From ef6489549b990864c59a720f2ba5b25f5caaa4f1 Mon Sep 17 00:00:00 2001 From: b0txec Date: Fri, 21 Aug 2026 22:18:33 +0300 Subject: [PATCH] Document frontend dependency maintenance --- docs/DEVELOPMENT_AND_STAGING.md | 12 ++++++++++++ docs/README.md | 1 + docs/UPDATE_ROADMAP.md | 15 +++++++++------ 3 files changed, 22 insertions(+), 6 deletions(-) diff --git a/docs/DEVELOPMENT_AND_STAGING.md b/docs/DEVELOPMENT_AND_STAGING.md index 8a2b7c8..37414de 100644 --- a/docs/DEVELOPMENT_AND_STAGING.md +++ b/docs/DEVELOPMENT_AND_STAGING.md @@ -101,6 +101,18 @@ At minimum, verify: 8. Ūdens temperatūra accepts all six manual ranges and exports both 1920×1080 and 3840×1440 PNGs. 9. Browser developer tools show no new runtime errors. +For frontend dependency maintenance, validate the committed lockfile from a clean install rather than relying on an already-mutated `node_modules` tree: + +```bash +docker compose run --rm --no-deps node npm ci +docker compose run --rm --no-deps node npm run typecheck +docker compose run --rm --no-deps node npm run build +docker compose run --rm --no-deps node npm audit +docker compose run --rm --no-deps node npm audit --omit=dev +``` + +At commit `de6f279`, all five checks pass and both audit scopes report zero known vulnerabilities. The npm major-version availability notice is informational and does not require changing the npm version independently of the pinned Node build image. + Known limitation: direct browser refreshes on newer client-side routes such as `/faktiska` can return 404 because the backend static-route list does not yet provide a general SPA fallback. Navigate from the home page until that backend behavior is fixed. ## Rollback diff --git a/docs/README.md b/docs/README.md index 5415ddf..88660c8 100644 --- a/docs/README.md +++ b/docs/README.md @@ -20,6 +20,7 @@ This directory contains the working documentation for the WeatherTool modernizat - Approved 1920×1080 and 3840×1440 PNG production bases are now the rendering source for Faktiskā and Ūdens temperatūra; code draws only the changing values, selected weather symbols, and wind data over those fixed newsroom graphics. - Browser branding assets and Latvian Open Graph/Twitter metadata are included for favicon, Apple home-screen icon, and link-preview support. Public crawler access still depends on the Nginx/Authelia policy used for the metadata and preview image. - Browser verification of release `16a8c68` confirmed both fixed-map workspaces and the favicon. The shared UAT login is ready for the first newsroom-user handoff on 2026-08-21. +- Frontend dependency maintenance is complete through commit `de6f279`: Solid runtime and Vite tooling were updated, obsolete packages were removed, TypeScript checking was added, and a clean Rocky `npm ci`, typecheck, production build, full audit, and production-only audit all pass with zero known vulnerabilities. These commits are newer than the currently deployed VPS release `16a8c68`. - This is not yet approved or hardened for workplace production. ## Documents diff --git a/docs/UPDATE_ROADMAP.md b/docs/UPDATE_ROADMAP.md index e40a341..aa83594 100644 --- a/docs/UPDATE_ROADMAP.md +++ b/docs/UPDATE_ROADMAP.md @@ -63,15 +63,17 @@ Status: in progress ## Phase 3 — Dependency modernization -Status: pending +Status: in progress — frontend maintenance complete; backend maintenance pending -The first observed frontend install reported 15 vulnerabilities: 1 critical, 10 high, 3 moderate, and 1 low. Exact advisories must be reviewed before choosing upgrades. +The first observed frontend install reported 15 vulnerabilities: 1 critical, 10 high, 3 moderate, and 1 low. The frontend dependency tree was reviewed in controlled groups, obsolete packages were removed, and both the complete and production-only npm audits now report zero known vulnerabilities at commit `de6f279`. -- [ ] Capture and review the full npm audit report. +- [x] Capture and review the full npm audit report. - [x] Establish that the production dependency audit is primarily blocked by `solid-js@1.9.4` resolving vulnerable `seroval@1.2.0`; confirm that the full audit also contains development-tool advisories. -- [ ] Update direct frontend dependencies in controlled groups. -- [ ] Replace or remove obsolete frontend packages where appropriate. -- [ ] Rebuild and visually compare every page after frontend upgrades. +- [x] Update direct frontend dependencies in controlled groups. +- [x] Replace or remove obsolete frontend packages where appropriate. +- [x] Add a committed TypeScript typecheck command and validate the updated frontend with a clean `npm ci`, typecheck, and production build. +- [x] Resolve the remaining transitive build-tool advisories after reviewing the proposed `npm audit fix` changes; verify full and production-only audits at zero. +- [ ] Rebuild, deploy, and visually compare every page in a commit-addressed VPS release containing `de6f279` or later. (Rocky clean-install build verification is complete.) - [ ] Update Scala within the supported 2.13 line before considering larger migration. - [ ] Update http4s, Doobie, Circe, Cats Effect, Logback, and test libraries in compatible groups. - [ ] Replace release-candidate dependencies with stable releases where possible. @@ -188,3 +190,4 @@ Record completed work here by date and commit after the Git workflow is establis | 2026-08-19 | `0d641bd` | Replace runtime Daira glyph rendering with normalized transparent image assets | Yes | | 2026-08-20 | `754415a` | Match editable title/source overlays to production-safe right margins | Yes | | 2026-08-20 | `16a8c68` | Deploy approved production map bases, normalized branding assets, favicon, Apple icon, and social metadata to public UAT | Yes — Rocky build and VPS/browser smoke checks | +| 2026-08-21 | `5007517`–`de6f279` | Update Solid runtime and frontend build tooling, add type checking, remove obsolete packages, prune the lockfile, and resolve all npm advisories | Yes — clean `npm ci`, typecheck, production build, full audit, and production-only audit |