build(deps): bump react and @types/react in /web - #18
Closed
dependabot[bot] wants to merge 16 commits into
Closed
Conversation
… block, 13 language packs
…tstrap actually install deps - web/tsconfig.json excludes test files; new tsconfig.test.json typechecks them - HITLPopup.test.tsx: type mocks against the real PendingResponse<T>; drop an invented ShellAsk.reason field the server never sends - Makefile: web-deps target with npm ci -> npm install fallback for the stale lockfile; bootstrap no longer short-circuits on a stale ui/assets directory - cmd/slmcode/ui is now build output only (.gitkeep tracked); the placeholder page moved into Go so building the UI cannot dirty a tracked file - release workflow verifies a real Studio bundle is embedded, strips sourcemaps, installs golangci-lint, and validates the tag against version.go - install scripts: real checksum verification on Windows, no sudo for --user installs, loud warning when SHA256SUMS is unavailable - slmcode update: fix the Windows asset name, downgrade guard, --user/--system - RELEASE.md, changelog breaking-changes table, docs
Contributor
Author
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
…gs (config was already v2, tool was v1)�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249m`.golangci.yml` is v2-format but the installed golangci-lint binary was�[0m �[38;5;243m 4�[0m �[38;5;249mv1.64, so `make check` silently never ran the real lint gate. Upgrading to�[0m �[38;5;243m 5�[0m �[38;5;249mv2.13.1 surfaced 95 findings: 66 staticcheck QF1012 (WriteString(Sprintf)�[0m �[38;5;243m 6�[0m �[38;5;249m-> Fprintf, auto-fixed) and 28 gosec findings reviewed per-file and either�[0m �[38;5;243m 7�[0m �[38;5;249mfixed or annotated with a `//nolint:gosec // reason` matching this repo's�[0m �[38;5;243m 8�[0m �[38;5;249mexisting convention.�[0m
…e reachable through a symlink mismatch�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249ms.rootDir() returns the configured root as-is, but every path derived from�[0m �[38;5;243m 4�[0m �[38;5;249mworkspacePath()/resolveWorkspacePath() is passed through EvalSymlinks. On�[0m �[38;5;243m 5�[0m �[38;5;249mmacOS $TMPDIR (and thus every t.TempDir() workspace root) is itself a�[0m �[38;5;243m 6�[0m �[38;5;249msymlink into /private, so filepath.Rel(s.rootDir(), resolvedPath) never�[0m �[38;5;243m 7�[0m �[38;5;249mmatched — silently defeating every ".slmcode/ harness state" check built on�[0m �[38;5;243m 8�[0m �[38;5;249mtop of it:�[0m �[38;5;243m 9�[0m �[38;5;243m 10�[0m �[38;5;249m - GET /api/workspace/file?path=.slmcode/auth.json served the operator's�[0m �[38;5;243m 11�[0m �[38;5;249m provider API keys over HTTP.�[0m �[38;5;243m 12�[0m �[38;5;249m - GET /api/workspace/tree advertised auth.json in the listing.�[0m �[38;5;243m 13�[0m �[38;5;249m - The review queue could both display and apply a write into�[0m �[38;5;243m 14�[0m �[38;5;249m .slmcode/hooks.json (arbitrary-bash-on-next-run) via a crafted�[0m �[38;5;243m 15�[0m �[38;5;249m .slmcode/pending/*.patch.json entry.�[0m �[38;5;243m 16�[0m �[38;5;243m 17�[0m �[38;5;249mAdded Server.realRootDir(), which applies the same EvalSymlinks-or-fallback�[0m �[38;5;243m 18�[0m �[38;5;249mresolution as resolveWorkspacePath, and routed the three affected�[0m �[38;5;243m 19�[0m �[38;5;249mfilepath.Rel(s.rootDir(), ...) call sites through it.�[0m �[38;5;243m 20�[0m �[38;5;243m 21�[0m �[38;5;249mCaught by pkg/server/adversarial_secrets_test.go�[0m �[38;5;243m 22�[0m �[38;5;249m(TestAdvNoAPIKeyLeakOverHTTP, TestAdvPendingQueueCannotTargetHarnessState),�[0m �[38;5;243m 23�[0m �[38;5;249mwhich were failing on main before this change.�[0m
…ed both reviewers, doubling real LLM calls�[0m �[38;5;243m 2�[0m �[38;5;243m 3�[0m �[38;5;249mspeculate() cancels a losing slot's goroutine only before it reaches the�[0m �[38;5;243m 4�[0m �[38;5;249mexecutor; once dispatched, a fast/local executor runs it to completion�[0m �[38;5;243m 5�[0m �[38;5;249mregardless. reviewSlots() launched the primary reviewer and the strict�[0m �[38;5;243m 6�[0m �[38;5;249msecond reviewer fully concurrently with no head start, so against a fast�[0m �[38;5;243m 7�[0m �[38;5;249mexecutor both real LLM calls always completed before either could cancel�[0m �[38;5;243m 8�[0m �[38;5;249mthe other — the "1 race, up to 2 real requests" design always spent 2,�[0m �[38;5;243m 9�[0m �[38;5;249mnever 1.�[0m �[38;5;243m 10�[0m �[38;5;243m 11�[0m �[38;5;249mThis doubled review calls per correction round, which both blew the�[0m �[38;5;243m 12�[0m �[38;5;249mcall-budget escalation threshold (14 real calls against a budget of 10) and�[0m �[38;5;243m 13�[0m �[38;5;249mduplicated review-prompt entries per round, misaligning correction-content�[0m �[38;5;243m 14�[0m �[38;5;249mchecks that expect one review per CORRECTOR-PASS-N.�[0m �[38;5;243m 15�[0m �[38;5;243m 16�[0m �[38;5;249mAdded an optional per-slot Delay to SpecSlot, honored in speculate()'s�[0m �[38;5;243m 17�[0m �[38;5;249mdispatch loop: a delayed slot waits out the delay (or bails immediately if�[0m �[38;5;243m 18�[0m �[38;5;249mthe race is already won) before ever reaching the executor. reviewSlots()�[0m �[38;5;243m 19�[0m �[38;5;249mnow gives reviewer-strict a 20ms head start — well under real LLM latency,�[0m �[38;5;243m 20�[0m �[38;5;249mso production still races both reviewers as before, but long enough for a�[0m �[38;5;243m 21�[0m �[38;5;249mfast/local/test executor to let the primary win outright and skip the�[0m �[38;5;243m 22�[0m �[38;5;249msecond dispatch.�[0m �[38;5;243m 23�[0m �[38;5;243m 24�[0m �[38;5;249mCaught by pkg/loop/retry_ladder_test.go�[0m �[38;5;243m 25�[0m �[38;5;249m(TestCorrectionRoundsSeeThePreviousCorrection,�[0m �[38;5;243m 26�[0m �[38;5;249mTestCallBudgetExhaustionEscalatesWithAUsefulState).�[0m
…he CSS bundle and its own SSE marker�[0m
�[38;5;243m 2�[0m
�[38;5;243m 3�[0m �[38;5;249mdiscoverAssets() found the CSS <link> by taking a +-200-char window around�[0m
�[38;5;243m 4�[0m �[38;5;249mrel="stylesheet" and grabbing the first href="/assets/..." in it. On a real�[0m
�[38;5;243m 5�[0m �[38;5;249mVite build, the preceding <link rel="modulepreload" href="...js"> tags for�[0m
�[38;5;243m 6�[0m �[38;5;249mroute chunks sit inside that window and their href comes first in document�[0m
�[38;5;243m 7�[0m �[38;5;249morder, so the "CSS path" it returned was actually a JS chunk�[0m
�[38;5;243m 8�[0m �[38;5;249m(assets/react-*.js) whenever the head had two or more modulepreload tags�[0m
�[38;5;243m 9�[0m �[38;5;249mahead of the stylesheet link. Fixed to search only within the matched�[0m
�[38;5;243m 10�[0m �[38;5;249m<link ...> tag's own boundaries.�[0m
�[38;5;243m 11�[0m
�[38;5;243m 12�[0m �[38;5;249mSeparately, the JS-corpus marker list checked for the literal "/api/events"�[0m
�[38;5;243m 13�[0m �[38;5;249msubstring, but createEventSource() builds that URL as `${BASE}/events`�[0m
�[38;5;243m 14�[0m �[38;5;249m(BASE="/api"), so the two halves never appear contiguous in the bundle —�[0m
�[38;5;243m 15�[0m �[38;5;249mevery other marker in the list is a bare path for the same reason (client.ts's�[0m
�[38;5;243m 16�[0m �[38;5;249mrequest() prepends BASE separately). Changed the marker to "/events" to�[0m
�[38;5;243m 17�[0m �[38;5;249mmatch.�[0m
Bumps [react](https://github.com/react/react/tree/HEAD/packages/react) and [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react). These dependencies needed to be updated together. Updates `react` from 18.3.1 to 19.2.8 - [Release notes](https://github.com/react/react/releases) - [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md) - [Commits](https://github.com/react/react/commits/v19.2.8/packages/react) Updates `@types/react` from 18.3.31 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) --- updated-dependencies: - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-major - dependency-name: react dependency-version: 19.2.8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/web/multi-9b1536b8cd
branch
from
August 24, 2026 08:25
9910535 to
f375aeb
Compare
piotrlaczkowski
force-pushed
the
main
branch
2 times, most recently
from
August 24, 2026 09:52
a85446a to
1d710eb
Compare
Contributor
Contributor
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/npm_and_yarn/web/multi-9b1536b8cd
branch
August 27, 2026 17:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps react and @types/react. These dependencies needed to be updated together.
Updates
reactfrom 18.3.1 to 19.2.8Release notes
Sourced from react's releases.
... (truncated)
Changelog
Sourced from react's changelog.
... (truncated)
Commits
1dd4ecb[FlightReply] Performance improvements when decoding (#37087)b0d2fdb[19.2.x] Update required references to GitHub repo (#36753)6117d7cVersion 19.2.7 (#36591)eaf3e95Version 19.2.623f4f9f19.2.590ab3f8Version 19.2.4612e371Version 19.2.3b910fc1Version 19.2.2053df4eVersion 19.2.15667a41Bump next prerelease version numbers (#34639)Maintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.
Updates
@types/reactfrom 18.3.31 to 19.2.18Commits