chore(deps): bump the console-production group in /console with 6 updates by dependabot[bot] · Pull Request #10 · DavidHLP/UltiCode

dependabot · 2026-04-18T05:27:06Z

Bumps the console-production group in /console with 6 updates:

Package	From	To
@internationalized/date	`3.12.0`	`3.12.1`
@tanstack/vue-virtual	`3.13.23`	`3.13.24`
axios	`1.14.0`	`1.15.0`
dompurify	`3.3.3`	`3.4.0`
monaco-editor	`0.52.2`	`0.55.1`
reka-ui	`2.9.5`	`2.9.6`

Updates @internationalized/date from 3.12.0 to 3.12.1

Release notes

Sourced from @internationalized/date's releases.

React Spectrum S2 v1.3.0

In this release we are excited to announce support for expandable rows in TableView, highlight selection in TreeView, and window scrolling in collection components! Window scrolling enables virtualized collections to automatically scroll with the rest of the page – no height needed. In addition, we've updated the set of available workflow icons, and reduced the number of dependencies installed when using S2 by over 90% – see the full release notes for details.

To help assist with migrations from S1 to S2, we've added a new end to end migration Agent skill that you can use with your agent of choice. Our existing S2 Agent skill has also been updated to greatly improve its ability to select the proper S2 component to use from context, so be sure to update.

Full release notes

React Spectrum S2 v1.2.0

In this release, we are excited to announce that ListView and unavailable menu items are now available! In addition, we have added ActionBar support for TreeView and custom renderer support for the Picker's display value. We also shipped multiple TableView fixes and a set of documentation improvements including a Typography search view now available in the main search menu.

Thanks to all of our contributors for the updates in this release.

Full release notes

React Spectrum S2 v1.1.0

It’s our first release of the new year and we’ve got plenty of exciting treats we’re bringing to the table. We’ve added a variety of new features to our documentation site including a new dark/light mode switch in the site header. Our search menu also now features a Colors section where you can browse the Spectrum-defined colors and search by name or hex value to find close or exact matches. We also now offer our docs in the form of Agent Skills that can be installed locally and used by your favorite AI coding tools.

This release also includes several bugs fixes, such as properly rendering menus when rendered from within a popover and updates to TreeView disabledBehavior styling to match the latest designs.

Full Release Notes

Commits

ca74817 Publish
2d2cc15 fix: prevent items from getting continually loaded in S2 TreeView (#9921)
beda778 fix: broken compound selector exposed by browserslist bump (Table virtualizer...
c7c4c67 fix: v3 docs build (#9919)
efc581c fix: nightly packing too many files (#9917)
5c5bda5 docs: improve S2 agent skill (#9908)
988c120 docs: Update RangeCalendar for api consitency, add docs for nonce, and TagGro...
21c4dfb chore: Revert 9875 and move disabledBehavior example in TableView docs (#9914)
9e18b4a chore: fix S2 datepicker errorMessage type (#9909)
b65a4aa Revert "fix: make aria test utils helpers work with vitest-browser-react (#97...
Additional commits viewable in compare view

Updates @tanstack/vue-virtual from 3.13.23 to 3.13.24

Release notes

Sourced from @tanstack/vue-virtual's releases.

@tanstack/vue-virtual@3.13.24

Patch Changes

Updated dependencies [97a204d]:

@tanstack/virtual-core@3.14.0

Changelog

Sourced from @tanstack/vue-virtual's changelog.

3.13.24

Patch Changes

Updated dependencies [97a204d]:

@tanstack/virtual-core@3.14.0

Commits

c3d4cd4 ci: Version Packages (#1157)
See full diff in compare view

Updates axios from 1.14.0 to 1.15.0

Release notes

Sourced from axios's releases.

v1.15.0

This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.

⚠️ Important Changes

Deprecation: url.parse() usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)

🔒 Security Fixes

Proxy Handling: Fixed a no_proxy hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)

Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)

🚀 New Features

Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)

🔧 Maintenance & Chores

CI Security: Hardened workflow permissions to least privilege, added the zizmor security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)

Dependencies: Bumped serialize-javascript, handlebars, picomatch, vite, and denoland/setup-deno to latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)

Documentation: Unified docs, improved beforeRedirect credential leakage example, clarified withCredentials/withXSRFToken behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)

Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)

Tests: Added regression coverage for urlencoded Content-Type casing. (#10573)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

@raashish1601 (#10573)

@Kilros0817 (#10625)

@ashstrc (#10624)

@Abhi3975 (#10589)

@theamodhshetty (#7452)

Changelog

Sourced from axios's changelog.

v1.15.0 — April 7, 2026

This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.

🔒 Security Fixes

Header Injection (CRLF): Rejects any header value containing \r or \n characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw "Invalid character in header content". (#10660)

SSRF via no_proxy Bypass: Introduces a shouldBypassProxy helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating no_proxy/NO_PROXY rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (#10661)

🚀 New Features

Deno & Bun Runtime Support: Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (#10652)

🐛 Bug Fixes

Node.js v22 Compatibility: Replaced deprecated url.parse() calls with the WHATWG URL/URLSearchParams API across examples, sandbox, and tests, eliminating DEP0169 deprecation warnings on Node.js v22+. (#10625)

🔧 Maintenance & Chores

CI Security Hardening: Added zizmor GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived NODE_AUTH_TOKEN); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicated npm-publish environment; and blocked the sponsor-block workflow from running on forks. (#10618, #10619, #10627, #10637, #10641, #10666)

Docs: Clarified HTTP/2 support and the unsupported httpVersion option; added documentation for header case preservation; improved the beforeRedirect example to prevent accidental credential leakage. (#10644, #10654, #10624)

Dependencies: Bumped picomatch, handlebars, serialize-javascript, vite (×3), denoland/setup-deno, and 4 additional dev dependencies to latest versions. (#10564, #10565, #10567, #10568, #10572, #10574, #10663, #10664, #10665, #10669, #10670)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

@Kilros0817 (#10625)

@shaanmajid (#10616, #10617, #10618, #10619, #10637, #10641, #10666)

@ashstrc (#10624, #10644)

@Abhi3975 (#10589)

@raashish1601 (#10573)

Full Changelog

Commits

772a4e5 chore(release): prepare release 1.15.0 (#10671)
4b07137 chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (#10663)
51e57b3 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (#10664)
fba1a77 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (#10665)
0bf6e28 chore(deps): bump denoland/setup-deno in the github-actions group (#10669)
8107157 chore(deps-dev): bump the development_dependencies group with 4 updates (#10670)
e66530e ci: require npm-publish environment for releases (#10666)
49f23cb chore(sponsor): update sponsor block (#10668)
3631854 fix: unrestricted cloud metadata exfiltration via header injection chain (#10...
fb3befb fix: no_proxy hostname normalization bypass leads to ssrf (#10661)
Additional commits viewable in compare view

Updates dompurify from 3.3.3 to 3.4.0

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @kodareef5

Fixed several minor problems and typos regarding MathML attributes, thanks @DavidOliver

Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @1Jesper1

Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @bencalif

Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @trace37labs

Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @eddieran

Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @christos-eth

Fixed an issue with USE_PROFILES prototype pollution, thanks @christos-eth

Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @researchatfluidattacks and others

Fixed an issue with closing tags leading to possible mXSS, thanks @frevadiscor

Fixed a problem with the type dentition patcher after Node version bump

Fixed freezing BS runs by reducing the tested browsers array

Bumped several dependencies where possible

Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

Commits

5b16e0b Getting 3.x branch ready for 3.4.0 release (#1250)
See full diff in compare view

Updates monaco-editor from 0.52.2 to 0.55.1

Release notes

Sourced from monaco-editor's releases.

v0.55.1

Changes:

#5121: Fixes missing language exports

#5122: v0.55.1

This list of changes was auto generated.

v0.55.0

Changes:

#5120: Fixes npx playwright install --with-deps

#5118: Fixes microsoft/monaco-editor#5113

#5117: v0.55.0

#5116: Install playwright dependencies in monaco-editor-core job

#5105: Fixes website

#5104: fixes website & adds editor.api.d.ts

#5102: Fixes typedoc & updates pipelines to test website

#5100: Updates website dependencies

#5071: Bump vite from 5.4.20 to 5.4.21 in /samples/browser-esm-vite-react

#4961: Bump on-headers and compression in /samples

#5040: Bump @babel/runtime from 7.18.9 to 7.28.4 in /website

#5095: Bump vite from 7.1.9 to 7.1.11 in /samples/browser-esm-vite

#5097: Cleans up build scripts

#5098: Dont build the editor when building the website

#5099: Run tests

#5094: Adds vite esm example

#5093: Adds playground support for esmUrl

#5092: Updates changelog

#5090: Adds localization section to readme

#5089: Adds missing NLS files

#5088: Dont use .js for typescript imports, as rollup adds them to the output

#5070: Bump vite from 7.1.5 to 7.1.11

#5069: Bump playwright and @playwright/test

#5058: Add monaco-editor-core dependencies to monaco-editor after updating monaco-editor-core.

#5053: Bump loader-utils from 2.0.2 to 2.0.4 in /website

#5055: Bump postcss and css-loader in /website

#5054: Bump json5 from 2.2.1 to 2.2.3 in /website

#4973: Fix Kotlin number literals

#4991: Bump vite from 2.9.17 to 5.4.20 in /samples/browser-esm-vite-react

#5039: Bump webpack from 5.90.1 to 5.102.1 in /website

#5037: Bump ws in /website

#5010: [Bug] Multiple issues with how monaco-editor is published

#5051: Fixes #5010

... (truncated)

Changelog

Sourced from monaco-editor's changelog.

[0.55.1]

Fixes missing language exports (monaco.json/typescript/...) due to wrong "types" path - #5123

[0.55.0]

Breaking Changes

Moves nested namespaces (languages.css, languages.html, languages.json, languages.typescript) to top level namespaces (css, html, json, typescript) to simplify the build process and align with typescript recommendations.

New Features

Adds native LSP support (see new lsp namespace).

Bug Fixes

Updates dompurify to 3.2.7

[0.54.0]

Adds option editor.mouseMiddleClickAction

Various bug fixes

[0.53.0]

⚠️ This release deprecates the AMD build and ships with significant changes of the AMD build. The AMD build will still be shipped for a while, but we don't offer support for it anymore. Please migrate to the ESM build.

New Features

Next Edit Suggestion support.

Scroll On Middle Click

Edit Context Support

Breaking Changes

Internal AMD modules are no longer accessible. Accessing internal AMD modules was never supported. While this is still possible in the ESM build, we don't encourage this usage pattern.

The browser-script-editor scenario for unbundled synchronous script import and editor creation no longer works. Instead, a the ESM build should be used with a bundler, such as vite or webpack.

Custom AMD workers don't work anymore out of the box.

[0.52.0]

Comment added inside of IModelContentChangedEvent

[0.51.0]

New fields IEditorOptions.placeholder and IEditorOptions.compactMode

New fields IGotoLocationOptions.multipleTests and IGotoLocationOptions.alternativeTestsCommand

New field IInlineEditOptions.backgroundColoring

New experimental field IEditorOptions.experimental.useTrueInlineView

New options CommentThreadRevealOptions for comments

Contributions to monaco-editor:

... (truncated)

Commits

516f350 Fixes missing language exports (#5121)
9221aa0 v0.55.1 (#5122)
d678c1d Merge pull request #5120 from microsoft/hediet/enormous-herring
f047a08 Fixes npx playwright install --with-deps
220c1ca Fixes microsoft/monaco-editor#5113 (#5118)
1b175c7 v0.55.0 (#5117)
574b846 Install playwright dependencies in monaco-editor-core job (#5116)
5486e82 update (#5105)
e70b661 fixes website & adds editor.api.d.ts (#5104)
36efbe0 Fixes typedoc & updates pipelines to test website (#5102)
Additional commits viewable in compare view

Updates reka-ui from 2.9.5 to 2.9.6

Release notes

Sourced from reka-ui's releases.

v2.9.6

🐞 Bug Fixes

Export missing TimeRange type - by @Bahtya in unovue/reka-ui#2590 (70e72)

MonthPicker, YearPicker: Preserve day/month when selecting - by @zernonia and Claude Opus 4.6 (1M context) in unovue/reka-ui#2594 (836f2)

TimeField: Change focus after pressing 0 more than once on hour segment with 12 hour locales - by @zomakus in unovue/reka-ui#2581 (1d772)

View changes on GitHub

Commits

e5667c2 chore: release v2.9.6
836f2e9 fix(MonthPicker, YearPicker): preserve day/month when selecting (#2594)
1d77296 fix(TimeField): change focus after pressing 0 more than once on hour segment ...
fbd9f04 chore(deps): update dependency vite to ^8.0.8 (#2592)
70e7286 fix: export missing TimeRange type (#2590)
68a490b Revert "chore(deps): bump vite from 5.4.21 to 8.0.5 (#2584)"
See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

dependabot · 2026-04-18T05:27:07Z

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Bumps the console-production group in /console with 6 updates: | Package | From | To | | --- | --- | --- | | [@internationalized/date](https://github.com/adobe/react-spectrum) | `3.12.0` | `3.12.1` | | [@tanstack/vue-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/vue-virtual) | `3.13.23` | `3.13.24` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.15.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.0` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.52.2` | `0.55.1` | | [reka-ui](https://github.com/unovue/reka-ui) | `2.9.5` | `2.9.6` | Updates `@internationalized/date` from 3.12.0 to 3.12.1 - [Release notes](https://github.com/adobe/react-spectrum/releases) - [Commits](https://github.com/adobe/react-spectrum/compare/@internationalized/date@3.12.0...@internationalized/date@3.12.1) Updates `@tanstack/vue-virtual` from 3.13.23 to 3.13.24 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/vue-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/vue-virtual@3.13.24/packages/vue-virtual) Updates `axios` from 1.14.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.14.0...v1.15.0) Updates `dompurify` from 3.3.3 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.0) Updates `monaco-editor` from 0.52.2 to 0.55.1 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.52.2...v0.55.1) Updates `reka-ui` from 2.9.5 to 2.9.6 - [Release notes](https://github.com/unovue/reka-ui/releases) - [Commits](unovue/reka-ui@v2.9.5...v2.9.6) --- updated-dependencies: - dependency-name: "@internationalized/date" dependency-version: 3.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: console-production - dependency-name: "@tanstack/vue-virtual" dependency-version: 3.13.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: console-production - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: console-production - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: console-production - dependency-name: monaco-editor dependency-version: 0.55.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: console-production - dependency-name: reka-ui dependency-version: 2.9.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: console-production ... Signed-off-by: dependabot[bot] <support@github.com>

Phase 1 frontend (task #10) foundational work: - i18n testCases.ts modules (zh-CN + en-US) with tabs/scope/count/section/ validation/confirm/toast/view sections - Register testCases in both locale index.ts - CaseScope type ('SAMPLE' | 'HIDDEN') mirroring backend - mapFlagsToCaseScope / mapCaseScopeToFlags utility — round-trip idempotent, legacy null pairs treated as SAMPLE per ADR-001 projection rules

Phase 1 frontend (task #10) TestCaseForm refactor: - Replace (is_sample, is_hidden) Switch pair with canonical CaseScope radio (SAMPLE / HIDDEN). Always emits both flags explicitly on set, guaranteeing backend XOR filter satisfaction - mapFlagsToCaseScope: legacy null pairs treated as SAMPLE (ADR-001 projection rule) - mapCaseScopeToFlags: always emits both booleans - 13 new unit tests across 2 specs: - src/api/admin/__tests__/test-cases.spec.ts: pure-function mapping (HIDDEN priority, SAMPLE default, round-trip idempotency, XOR holds) - src/components/problem/components/__tests__/TestCaseForm.spec.ts: radio UI emits correct formData; never half-defined state - Baseline: 40 test files / 269 tests pass

Phase 1 frontend (task #10): - Wrap CasesForm + HiddenTestCasesEditor in shadcn-vue Tabs - Tab 1 'samples' = existing CasesForm (problem.examples API, backward compat) - Tab 2 'hidden' = existing HiddenTestCasesEditor (self-contained, /admin/ problems/{id}/test-cases) - Tab labels driven by i18n testCases.tabs.samples / .hidden - Default to 'samples' tab; user can switch - 40 test files / 269 tests pass; vue-tsc clean

Phase 1 frontend (task #10) View mode: - New HiddenCasesView.vue: read-only admin view of hidden judge cases, fetched via GET /admin/problems/{id}/test-cases?is_hidden=true - Mounted in ViewCasesView and CasesTab below CasesDisplay (samples first, then hidden collapsed card with count + lock icon) - ADR-001 visibility contract documented in JSDoc: this component is admin-only and MUST NOT be imported in console/. The console side receives only SubmissionVO.tests (no HIDDEN rows) via backend SubmissionServiceImpl.toVO() projection. - Type-check clean; 40 test files / 269 tests pass; i18n keys validate

Phase 1 frontend (task #10) test coverage: management (admin): - HiddenTestCasesEditor.spec.ts (3 tests): - GET /admin/problems/{id}/test-cases called on mount with limit 1000 - Refetches when problemId prop changes - Sample/hidden count from API response (XOR filter on client) console (user-facing): - SubmissionTestResults.spec.ts (4 tests, ADR-001 invariant): - SubmissionRecord has no isHidden / is_hidden / caseScope fields - SubmissionTestRecord has no per-test hidden case data - Only SubmissionRecord (top-level) carries first-failed detail fields - SubmissionTestResults.vue source file is free of 'isHidden' / 'caseScope' / 'is_hidden' / 'case_scope' identifiers (static source check) The console spec is the structural witness of the ADR-001 visibility contract: backend SubmissionServiceImpl.toVO() strips HIDDEN rows via CaseScope.isUserVisible(scope), and the frontend type is a structural witness of that contract. If this test ever fails, the visibility contract has been broken — review P0-1 backend projection, do not relax the type. Note: project has no Playwright infrastructure yet. This Vitest-based integration coverage is the practical substitute; a follow-up Playwright E2E suite (admin edit flow + console submission detail walkthrough) is recorded as future work in the worktree MEMORY. Stats: - management: 41 test files / 272 tests (was 40 / 269, +1 file / +3 tests) - console: 34 test files / 303 tests (was 33 / 299, +1 file / +4 tests) - vue-tsc clean on both apps

…#10) Replace the /home/davidhlp/... absolute path with import.meta.url relative resolution so the static-scan test works in CI and on any clone path, and reads the worktree copy instead of the main-repo path. Reviewer pre-push blocker (msg 9d908982).

Phase 1 frontend hidden test cases UI: Tabs (samples/hidden) + RadioGroup scope (SAMPLE/HIDDEN) + CaseScope utility + admin-only HiddenCasesView + ADR-001 console 0-leak invariant. P9 pre-reviewed (3 security points); reviewer path-blocker fixed (import.meta.url). Pre-push: management 272 + console 303 green, vue-tsc clean, i18n validated.

… follow-up) Replace the runtime object-literal assertion (theatre test) with compile-time keyof conditional witnesses — adding a hidden-case field (isHidden / is_hidden / caseScope / case_scope / input / output / expectedOutput) to SubmissionRecord / SubmissionTestRecord now fails to COMPILE, which is the real protection. Backend HiddenCaseLeakIT (asserts real Jackson JSON) remains source-of-truth. Also fix the spec comment: the import.meta.url resolution is path-agnostic (any clone / CI), not worktree-specific. Reviewer P1-2 + P2 follow-up (msg ffa1832a).

…e-level invariant + path comment Post-push follow-up: compile-time keyof conditional witnesses replace the theatre object-literal assertion (adding a hidden-case field to SubmissionRecord/SubmissionTestRecord now fails to compile); spec comment clarified to path-agnostic. reviewer P1-2 + P2 (msg ffa1832a).

Bumps the console-production group in /console with 6 updates: | Package | From | To | | --- | --- | --- | | [@internationalized/date](https://github.com/adobe/react-spectrum) | `3.12.0` | `3.12.1` | | [@tanstack/vue-virtual](https://github.com/TanStack/virtual/tree/HEAD/packages/vue-virtual) | `3.13.23` | `3.13.24` | | [axios](https://github.com/axios/axios) | `1.14.0` | `1.15.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.3.3` | `3.4.0` | | [monaco-editor](https://github.com/microsoft/monaco-editor) | `0.52.2` | `0.55.1` | | [reka-ui](https://github.com/unovue/reka-ui) | `2.9.5` | `2.9.6` | Updates `@internationalized/date` from 3.12.0 to 3.12.1 - [Release notes](https://github.com/adobe/react-spectrum/releases) - [Commits](https://github.com/adobe/react-spectrum/compare/@internationalized/date@3.12.0...@internationalized/date@3.12.1) Updates `@tanstack/vue-virtual` from 3.13.23 to 3.13.24 - [Release notes](https://github.com/TanStack/virtual/releases) - [Changelog](https://github.com/TanStack/virtual/blob/main/packages/vue-virtual/CHANGELOG.md) - [Commits](https://github.com/TanStack/virtual/commits/@tanstack/vue-virtual@3.13.24/packages/vue-virtual) Updates `axios` from 1.14.0 to 1.15.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.14.0...v1.15.0) Updates `dompurify` from 3.3.3 to 3.4.0 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.3.3...3.4.0) Updates `monaco-editor` from 0.52.2 to 0.55.1 - [Release notes](https://github.com/microsoft/monaco-editor/releases) - [Changelog](https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md) - [Commits](microsoft/monaco-editor@v0.52.2...v0.55.1) Updates `reka-ui` from 2.9.5 to 2.9.6 - [Release notes](https://github.com/unovue/reka-ui/releases) - [Commits](unovue/reka-ui@v2.9.5...v2.9.6) --- updated-dependencies: - dependency-name: "@internationalized/date" dependency-version: 3.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: console-production - dependency-name: "@tanstack/vue-virtual" dependency-version: 3.13.24 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: console-production - dependency-name: axios dependency-version: 1.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: console-production - dependency-name: dompurify dependency-version: 3.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: console-production - dependency-name: monaco-editor dependency-version: 0.55.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: console-production - dependency-name: reka-ui dependency-version: 2.9.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: console-production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>