Current Behavior
Open dependency PRs span the current SRE UI and obsolete project paths, with overlapping versions. Several workflows still use older Actions, and their pinned commits are also enforced by repository policy and contract tests.
Proposed Enhancement
Consolidate the pending upgrades in the current project locations:
| Dependency |
Target |
Source PR |
| @types/react-dom |
19.2.5 |
#9899 |
| eslint-plugin-react-refresh |
0.5.5 |
#9898 |
| vitest |
4.1.11 |
#9897 |
| typescript-eslint |
8.69.0 |
#9896 |
| eslint |
10.9.1 |
#9895 |
| vite |
8.2.2 |
#9894 |
| @types/node |
26.4.0 |
#9893 |
| lucide-react |
1.34.0 |
#9892 |
| @vitejs/plugin-react |
6.1.0 |
#9891 |
| @testing-library/user-event |
14.6.6 |
#9890 |
| globals |
17.11.0 |
#9549 |
| anchore/sbom-action/download-syft |
v0.24.2 |
#9943 |
| docker/setup-buildx-action |
v4.3.0 |
#9585 |
| actions/download-artifact |
v8 |
#9545 |
| actions/checkout |
v7 |
#9544 |
| actions/upload-artifact |
v7 |
#9543 |
Update the SRE UI manifest and lockfile, adapt Vite aliases to import.meta.dirname, and preserve TypeScript 5.9.3 for the openapi-typescript peer dependency. Align workflow pins with container policy, architecture inventory, Kubernetes validation, and release contract expectations.
Validate the UI installation, API contract, lint, tests, and build; run the affected workflow and repository guards, comparing existing failures against the unchanged baseline.
Benefits
Applies compatible upgrades once, includes the second page of open PRs, and keeps enforced Action versions consistent with workflow configuration. Avoids downgrading crates already upgraded on main.
Additional Context
All 30 open PRs were reviewed. The 16 targets above also cover nine older or obsolete-path PRs: #9796, #9744, #9718, #9717, #9716, #9715, #9610, #9356, and #9354. Four crate PRs are already covered by current jsonschema 0.52.1 (#9797, #9798) and uuid 1.26.0 (#9747, #9743).
Do not apply #9996: the official Rust 1.120.0 distribution manifest returns HTTP 404, while the proposed Action branch explicitly installs that version. Keep Rust 1.95.0.
Local UI validation passed, including all 92 tests. Existing Kubernetes, architecture documentation, contract-test, actionlint runner-label, and npm audit findings were reproduced on the clean baseline with no new findings. Record the command results and limitations in the implementation PR.
Current Behavior
Open dependency PRs span the current SRE UI and obsolete project paths, with overlapping versions. Several workflows still use older Actions, and their pinned commits are also enforced by repository policy and contract tests.
Proposed Enhancement
Consolidate the pending upgrades in the current project locations:
Update the SRE UI manifest and lockfile, adapt Vite aliases to
import.meta.dirname, and preserve TypeScript 5.9.3 for the openapi-typescript peer dependency. Align workflow pins with container policy, architecture inventory, Kubernetes validation, and release contract expectations.Validate the UI installation, API contract, lint, tests, and build; run the affected workflow and repository guards, comparing existing failures against the unchanged baseline.
Benefits
Applies compatible upgrades once, includes the second page of open PRs, and keeps enforced Action versions consistent with workflow configuration. Avoids downgrading crates already upgraded on main.
Additional Context
All 30 open PRs were reviewed. The 16 targets above also cover nine older or obsolete-path PRs: #9796, #9744, #9718, #9717, #9716, #9715, #9610, #9356, and #9354. Four crate PRs are already covered by current jsonschema 0.52.1 (#9797, #9798) and uuid 1.26.0 (#9747, #9743).
Do not apply #9996: the official Rust 1.120.0 distribution manifest returns HTTP 404, while the proposed Action branch explicitly installs that version. Keep Rust 1.95.0.
Local UI validation passed, including all 92 tests. Existing Kubernetes, architecture documentation, contract-test, actionlint runner-label, and npm audit findings were reproduced on the clean baseline with no new findings. Record the command results and limitations in the implementation PR.