build(deps): bump nginx from 54f2a90 to 4a73073 in /frontend - #82
Merged
Conversation
Bumps nginx from `54f2a90` to `4a73073`. --- updated-dependencies: - dependency-name: nginx dependency-version: alpine dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Uh oh!
There was an error while loading. Please reload this page.
WolfTasks pushed a commit
that referenced
this pull request
Jul 18, 2026
Dependency & base-image maintenance release (no functional changes), batching the merged Dependabot PRs #81, #62, #60, #59, #82: frontend libs (TipTap/lucide/Recharts/Vite, TypeScript held at 6.x), node + nginx base images (CVE digests), commons-compress 1.28.0, and CI action bumps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WolfTasks pushed a commit
that referenced
this pull request
Jul 18, 2026
…lease status Add M1 row + section for the v1.0.14 dependency/base-image maintenance release (Dependabot PRs #81/#62/#60/#59/#82; TypeScript held at 6.x). Also correct stale tracking: #13 and #15 (i18n) shipped in v1.0.13, not "noch nicht released". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
WolfTasks added a commit
that referenced
this pull request
Jul 29, 2026
…), unblock nightly scan (#103) * fix(ci): suppress non-exploitable react-router CVE to unblock nightly scan Die Nightly-Security-Scan- und Dependabot-Update-Läufe schlagen seit 2026-07-25 fehl wegen GHSA-qwww-vcr4-c8h2 (react-router 7.18.1, HIGH, CVSS 7.1). Die CVE ist eine CSRF-Lücke ausschließlich im unstable RSC-Modus (React Server Components). TaskWolf-Frontend ist eine reine Client-SPA (createBrowserRouter, kein SSR/RSC) → verwundbarer Code-Pfad ungenutzt, nicht ausnutzbar. Fix nur in react-router 8.3.0 (Major; react-router-dom in v8 aufgelöst, kein v7-Patch) → Dependabot kann nicht auto-fixen. - .trivyignore: begründete Ausnahme für GHSA-qwww-vcr4-c8h2 - Dependabot-Alert #82 dismissed (not_used) via API - v8-Migrations-Plan als Backlog dokumentiert, löst die Ausnahme später auf Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix(ci): allowlist-aware npm-audit gate for suppressed react-router CVE Der frontend-build npm-audit-Gate (`npm audit --audit-level=high`) failt ebenfalls an GHSA-qwww-vcr4-c8h2 — .trivyignore greift dort nicht, und npm audit kann einzelne Advisories nicht ausnehmen. Ersetzt durch .github/scripts/audit-gate.mjs: blockt weiterhin bei jedem nicht-allowlisteten HIGH/CRITICAL-Advisory, lässt aber die begründete Ausnahme (RSC-only, Client-SPA nicht betroffen) durch. Gleiche Policy wie .trivyignore. Negativ-getestet: leere Allowlist -> exit 1. v8-Migrations-Plan um dritten Aufräum-Ort ergänzt. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Wolfgang Kozian <kozian.wolfgang@gmail.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
WolfTasks pushed a commit
that referenced
this pull request
Sep 6, 2026
Wiki (mkdocs): - development.md: Node.js 20+ -> 22.22+ (react-router v8 build requirement) - frontend/overview.md: stack table said "React Router v6" — stale even before this migration (repo was on v7); now v8, with a note that the package is `react-router` and `react-router-dom` no longer exists. Routing section documents the lazyPage/Suspense split. - frontend/components.md: NotificationBell example imported from react-router-dom, which no longer resolves. - ai-guide.md: new "Frontend: Route Registration" pattern — a wrong export name in lazyPage type-checks and builds fine and only fails when the route is opened, so it needs to be written down. Plus two architecture decision rows (library mode over framework mode; leaf-only lazy). Backlog doc marked done with the outcome; original text kept collapsed. All three interim suppressions are resolved — the third (Dependabot alert #82) lapsed on its own when react-router-dom was removed. CHANGELOG.md deliberately untouched: it stops at 1.0.0 and GitHub release notes have carried that role since v1.0.06. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps nginx from
54f2a90to4a73073.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)