkbox"
  dependency-version: 1.3.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-collapsible"
  dependency-version: 1.1.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-context-menu"
  dependency-version: 2.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-dialog"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-dropdown-menu"
  dependency-version: 2.1.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-hover-card"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-label"
  dependency-version: 2.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-menubar"
  dependency-version: 1.1.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-navigation-menu"
  dependency-version: 1.2.18
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-popover"
  dependency-version: 1.1.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-progress"
  dependency-version: 1.1.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-radio-group"
  dependency-version: 1.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-scroll-area"
  dependency-version: 1.2.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-select"
  dependency-version: 2.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-separator"
  dependency-version: 1.1.11
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-slider"
  dependency-version: 1.4.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-slot"
  dependency-version: 1.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-switch"
  dependency-version: 1.3.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-tabs"
  dependency-version: 1.1.17
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toast"
  dependency-version: 1.2.19
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toggle"
  dependency-version: 1.1.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-toggle-group"
  dependency-version: 1.1.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@radix-ui/react-tooltip"
  dependency-version: 1.2.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: react-hook-form
  dependency-version: 7.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-router-dom
  dependency-version: 7.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/typography"
  dependency-version: 0.5.20
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: orval
  dependency-version: 8.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pg
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/pg"
  dependency-version: 8.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/pg"
  dependency-version: 8.20.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: drizzle-kit
  dependency-version: 0.31.10
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@replit/vite-plugin-cartographer"
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tailwindcss/vite"
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@tanstack/react-query"
  dependency-version: 5.101.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: framer-motion
  dependency-version: 12.42.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: react
  dependency-version: 19.2.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: "@types/react"
  dependency-version: 19.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: tailwind-merge
  dependency-version: 3.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tailwindcss
  dependency-version: 4.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: tsx
  dependency-version: 4.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: adapt to sharp 0.35 types and esbuild 0.28 PWA target

The minor-and-patch group surfaces two breaking changes:

1. sharp 0.35 no longer exposes its namespace via a default import, so
   `sharp.Metadata` fails (TS2503). Import the Metadata type by name in
   adminBottleImageUpload.ts and packshotTrimCore.ts.

2. esbuild 0.28 (pulled in via the tsx/esbuild bumps) now refuses to
   transform the PWA service worker's destructuring for the Safari 14.0
   target — Safari 14.0 has a destructuring bug that 14.1 fixed. Bump the
   scent-cast build target safari14 -> safari14.1 (still es2020 + iOS 14).

Verified: full typecheck + both frontend builds (incl. PWA SW) pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps): bump @vitejs/plugin-react from 5.1.4 to 6.0.3

Bumps [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) from 5.1.4 to 6.0.3.
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.0.3/packages/plugin-react)

---
updated-dependencies:
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): migrate to vite 8 to satisfy @vitejs/plugin-react 6 peer

plugin-react 6.0.3 imports vite/internal and requires vite ^8.0.0; on
vite 7 the build fails with ERR_PACKAGE_PATH_NOT_EXPORTED. Bump the catalog
vite to ^8.1.4. Verified: scent-cast + mockup-sandbox both build and the
full typecheck passes; @tailwindcss/vite and vite-plugin-pwa already
support vite 8, and tests use node --test (not vite).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps-dev): bump recharts from 2.15.4 to 3.9.2

Bumps [recharts](https://github.com/recharts/recharts) from 2.15.4 to 3.9.2.
- [Release notes](https://github.com/recharts/recharts/releases)
- [Changelog](https://github.com/recharts/recharts/blob/main/CHANGELOG.md)
- [Commits](recharts/recharts@v2.15.4...v3.9.2)

---
updated-dependencies:
- dependency-name: recharts
  dependency-version: 3.9.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(chart): adapt shadcn chart.tsx to recharts v3 API

recharts v3 moved active/payload/label onto TooltipContentProps and legend
payload/verticalAlign onto DefaultLegendContentProps; retype
ChartTooltipContent/ChartLegendContent and coerce the DataKey<any> React key.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps): bump pino-http from 10.5.0 to 11.0.0

Bumps [pino-http](https://github.com/pinojs/pino-http) from 10.5.0 to 11.0.0.
- [Release notes](https://github.com/pinojs/pino-http/releases)
- [Commits](pinojs/pino-http@v10.5.0...v11.0.0)

---
updated-dependencies:
- dependency-name: pino-http
  dependency-version: 11.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix(api): satisfy pino-http v11 generics in app.ts

pino-http v11 tightened its call generics so CustomLevels infers as
string, rejecting our default pino.Logger<never>. Pin the
Request/Response generics (keeps the req.id serializer valid) and let
CustomLevels fall back to its never default.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* build(deps): regenerate lockfile for combined bumps; declare react-is peer

The four dependency PRs (#579, #571, #565, #572) each carried a lockfile
generated against main in isolation; combining them needs one consistent
resolve. Also declare react-is in mockup-sandbox — recharts 3 requires it
as a peer and autoInstallPeers is off.

Verified: pnpm install clean, full typecheck, workspace build, 981-test
API suite green, eslint 0 errors, pnpm audit --prod has no high findings.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7

* ci: drop docker-build job duplicated by the standalone docker-build.yml workflow

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L112eiWss3qDdppZUJrAw7

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Claude <noreply@anthropic.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant