deps: go 1.27, latest go + npm deps, alpine 3.24 - #40
Merged
Conversation
go modules: all direct deps to latest (sqlite 1.53→1.57, crypto 0.53→0.55, testify 1.11→1.12, goose, image, term). go directive and toolchain 1.26→1.27 in go.mod, Dockerfiles and CI. npm: ui and e2e to latest within the framework-major holds. clears the five open dependabot PRs (#35–39) — every package they target is at or above the requested version. audit drops from 8 (6 high) to 6 low, all cookie<0.7.0 via sveltekit itself, no non-breaking fix available. node stays on 24 — still the active LTS, 26 is current but not LTS until october. alpine 3.23→3.24 in prebuild and test-mpd. typescript held at 6.0.3: svelte-check refuses TS 7 unless both 6 and 7 are installed and it runs behind --tsgo. same reason the dependabot ignore list already gives. jsdom 30 and jest-dom 7 left for a separate bump. generate-api.sh now drops the swag-generated api/spec/docs.go — it imports swaggo/swag, which is not a module dependency, so any tree with a generated client failed `go vet ./...`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
klabast
added a commit
that referenced
this pull request
Aug 28, 2026
pull_request runs the commit stage only; merge_group runs the full pipeline against trunk + the queued change (the gate); push to main runs it again and promotes. Fixes three gaps found while merging #40/#41/#42: acceptance only ran after merge, nothing tested the prospective combination, and promote was an unguarded race on :latest where last writer wins. ADR in docs/adr/0001-trunk-based-delivery-pipeline.md.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine dependency sweep. Everything green:
go build/vet/test,npm test/check/lint/buildon both stacks.what moved
go.mod, both Dockerfiles,tools/test-mpd, and CI.ui/ande2e/to latest within the existing framework-major holds.Dockerfile.prebuildandtools/test-mpd. node stays on 24: still the active LTS, 26 is current but not LTS until october.dependabot
Closes out #35–39 — every package those PRs target is now at or above the version they asked for (e.g.
brace-expansion5.0.9 vs 5.0.7).npm auditgoes 8 vulnerabilities (6 high) → 6 low; the remainder iscookie<0.7.0pulled in by sveltekit itself, and npm's only offered fix is downgrading kit to 0.0.30. Not actionable here.held back
typescriptstays at 6.0.3. svelte-check hard-errors on TS 7 unless both 6 and 7 are installed side by side and it runs behind--tsgo. That's the same coupling the dependabot ignore list already documents, so the hold stands.jsdom30 and@testing-library/jest-dom7 are unrelated majors, left for their own bump.drive-by
generate-api.shnow removes the swag-generatedapi/spec/docs.go. It importsgithub.com/swaggo/swag, which isn't a module dependency, so any tree where the API client had been generated failedgo vet ./...— item 5 of the definition of done. CI never caught it because lint and generate-api run in different jobs. Only the JSON/YAML spec is consumed downstream.🤖 Generated with Claude Code