Skip to content

chore(deps): bump the management-production group in /management with 5 updates - #9

Closed
dependabot[bot] wants to merge 0 commit into
mainfrom
dependabot/npm_and_yarn/management/management-production-8b16707186
Closed

chore(deps): bump the management-production group in /management with 5 updates#9
dependabot[bot] wants to merge 0 commit into
mainfrom
dependabot/npm_and_yarn/management/management-production-8b16707186

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor

Bumps the management-production group in /management with 5 updates:

Package From To
@dnd-kit/abstract 0.1.21 0.4.0
@internationalized/date 3.12.0 3.12.1
axios 1.14.0 1.15.0
dompurify 3.3.3 3.4.0
reka-ui 2.9.5 2.9.6

Updates @dnd-kit/abstract from 0.1.21 to 0.4.0

Release notes

Sourced from @​dnd-kit/abstract's releases.

@​dnd-kit/abstract@​0.4.0

Minor Changes

  • #1923 cde61e4 Thanks @​clauderic! - Batch entity identity changes to prevent collision oscillation during virtualized sorting.

    When entities swap ids (e.g. as react-window recycles DOM nodes during a drag), multiple registry updates could fire in an interleaved order, causing the collision detector to momentarily see stale or duplicate entries and oscillate between targets.

    Entity id changes are now deferred to a microtask and flushed atomically in a single batch(), ensuring:

    • The collision notifier skips detection while id changes are pending
    • The registry cleans up ghost registrations (stale keys left behind after an id swap)

  • #1915 9b24dff Thanks @​clauderic! - Redesign event type system to follow the DOM EventMap pattern. Introduces DragDropEventMap for event object types and DragDropEventHandlers for event handler signatures, replacing the ambiguously named DragDropEvents. Event type aliases (CollisionEvent, DragStartEvent, etc.) now derive directly from DragDropEventMap rather than using Parameters<> extraction.

    Migration guide

    • DragDropEvents has been split into two types:
      • DragDropEventMap — maps event names to event object types (like WindowEventMap)
      • DragDropEventHandlers — maps event names to (event, manager) => void handler signatures
    • If you were importing DragDropEvents to type event objects, use DragDropEventMap instead: 
      // Before
type MyEvent = Parameters<DragDropEvents<D, P, M>['dragend']>[0];
// After
type MyEvent = DragDropEventMap<D, P, M>['dragend'];
    • If you were importing DragDropEvents to type event handlers, use DragDropEventHandlers instead: 
      // Before
const handler: DragDropEvents<D, P, M>['dragend'] = (event, manager) => {};
// After
const handler: DragDropEventHandlers<D, P, M>['dragend'] = (
  event,
  manager
) => {};
    • The DragDropEvents re-export from @dnd-kit/react and @dnd-kit/solid has been removed. Import DragDropEventMap or DragDropEventHandlers from @dnd-kit/abstract directly if needed.
    • Convenience aliases (CollisionEvent, DragStartEvent, DragEndEvent, etc.) are unchanged and continue to work as before.

  • #1938 e69387d Thanks @​clauderic! - Added per-entity plugin configuration and moved feedback from the Draggable entity to the Feedback plugin.

    Draggable entities now accept a plugins property for per-entity plugin configuration, using the existing Plugin.configure() pattern. Plugins can read per-entity options via source.pluginConfig(PluginClass).

    The feedback property ('default' | 'move' | 'clone' | 'none') has been moved from the Draggable entity to FeedbackOptions. Drop animation can also now be configured per-draggable.

    Plugins listed in an entity's plugins array are auto-registered on the manager if not already present. The Sortable class now uses this generic mechanism instead of its own custom registration logic.

    Migration guide

    The feedback property has been moved from the draggable/sortable hook input to per-entity Feedback plugin configuration.

... (truncated)

Commits
  • ebc564e Merge pull request #1907 from clauderic/changeset-release/main
  • 4f071cb Version Packages
  • 5e7735f Merge pull request #2001 from lixiaoyan/feat/feedback-callback
  • 412047b Merge pull request #2007 from clauderic/chore/upgrade-turborepo
  • cf33af0 chore: remove turborepo agent skill from repo
  • 7a02b46 chore: upgrade turborepo from 2.5.2 to 2.9.0
  • fab49db Merge pull request #2006 from clauderic/claude/docs-mobile-fixes
  • 2d2bb7a Add GitHub icon to mobile header
  • 671a95a Pure CSS CodeGroup tabs — zero JavaScript for tab switching
  • f1423c0 Fix CodeGroup: SSR-only Shiki with DOM-based tab switching
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @​dnd-kit/abstract since your current version.


Updates @internationalized/date from 3.12.0 to 3.12.1

Release notes

Sourced from @​internationalized/date's releases.

React Spectrum S2 v1.3.0

In this release we are excited to announce support for expandable rows in TableView, highlight selection in TreeView, and window scrolling in collection components! Window scrolling enables virtualized collections to automatically scroll with the rest of the page – no height needed. In addition, we've updated the set of available workflow icons, and reduced the number of dependencies installed when using S2 by over 90% – see the full release notes for details.

To help assist with migrations from S1 to S2, we've added a new end to end migration Agent skill that you can use with your agent of choice. Our existing S2 Agent skill has also been updated to greatly improve its ability to select the proper S2 component to use from context, so be sure to update.

Full release notes

React Spectrum S2 v1.2.0

In this release, we are excited to announce that ListView and unavailable menu items are now available! In addition, we have added ActionBar support for TreeView and custom renderer support for the Picker's display value. We also shipped multiple TableView fixes and a set of documentation improvements including a Typography search view now available in the main search menu.

Thanks to all of our contributors for the updates in this release.

Full release notes

React Spectrum S2 v1.1.0

It’s our first release of the new year and we’ve got plenty of exciting treats we’re bringing to the table. We’ve added a variety of new features to our documentation site including a new dark/light mode switch in the site header. Our search menu also now features a Colors section where you can browse the Spectrum-defined colors and search by name or hex value to find close or exact matches. We also now offer our docs in the form of Agent Skills that can be installed locally and used by your favorite AI coding tools.

This release also includes several bugs fixes, such as properly rendering menus when rendered from within a popover and updates to TreeView disabledBehavior styling to match the latest designs.

Full Release Notes

Commits
  • ca74817 Publish
  • 2d2cc15 fix: prevent items from getting continually loaded in S2 TreeView (#9921)
  • beda778 fix: broken compound selector exposed by browserslist bump (Table virtualizer...
  • c7c4c67 fix: v3 docs build (#9919)
  • efc581c fix: nightly packing too many files (#9917)
  • 5c5bda5 docs: improve S2 agent skill (#9908)
  • 988c120 docs: Update RangeCalendar for api consitency, add docs for nonce, and TagGro...
  • 21c4dfb chore: Revert 9875 and move disabledBehavior example in TableView docs (#9914)
  • 9e18b4a chore: fix S2 datepicker errorMessage type (#9909)
  • b65a4aa Revert "fix: make aria test utils helpers work with vitest-browser-react (#97...
  • Additional commits viewable in compare view

Updates axios from 1.14.0 to 1.15.0

Release notes

Sourced from axios's releases.

v1.15.0

This release delivers two critical security patches, adds runtime support for Deno and Bun, and includes significant CI hardening, documentation improvements, and routine dependency updates.

⚠️ Important Changes

  • Deprecation: url.parse() usage has been replaced to address Node.js deprecation warnings. If you are on a recent version of Node.js, this resolves console warnings you may have been seeing. (#10625)

🔒 Security Fixes

  • Proxy Handling: Fixed a no_proxy hostname normalisation bypass that could lead to Server-Side Request Forgery (SSRF). (#10661)
  • Header Injection: Fixed an unrestricted cloud metadata exfiltration vulnerability via a header injection chain. (#10660)

🚀 New Features

  • Runtime Support: Added compatibility checks and documentation for Deno and Bun environments. (#10652, #10653)

🔧 Maintenance & Chores

  • CI Security: Hardened workflow permissions to least privilege, added the zizmor security scanner, pinned action versions, and gated npm publishing with OIDC and environment protection. (#10618, #10619, #10627, #10637, #10666)
  • Dependencies: Bumped serialize-javascript, handlebars, picomatch, vite, and denoland/setup-deno to latest versions. Added a 7-day Dependabot cooldown period. (#10574, #10572, #10568, #10663, #10664, #10665, #10669, #10670, #10616)
  • Documentation: Unified docs, improved beforeRedirect credential leakage example, clarified withCredentials/withXSRFToken behaviour, HTTP/2 support notes, async/await timeout error handling, header case preservation, and various typo fixes. (#10649, #10624, #7452, #7471, #10654, #10644, #10589)
  • Housekeeping: Removed stale files, regenerated lockfile, and updated sponsor scripts and blocks. (#10584, #10650, #10582, #10640, #10659, #10668)
  • Tests: Added regression coverage for urlencoded Content-Type casing. (#10573)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve Axios:

Changelog

Sourced from axios's changelog.

v1.15.0 — April 7, 2026

This release delivers two critical security patches targeting header injection and SSRF via proxy bypass, adds official runtime support for Deno and Bun, and includes significant CI security hardening.

🔒 Security Fixes

  • Header Injection (CRLF): Rejects any header value containing \r or \n characters to block CRLF injection chains that could be used to exfiltrate cloud metadata (IMDS). Behavior change: headers with CR/LF now throw "Invalid character in header content". (#10660)

  • SSRF via no_proxy Bypass: Introduces a shouldBypassProxy helper that normalises hostnames (strips trailing dots, handles bracketed IPv6) before evaluating no_proxy/NO_PROXY rules, closing a gap that could cause loopback or internal hosts to be inadvertently proxied. (#10661)

🚀 New Features

  • Deno & Bun Runtime Support: Added full smoke test suites for Deno and Bun, with CI workflows that run both runtimes before any release is cut. (#10652)

🐛 Bug Fixes

  • Node.js v22 Compatibility: Replaced deprecated url.parse() calls with the WHATWG URL/URLSearchParams API across examples, sandbox, and tests, eliminating DEP0169 deprecation warnings on Node.js v22+. (#10625)

🔧 Maintenance & Chores

  • CI Security Hardening: Added zizmor GitHub Actions security scanner; switched npm publish to OIDC Trusted Publishing (removing the long-lived NODE_AUTH_TOKEN); pinned all action references to full commit SHAs; narrowed workflow permissions to least privilege; gated the publish step behind a dedicated npm-publish environment; and blocked the sponsor-block workflow from running on forks. (#10618, #10619, #10627, #10637, #10641, #10666)

  • Docs: Clarified HTTP/2 support and the unsupported httpVersion option; added documentation for header case preservation; improved the beforeRedirect example to prevent accidental credential leakage. (#10644, #10654, #10624)

  • Dependencies: Bumped picomatch, handlebars, serialize-javascript, vite (×3), denoland/setup-deno, and 4 additional dev dependencies to latest versions. (#10564, #10565, #10567, #10568, #10572, #10574, #10663, #10664, #10665, #10669, #10670)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

Full Changelog

Commits
  • 772a4e5 chore(release): prepare release 1.15.0 (#10671)
  • 4b07137 chore(deps-dev): bump vite from 8.0.0 to 8.0.5 in /tests/smoke/esm (#10663)
  • 51e57b3 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 (#10664)
  • fba1a77 chore(deps-dev): bump vite from 8.0.2 to 8.0.5 in /tests/module/esm (#10665)
  • 0bf6e28 chore(deps): bump denoland/setup-deno in the github-actions group (#10669)
  • 8107157 chore(deps-dev): bump the development_dependencies group with 4 updates (#10670)
  • e66530e ci: require npm-publish environment for releases (#10666)
  • 49f23cb chore(sponsor): update sponsor block (#10668)
  • 3631854 fix: unrestricted cloud metadata exfiltration via header injection chain (#10...
  • fb3befb fix: no_proxy hostname normalization bypass leads to ssrf (#10661)
  • Additional commits viewable in compare view

Updates dompurify from 3.3.3 to 3.4.0

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.0

Most relevant changes:

  • Fixed a problem with FORBID_TAGS not winning over ADD_TAGS, thanks @​kodareef5
  • Fixed several minor problems and typos regarding MathML attributes, thanks @​DavidOliver
  • Fixed ADD_ATTR/ADD_TAGS function leaking into subsequent array-based calls, thanks @​1Jesper1
  • Fixed a missing SAFE_FOR_TEMPLATES scrub in RETURN_DOM path, thanks @​bencalif
  • Fixed a prototype pollution via CUSTOM_ELEMENT_HANDLING, thanks @​trace37labs
  • Fixed an issue with ADD_TAGS function form bypassing FORBID_TAGS, thanks @​eddieran
  • Fixed an issue with ADD_ATTR predicates skipping URI validation, thanks @​christos-eth
  • Fixed an issue with USE_PROFILES prototype pollution, thanks @​christos-eth
  • Fixed an issue leading to possible mXSS via Re-Contextualization, thanks @​researchatfluidattacks and others
  • Fixed an issue with closing tags leading to possible mXSS, thanks @​frevadiscor
  • Fixed a problem with the type dentition patcher after Node version bump
  • Fixed freezing BS runs by reducing the tested browsers array
  • Bumped several dependencies where possible
  • Added needed files for OpenSSF scorecard checks

Published Advisories are here: https://github.com/cure53/DOMPurify/security/advisories?state=published

Commits

Updates reka-ui from 2.9.5 to 2.9.6

Release notes

Sourced from reka-ui's releases.

v2.9.6

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • e5667c2 chore: release v2.9.6
  • 836f2e9 fix(MonthPicker, YearPicker): preserve day/month when selecting (#2594)
  • 1d77296 fix(TimeField): change focus after pressing 0 more than once on hour segment ...
  • fbd9f04 chore(deps): update dependency vite to ^8.0.8 (#2592)
  • 70e7286 fix: export missing TimeRange type (#2590)
  • 68a490b Revert "chore(deps): bump vite from 5.4.21 to 8.0.5 (#2584)"
  • See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot @github

dependabot Bot commented on behalf of github Apr 18, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated, dependencies. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@DavidHLP
DavidHLP force-pushed the dependabot/npm_and_yarn/management/management-production-8b16707186 branch from af0a37d to d345b50 Compare April 18, 2026 06:27
@DavidHLP DavidHLP closed this Apr 18, 2026
@DavidHLP
DavidHLP force-pushed the dependabot/npm_and_yarn/management/management-production-8b16707186 branch from d345b50 to 1547fea Compare April 18, 2026 06:43
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/management/management-production-8b16707186 branch April 18, 2026 06:43
DavidHLP added a commit that referenced this pull request Jul 3, 2026
@DavidHLP @claude
fix(auth): 企业级 Auth/API/Router 架构深度修复
fe87b55 
管理后台鉴权初始化（CRITICAL #1）：
- management/src/main.ts: 新增完整 auth bootstrap 流程
- management/src/stores/auth.ts: 新增 setupSessionExpiredCallback + clearUser

WebSocket Token 安全泄露（CRITICAL #2）：
- console/src/lib/socket.ts: 移除 URL ?token= 参数，token 改走 connectHeaders
- console/src/composables/contest/useContestSocket.ts: 同上

OAuth 重定向 URL 统一（CRITICAL #4）：
- management/src/views/auth/components/OAuthButton.vue: 相对路径→绝对路径

Router Guard 错误处理（HIGH #5）：
- console/src/router/index.ts: catch 块增加 ApiError instanceof 判断

WebSocket Token 传递优化（HIGH #6）：
- useContestSocket.ts: 已正确从 socket.ts 导入 getTokenFromCookie

verifyAuth 绕过 axios 拦截器（HIGH #7）：
- console/src/utils/auth.ts: fetch() → apiGet()

性能优化（HIGH #9）：
- console/src/contexts/AuthContext.ts: setInterval(1000) → watch(isAuthenticated)

代码质量提升（MEDIUM）：
- console/src/stores/auth.ts: 移除 LOGOUT_KEY localStorage 追踪
- 新增 hasAuthCookie() 提前检查，173 行净减少
- clearUser() 重置 status="idle" 允许重新初始化
- 移除所有调试 console.log

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
DavidHLP added a commit that referenced this pull request Jul 10, 2026
@DavidHLP
refactor(management): promote extractApiErrorMessage, dedup inline pa…
a8d8fa2 
…ttern

The inline error-extraction pattern
  (err as { response?: { data?: { message?: string } } })?.response?.data?.message || 'Failed to ...'
was copy-pasted across 10 admin Pinia stores (36+ occurrences across
3 variants). Promote a single extractApiErrorMessage(err, fallback)
helper into utils/error.ts alongside the existing getErrorContext.

The helper uses instanceof ApiError first (the actual type the
http-client seam produces — its constructor already extracts
response.data.message into the message field), with a defensive
Axios-shape cast fallback for errors that escape the interceptor.

problems.ts and moderationStore.ts had local extractErrorMessage
helpers wrapping the same inline pattern — both now delegate to the
shared utils function.

Architecture review Card #9 — see /tmp/architecture-review-1783403689.html.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DavidHLP