chore(deps-dev): bump the management-development group across 1 directory with 13 updates - #72
Closed
dependabot[bot] wants to merge 1203 commits into
Closed
Conversation
Replace fu-* prefixed forum user IDs with real users table IDs (u-admin-001, user-alice-001, etc.) in seed data and add migration to update existing references across forum tables.
Fix system module keys (backup, email, monitoring) that were silently failing due to missing `system.` prefix. Add missing en-US/zh-CN keys for contests, problems, solutions, users, and errors. Move error type keys under `errors.errorType` namespace.
Add i18n keys for stats labels, page titles, status badges, and common UI text across contests, notifications, problem lists, and moderation modules. Includes both en-US and zh-CN locales.
Add CI job for management i18n completeness and naming convention checks. Enhance check.ts with code-to-locale coverage scanning and JSON output for CI consumption. Add i18n-coverage and naming-convention test suites. Add fallback values to all dynamic t() calls per design spec. Remove dead snake_case keys from dashboard locale. Document conventions in docs/i18n-design.md.
Introduce SemanticBadge component and semantic-maps for consistent terminal-style badges across console and management frontends. Replace scattered Badge variant mappings and inline CSS with centralized SemanticColor system. Update ContestStatusBadge, entity helpers, and audit views to use the new unified badge API.
Replace duplicate semantic-maps.ts and semantic-types.ts definitions in console and management frontends with re-exports from the new shared/badge-config module. This completes Phase 0 of the badge unification plan.
Replace hardcoded Tailwind colors with terminal CSS variables and consolidate ProblemListVisibility color map into the shared config. Also apply Prettier formatting to entity files.
Add MIT License and comprehensive Chinese README. Translate all Flyway seed data (user names, comments, problem titles, audit logs, contest descriptions) from English to Chinese.
Delete the admin /billing page and all its wiring: - views/billing/BillingView.vue - i18n modules billing.ts (en + zh) - i18n index.ts module registrations - nav.billing translation key (en + zh) - router route path/name/component/meta - NavUser dropdown menu item + IconCreditCard import Validation: - pnpm type-check: pass - pnpm lint: pass (no new warnings) - pnpm validate:i18n-keys: pass (All keys found) - pnpm vitest run: 233 passed, 0 failed - grep residue: 0 hits for billing|Billing
Removes the management frontend /billing view, route, i18n module, and user-menu entry. Console subscription, backend subscription module, and unrelated admin 'subscription' references are intentionally left intact (see PR #N conversation for scope rationale). Reviewed via ecc:code-review (Local Review Mode) — APPROVE, 0 findings.
…time errors
OJ submissions occasionally surfaced 'sh: 0: Cannot fork' inside the Docker
sandbox, which the previous verdict logic misclassified as 'Runtime Error'.
This made ops triage harder: a host/cgroup/seccomp pressure signal was
indistinguishable from a real user-program bug.
Changes:
- SandboxServiceImpl: split fork-failure detection into two scopes with
distinct semantics.
- isSandboxForkFailure(String output): detects sandbox-internal fork
failures from merged stdout/stderr (busybox sh 'Cannot fork',
glibc/dockerd 'Resource temporarily unavailable', kernel
'fork: Cannot allocate memory'). Returned verdict is now 'Sandbox
Error' with detail prefix 'Sandbox fork failed (likely
PID/cgroup/seccomp pressure): ...'.
- isDockerDaemonForkFailure(String msg): stricter IOException-side
matcher that avoids false-positives on docker daemon configuration
warnings containing 'pids'. Accepts only unambiguous fork phrases:
'Cannot fork', 'fork: Cannot allocate memory', 'pids-limit
reached', 'cgroup pids limit', 'RLIMIT_NPROC'. Throws
SANDBOX_ERROR with 'Sandbox daemon-level fork failure' prefix.
- Constants extracted (SANDBOX_FORK_FAILURE_VERDICT,
SANDBOX_FORK_FAILURE_DETAIL_PREFIX, MAX_LOG_DETAIL_BYTES) to remove
duplicated magic strings and bound log payload size via
truncateForLog(String).
- SandboxServiceImplTest: +16 BCDE tests covering both matchers,
parameterized markers, and false-positive guards for docker daemon
config warnings.
- i18n (console + management, en-US + zh-CN): added 'Sandbox Error' /
'沙箱错误' under status.sandboxError (console) and
statusLabels.SANDBOX_ERROR (management) so the new verdict renders
consistently across locales.
- docs/CODEMAPS/sandbox.md: codifies resource limit matrix, both
fork-failure classification paths, i18n key table, and the 2026-06-12
diagnostic finding that --pids-limit=128 is empirically sufficient
for current sandbox images (H1 of the original PRP plan refuted).
Diagnostic context: see .claude/PRPs/reports/oj-sandbox-cannot-fork-diagnose-report.md.
The accompanying plan (.claude/PRPs/plans/oj-sandbox-cannot-fork-diagnose.plan.md)
and report remain gitignored per .claude/PRPs/ tree convention.
…fication Implements the verdict classification improvements from .claude/PRPs/plans/oj-sandbox-cannot-fork-diagnose.plan.md after the 2026-06-12 H1 refutation (--pids-limit=128 empirically sufficient). See commit 6f8f36b for the full diff and .claude/PRPs/reports/oj-sandbox-cannot-fork-diagnose-report.md for diagnostic context.
Move success feedback responsibility to UI callers in account API to prevent duplicate notifications. Add unit tests verifying toast.success is not invoked on updateProfile or changePassword.
…se 1)
Per the agreed sandbox refactor plan, replace the in-source 950-line String
constants in CodeExecutionHelperImpl with a real harness project that will
later be compiled into the sandbox image (Phase 2). Phase 1 is harness
code only — zero impact on backend, Dockerfile, or DB.
Java harness: 39/39 tests pass (31 HarnessTest unit + 8 MainE2ETest end-to-end).
- JSON parser/serializer, argument adapter, ListNode/TreeNode helpers
- Reflective Solution invocation, per-case worker thread with soft TLE
- User System.out capture so envelope JSON is never contaminated
- Default-package classes to match LeetCode's zero-import convention
Python harness: 7/7 pytest pass.
- Same envelope contract; uses inspect.signature for ListNode/TreeNode hints
C/C++ harness: smoke skeleton (gcc/g++ build verified).
- Full impl in later phase; current binary emits empty envelope JSON
Three real bugs surfaced and fixed by the test suite:
- parseJson("{") caught StringIndexOutOfBoundsException at EOF -> rethrow as IAE
- fromTreeNode using ArrayDeque rejected null offers -> switched to LinkedList
- HarnessTest hit javac Unicode preprocessing on literal \\uXXXX -> built via
char-cast + concatenation so the source contains no backslash-u sequence
…1.5)
- Strict JSON parser: reject leading zero, naked dot, empty exponent,
Infinity/NaN literals, exponent overflow, unescaped control chars,
bareword keys, max depth, trailing data
- Serializer cycle/depth/node-count guards via IdentityHashMap /
id-set; reject non-finite floats in toJson
- Block System.exit AND Runtime.halt via SecurityManager
(checkExit + checkPermission('exitVM.*'))
- Deterministic method dispatch: hint OR single public method;
reject overloads, shadowing, missing
- Per-case jsonable try/catch so cyclic / NaN results surface as
Runtime Error instead of harness panic
- Mirror all of the above in Python harness (os._exit / sys.exit
blocked, type_override honored, allow_nan=False, SystemExit -> RE)
- 23 new Java + 11 new Python adversarial tests covering each fix
- Add -Djava.security.manager=allow to test ProcessBuilder so
SecurityManager installs on JDK 18+ (the harness image pins
JDK 17 where it is a no-op)
Java 68/68 + Python 18/18 green.
- New multi-stage Dockerfile: pre-compiled harness artifacts from
harness-staging/ get COPYed into /opt/harness/{java,python,c,cpp}/
in the runtime image. Base is ulticode-sandbox:latest (which already
carries JDK 17 + python3 + gcc + g++) so no apt mirror dependency.
- harness/build.sh: host-side driver that runs mvn compile /
py_compile / gcc / g++ and populates harness-staging/. CI calls
this ahead of 'docker build'.
- .dockerignore: keeps target/, __pycache__/, *.pyc, harness-staging/
out of the build context.
- application.yml: code-execution.sandbox.d-form.{enabled,harness-root}
flags (env-overridable). enabled defaults to false until Phase 3
wires CodeExecutionHelperImpl to the new dispatch path; Phase 5
deletes the legacy Form A wrappers.
- harness-staging/ added to .gitignore (regenerated by build.sh).
Verified: 4-language sanity check
- C / C++: pre-compiled smoke binaries print valid empty envelope
- Java: add(2,3)=5 → 'Accepted'
- Python: add(2,3)=5 → 'Accepted' (SOLUTION_DIR=/job)
1. [critical] .dockerignore negated to re-include harness-staging/
The Dockerfile COPYs harness-staging/{java,python,c,cpp} but the
previous .dockerignore excluded both that directory and *.class
files, so 'docker build' could not see the artifacts and failed.
Re-included the staging dir with explicit negation rules after
the generic artifact patterns.
2. [high] FROM a separately-pinned base image
ulticode-sandbox:latest is the project's rolling sandbox tag and
also the natural output name for this Dockerfile — a self-cycle
that would silently inherit whatever the host happened to have.
Switched FROM to ulticode-sandbox:base-17 (JDK 17 pinned). Added
a first-time-setup hint in harness/build.sh that checks for the
tag and tells the user to docker tag or rebuild the base.
3. [high] TreeNode cycle guard + node cap
fromTreeNode did BFS without identity tracking, so a user result
like root.left = root would grow the queue and output until the
process was killed. Added IdentityHashMap-based cycle detection
+ MAX_JSONABLE_NODES cap, throws IAE so the per-case path can
convert to Runtime Error (envelope stays well-formed).
New tests: self-cycle, mutual cycle, node cap exceeded.
4. [medium] Output-size cap enforced incrementally
The 8 MiB MAX_JSON_OUTPUT_BYTES check was only at writeJson entry;
a single large String or map key bypassed it. Added post-append
assertions in writeNumber and writeString, so the cap kicks in
mid-serialize rather than after recursion unwinds.
New tests: oversized string scalar, oversized map key.
Java 73/73 (was 68, +5 adversarial) and Python 18/18 both green.
Verified: clean-context docker build (no cache) succeeds with the
new FROM tag, all 4-language sanity checks still pass.
Backend now has two execution paths inside SandboxServiceImpl, gated by
code-execution.sandbox.d-form.enabled (default false until rollout):
A-path (legacy Form A): unchanged — buildWrapperScript() builds a
per-request bash wrapper string, parseBatchResults() parses its stdout.
Both kept around for Phase 5 rollback / per-language fallback.
D-path (LeetCode/HackerRank): materializeDFormJob() writes
input.json + Solution.{java,py,c,cpp} to a per-run temp dir,
buildDDockerCommand() mounts it :ro at /job, and the pre-compiled
harness in the sandbox image (Phase 2) compiles+executes the user
code. stdout JSON envelope is parsed by helper.parseDEnvelope()
into per-case RunCaseResults with the legacy verdict spellings
(Accepted / Wrong Answer / Runtime Error / Time Limit Exceeded).
New DTOs (MapStruct not used; Jackson trees):
- EnvelopeDTO : {harness_version, language, exit_code,
total_elapsed_ms, results[]}
- PerCaseResultDTO: {case_id, label, elapsed_ms, status, result,
interrupted, error, user_stdout, user_stderr}
- InputSpecDTO : {name, value, type} (forward-compat for
Phase 4 problem_method_signature.type)
Timeouts:
- perCaseTimeoutMs (soft): forwarded in input.json; harness uses
Thread.interrupt on the executor worker
- dFormHardTimeoutSeconds (hard): ProcessBuilder.waitFor + destroyForcibly
in SandboxServiceImpl
- Currently 1s soft / 10s hard defaults; tunable in CodeExecutionHelper
CodeExecutionHelper interface gained 3 methods + DFORM_SUPPORTED_LANGUAGES.
DockerSandboxConfig record gained the nested DForm record + dFormEnabled/
dFormHarnessRoot accessors. SandboxServiceImplTest updated to pass null
for d-form (keeps the existing Form A path under test).
Verification: 36/36 sandbox tests pass (CodeExecutionHelperImpl 11,
SandboxServiceImpl 20, CodeExecutionService 5). Other 8+2 test
failures in this mvn test run are pre-existing issues in
contest/admin modules (missing ContestProblemMapper bean, SQL
'key' reserved-word syntax error) — unrelated to this change.
No production image build step run yet (Phase 2 already shipped
ulticode-sandbox:base-17; to enable D-form in a deployed env, set
SANDBOX_DFORM_ENABLED=true and rebuild the d-form image:
./docker/sandbox/harness/build.sh
docker build -t ulticode-sandbox-dform:phase2 docker/sandbox/
docker tag ulticode-sandbox-dform:phase2 ulticode-sandbox:latest
).
Three blocking defects flagged by the Phase 3 review:
1. [critical] Java compilation failed against :ro mount
The dispatcher ran 'javac -d .' from inside the :ro /job mount,
which made every Java D-form submission return Runtime Error.
Moved compilation to /tmp/classes (writable) and prepended it
on the runtime classpath. Also pass -Djava.security.manager=allow
so the harness can install its SecurityManager on JDK 18+.
2. [critical] C and C++ D-form dispatch never reached a harness
The C/C++ dispatchers in dFormDispatchShell() compiled user source
and ran the binary, but the harness images at
docker/sandbox/harness/{c,cpp}/ are still Phase 1 smoke skeletons
that don't read input.json. Enabling D-form would silently
break C/C++ judging for users whose Solution is the typical
library-style code (no main()). Trimmed
DFORM_SUPPORTED_LANGUAGES to {java, python} for now; C/C++ re-add
with a follow-up that ships envelope-producing harnesses.
3. [high] waitFor-before-read pipe deadlock
Both executeInSandboxD and executeBatchD called process.waitFor()
before process.getInputStream().readAllBytes(). With merged-error
stdout, the kernel pipe is only 64 KiB; a batch envelope with
100 cases × (verdict + 64 KiB user_stdout) easily exceeds that,
and the harness blocks on write() while the backend blocks on
waitFor() — false TLE for otherwise valid runs.
New runDProcess() helper spawns a daemon reader thread that
drains the merged pipe into a bounded ByteArrayOutputStream
(DFORM_OUTPUT_BUDGET_BYTES = 8 MiB + 128 KiB headroom). The
reader closes the InputStream on budget overflow so the harness
unblocks. waitFor joins the reader with a 2s grace window.
BOTH single-case and batch dispatch now go through runDProcess.
Verification: 36/36 sandbox tests pass (CodeExecutionHelperImpl 11,
SandboxServiceImpl 20, CodeExecutionService 5).
Frontends now have a single source of truth for the D-form sandbox
contract. Mirrors the backend's EnvelopeDTO / PerCaseResultDTO /
InputSpecDTO records (Phase 3).
shared/sandbox-types/ exports:
- DFormVerdict (the full verdict set, including legacy
Form A spellings the backend maps to)
- DFormHarnessVerdict (narrow — what the D-form harness actually
emits; subset of DFormVerdict)
- DFormVerdictCategory ('success' | 'error' | 'warning' |
'pending' | 'system' for UI styling)
- OJDataType ('int' | 'long' | 'double' | 'boolean' |
'String' | 'int[]' | 'int[][]' |
'long[]' | 'String[]' | 'ListNode' |
'ListNode[]' | 'TreeNode' | 'TreeNode[]')
- DFormInputSpec ({name, value, type?}) — the per-case
argument shape the harness reads
- DFormPerCaseResult ({case_id, label, elapsed_ms, status,
result, interrupted?, error?, user_stdout?,
user_stderr?})
- DFormEnvelope (top-level: {harness_version, language,
exit_code, total_elapsed_ms, results[]})
- verdictCategory(status) helper
- SUPPORTED_OJ_DATA_TYPES, isSupportedOJDataType, isDFormInputSpec
Each frontend gets a thin re-export shim:
console/src/types/sandbox.ts
management/src/types/sandbox.ts
so consumers can do
import type { DFormEnvelope, DFormPerCaseResult } from '@/types/sandbox'
without caring about the symlink path.
Per CLAUDE.md: 'shared/auth-core/ 改动必须在该包内跑 pnpm test +
pnpm type-check, 并在两个前端验证.' This package has no test
suite yet (pure types); type-check is the gate.
Verification:
shared/sandbox-types: created; tsc config in tsconfig.json
console: pnpm type-check passes
management: pnpm type-check passes
Cross-stack audit (manual, per cross-stack-dto-granularity-alignment
skill's checklist):
- backend EnvelopeDTO ↔ shared DFormEnvelope
Both carry {harness_version, language, exit_code,
total_elapsed_ms, results[]}. Field names match the JSON
snake_case the harness emits.
- backend PerCaseResultDTO ↔ shared DFormPerCaseResult
Same field set; backend maps the JSON into a Map first
then constructs the record. Both use the same verdict
strings; no enum mismatch.
- backend InputSpecDTO ↔ shared DFormInputSpec + OJDataType
Backend validates type against DFORM_TYPES at submission
time. Shared OJDataType union is the authoritative list;
backend's DFORM_TYPES constant is in lockstep (any new
type must be added to both).
The fields are intentionally compatible with what the harness
emits; no transformations are needed at the cross-stack boundary
beyond the verdict spellings the backend already normalizes.
… 4.5) Two cross-stack contract defects flagged by the Phase 4 review: 1. [high] DFormInputSpec.type never reached the harness The shared DTO advertised a 'type' field with a comment saying the harness prefers it over a Java annotation, but the CodeExecutionHelperImpl.buildDInputSpecs helper only serialized name + value, leaving the hint silently dropped. A frontend that populated type=ListNode for an unannotated Python user would have the value arrive as a raw list and crash on .next access at runtime. Fix: add 'type' field to RunInput DTO record and forward it in buildDInputSpecs when set and recognized by DFORM_TYPES. The field stays nullable for backward-compat with existing API callers; missing / blank / unknown types are omitted so the harness falls back to whatever the annotation says. 2. [medium] isDFormInputSpec accepted malformed input The shared type guard returned true after checking only that name and value were strings, accepting blank names (which the backend's InputSpecDTO record explicitly rejects) and arbitrary 'type' strings (which the backend silently drops). Callers using the guard at a trust boundary would accept data that fails later in the submission flow. Fix: require non-blank-after-trim name; require any present 'type' to pass isSupportedOJDataType. Added 16 negative tests (non-object, null, missing name, blank name, non-string fields, unsupported type, wrong-case type, trailing space) in shared/sandbox-types/src/input-spec.spec.ts. Verification: shared/sandbox-types: 16/16 vitest pass; tsc clean backend-spring: mvn compile clean console: pnpm type-check clean management: pnpm type-check clean
D-form (LeetCode/HackerRank harness) is now the default submission
dispatch path. The legacy Form A (per-request bash wrapper) remains
in CodeExecutionHelperImpl as a fallback gated by the d-form.enabled
flag for any deployment that needs to roll back.
To roll back: set SANDBOX_DFORM_ENABLED=false (or unset the env var
override in application.yml).
What D-form brings by default:
- Per-case verdict from a single static input.json contract
(no more 950-line Form A wrapper String templates)
- IdentityHashMap cycle guards, NaN rejection, output-size
caps inside the harness (Phase 1.5)
- Pre-compiled harness in the runtime image (Phase 2)
- Java + Python only (C/C++ D-form dispatch is gated out until
those harnesses ship envelope-producing executors)
- Soft TLE (Thread.interrupt) + hard TLE (ProcessBuilder
.waitFor + destroyForcibly) with concurrent stdout drainer
Verification:
backend-spring: 36/36 sandbox tests pass
console: pnpm type-check clean (lint clean)
management: pnpm type-check clean (27 pre-existing lint
errors in __tests__/error.test.ts and various
unused-import component files, unrelated to
this change)
No i18n additions required: console + management already ship
verdict labels for all DFormVerdict members (Accepted, Wrong
Answer, Runtime Error, Time Limit Exceeded, Compile Error,
Sandbox Error, System Error, ...) in both en-US and zh-CN.
These were already wired in the original StatusMeta/SubmissionStatusKey
i18n modules.
Phase 5b tears out the per-request bash wrapper generator and the
Form A path in the sandbox dispatcher. D-form (LeetCode/HackerRank
harness) is now the sole execution mode.
Code execution:
- CodeExecutionHelper interface: 100 → 53 lines
Removed: buildWrapperScript, buildBatchInputsJson,
parseBatchResults, wrapJavaScript, wrapPython, wrapJava,
buildInputsJson (10 method declarations).
Kept: buildDInputsJson, buildDBatchInputsJson, parseDEnvelope,
plus utility helpers (parseRuntimeMs, normalizeOutput,
sanitizeSandboxOutput, extractFunctionName, emptyResult,
buildCaseResult).
- CodeExecutionHelperImpl: 893 → 236 lines (-657)
Removed: 12 method bodies including the giant 950-line
PYTHON_BATCH_WRAPPER / JAVA_BATCH_WRAPPER / JAVA_JSON_PARSER
String-template constants, the 5 buildXxxBatchWrapper methods,
the embedded Java JSON parser/serializer, parseBatchResults,
the 3 wrapXxx methods, buildInputsJson, parseInputValue.
Kept + restored: extractFunctionName + parseRuntimeMs (still
used by the controller / other modules).
Sandbox dispatch:
- SandboxService interface: 60 → 36 lines
Removed: buildDockerCommand + buildBatchDockerCommand
(Form A only; D-form composes its docker command internally).
- SandboxServiceImpl: 679 → 320 lines (-360)
Removed: useDForm gate, A-path bodies in executeInSandbox and
executeBatch, buildDockerCommand, buildBatchDockerCommand.
Kept: D-form executeInSandbox / executeBatch (now the only
paths), materializeDFormJob, dFormDispatchShell,
buildDDockerCommand, runDProcess with the concurrent stdout
drainer (Phase 3.5 CR fix), DFormRunResult.
Test cleanup:
- CodeExecutionHelperImplTest: 333 → 268 lines
Removed 4 A-path test cases (buildPython/Java/C/Cpp batch
wrapper decode / stripPublicModifier). Replaced with 12
D-form-focused cases (buildDInputsJson for single + batch +
type-field wiring + unsupported-type drop; parseDEnvelope for
happy path / per-case error / harness panic / empty stdout /
unparseable JSON / wrong answer; utility helper regressions).
- SandboxServiceImplTest: 193 → 128 lines
Removed 4 A-path test cases (buildBatchDockerCommand for
python / javascript / default-seccomp / relative-seccomp).
Kept the 16 fork-failure detection cases (isSandboxForkFailure
+ isDockerDaemonForkFailure) that exercise the still-used
public static helpers.
Verification:
backend-spring: mvn compile + 36/36 sandbox tests pass
(CodeExecutionHelperImpl 15, SandboxServiceImpl 16,
CodeExecutionService 5)
d-form.enabled : true (default since 095a01f)
Net: 6 files, +402 / -1445 lines, 1043-line legacy deletion.
No further commits planned; Phase 5 done. The D-form rollout is
the only execution path. SANDBOX_DFORM_ENABLED=false no longer
exists in code; rolling back requires reverting this commit.
Plan ref: .claude/PRPs/plans/oj-sandbox-d-form-refactor.plan.md (Phase 5)
- validate language against DFORM_SUPPORTED_LANGUAGES so callers can't slip past the API-advertised SUPPORTED_LANGUAGES - reword the d-form.enabled yml comment to reflect that env var no longer toggles the dispatcher (D-form is always on; rollback is a git revert + image rebuild) - forward item.type into RunInput inside JudgeWorkerProcessor so the harness adapt_arg() can materialize ListNode/TreeNode - spawn _case_runner.py per case from main.py so a per-case subprocess.run(timeout=...) SIGKILLs a runaway case instead of poisoning the rest of the batch; the verdict is parsed from the child's stdout and a non-zero exit becomes a per-case Runtime Error verdict - add isJavaCompileFailure() to SandboxServiceImpl so javac failures surfaced from the `javac && java` pipeline are classified as Compile Error instead of Runtime Error
…tory with 13 updates Bumps the management-development group with 13 updates in the /management directory: | Package | From | To | | --- | --- | --- | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.9.1` | `25.9.3` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.7` | `4.1.8` | | [@vitest/ui](https://github.com/vitest-dev/vitest/tree/HEAD/packages/ui) | `4.1.7` | `4.1.8` | | [@vue/eslint-config-typescript](https://github.com/vuejs/eslint-config-typescript) | `14.7.0` | `14.8.0` | | [@vue/test-utils](https://github.com/vuejs/test-utils) | `2.4.10` | `2.4.11` | | [eslint](https://github.com/eslint/eslint) | `10.4.0` | `10.5.0` | | [eslint-plugin-vue](https://github.com/vuejs/eslint-plugin-vue) | `10.9.1` | `10.9.2` | | [knip](https://github.com/webpro-nl/knip/tree/HEAD/packages/knip) | `6.14.2` | `6.16.1` | | [npm-run-all2](https://github.com/bcomnes/npm-run-all2) | `9.0.1` | `9.0.2` | | [prettier](https://github.com/prettier/prettier) | `3.8.3` | `3.8.4` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.0.14` | `8.0.16` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.7` | `4.1.8` | | [vue-tsc](https://github.com/vuejs/language-tools/tree/HEAD/packages/tsc) | `3.3.1` | `3.3.5` | Updates `@types/node` from 25.9.1 to 25.9.3 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@vitest/coverage-v8` from 4.1.7 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/coverage-v8) Updates `@vitest/ui` from 4.1.7 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/ui) Updates `@vue/eslint-config-typescript` from 14.7.0 to 14.8.0 - [Release notes](https://github.com/vuejs/eslint-config-typescript/releases) - [Commits](vuejs/eslint-config-typescript@v14.7.0...v14.8.0) Updates `@vue/test-utils` from 2.4.10 to 2.4.11 - [Release notes](https://github.com/vuejs/test-utils/releases) - [Commits](vuejs/test-utils@v2.4.10...v2.4.11) Updates `eslint` from 10.4.0 to 10.5.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.4.0...v10.5.0) Updates `eslint-plugin-vue` from 10.9.1 to 10.9.2 - [Release notes](https://github.com/vuejs/eslint-plugin-vue/releases) - [Changelog](https://github.com/vuejs/eslint-plugin-vue/blob/master/CHANGELOG.md) - [Commits](vuejs/eslint-plugin-vue@v10.9.1...v10.9.2) Updates `knip` from 6.14.2 to 6.16.1 - [Release notes](https://github.com/webpro-nl/knip/releases) - [Commits](https://github.com/webpro-nl/knip/commits/knip@6.16.1/packages/knip) Updates `npm-run-all2` from 9.0.1 to 9.0.2 - [Release notes](https://github.com/bcomnes/npm-run-all2/releases) - [Changelog](https://github.com/bcomnes/npm-run-all2/blob/master/CHANGELOG.md) - [Commits](bcomnes/npm-run-all2@v9.0.1...v9.0.2) Updates `prettier` from 3.8.3 to 3.8.4 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.8.3...3.8.4) Updates `vite` from 8.0.14 to 8.0.16 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.0.16/packages/vite) Updates `vitest` from 4.1.7 to 4.1.8 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.8/packages/vitest) Updates `vue-tsc` from 3.3.1 to 3.3.5 - [Release notes](https://github.com/vuejs/language-tools/releases) - [Changelog](https://github.com/vuejs/language-tools/blob/master/CHANGELOG.md) - [Commits](https://github.com/vuejs/language-tools/commits/v3.3.5/packages/tsc) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 25.9.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: "@vitest/ui" dependency-version: 4.1.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: "@vue/eslint-config-typescript" dependency-version: 14.8.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: management-development - dependency-name: "@vue/test-utils" dependency-version: 2.4.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: eslint dependency-version: 10.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: management-development - dependency-name: eslint-plugin-vue dependency-version: 10.9.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: knip dependency-version: 6.16.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: management-development - dependency-name: npm-run-all2 dependency-version: 9.0.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: prettier dependency-version: 3.8.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: vite dependency-version: 8.0.16 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: vitest dependency-version: 4.1.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development - dependency-name: vue-tsc dependency-version: 3.3.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: management-development ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/management/management-development-08640df958
branch
June 20, 2026 08:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the management-development group with 13 updates in the /management directory:
25.9.125.9.34.1.74.1.84.1.74.1.814.7.014.8.02.4.102.4.1110.4.010.5.010.9.110.9.26.14.26.16.19.0.19.0.23.8.33.8.48.0.148.0.164.1.74.1.83.3.13.3.5Updates
@types/nodefrom 25.9.1 to 25.9.3Commits
Updates
@vitest/coverage-v8from 4.1.7 to 4.1.8Release notes
Sourced from @vitest/coverage-v8's releases.
Commits
e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...Updates
@vitest/uifrom 4.1.7 to 4.1.8Release notes
Sourced from @vitest/ui's releases.
Commits
e61f2ddchore: release v4.1.8Updates
@vue/eslint-config-typescriptfrom 14.7.0 to 14.8.0Release notes
Sourced from @vue/eslint-config-typescript's releases.
Commits
e16940914.8.0ac937a3chore: align redefine-plugin-vue fixture depsd003778docs: document includeDotFolders optiondd31946chore(deps): lock file maintenance (#301)0d40d25chore(deps): lock file maintenance (#296)08da67cchore(deps): update dependency@quasar/extrasto v2 (#299)eda6e41chore(deps): update v0.x to ^0.14.1 (#298)735c0ddchore(deps): update dependency vite to ^8.0.14 (#295)c065c57chore(deps): update all non-major dependencies (#297)f3bc5cechore(deps): update dependency npm-run-all2 to v9 (#300)Updates
@vue/test-utilsfrom 2.4.10 to 2.4.11Release notes
Sourced from @vue/test-utils's releases.
Commits
5e48e1ev2.4.11b73ee1dchore(deps): update dependency oxfmt to v0.53.039e32ecchore(deps): update all non-major dependencies to v17.0.7 (#2881)0621772chore(deps): update actions/checkout digest to df4cb1c (#2880)81fde07chore(deps): update all non-major dependencies (#2879)4ad4255chore(deps): update dependency oxfmt to v0.52.0 (#2878)8d3d26echore(deps): update pnpm to v11.3.0 (#2877)bc79effchore(deps): update all non-major dependencies (#2876)58db8f7chore(deps): update all non-major dependencies (#2874)9ad31cbchore: enable renovate minimum release age for npmUpdates
eslintfrom 10.4.0 to 10.5.0Release notes
Sourced from eslint's releases.
... (truncated)
Commits
de3b67210.5.0362a518Build: changelog update for 10.5.05ca8c52feat: correct stack tracking in max-nested-callbacks (#20973)b565783feat: report no-with violations at the with keyword (#20971)2ce032ffeat: report max-lines-per-function violations at function head (#20966)732cb3efeat: report max-nested-callbacks violations at function head (#20967)f9c138afeat: report max-depth violations on keywords (#20943)8ae1b5bdocs: Update READMEca7eb90docs: update Node.js prerequisites to include ICU support (#20962)b18bf58chore: update ecosystem plugins (#20959)Updates
eslint-plugin-vuefrom 10.9.1 to 10.9.2Release notes
Sourced from eslint-plugin-vue's releases.
Changelog
Sourced from eslint-plugin-vue's changelog.
Commits
9aa463aVersion Packages (#3080)517347cAdd error positions (#3085)b582b7efix: false positive for returns in exhaustive switch (#3067)91a136cfix(one-component-per-file): Ignore members imported from elsewhere (#3063)d37d17bfix(prefer-import-from-vue): don't report names not exported by vue (#3081)836aa95fix(custom-event-name-casing): check segments of colon-separated names (#3079)Updates
knipfrom 6.14.2 to 6.16.1Release notes
Sourced from knip's releases.
... (truncated)
Commits
a3169ecRelease knip@6.16.1370ef4cResolve SvelteKit ./$types in monorepos (resolve #1778)e9a5a64Release knip@6.16.08a37f8cAdd Catalyst plugin to credit bare@controllercustom elements152d730Improve Stencil plugin: credit@Componentand recognize test filesd7cbe12Credit custom elements via aliases, scoped registries, and static blocksd14eb05Fix backtick string literals in require() and plugin-name config arrays (#1776)f1adc7fFix crash on backtick string literals in plugin config (resolve #1776)94632cdScope static custom-element define detection to the FAST pluginba6865dSimplify boolean check in parseArgs adapterUpdates
npm-run-all2from 9.0.1 to 9.0.2Release notes
Sourced from npm-run-all2's releases.
Changelog
Sourced from npm-run-all2's changelog.
Commits
ed22aa99.0.29fa0e66fix: update Node.js version requirements (#232)604c2a4Upgrade: Bump codecov/codecov-action from 6 to 7 (#233)5812591fix: bump shell-quote to ^1.8.4 (#236)d4b4211Upgrade: Bump pidtree from 0.6.1 to 1.0.0 (#234)Updates
prettierfrom 3.8.3 to 3.8.4Release notes
Sourced from prettier's releases.
Changelog
Sourced from prettier's changelog.
Commits
1c6ba55Release 3.8.44a673dcFix blank lines between list items and nested sub-lists being removed in Mark...074aaedReplacemainbranch in changelog link with tags (#19054)c22a003Bump Prettier dependency to 3.8.307bad1fClean changelog_unreleasedUpdates
vitefrom 8.0.14 to 8.0.16Release notes
Sourced from vite's releases.
Changelog
Sourced from vite's changelog.
Commits
f94df87release: v8.0.16dc245c7fix: reject windows alternate paths (#22572)50b9512fix(deps): reject UNC paths for launch-editor-middleware (#22571)8d1b019release: v8.0.152686d7dfix(deps): update all non-major dependencies (#22511)3052a67chore(deps): update rolldown-related dependencies (#22566)e3cfb9dfix(optimizer): close the rolldown bundle when write() rejects (#22528)6978a9crefactor: correct logic incollectAllModulesfunction (#22562)646dbedfeat: update rolldown to 1.0.3 (#22538)85a0efffix: capitalize error messages and remove spurious space in parse error (#22488)Updates
vitestfrom 4.1.7 to 4.1.8Release notes
Sourced from vitest's releases.
Commits
e61f2ddchore: release v4.1.8e4067b3fix(browser): disable clientcdpAPI whenallowWrite/allowExec: false[ba...Updates
vue-tscfrom 3.3.1 to 3.3.5Release notes
Sourced from vue-tsc's releases.
... (truncated)
Changelog
Sourced from vue-tsc's changelog.
Commits
2fe255cv3.3.5 (#6102)043a77bv3.3.4 (#6095)5c41b5fv3.3.3 (#6079)7a00047v3.3.2 (#6068)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditions