chore(deps): bump the management-production group across 1 directory with 13 updates - #74
Closed
dependabot[bot] wants to merge 1203 commits into
Closed
Conversation
Replace fu-* prefixed forum user IDs with real users table IDs (u-admin-001, user-alice-001, etc.) in seed data and add migration to update existing references across forum tables.
Fix system module keys (backup, email, monitoring) that were silently failing due to missing `system.` prefix. Add missing en-US/zh-CN keys for contests, problems, solutions, users, and errors. Move error type keys under `errors.errorType` namespace.
Add i18n keys for stats labels, page titles, status badges, and common UI text across contests, notifications, problem lists, and moderation modules. Includes both en-US and zh-CN locales.
Add CI job for management i18n completeness and naming convention checks. Enhance check.ts with code-to-locale coverage scanning and JSON output for CI consumption. Add i18n-coverage and naming-convention test suites. Add fallback values to all dynamic t() calls per design spec. Remove dead snake_case keys from dashboard locale. Document conventions in docs/i18n-design.md.
Introduce SemanticBadge component and semantic-maps for consistent terminal-style badges across console and management frontends. Replace scattered Badge variant mappings and inline CSS with centralized SemanticColor system. Update ContestStatusBadge, entity helpers, and audit views to use the new unified badge API.
Replace duplicate semantic-maps.ts and semantic-types.ts definitions in console and management frontends with re-exports from the new shared/badge-config module. This completes Phase 0 of the badge unification plan.
Replace hardcoded Tailwind colors with terminal CSS variables and consolidate ProblemListVisibility color map into the shared config. Also apply Prettier formatting to entity files.
Add MIT License and comprehensive Chinese README. Translate all Flyway seed data (user names, comments, problem titles, audit logs, contest descriptions) from English to Chinese.
Delete the admin /billing page and all its wiring: - views/billing/BillingView.vue - i18n modules billing.ts (en + zh) - i18n index.ts module registrations - nav.billing translation key (en + zh) - router route path/name/component/meta - NavUser dropdown menu item + IconCreditCard import Validation: - pnpm type-check: pass - pnpm lint: pass (no new warnings) - pnpm validate:i18n-keys: pass (All keys found) - pnpm vitest run: 233 passed, 0 failed - grep residue: 0 hits for billing|Billing
Removes the management frontend /billing view, route, i18n module, and user-menu entry. Console subscription, backend subscription module, and unrelated admin 'subscription' references are intentionally left intact (see PR #N conversation for scope rationale). Reviewed via ecc:code-review (Local Review Mode) — APPROVE, 0 findings.
…time errors
OJ submissions occasionally surfaced 'sh: 0: Cannot fork' inside the Docker
sandbox, which the previous verdict logic misclassified as 'Runtime Error'.
This made ops triage harder: a host/cgroup/seccomp pressure signal was
indistinguishable from a real user-program bug.
Changes:
- SandboxServiceImpl: split fork-failure detection into two scopes with
distinct semantics.
- isSandboxForkFailure(String output): detects sandbox-internal fork
failures from merged stdout/stderr (busybox sh 'Cannot fork',
glibc/dockerd 'Resource temporarily unavailable', kernel
'fork: Cannot allocate memory'). Returned verdict is now 'Sandbox
Error' with detail prefix 'Sandbox fork failed (likely
PID/cgroup/seccomp pressure): ...'.
- isDockerDaemonForkFailure(String msg): stricter IOException-side
matcher that avoids false-positives on docker daemon configuration
warnings containing 'pids'. Accepts only unambiguous fork phrases:
'Cannot fork', 'fork: Cannot allocate memory', 'pids-limit
reached', 'cgroup pids limit', 'RLIMIT_NPROC'. Throws
SANDBOX_ERROR with 'Sandbox daemon-level fork failure' prefix.
- Constants extracted (SANDBOX_FORK_FAILURE_VERDICT,
SANDBOX_FORK_FAILURE_DETAIL_PREFIX, MAX_LOG_DETAIL_BYTES) to remove
duplicated magic strings and bound log payload size via
truncateForLog(String).
- SandboxServiceImplTest: +16 BCDE tests covering both matchers,
parameterized markers, and false-positive guards for docker daemon
config warnings.
- i18n (console + management, en-US + zh-CN): added 'Sandbox Error' /
'沙箱错误' under status.sandboxError (console) and
statusLabels.SANDBOX_ERROR (management) so the new verdict renders
consistently across locales.
- docs/CODEMAPS/sandbox.md: codifies resource limit matrix, both
fork-failure classification paths, i18n key table, and the 2026-06-12
diagnostic finding that --pids-limit=128 is empirically sufficient
for current sandbox images (H1 of the original PRP plan refuted).
Diagnostic context: see .claude/PRPs/reports/oj-sandbox-cannot-fork-diagnose-report.md.
The accompanying plan (.claude/PRPs/plans/oj-sandbox-cannot-fork-diagnose.plan.md)
and report remain gitignored per .claude/PRPs/ tree convention.
…fication Implements the verdict classification improvements from .claude/PRPs/plans/oj-sandbox-cannot-fork-diagnose.plan.md after the 2026-06-12 H1 refutation (--pids-limit=128 empirically sufficient). See commit 6f8f36b for the full diff and .claude/PRPs/reports/oj-sandbox-cannot-fork-diagnose-report.md for diagnostic context.
Move success feedback responsibility to UI callers in account API to prevent duplicate notifications. Add unit tests verifying toast.success is not invoked on updateProfile or changePassword.
…se 1)
Per the agreed sandbox refactor plan, replace the in-source 950-line String
constants in CodeExecutionHelperImpl with a real harness project that will
later be compiled into the sandbox image (Phase 2). Phase 1 is harness
code only — zero impact on backend, Dockerfile, or DB.
Java harness: 39/39 tests pass (31 HarnessTest unit + 8 MainE2ETest end-to-end).
- JSON parser/serializer, argument adapter, ListNode/TreeNode helpers
- Reflective Solution invocation, per-case worker thread with soft TLE
- User System.out capture so envelope JSON is never contaminated
- Default-package classes to match LeetCode's zero-import convention
Python harness: 7/7 pytest pass.
- Same envelope contract; uses inspect.signature for ListNode/TreeNode hints
C/C++ harness: smoke skeleton (gcc/g++ build verified).
- Full impl in later phase; current binary emits empty envelope JSON
Three real bugs surfaced and fixed by the test suite:
- parseJson("{") caught StringIndexOutOfBoundsException at EOF -> rethrow as IAE
- fromTreeNode using ArrayDeque rejected null offers -> switched to LinkedList
- HarnessTest hit javac Unicode preprocessing on literal \\uXXXX -> built via
char-cast + concatenation so the source contains no backslash-u sequence
…1.5)
- Strict JSON parser: reject leading zero, naked dot, empty exponent,
Infinity/NaN literals, exponent overflow, unescaped control chars,
bareword keys, max depth, trailing data
- Serializer cycle/depth/node-count guards via IdentityHashMap /
id-set; reject non-finite floats in toJson
- Block System.exit AND Runtime.halt via SecurityManager
(checkExit + checkPermission('exitVM.*'))
- Deterministic method dispatch: hint OR single public method;
reject overloads, shadowing, missing
- Per-case jsonable try/catch so cyclic / NaN results surface as
Runtime Error instead of harness panic
- Mirror all of the above in Python harness (os._exit / sys.exit
blocked, type_override honored, allow_nan=False, SystemExit -> RE)
- 23 new Java + 11 new Python adversarial tests covering each fix
- Add -Djava.security.manager=allow to test ProcessBuilder so
SecurityManager installs on JDK 18+ (the harness image pins
JDK 17 where it is a no-op)
Java 68/68 + Python 18/18 green.
- New multi-stage Dockerfile: pre-compiled harness artifacts from
harness-staging/ get COPYed into /opt/harness/{java,python,c,cpp}/
in the runtime image. Base is ulticode-sandbox:latest (which already
carries JDK 17 + python3 + gcc + g++) so no apt mirror dependency.
- harness/build.sh: host-side driver that runs mvn compile /
py_compile / gcc / g++ and populates harness-staging/. CI calls
this ahead of 'docker build'.
- .dockerignore: keeps target/, __pycache__/, *.pyc, harness-staging/
out of the build context.
- application.yml: code-execution.sandbox.d-form.{enabled,harness-root}
flags (env-overridable). enabled defaults to false until Phase 3
wires CodeExecutionHelperImpl to the new dispatch path; Phase 5
deletes the legacy Form A wrappers.
- harness-staging/ added to .gitignore (regenerated by build.sh).
Verified: 4-language sanity check
- C / C++: pre-compiled smoke binaries print valid empty envelope
- Java: add(2,3)=5 → 'Accepted'
- Python: add(2,3)=5 → 'Accepted' (SOLUTION_DIR=/job)
1. [critical] .dockerignore negated to re-include harness-staging/
The Dockerfile COPYs harness-staging/{java,python,c,cpp} but the
previous .dockerignore excluded both that directory and *.class
files, so 'docker build' could not see the artifacts and failed.
Re-included the staging dir with explicit negation rules after
the generic artifact patterns.
2. [high] FROM a separately-pinned base image
ulticode-sandbox:latest is the project's rolling sandbox tag and
also the natural output name for this Dockerfile — a self-cycle
that would silently inherit whatever the host happened to have.
Switched FROM to ulticode-sandbox:base-17 (JDK 17 pinned). Added
a first-time-setup hint in harness/build.sh that checks for the
tag and tells the user to docker tag or rebuild the base.
3. [high] TreeNode cycle guard + node cap
fromTreeNode did BFS without identity tracking, so a user result
like root.left = root would grow the queue and output until the
process was killed. Added IdentityHashMap-based cycle detection
+ MAX_JSONABLE_NODES cap, throws IAE so the per-case path can
convert to Runtime Error (envelope stays well-formed).
New tests: self-cycle, mutual cycle, node cap exceeded.
4. [medium] Output-size cap enforced incrementally
The 8 MiB MAX_JSON_OUTPUT_BYTES check was only at writeJson entry;
a single large String or map key bypassed it. Added post-append
assertions in writeNumber and writeString, so the cap kicks in
mid-serialize rather than after recursion unwinds.
New tests: oversized string scalar, oversized map key.
Java 73/73 (was 68, +5 adversarial) and Python 18/18 both green.
Verified: clean-context docker build (no cache) succeeds with the
new FROM tag, all 4-language sanity checks still pass.
Backend now has two execution paths inside SandboxServiceImpl, gated by
code-execution.sandbox.d-form.enabled (default false until rollout):
A-path (legacy Form A): unchanged — buildWrapperScript() builds a
per-request bash wrapper string, parseBatchResults() parses its stdout.
Both kept around for Phase 5 rollback / per-language fallback.
D-path (LeetCode/HackerRank): materializeDFormJob() writes
input.json + Solution.{java,py,c,cpp} to a per-run temp dir,
buildDDockerCommand() mounts it :ro at /job, and the pre-compiled
harness in the sandbox image (Phase 2) compiles+executes the user
code. stdout JSON envelope is parsed by helper.parseDEnvelope()
into per-case RunCaseResults with the legacy verdict spellings
(Accepted / Wrong Answer / Runtime Error / Time Limit Exceeded).
New DTOs (MapStruct not used; Jackson trees):
- EnvelopeDTO : {harness_version, language, exit_code,
total_elapsed_ms, results[]}
- PerCaseResultDTO: {case_id, label, elapsed_ms, status, result,
interrupted, error, user_stdout, user_stderr}
- InputSpecDTO : {name, value, type} (forward-compat for
Phase 4 problem_method_signature.type)
Timeouts:
- perCaseTimeoutMs (soft): forwarded in input.json; harness uses
Thread.interrupt on the executor worker
- dFormHardTimeoutSeconds (hard): ProcessBuilder.waitFor + destroyForcibly
in SandboxServiceImpl
- Currently 1s soft / 10s hard defaults; tunable in CodeExecutionHelper
CodeExecutionHelper interface gained 3 methods + DFORM_SUPPORTED_LANGUAGES.
DockerSandboxConfig record gained the nested DForm record + dFormEnabled/
dFormHarnessRoot accessors. SandboxServiceImplTest updated to pass null
for d-form (keeps the existing Form A path under test).
Verification: 36/36 sandbox tests pass (CodeExecutionHelperImpl 11,
SandboxServiceImpl 20, CodeExecutionService 5). Other 8+2 test
failures in this mvn test run are pre-existing issues in
contest/admin modules (missing ContestProblemMapper bean, SQL
'key' reserved-word syntax error) — unrelated to this change.
No production image build step run yet (Phase 2 already shipped
ulticode-sandbox:base-17; to enable D-form in a deployed env, set
SANDBOX_DFORM_ENABLED=true and rebuild the d-form image:
./docker/sandbox/harness/build.sh
docker build -t ulticode-sandbox-dform:phase2 docker/sandbox/
docker tag ulticode-sandbox-dform:phase2 ulticode-sandbox:latest
).
Three blocking defects flagged by the Phase 3 review:
1. [critical] Java compilation failed against :ro mount
The dispatcher ran 'javac -d .' from inside the :ro /job mount,
which made every Java D-form submission return Runtime Error.
Moved compilation to /tmp/classes (writable) and prepended it
on the runtime classpath. Also pass -Djava.security.manager=allow
so the harness can install its SecurityManager on JDK 18+.
2. [critical] C and C++ D-form dispatch never reached a harness
The C/C++ dispatchers in dFormDispatchShell() compiled user source
and ran the binary, but the harness images at
docker/sandbox/harness/{c,cpp}/ are still Phase 1 smoke skeletons
that don't read input.json. Enabling D-form would silently
break C/C++ judging for users whose Solution is the typical
library-style code (no main()). Trimmed
DFORM_SUPPORTED_LANGUAGES to {java, python} for now; C/C++ re-add
with a follow-up that ships envelope-producing harnesses.
3. [high] waitFor-before-read pipe deadlock
Both executeInSandboxD and executeBatchD called process.waitFor()
before process.getInputStream().readAllBytes(). With merged-error
stdout, the kernel pipe is only 64 KiB; a batch envelope with
100 cases × (verdict + 64 KiB user_stdout) easily exceeds that,
and the harness blocks on write() while the backend blocks on
waitFor() — false TLE for otherwise valid runs.
New runDProcess() helper spawns a daemon reader thread that
drains the merged pipe into a bounded ByteArrayOutputStream
(DFORM_OUTPUT_BUDGET_BYTES = 8 MiB + 128 KiB headroom). The
reader closes the InputStream on budget overflow so the harness
unblocks. waitFor joins the reader with a 2s grace window.
BOTH single-case and batch dispatch now go through runDProcess.
Verification: 36/36 sandbox tests pass (CodeExecutionHelperImpl 11,
SandboxServiceImpl 20, CodeExecutionService 5).
Frontends now have a single source of truth for the D-form sandbox
contract. Mirrors the backend's EnvelopeDTO / PerCaseResultDTO /
InputSpecDTO records (Phase 3).
shared/sandbox-types/ exports:
- DFormVerdict (the full verdict set, including legacy
Form A spellings the backend maps to)
- DFormHarnessVerdict (narrow — what the D-form harness actually
emits; subset of DFormVerdict)
- DFormVerdictCategory ('success' | 'error' | 'warning' |
'pending' | 'system' for UI styling)
- OJDataType ('int' | 'long' | 'double' | 'boolean' |
'String' | 'int[]' | 'int[][]' |
'long[]' | 'String[]' | 'ListNode' |
'ListNode[]' | 'TreeNode' | 'TreeNode[]')
- DFormInputSpec ({name, value, type?}) — the per-case
argument shape the harness reads
- DFormPerCaseResult ({case_id, label, elapsed_ms, status,
result, interrupted?, error?, user_stdout?,
user_stderr?})
- DFormEnvelope (top-level: {harness_version, language,
exit_code, total_elapsed_ms, results[]})
- verdictCategory(status) helper
- SUPPORTED_OJ_DATA_TYPES, isSupportedOJDataType, isDFormInputSpec
Each frontend gets a thin re-export shim:
console/src/types/sandbox.ts
management/src/types/sandbox.ts
so consumers can do
import type { DFormEnvelope, DFormPerCaseResult } from '@/types/sandbox'
without caring about the symlink path.
Per CLAUDE.md: 'shared/auth-core/ 改动必须在该包内跑 pnpm test +
pnpm type-check, 并在两个前端验证.' This package has no test
suite yet (pure types); type-check is the gate.
Verification:
shared/sandbox-types: created; tsc config in tsconfig.json
console: pnpm type-check passes
management: pnpm type-check passes
Cross-stack audit (manual, per cross-stack-dto-granularity-alignment
skill's checklist):
- backend EnvelopeDTO ↔ shared DFormEnvelope
Both carry {harness_version, language, exit_code,
total_elapsed_ms, results[]}. Field names match the JSON
snake_case the harness emits.
- backend PerCaseResultDTO ↔ shared DFormPerCaseResult
Same field set; backend maps the JSON into a Map first
then constructs the record. Both use the same verdict
strings; no enum mismatch.
- backend InputSpecDTO ↔ shared DFormInputSpec + OJDataType
Backend validates type against DFORM_TYPES at submission
time. Shared OJDataType union is the authoritative list;
backend's DFORM_TYPES constant is in lockstep (any new
type must be added to both).
The fields are intentionally compatible with what the harness
emits; no transformations are needed at the cross-stack boundary
beyond the verdict spellings the backend already normalizes.
… 4.5) Two cross-stack contract defects flagged by the Phase 4 review: 1. [high] DFormInputSpec.type never reached the harness The shared DTO advertised a 'type' field with a comment saying the harness prefers it over a Java annotation, but the CodeExecutionHelperImpl.buildDInputSpecs helper only serialized name + value, leaving the hint silently dropped. A frontend that populated type=ListNode for an unannotated Python user would have the value arrive as a raw list and crash on .next access at runtime. Fix: add 'type' field to RunInput DTO record and forward it in buildDInputSpecs when set and recognized by DFORM_TYPES. The field stays nullable for backward-compat with existing API callers; missing / blank / unknown types are omitted so the harness falls back to whatever the annotation says. 2. [medium] isDFormInputSpec accepted malformed input The shared type guard returned true after checking only that name and value were strings, accepting blank names (which the backend's InputSpecDTO record explicitly rejects) and arbitrary 'type' strings (which the backend silently drops). Callers using the guard at a trust boundary would accept data that fails later in the submission flow. Fix: require non-blank-after-trim name; require any present 'type' to pass isSupportedOJDataType. Added 16 negative tests (non-object, null, missing name, blank name, non-string fields, unsupported type, wrong-case type, trailing space) in shared/sandbox-types/src/input-spec.spec.ts. Verification: shared/sandbox-types: 16/16 vitest pass; tsc clean backend-spring: mvn compile clean console: pnpm type-check clean management: pnpm type-check clean
D-form (LeetCode/HackerRank harness) is now the default submission
dispatch path. The legacy Form A (per-request bash wrapper) remains
in CodeExecutionHelperImpl as a fallback gated by the d-form.enabled
flag for any deployment that needs to roll back.
To roll back: set SANDBOX_DFORM_ENABLED=false (or unset the env var
override in application.yml).
What D-form brings by default:
- Per-case verdict from a single static input.json contract
(no more 950-line Form A wrapper String templates)
- IdentityHashMap cycle guards, NaN rejection, output-size
caps inside the harness (Phase 1.5)
- Pre-compiled harness in the runtime image (Phase 2)
- Java + Python only (C/C++ D-form dispatch is gated out until
those harnesses ship envelope-producing executors)
- Soft TLE (Thread.interrupt) + hard TLE (ProcessBuilder
.waitFor + destroyForcibly) with concurrent stdout drainer
Verification:
backend-spring: 36/36 sandbox tests pass
console: pnpm type-check clean (lint clean)
management: pnpm type-check clean (27 pre-existing lint
errors in __tests__/error.test.ts and various
unused-import component files, unrelated to
this change)
No i18n additions required: console + management already ship
verdict labels for all DFormVerdict members (Accepted, Wrong
Answer, Runtime Error, Time Limit Exceeded, Compile Error,
Sandbox Error, System Error, ...) in both en-US and zh-CN.
These were already wired in the original StatusMeta/SubmissionStatusKey
i18n modules.
Phase 5b tears out the per-request bash wrapper generator and the
Form A path in the sandbox dispatcher. D-form (LeetCode/HackerRank
harness) is now the sole execution mode.
Code execution:
- CodeExecutionHelper interface: 100 → 53 lines
Removed: buildWrapperScript, buildBatchInputsJson,
parseBatchResults, wrapJavaScript, wrapPython, wrapJava,
buildInputsJson (10 method declarations).
Kept: buildDInputsJson, buildDBatchInputsJson, parseDEnvelope,
plus utility helpers (parseRuntimeMs, normalizeOutput,
sanitizeSandboxOutput, extractFunctionName, emptyResult,
buildCaseResult).
- CodeExecutionHelperImpl: 893 → 236 lines (-657)
Removed: 12 method bodies including the giant 950-line
PYTHON_BATCH_WRAPPER / JAVA_BATCH_WRAPPER / JAVA_JSON_PARSER
String-template constants, the 5 buildXxxBatchWrapper methods,
the embedded Java JSON parser/serializer, parseBatchResults,
the 3 wrapXxx methods, buildInputsJson, parseInputValue.
Kept + restored: extractFunctionName + parseRuntimeMs (still
used by the controller / other modules).
Sandbox dispatch:
- SandboxService interface: 60 → 36 lines
Removed: buildDockerCommand + buildBatchDockerCommand
(Form A only; D-form composes its docker command internally).
- SandboxServiceImpl: 679 → 320 lines (-360)
Removed: useDForm gate, A-path bodies in executeInSandbox and
executeBatch, buildDockerCommand, buildBatchDockerCommand.
Kept: D-form executeInSandbox / executeBatch (now the only
paths), materializeDFormJob, dFormDispatchShell,
buildDDockerCommand, runDProcess with the concurrent stdout
drainer (Phase 3.5 CR fix), DFormRunResult.
Test cleanup:
- CodeExecutionHelperImplTest: 333 → 268 lines
Removed 4 A-path test cases (buildPython/Java/C/Cpp batch
wrapper decode / stripPublicModifier). Replaced with 12
D-form-focused cases (buildDInputsJson for single + batch +
type-field wiring + unsupported-type drop; parseDEnvelope for
happy path / per-case error / harness panic / empty stdout /
unparseable JSON / wrong answer; utility helper regressions).
- SandboxServiceImplTest: 193 → 128 lines
Removed 4 A-path test cases (buildBatchDockerCommand for
python / javascript / default-seccomp / relative-seccomp).
Kept the 16 fork-failure detection cases (isSandboxForkFailure
+ isDockerDaemonForkFailure) that exercise the still-used
public static helpers.
Verification:
backend-spring: mvn compile + 36/36 sandbox tests pass
(CodeExecutionHelperImpl 15, SandboxServiceImpl 16,
CodeExecutionService 5)
d-form.enabled : true (default since 095a01f)
Net: 6 files, +402 / -1445 lines, 1043-line legacy deletion.
No further commits planned; Phase 5 done. The D-form rollout is
the only execution path. SANDBOX_DFORM_ENABLED=false no longer
exists in code; rolling back requires reverting this commit.
Plan ref: .claude/PRPs/plans/oj-sandbox-d-form-refactor.plan.md (Phase 5)
- validate language against DFORM_SUPPORTED_LANGUAGES so callers can't slip past the API-advertised SUPPORTED_LANGUAGES - reword the d-form.enabled yml comment to reflect that env var no longer toggles the dispatcher (D-form is always on; rollback is a git revert + image rebuild) - forward item.type into RunInput inside JudgeWorkerProcessor so the harness adapt_arg() can materialize ListNode/TreeNode - spawn _case_runner.py per case from main.py so a per-case subprocess.run(timeout=...) SIGKILLs a runaway case instead of poisoning the rest of the batch; the verdict is parsed from the child's stdout and a non-zero exit becomes a per-case Runtime Error verdict - add isJavaCompileFailure() to SandboxServiceImpl so javac failures surfaced from the `javac && java` pipeline are classified as Compile Error instead of Runtime Error
…with 13 updates Bumps the management-production group with 13 updates in the /management directory: | Package | From | To | | --- | --- | --- | | [@dnd-kit/abstract](https://github.com/clauderic/dnd-kit) | `0.1.21` | `0.5.0` | | [@dnd-kit/dom](https://github.com/clauderic/dnd-kit) | `0.1.21` | `0.5.0` | | [@internationalized/date](https://github.com/adobe/react-spectrum) | `3.12.1` | `3.12.2` | | [@tailwindcss/vite](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/@tailwindcss-vite) | `4.3.0` | `4.3.1` | | [axios](https://github.com/axios/axios) | `1.16.1` | `1.17.0` | | [date-fns](https://github.com/date-fns/date-fns) | `4.3.0` | `4.4.0` | | [dompurify](https://github.com/cure53/DOMPurify) | `3.4.5` | `3.4.10` | | [markdown-it](https://github.com/markdown-it/markdown-it) | `14.1.1` | `14.2.0` | | [reka-ui](https://github.com/unovue/reka-ui) | `2.9.8` | `2.9.10` | | [tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss) | `4.3.0` | `4.3.1` | | [vue](https://github.com/vuejs/core) | `3.5.34` | `3.5.38` | | [vue-i18n](https://github.com/intlify/vue-i18n/tree/HEAD/packages/vue-i18n) | `11.4.4` | `11.4.5` | | [vue-router](https://github.com/vuejs/router) | `5.0.4` | `5.1.0` | Updates `@dnd-kit/abstract` from 0.1.21 to 0.5.0 - [Release notes](https://github.com/clauderic/dnd-kit/releases) - [Commits](https://github.com/clauderic/dnd-kit/compare/@dnd-kit/abstract@0.1.21...@dnd-kit/abstract@0.5.0) Updates `@dnd-kit/dom` from 0.1.21 to 0.5.0 - [Release notes](https://github.com/clauderic/dnd-kit/releases) - [Commits](https://github.com/clauderic/dnd-kit/compare/@dnd-kit/dom@0.1.21...@dnd-kit/dom@0.5.0) Updates `@internationalized/date` from 3.12.1 to 3.12.2 - [Release notes](https://github.com/adobe/react-spectrum/releases) - [Commits](https://github.com/adobe/react-spectrum/compare/@internationalized/date@3.12.1...@internationalized/date@3.12.2) Updates `@tailwindcss/vite` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/@tailwindcss-vite) Updates `axios` from 1.16.1 to 1.17.0 - [Release notes](https://github.com/axios/axios/releases) - [Changelog](https://github.com/axios/axios/blob/v1.x/CHANGELOG.md) - [Commits](axios/axios@v1.16.1...v1.17.0) Updates `date-fns` from 4.3.0 to 4.4.0 - [Release notes](https://github.com/date-fns/date-fns/releases) - [Commits](date-fns/date-fns@v4.3.0...v4.4.0) Updates `dompurify` from 3.4.5 to 3.4.10 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.4.5...3.4.10) Updates `markdown-it` from 14.1.1 to 14.2.0 - [Changelog](https://github.com/markdown-it/markdown-it/blob/master/CHANGELOG.md) - [Commits](markdown-it/markdown-it@14.1.1...14.2.0) Updates `reka-ui` from 2.9.8 to 2.9.10 - [Release notes](https://github.com/unovue/reka-ui/releases) - [Commits](unovue/reka-ui@v2.9.8...v2.9.10) Updates `tailwindcss` from 4.3.0 to 4.3.1 - [Release notes](https://github.com/tailwindlabs/tailwindcss/releases) - [Changelog](https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md) - [Commits](https://github.com/tailwindlabs/tailwindcss/commits/v4.3.1/packages/tailwindcss) Updates `vue` from 3.5.34 to 3.5.38 - [Release notes](https://github.com/vuejs/core/releases) - [Changelog](https://github.com/vuejs/core/blob/main/CHANGELOG.md) - [Commits](vuejs/core@v3.5.34...v3.5.38) Updates `vue-i18n` from 11.4.4 to 11.4.5 - [Release notes](https://github.com/intlify/vue-i18n/releases) - [Changelog](https://github.com/intlify/vue-i18n/blob/master/CHANGELOG.md) - [Commits](https://github.com/intlify/vue-i18n/commits/v11.4.5/packages/vue-i18n) Updates `vue-router` from 5.0.4 to 5.1.0 - [Release notes](https://github.com/vuejs/router/releases) - [Commits](vuejs/router@v5.0.4...v5.1.0) --- updated-dependencies: - dependency-name: "@dnd-kit/abstract" dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: management-production - dependency-name: "@dnd-kit/dom" dependency-version: 0.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: management-production - dependency-name: "@internationalized/date" dependency-version: 3.12.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: "@tailwindcss/vite" dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: axios dependency-version: 1.17.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: management-production - dependency-name: date-fns dependency-version: 4.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: management-production - dependency-name: dompurify dependency-version: 3.4.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: markdown-it dependency-version: 14.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: management-production - dependency-name: reka-ui dependency-version: 2.9.10 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: tailwindcss dependency-version: 4.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: vue dependency-version: 3.5.38 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: vue-i18n dependency-version: 11.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: management-production - dependency-name: vue-router dependency-version: 5.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: management-production ... Signed-off-by: dependabot[bot] <support@github.com>
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
Contributor
Author
|
Looks like these dependencies are updatable in another way, so this is no longer needed. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/management/management-production-86ff0246f9
branch
June 20, 2026 08:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the management-production group with 13 updates in the /management directory:
0.1.210.5.00.1.210.5.03.12.13.12.24.3.04.3.11.16.11.17.04.3.04.4.03.4.53.4.1014.1.114.2.02.9.82.9.104.3.04.3.13.5.343.5.3811.4.411.4.55.0.45.1.0Updates
@dnd-kit/abstractfrom 0.1.21 to 0.5.0Release notes
Sourced from @dnd-kit/abstract's releases.
... (truncated)
Commits
cc98bddMerge pull request #2022 from clauderic/changeset-release/mainf2b2135Version Packages32d2c66Merge pull request #2067 from Philipp91/patch-18691737Merge pull request #2074 from timagixe/issues/2065c04d797Merge pull request #2079 from silence717/fix/parse-transform-undefined051fec0Merge pull request #2063 from albertonoys/fix/docs-navigation-linkse4792f3fix(dom): guard parseScale/parseTranslate against undefined transform valuese4d1a7eSupply correct Options type in return type of plugin configurator()90ddfcdfix(helpers): support numeric group IDs in grouped move737d3e5fix(docs): fix malformed navigation links in plugins and sensors sectionMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@dnd-kit/abstractsince your current version.Updates
@dnd-kit/domfrom 0.1.21 to 0.5.0Release notes
Sourced from @dnd-kit/dom's releases.
... (truncated)
Commits
cc98bddMerge pull request #2022 from clauderic/changeset-release/mainf2b2135Version Packages32d2c66Merge pull request #2067 from Philipp91/patch-18691737Merge pull request #2074 from timagixe/issues/2065c04d797Merge pull request #2079 from silence717/fix/parse-transform-undefined051fec0Merge pull request #2063 from albertonoys/fix/docs-navigation-linkse4792f3fix(dom): guard parseScale/parseTranslate against undefined transform valuese4d1a7eSupply correct Options type in return type of plugin configurator()90ddfcdfix(helpers): support numeric group IDs in grouped move737d3e5fix(docs): fix malformed navigation links in plugins and sensors sectionMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for
@dnd-kit/domsince your current version.Updates
@internationalized/datefrom 3.12.1 to 3.12.2Release notes
Sourced from @internationalized/date's releases.
Commits
791377fPublish7840603chore: update test util page badges (#10123)2cea5b5chore: update circleci resource classes (#10119)83e5b53chore: Omit calendar features from v3 (#10122)2c18eb6fix: Custom 454 Calendar month (#10115)ed9170ffix: ensure Tableview and ListView render their dividers and borders with the...6206fc3chore: Only export DragPreview from useDragAndDrop subpath (#10114)8e4498fdocs: add api section with slots to DragPreview (#10113)719ebb2fix: optimize locales not tree-shaking react-stately intl messages (#10111)3547c08fix: stabilise our flaky CI jobs (#10106)Updates
@tailwindcss/vitefrom 4.3.0 to 4.3.1Release notes
Sourced from @tailwindcss/vite's releases.
Changelog
Sourced from @tailwindcss/vite's changelog.
Commits
8a14a714.3.1 (#20226)73983e1Fix 'Sourcemap is likely to be incorrect' warnings when using `@tailwindcss/v...Updates
axiosfrom 1.16.1 to 1.17.0Release notes
Sourced from axios's releases.
Changelog
Sourced from axios's changelog.
Commits
4306df2chore: add fun 88 sponsorship931cc8fchore(release): prepare release 1.17.0 (#10983)38ba1b3fix(fetch): support basic auth from URL (#10896)32e2515fix: replace ternary side effect in script (#10931)030e722chore(deps): bump axios from 1.15.2 to 1.16.1 in /docs (#10960)ec63164chore: remove openspec (#10958)3dec28ffix(http): preserve TLS options for proxy tunnels (#10957)a2390a5fix: correct isCancel type to narrow to CanceledError<T> (#10952)fa01b92chore(deps-dev): bump tmp from 0.2.5 to 0.2.7 in /docs (#10954)2d2314afix: AxiosHeaderstoJSON()return types (#10956)Updates
date-fnsfrom 4.3.0 to 4.4.0Release notes
Sourced from date-fns's releases.
Commits
cd53d25Promote to v4.4.0d948ec1Preserve but deprecate CDN versions for v4, set up v5 with polyfillsee65753Add rootmise :formattask9f5bdf5Add positional argument totest/smoke.shscript651ead6Split CDN bundles into separate@date-fns/cdnpackage224c1a2Deprecate type tests as attw hangs on date-fns package7bb2842SwitchPACKAGE_OUTPUT_PATHto--distflag in the package build scriptb6ad5acAdd flags to control package build script424a783Fix docs release after moving to monorepo setupUpdates
dompurifyfrom 3.4.5 to 3.4.10Release notes
Sourced from dompurify's releases.