🔧 chore(sync): forward-port main (rc.3→rc.5) into dev/v1.6#588
Merged
Conversation
Promotes the v1.6.0-rc.3 content from `dev/v1.6` to `main` for the release cut. rc.3 delta over rc.2: - **#566 display-honesty batch** — update-status vocabulary ("Digest update", Unknown badge, "Security hold"), pin glyph driven by the real pin-gate verdict (`tagPinGated`), insight-only pinned rows read Current everywhere (table + detail panel), one-clock maturity panel, column-picker auto-hide annotations, registries deep-link fix (#556), banner pluralization, tooltip freshness. - **#567 security hardening** — anonymous auth fails closed on upgrades, HTTP trigger SSRF guards, full WebSocket origin validation, `drydock.sid` session cookie, owner-only store perms, pinned icon CDN revisions, CI secret scans. - **#568 maturity-clock restart fix** (#565) — the soak clock restarts only when the update candidate identity changes. - **#569 docs freshness** — auth/SSRF/WS/UI copy corrected to shipped v1.6 behavior. - **#571 release identity bump** — dated CHANGELOG heading, rc.3 across all public version surfaces, guard tests in lockstep. After merge: dispatch `release-cut.yml` from `main` with `release_tag=v1.6.0-rc.3`.
## Summary - pin `fast-uri` 3.1.4 in app and UI for CVE-2026-16221 - pin `fast-xml-parser` 5.10.1 in app for GHSA-8r6m-32jq-jx6q - override the Next.js transitive `sharp` dependency to 0.35.3 for GHSA-f88m-g3jw-g9cj - add lockfile regression coverage and record the refresh in the rc.3 changelog ## Why The approved rc.3 tree passed PR CI, but the GitHub Advisory Database updated before the post-merge `main` run completed. Qlty then correctly blocked the release on these three newly recognized advisories. The release workflow was canceled before any publication side effects. This combined PR supersedes the incomplete single-package Renovate PRs #577 and #578; neither can pass the all-plugin Qlty gate independently. ## Validation - Qlty all-plugin gate: pass - npm audit, app/UI/website production trees: 0 vulnerabilities - backend: 392 files, 12,288 tests, 100% coverage - UI: 213 files, 4,273 tests, 100% coverage - website: 44 script tests, typecheck, 348-page production build - root scripts: 111 tests - workflow policy: 40 tests - pre-push repository gate: pass - rc.3 precheck: pass with five informational discussion-reply reminders <!-- This is an auto-generated comment: release notes by coderabbit.ai --> 🔒 **Security** - Pin `fast-uri` to `3.1.4` in `app` and `ui` for CVE-2026-16221. - Pin `fast-xml-parser` to `5.10.1` in `app` (via `dependencies` + `overrides`) for GHSA-8r6m-32jq-jx6q. - Override Next.js transitive `sharp` to `0.35.3` in `apps/web` for GHSA-f88m-g3jw-g9cj. ✨ **Added** - Add `scripts/security-dependency-versions.test.mjs` to regression-test that: - workspace manifests include the expected pins/overrides, - `package-lock.json` resolved versions are semver-equal-or-greater than the patched targets, - `CHANGELOG.md` `## [1.6.0-rc.3]` contains the expected CVE/GHSA identifiers and patched-version statements. 🔧 **Changed** - Update `app/package.json` to pin/override `fast-uri@3.1.4` and `fast-xml-parser@5.10.1`. - Update `ui/package.json` to override `fast-uri@3.1.4`. - Update `apps/web/package.json` to override `sharp@0.35.3`. - Record the security dependency refresh in `CHANGELOG.md` under `## [1.6.0-rc.3]`. - Supersede prior Renovate updates. - Confirm the previously canceled release workflow / post-merge advisory failure no longer blocks publication. - Verify all listed CI/validation gates remain passing (Qlty, audit, test, coverage, build, typecheck, workflow policy, pre-push, rc.3 precheck). <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary - render pinned newer-version insights as informational Major, Minor, or Patch states without exposing update actions - rename same-tag digest changes to Image update and explain the redeploy behavior - keep Host visible ahead of secondary Software Version metadata at constrained widths - add browser-managed container group overrides with preference migration, sync, and Docker-derived fallback - update current docs, changelog, translations fallback behavior, and v1.6 E2E coverage ## Verification - 4,286 UI tests across 213 files with 100% coverage - backend coverage gate at 100% - full pre-push lint, typecheck, workflow, script, app build, and UI build gates passed - Playwright Host regression passed at 1197px - direct visual QA passed for desktop status and layout, explanatory tooltip, grouping set/clear flow, dark mode, and 390x844 DPR3 touch/mobile with zero horizontal overflow Closes #498 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog 🐛 **Fixed** - Render pinned newer-version insights as informational Major/Minor/Patch via the `insight` update status (no update CTA/actions for digest-only comparisons). - Ensure pinned-tag panels use the `insight` state (info tone + pinned summary) instead of incorrectly showing **Up to date**. - Correct “same-tag digest changes” UX by renaming digest-only updates to **Image update** and aligning pinned tooltip/title + compact/table/card expectations. 🔧 **Changed** - Renamed same-tag digest rebuild messaging across UI + docs + i18n from **Digest update** → **Image update** (including tooltips and plain-English fallback label). - Updated grouped views rendering to treat `container.updateInsight` as the primary source for update label/color, with digest-kind special-casing for image-update tooltip behavior. - Improved constrained-width layout behavior: keep **Host** visible before hiding **Software Version**, and updated column metadata/priorities (Version → Software Version, priority adjustments). - Added container grouping UI flow: - New “Set group” action opens `ContainerGroupDialog`. - `containers.manualGroups` manual overrides are prioritized over detected/Docker grouping. - Clearing/flattening behavior respects manual overrides vs stack-derived grouping rules. - Extended preferences schema to schemaVersion **12**: - Added/sanitized `containers.manualGroups: Record<identityKey, groupName>` - Added migration + normalization (trim, drop empty keys/names, reject malformed non-record payloads). - Updated docs to reflect server-derived container groups vs browser/manual overrides, clarified watcher pin-info informational insights vs actionable updates, and adjusted update-eligibility “no-update-available” semantics. - Updated locale files to remove `dashboardView.updateKind.digest` and add/adjust image-update strings. ✨ **Added** - `ContainerGroupDialog` Vue component (modal with save/clear, trimming/normalization, and suggestion support). - Playwright coverage updates for mobile emulation pre-checks and expanded `#498` scenarios (including digest-level test data, pinned tooltip/title checks, Host-vs-Software-Version responsive assertions). - Unit/UI test coverage for `#498` pinned insight state, image-update labeling, grouped view `updateInsight` sourcing, and container grouping dialog + preference trimming behavior. - Documentation/changelog updates for pinned freshness, image-update redeploy messaging, and constrained-width Containers layout. ## Concerns / Issues to Address - Confirm all removed `digest` locale keys (UI + any translation fallback paths) are fully covered so runtime never shows missing-key placeholders. - Verify informational `updateInsight` paths never enable update CTAs/actions across all update-eligibility flows and panel variants. - Ensure manual group override precedence and “single-container group flattening” match intended Docker/Compose-derived grouping behavior in all responsive and grouped-view scenarios. - Validate `containers.manualGroups` migration/sanitization + sync across devices preserves valid overrides and correctly clears back to server/Docker grouping. - Double-check responsive column-hide ordering at laptop/mobile breakpoints to ensure **Host** stays visible before **Software Version** is hidden. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary - Audit all 761 retained CI Verify runs and every rerun history, classifying all 30 Cucumber failures by root cause. - Reuse the exact QA image from the build gate; remove redundant app/browser bootstrap and blanket scenario retries from Cucumber. - Gate readiness on a checked six-fixture manifest, restore scenario-mutated state, and publish structured reports plus failure diagnostics. - Keep browser rendering in Playwright with direct-route coverage and first-failure traces, screenshots, video, and logs—without whole-test retries. - Fix the targeted watch endpoint stale-object bug exposed by the health-transition test. - Give only the ephemeral QA stack explicit API/icon traffic budgets and make remote fixture seeding bounded-retry and fail-closed. ## Verification - 123/123 repository script tests - 45/45 workflow invariant tests - 13/13 Cucumber support tests - Cucumber dry-run: 50 scenarios, 402 steps - Docker-backed Cucumber: 50/50 scenarios, 402/402 steps - Playwright discovery: 33 tests across 12 files - Targeted full-stack Playwright #198: 2/2 tests with the pinned CI browser image - Full pre-push gate: 100% app/UI coverage, builds, type-checking, Biome, Qlty, and secret checks The historical evidence, failure taxonomy, reliability policy, and follow-up threshold are in [docs/cucumber-reliability.md](https://github.com/CodesWhat/drydock/blob/fix/cucumber-reliability/docs/cucumber-reliability.md). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - ✨ Added manifest-based Cucumber fixture readiness checks with exact missing-field diagnostics (via `scripts/start-drydock.sh` + `e2e/config/cucumber-core-fixtures.txt`). - ✨ Added Drydock reliability audit + reliability policy documentation (`docs/cucumber-reliability.md`) based on retained CI Verify runs. - ✨ Added Cucumber state snapshot/restore support for mutable domains (container, settings, notification rules) via `@restores_container_state` / `@restores_settings_state` / `@restores_notification_state`. - ✨ Added Node test coverage for state restoration behavior + API request timeout/abort semantics (`e2e/tests/state-restoration.test.js` + supporting runner/tests). - ✨ Added structured Cucumber reporting + enriched failure/cancellation diagnostics/artifact uploads (JSON/JUnit/HTML + expanded diagnostics on failure/cancel). - ✨ Added Playwright direct-route rendering coverage using `main[data-route-name]` (and updated layout/unit tests accordingly). - ✨ Added Playwright health-preference improvement to actively refresh fixture health until the expected state is observed. - ✨ Added QA Compose + release-gate robustness improvements: explicit traffic budgets, hardened remote bootstrap image pull/retry/save/load, and improved `health-transition` unhealthy detection. - ✨ Added CI workflow invariants/tests for Cucumber browser-free execution and SHA-specific release-gate gating (release source SHA + fixed `e2e-playwright.yml` workflow file). - 🔧 Changed `ci-verify` to run Cucumber browser-free: use a QA-provisioned Drydock image artifact (no pinned Playwright Docker image; no `docker run` for Cucumber). - 🔧 Changed `ci-verify` dependency installation to use bounded retries (`nick-fields/retry`) only around dependency install/setup steps (not blanket scenario retries). - 🔧 Changed Drydock startup to parameterize the prebuilt image via `DD_E2E_IMAGE`, support build-skipping with image existence checks, and gate readiness via fixture identity + required image metadata fields. - 🐛 Fixed a stale-object bug in the targeted watch endpoint by refreshing containers from `getContainers()` before calling `watchContainer`. - 🔧 Changed watcher/failure behavior by ensuring diagnostics collection is conditional and includes per-container fixture state/logs + health/containers API outputs. - 🔧 Changed fixture contracts/data to align with readiness expectations (e.g., `cucumber-core-fixtures.txt` adds core fixtures; `/api/v1/containers` minimum length updated; v1.4 scenarios tagged for state restoration). - 🔧 Changed release gating to require “successful Playwright on release source SHA” using the exact configured workflow file (`e2e-playwright.yml`). - 🗑️ Removed the Cucumber UI step-definition wiring (`e2e/features/step_definitions/ui.js`) and eliminated prior blanket `--retry 1` scenario behavior. - 🐛 Fixed Cucumber reliability by removing browser navigation/text assertions from Cucumber and strengthening setup/diagnostics so failures are attributable. - 🔒 Security: added tests asserting `start-drydock.sh` readiness logic doesn’t embed PEM-shaped private-key material (and uses safe dummy/private-key templating paths). ## Concerns - Verify `docs/cucumber-reliability.md` statistics/taxonomy/policy claims still match the intended retained CI Verify dataset and lenses. - Confirm `scripts/start-drydock.sh` readiness checks (default manifest + required image metadata fields like `image.registry.url` / `image.tag.value`) remain aligned with the currently active Cucumber fixture contracts. - Validate the state-restoration capture/restore targets (`hub_nginx_120`, notification rule `update-available`) and whitelisted mutable fields still match the current API shape for all scenarios using `@restores_*`. - Ensure workflow invariant tests (`ci-verify-workflow.test.ts`, `release-cut-retry-workflow.test.ts`) match actual step names/conditions and diagnostics/artifact paths (e.g., `e2e/reports`). - Double-check the “no fail-open” behavior of remote fixture seeding: remote-bootstrap pull/save/load should hard-fail when retries exhaust, rather than allowing partially-bootstrapped runs. - Confirm Playwright retries are intentionally disabled (`retries: 0`) and CI trace retention is sufficient to diagnose single amplified failures. - Validate traffic-budget expectations and env plumbing: `DD_SERVER_RATELIMIT_MAX=10000` and `DD_ICON_PROXY_RATE_LIMIT_MAX=1000` should be applied only to the intended ephemeral/QA release-gate stack. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary Prepare **v1.6.0-rc.4** from the latest `main`. rc.4 delta over rc.3: - **#580 issue #498 visual follow-ups** - informational pinned Major/Minor/Patch states, "Image update" vocabulary and explanation, Host-first constrained layout, explicit Software Version metadata, browser-managed grouping, docs, regression coverage, and desktop/mobile visual QA. - **#581 Cucumber reliability** - complete retained-run audit, exact build-artifact reuse, six-fixture readiness manifest, scenario state restoration, structured reports/diagnostics, no blanket Cucumber/Playwright retries, fail-closed remote fixture seeding, and the targeted health-refresh product/race fixes. - Release identity advanced across the changelog, README, website/demo, current docs, API examples, quickstart, and guard tests. ## Verification - 123/123 repository script tests - 45/45 workflow invariant tests - 44/44 website script tests - Full pre-push gate: 100% app/UI coverage, type-check, Biome, Qlty, and app/UI builds - Local prerelease precheck completed; its five unchecked "shipped in v1.6.0" Discussion follow-ups remain GA closeout actions and are not RC blockers After merge: verify exact-`main` CI Verify and Playwright, then dispatch `release-cut.yml` with `release_tag=v1.6.0-rc.4`. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog ### 🔧 Changed - Prepared release identity for `v1.6.0-rc.4` across README, website/demo mocks, API documentation, Portwing examples, quickstart materials, and release updates. - Updated changelog comparison links and release identity guard tests for `v1.6.0-rc.4`. - Added release-gated Cucumber E2E failure-reporting highlights to the updates page. ## Concerns - Verify exact CI Verify and Playwright workflows after merge. - Post the five tracked Discussion replies against the published release candidate. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary - let people hide the Containers table’s Resources column while keeping it visible by default - move Source, Release Notes, and Registry shortcuts into the row’s More menu whenever the column is hidden - keep card footers as the single resource-action surface in card and forced-reflow modes - preserve current-schema choices and keep Resources visible once for legacy column migrations - document the behavior and add unit plus real-browser regression coverage for #498 ## Verification - 4,293 UI tests across 213 files with 100% statement, branch, function, and line coverage - app coverage gate at 100% - full pre-push formatter, quality, script, workflow, typecheck, coverage, app build, and UI build gates passed - seven-test #498 Playwright spec passed against the packaged QA app - visual QA passed at the reporter’s exact 1197px viewport and at 390×844 mobile, with all three resource shortcuts preserved and no horizontal overflow Addresses the remaining Resources-column feedback in #498. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Changelog - ✨ Added deterministic Playwright regression for `#498` covering Resources-column hiding and ensuring row/card “More” menu resource shortcuts remain correct (including exact `data-test` ordering). - ✨ Added per-container “Resources” quick-links into the row More menu when the Resources column is hidden. - ✨ Added unit coverage for resource shortcut rendering and non-duplication across table vs Cards view (including forced card reflow). - 🔧 Made the Containers “links/Resources” column user-hideable while keeping it visible by default. - 🔧 Updated column visibility/composable defaults and responsive auto-hide expectations to match new “required/default-visible” semantics. - 🔧 Updated legacy `dd-table-cols-v1` migration to preserve “links/Resources” when already present, otherwise append it once for older users. - 🐛 Fixed duplicate resource actions in card More menus by conditionally rendering resource sections only when appropriate. - 🔧 Documented/validated the updated Resources-column behavior via tests. ## Concerns - Verify the More-menu shortcut ordering stays stable across grouped and responsive layouts. - Confirm migration behavior across all legacy preference payload variants (especially when `links/Resources` is already present vs missing). - Ensure resource shortcuts are omitted when a container has no resource data (to avoid empty/irrelevant quick-links). <!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary Prepare **v1.6.0-rc.5** from the latest `main`. rc.5 delta over rc.4: - **#583 issue #498 Resources follow-up** — Resources remains visible by default but is now user-hideable and persistent; Source, Release Notes, and Registry remain reachable from each table row's More menu, while cards keep the same links in their footer without duplication. Covered at the reporter's exact 1197px laptop width and at 390px mobile. - **Website security refresh** — Next.js 16.2.9 → 16.2.11 and React/React DOM 19.2.7 → 19.2.8 after nine newly disclosed Next.js advisories blocked the local Qlty gate. Added a pinned-version regression guard and rc.5 security notes. - **Release identity** — advanced the changelog, README, website/demo, current docs, API examples, quickstart, and release guard tests to rc.5. ## Verification - 125/125 repository script tests - 45/45 workflow invariant tests - 44/44 website script tests - `npm audit`: 0 vulnerabilities in the website workspace - Website production build: 348 pages generated on Next.js 16.2.11 - Live development smoke: homepage and `/docs/v1.6/updates` both returned 200 with rc.5 content present - Full pre-push gate: 100% app/UI coverage, type-check, Biome, Qlty, and app/UI builds - Local prerelease precheck completed; its five unchecked “shipped in v1.6.0” Discussion follow-ups remain GA closeout actions and are not RC blockers After merge: verify exact-`main` CI Verify and Playwright, then dispatch `release-cut.yml` with `release_tag=v1.6.0-rc.5`.
#586) Folds today's outstanding fixes into the staged-but-uncut v1.6.0-rc.5 tree so the soak covers them. - fix(ui) #498: Dashboard re-syncs the active widget layout when crossing into a single-column breakpoint (widgets stop spilling past the viewport); DataTable single-column card mode uses `auto` grid rows instead of `1fr` (no empty band below reflowed cards); the Containers group header truncates long stack names and pins the update-all button so it stops getting clipped off-screen. - fix(ui): `parseCardMinWidthPx` resolves `rem`/`em` against the live computed root font size instead of a hardcoded 16px, since `--dd-font-size` scales the document root (0.8–1.3 presets), so the row-mode heuristic matches the browser's `minmax()` layout at every font-size preset. - chore(ci): SHA-pinned bumps — `github/codeql-action` v4.36.2→v4.36.3 and `actions/cache` v5.0.5→v5.1.0, plus the pin fixture sync in `.github/tests/github-action-pins.ts`. - security(web): `postcss` build-dependency override → 8.5.22, closing CVE-2026-45623 (GHSA-6g55-p6wh-862q), a pre-existing repo-wide osv-scanner finding that was failing every push off main. - docs: entries under the existing `[1.6.0-rc.5]` heading, dated to the actual cut day (2026-07-23), plus a #498 mobile-fix bullet on the updates page. Refs #498.
Settles the main↔dev/v1.6 divergence. main carried the rc.3/rc.4/rc.5 cuts plus #579/#580/#581/#583/#586, while dev/v1.6 was left holding superseded #566-era UI. Verified lossless before merging — main is a strict superset of dev/v1.6: - Three-way merge-base analysis over all 112 differing paths found 0 files where dev/v1.6 advanced and main did not. - All 14 dev-side rc.3 CHANGELOG bullets are already present on main under the identical [1.6.0-rc.3] heading. - e2e/features/step_definitions/ui.js exists only on dev because #581 deleted it deliberately during the Cucumber hardening. - The 16 non-English dashboardView.updateKind.digest keys were removed deliberately by #580 alongside the EN "Digest" → "Image update" rename, so the runtime falls back to the current wording until Crowdin re-translates. Carrying dev's pre-rename values forward would have undone that fix. - The remaining conflicts were stale rc.3 version strings and the #566 update-status vocabulary that #580 superseded. Every conflict resolved to main. The resulting tree is byte-identical to origin/main (tree 6dd9fc1).
scttbnsn
requested review from
ALARGECOMPANY and
biggest-littlest
as code owners
July 24, 2026 12:01
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
Important Review skippedToo many files! This PR contains 107 files, which is 7 over the limit of 100. To get a review, narrow the scope: Upgrade to a paid plan to raise the limit. This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (108)
You can disable this status message by setting the ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Settles the
main↔dev/v1.6divergence.mainhad pulled 8 commits ahead (rc.3/rc.4/rc.5 plus #579/#580/#581/#583/#586) whiledev/v1.6still held the superseded #566-era UI — 112 files apart.This is a merge, not a cherry-pick, so
mainbecomes a true ancestor ofdev/v1.6and the drift can't hide again.Verified lossless before merging
mainis a strict superset ofdev/v1.6. Checks run:[1.6.0-rc.3]heading.e2e/features/step_definitions/ui.jsis dev-only because 🧪 test(ci): harden Cucumber reliability #581 deleted it during the Cucumber hardening (blob unchanged on dev since v1.5.0-rc.20).dashboardView.updateKind.digestkeys were removed deliberately by 🐛 fix(ui): resolve #498 visual follow-ups #580, alongside the EN"Digest"→"Image update"rename, so the runtime falls back to current wording until Crowdin re-translates. Carrying dev's pre-rename values forward would have undone that fix.content/docs/current/configuration/ui/index.mdx— main has dev's paragraph plus an extra sentence.rc.3version strings (demo mocks, web config, docs API examples, README badge, identity tests) and ✨ feat(ui): display-honesty batch — update-status vocabulary, pin glyph, one-clock maturity panel #566 update-status vocabulary that 🐛 fix(ui): resolve #498 visual follow-ups #580 superseded. Every one resolved to main.Result
Tree is byte-identical to
origin/main(6dd9fc187e556da328f718980802acf6b7471094), andgit merge-base --is-ancestor origin/main HEADnow passes.Follow-ups (not in this PR)
"Image update"for the 16 locales, covering bothdashboardView.updateKind.digestandcontainerComponents.listContent.digest(the latter is missing on both branches — pre-existing gap).git merge-base --is-ancestor origin/main origin/dev/vX.Y, so a direct-to-main commit fails loudly in the same run instead of drifting for weeks.