Full `uv lock --upgrade` and `pnpm update --latest`.
Python: curl-cffi 0.15 -> 0.16.3, python-socketio 5.16 -> 5.17, anyio,
multidict, urllib3, websockets, yarl and the pylint/isort dev chain. yt-dlp and
aiohttp were already current.
Frontend: Angular 22.1.2 -> 22.1.6 (build/cli 22.1.8), angular-eslint 22.5.0,
typescript-eslint 8.70.0, eslint 10, jsdom 30, plus three runtime majors --
@ng-select/ng-select 24, @fortawesome/angular-fontawesome 5 and zone.js 0.16.
Two upgrades are deliberately held back, both pinned by @angular/build's peer
ranges rather than by anything of ours:
* typescript stays on 6.0.x (peer `>=6.0 <6.1`). 7.0.2 breaks the build
outright -- @angular/compiler-cli's readConfiguration throws on it.
* vitest stays on 4.x (peer `^4.0.8`), which is also what the Angular unit-test
builder is written against. 4.1.11 carries the @vitest/mocker fix, so this
costs no coverage -- it is what dependabot's #1076 should have proposed.
`pnpm audit` is clean afterwards, which clears all nine open alerts (fast-uri,
js-yaml, hono, vitest) without touching the runtime image either way: the
Dockerfile only copies `dist` out of the builder stage.
Verified with the backend suite, `pnpm run lint`, `ng test`, a production
`pnpm run build`, and by running the app: icons, the collapsible sections, the
ng-select preset dropdown, and a queued item arriving over the websocket all
behave.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Routine `pnpm upgrade`. Angular 22.0.6 -> 22.1.2 across the runtime packages
and 22.0.7 -> 22.1.4 for the build toolchain, ng-select 23.2 -> 23.11.
This also clears every open npm Dependabot alert. All fifteen were build
toolchain transitives that never reach the runtime image, since the Dockerfile
builds the UI in a separate stage and copies only dist: hono 4.13.2, esbuild
0.28.2, postcss 8.5.26, js-yaml 4.3.1, fast-uri 3.1.5, ip-address 10.5.0, with
undici and @hono/node-server no longer in the tree at all.
Build, lint and both suites pass (44 frontend, 372 backend).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
corepack prepare pnpm --activate without a version was resolving to
12.0.0-alpha.0 (broken pre-release), causing the dockerhub-build-push
job to fail. Adding packageManager field pins it to a stable release.
- Extract map reference to local variable before iteration
- Change from forEach to for-of loop for better error handling
- Add null check on map before iterating
- Add @popperjs/core peer dependency for ng-bootstrap
- Update .gitignore to exclude package-lock.json
Co-authored-by: alexta69 <7450369+alexta69@users.noreply.github.com>
Alex Shnitman