v4.1.1

Fixed

• Repaired the dashboard SPA build, which unblocks the orchestrator container image. Dockerfile builds frontend/ in its first stage, so a frontend build failure fails the whole image and therefore azd deploy. v4.1.0 could not be built at all: building v4.0.2 exits 0, building v4.1.0 exits 1.

Three unrelated dependency bumps, all merged without any CI job that builds the frontend, broke it together:

#	Package	v4.1.0	Fixed to	Failure
1	react-dom / @types/react-dom	^18.3.1	^19.2.8 / ^19.2.5	react moved to 19 while these stayed on 18, so npm install aborted with a fatal ERESOLVE peer conflict
2	@azure/msal-react	^5.7.0	^3.0.29	that version has been unpublished from npm and now returns E404; because the Dockerfile uses npm install rather than npm ci, the lockfile did not protect the build
2	@azure/msal-browser	^3.28.1	^4.21.0	peer requirement of msal-react 3.x
3	tailwindcss	^4.3.3	^3.4.19	v4 is a migration, not a bump: it moves the PostCSS plugin to @tailwindcss/postcss and replaces the @tailwind directives with @import "tailwindcss". Neither postcss.config.js nor src/index.css was migrated, so vite build failed

@azure/msal-react@3.0.29 is the newest major that accepts React 19 and still exposes navigateToLoginRequestUrl and storeAuthStateInCookie, both removed in 5.x and both used by src/lib/auth.ts. navigateToLoginRequestUrl: false is deliberate, so keeping it means this fix required no application-code change. There is no major 4.

• Regenerated frontend/package-lock.json with npm install --package-lock-only so it retains every platform-specific optional dependency. A lockfile written by a full npm install on Windows prunes them: an earlier attempt at this fix shipped a lock holding 2 of the expected 25 @rollup/rollup-* entries, which passed tsc -b locally and only failed on the Linux runner with Cannot find module @rollup/rollup-linux-x64-gnu. The published lock has 25 @rollup/* and 12 @swc/core-* entries.

Added

• A frontend build job in .github/workflows/pr_pipeline.yaml. The frontend had no CI coverage whatsoever, which is the root cause of all three regressions reaching a tagged release. It proved itself immediately by catching the pruned lockfile described above.

Validation

• npm install and npm run build both exit 0 against the published frontend/package.json and lockfile.
• frontend build, tests, and license/cla all green on #344 before merge; block-pr, CodeQL, and all three Analyze jobs green on #345.

Upgrade note

GPT-RAG v3.8.0 pins this component at the unbuildable v4.1.0. Use the umbrella v3.8.1 release, which repins manifest.json to v4.1.1.