Stratos v5.5.3

Bug Fixes

• The Helm release resource graph (Workloads, a release, Overview) stayed on
  "Loading resources" after the resources had arrived. The component runs
  OnPush under zoneless change detection and wrote the nodes and links into
  plain fields from its socket subscription, so nothing ever marked the view
  dirty; they are signals now. The graph also fitted itself on a timer that
  fired before the first layout existed, leaving the right-hand nodes clipped,
  so it now fits on ngx-graph's drawComplete. And the standalone
  GraphComponent that ngx-graph 12 steers consumers toward needs a
  LayoutService only its deprecated module provided, which the component
  now supplies itself.
• The Helm release status poller asked the Kubernetes API for the wrong
  URL for several kinds in a release, got 404 every ten seconds, and dropped
  those resources from the release, so their preview panel opened empty and
  their status never updated. Cluster-scoped kinds such as ClusterRole,
  ClusterRoleBinding and IngressClass were fetched under the release
  namespace; the plural was guessed by appending an "s", which turns
  IngressClass into "ingressclasss"; and a "/status" subresource was
  appended to every non-core kind, which custom resources such as a Traefik
  IngressRoute do not have. The poller now takes each kind's plural and scope
  from API discovery, through the same REST mapper Helm itself uses, and
  fetches the resource itself, which carries its status. When discovery
  cannot name a kind the fallback guess no longer appends "/status" and
  pluralises "s", "x", "ch" and "sh" endings with "es".
• Several pages kept their first render under zoneless change detection
  because an OnPush component wrote data that arrived later into plain
  fields, which never marks the view dirty. The affected fields are
  signals now. Visible effects fixed: the About page's EULA rendered
  blank; a Helm chart's details showed no versions and no schema notice;
  the markdown help panel on the endpoint connect dialogs stayed empty;
  the Edit Endpoint CA certificate toggle ignored the saved endpoint; the
  Metrics tab on an application and the Quota tab on a space could be
  missing; the add-route form's HTTP/TCP switch, a user-provided
  service's existing tags, a favourite card's invalid state, the profile
  form's password rules, and a disabled file input all lagged behind
  their data.
• Installing or upgrading a Helm release sat on "Loading ..." forever.
  The values editor built an observable from a signal inside its config
  input setter, which runs outside an injection context and threw
  NG0203 before the chart values were ever requested.
• The Helm chart catalog (Helm, Charts) said "There are no charts" and
  never requested them, and the Workloads release list had the same
  latent gap: both list configs compared a signal accessor to null
  instead of the signal's value, so the first-visit load was skipped.
• Opening workloads/install/<endpoint>/<repo>/<chart> without a version
  requested versions/undefined and failed; the page now resolves the
  chart's latest version.
• Adding a user from another identity origin to an org failed for org
  managers with "user not found", while working for admins (#5883). The
  roles handler looked the user up through GET /v3/users before creating
  the role, and Cloud Foundry only shows an org manager the users already
  in their orgs. Adds now go to POST /v3/roles by username and origin
  and Cloud Foundry resolves the user itself, as the CF API intends for
  org managers. Removes still resolve the GUID, since a role is deleted by
  GUID and the user is a listable member by then. The org Users list now
  shows the new member as soon as the add succeeds, using the user GUID
  from the created role, instead of waiting for a manual refresh.
• Creating a service key, or binding a route service, showed the new
  entry only after re-reading the list from Cloud Foundry. When the
  broker answers synchronously the create response already carries the
  key or binding, so the page now adds it in place and re-reads only
  when the broker handed back an asynchronous job instead.
• A failed service key create or route service bind reported its error
  in an unstyled box showing only the Cloud Foundry error code. The
  message now uses the same red warning banner as the rest of the console
  and carries the broker's own explanation, such as the gateway timeout
  behind a CF-UnableToPerform. Two related delete and unbind links and
  the failed-row highlight on the detach page had the same missing
  colours.
• The failure banner stripped the markup Cloud Foundry embeds when it
  quotes a broker's raw response, so a router timeout reads as a sentence
  rather than an HTML page. Expanding a service key whose creation failed
  said "Failed to load credentials: unknown error"; it now says the key
  has no credentials and does not offer to copy them, and other credential
  load failures name the HTTP status instead of "unknown error".
• The branding service no longer leaves its start-up timer and colour-scheme
  listener behind when its injector is destroyed.
• The org Spaces tab no longer offers Create Space to roles that cannot create
  one; only an org manager sees it, matching the other create actions.
• A tab the user may not see, such as Variables on an application for
  anyone who is not a space developer, was drawn on page load and then
  removed once the permission check answered. Tabs gated on a permission
  or endpoint capability now stay out of the side nav until the answer is
  known (#5894).
• Add User let an org or space manager submit a username with no role
  ticked, and the add then failed with "user not found" because Cloud
  Foundry only lets an administrator add a user without granting a
  role. The dialog now asks such a user to grant at least one role
  before it will submit (#5893).
• A dialog with a drag handle, such as Add User, could grow past the
  bottom of the window once its content loaded, leaving its buttons
  unreachable. The panel is now capped at the window edge from where it
  sits, and Add User's scope and roles section scrolls on its own, with
  a visible scrollbar, so every org and space is reachable while the
  buttons stay in view.

Maintainability

• The unit run no longer ignores unhandled errors: the timer leak above and
  three kubernetes specs whose components looked up an endpoint no spec had
  seeded were the only sources, both fixed, so the flag that hid them is gone
  and the next leak fails the gate.
• The production build is warning-free: 74 template diagnostics cleared by
  fixing the types behind them rather than re-wrapping, the editor chunk
  budget lifted to 2.75 MB to match the curated Monaco 0.56 subset, and the
  monaco-yaml worker's CommonJS import acknowledged.
• The e2e suite can run as CF roles: org manager, space manager, org auditor
  and space auditor each get their own console session and a suite asserting
  what the console lets them do and what it refuses, with canary tests that
  must fail so a leaked control turns the run red. Role-gated controls carry
  stable test hooks; app creation in the API helper no longer names a stack
  the foundation may not have.

Chores

• Dependency bumps: @swimlane/ngx-graph 11 to 13, copy-webpack-plugin 13
  to 14, json-schema-to-typescript 15 to 16, eslint 10.8 to 10.9, mktemp
  2.0.3 to 2.0.4, google.golang.org/grpc 1.82 to 1.83 in jetstream, and the
  indirect fast-uri 3.1.5 to 3.1.7 in the devkit lockfile.
  ngx-graph 12 rewrote its graph component on signal inputs and renamed
  draggingEnabled to enableDrag, which the Helm release resource graph
  binds; the module wrapper it used to import is deprecated, so it now
  imports the standalone component instead.
• fw-capi bumped v3.222.4 → v3.229.1, absorbing its breaking metadata
  change (Metadata.Labels/Annotations are now map[string]*string, so
  a nil value can delete a key on PATCH) and the corrected service plan
  visibility wire format (organizations as {"guid": ...} objects). The
  by-username role relationship this fix needs is fivetwenty-io/capi#15,
  consumed through a module replace on the fork until it is released.
• Dependency bump: google.golang.org/grpc 1.82.1 to 1.83.1 in the cfapppush
  plugin module, matching the jetstream bump already announced above.
• Dependency bumps: the Angular family 22.1.4 to 22.1.5 with cli and devkit
  22.1.7, angular-eslint 22.1 to 22.5, @playwright/test 1.63, eslint 10.10,
  typescript-eslint 8.70, vitest 4.1.11, happy-dom 20.14, sass 1.104, marked
  18.0.12, acorn 8.18 and the other patch-level frontend packages; the
  Go modules take their current direct dependencies (go-cfenv 1.24, noaa 2.6,
  mysql 1.10, prometheus client 1.24, x/crypto 0.57, cf cli v8.19, k8s.io
  0.37, aws-sdk-go-v2 1.46, aws-iam-authenticator 0.7.20).
• Dropped immer, reselect, globby and mem, which nothing had imported
  for years.
• The devkit forces qs 6.16.0 through its overrides block, clearing the open
  Dependabot alert that express 4's ~6.15 pin kept it from fixing itself.
• The asdf Go pin in .tool-versions now matches go.mod and CI at 1.27.
• Dependency bump: google.golang.org/grpc 1.83.1 to 1.83.2 in jetstream and the
  cfapppush plugin.
• The unit test run printed some two hundred happy-dom AbortError stack
  traces: Angular gives every injector a root HttpClient on the fetch
  backend even when nothing provides one, so specs that never mention
  HttpClient still sent real requests that were aborted at teardown. The
  test platform now holds every request in the testing backend, the
  specs that provided their own real client pair it with the testing
  one, and the narrowed make test frontend run no longer ignores
  unhandled errors.
• The unit test runner stays on vitest 4. Vitest 5 cannot be adopted while
  the build is on Angular 22: @angular/build requires vitest ^4.0.8 and
  @analogjs/vitest-angular supports up to 4. Tried against 5.0.0, the
  Angular plugin stops inlining component templates and styles during
  transform, so component specs fail to compile with "is not resolved:
  styleUrls". Vite itself is not affected; the repo runs vite 8. This will
  be revisited when those packages widen their supported ranges.