Upgrade dependencies, runtimes and PDS version #117

Closed
opened 2026-08-19 02:31:13 +00:00 by Grandiras · 2 comments
Owner
No description provided.
Collaborator

🤖 On it — follow along in the action run; the reply will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the task runs.

🤖 On it — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/289); the reply will link the full session transcript. <!-- claude-run:comment --> 📜 [Live transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/Ponente/issue-117/run-289.md) — updating every ~5 minutes while the task runs.
Collaborator

Everything is pushed and the working tree is clean. Writing the reply.

Pushed claude/issue-117 — one commit, no behaviour change.

What moved

from to
EF Core (Design + Relational) 10.0.5 10.0.11
Npgsql.EntityFrameworkCore.PostgreSQL 10.0.1 10.0.3
Markdig 1.1.2 1.3.2
Microsoft.NET.Test.Sdk 17.12.0 18.9.0
xunit / xunit.runner.visualstudio 2.9.2 / 2.8.2 2.9.3 / 4.0.0
@playwright/test 1.59.1 1.62.1
SortableJS (vendored) 1.15.6 1.15.7
Docker CLI pin in release.yml 27.5.1 29.7.2 (+ new sha256)

The vstest runner 4.0.0 is not a migration — its nuspec says it runs v1, v2 and v3 tests, so xunit stays on v2. SortableJS 1.15.7 is two upstream bug fixes and no API change; the vendored file was byte-identical to the upstream 1.15.6 dist and still is for 1.15.7.

What deliberately did not move, and why

  • .NET stays on 10. 11 is still at preview 7 upstream (EF 11 has no stable release), and sdk:10.0 / aspnet:10.0 already float onto the current patch.
  • MailKit 4.17.0 and the three ATProtoNet 0.5.0 packages are already the newest published. dotnet list package --outdated is now empty for the app project.
  • Postgres stays 17. The major lives in the data directory, so 17 → 18 is a planned pg_upgrade against db-data on both deployed stacks, not a tag edit. Filed as its own issue.
  • actions/checkout stays at v4. The runner's job container is node:22-bookworm (I read it off the daemon), and v5+ declare using: node24 — a bump would fail at "Setup job". Written into ci.yml's runner notes.
  • The PDS keeps :latest, and this is the answer to the "PDS version" part of the issue: there is no version in this repository to bump. Upstream publishes latest, beta, a moving 0.4, and one immutable semver tag — 0.4.0, which is the February 2024 build. latest is 0.4.5027, built 2026-08-11, and pinning to the tag that looks like a version would take the PDS two years backwards. It is pulled by compose pull inside deploy.sh; the unattended timer only moves the app image. So upgrading the PDS is a deploy, not a commit — now written down in docs/deployment.md.

Verified

The runner's job container can reach the dind daemon on the default gateway (the trick release.yml already uses), so this was checked against real things rather than by inspection:

  • dotnet build + 295/295 unit tests green.
  • The Docker CLI 29.7.2 pin against the daemon it actually dials — the dind host answers as Engine 29.7.2 / API 1.55. This mattered: a 29.x client refuses to negotiate below API v1.44, so the pin is a statement about that host, and the comment now says so.
  • The Markdig bump against its safety contract — bold/headings/tables/task lists render, <script> is stripped, javascript: hrefs are emptied, ToPlainText keeps link destinations.
  • The whole compose stack built from this tree and the full Playwright suite run against it: 111 of 133 passed.

The 22 failures are the environment, not the bumps. boards.spec.js:99 fails 3 times out of 3 on an unmodified tree and 2 of 3 with the bumps, and driving the page by hand pins the cause: the delete button on /admin/boards does nothing when clicked immediately after the navigation and works when the identical click is made six seconds later — the prerender/circuit-attach race the suite wins on a normal machine. docs/testing.md claimed CI "has no container engine to start the stack with"; that is now corrected to what is true (there is one, reachable) plus the real reason not to wire e2e into CI — it comes back red for reasons no pull request caused.

Docs updated in the same commit: deployment.md (third-party image tags), frontend.md (how to re-vendor SortableJS), testing.md (the above). No Changelog.Unreleased entry — no member would notice any of this.

The stack and volumes I created on the shared dind host are torn down.


⏱ 34m 34s · 155 turns · tokens: 156.6k in / 61.3k out (+17249.5k cache-read)
📜 Full session transcript
→ Opened PR: #118
→ Filed follow-up issue #119: Plan the Postgres 17 → 18 upgrade (it is a pg_upgrade, not a tag edit)
→ Filed follow-up issue #120: The build's one warning: CS8604 on the calendar day cell's conditional @onclick

Everything is pushed and the working tree is clean. Writing the reply. Pushed **`claude/issue-117`** — one commit, no behaviour change. ## What moved | | from | to | |---|---|---| | EF Core (Design + Relational) | 10.0.5 | 10.0.11 | | Npgsql.EntityFrameworkCore.PostgreSQL | 10.0.1 | 10.0.3 | | Markdig | 1.1.2 | 1.3.2 | | Microsoft.NET.Test.Sdk | 17.12.0 | 18.9.0 | | xunit / xunit.runner.visualstudio | 2.9.2 / 2.8.2 | 2.9.3 / 4.0.0 | | @playwright/test | 1.59.1 | 1.62.1 | | SortableJS (vendored) | 1.15.6 | 1.15.7 | | Docker CLI pin in `release.yml` | 27.5.1 | 29.7.2 (+ new sha256) | The vstest runner 4.0.0 is not a migration — its nuspec says it runs v1, v2 **and** v3 tests, so xunit stays on v2. SortableJS 1.15.7 is two upstream bug fixes and no API change; the vendored file was byte-identical to the upstream 1.15.6 dist and still is for 1.15.7. ## What deliberately did not move, and why - **.NET stays on 10.** 11 is still at preview 7 upstream (EF 11 has no stable release), and `sdk:10.0` / `aspnet:10.0` already float onto the current patch. - **MailKit 4.17.0 and the three ATProtoNet 0.5.0 packages are already the newest published.** `dotnet list package --outdated` is now empty for the app project. - **Postgres stays 17.** The major lives in the data directory, so 17 → 18 is a planned `pg_upgrade` against `db-data` on both deployed stacks, not a tag edit. Filed as its own issue. - **`actions/checkout` stays at v4.** The runner's job container is `node:22-bookworm` (I read it off the daemon), and v5+ declare `using: node24` — a bump would fail at "Setup job". Written into `ci.yml`'s runner notes. - **The PDS keeps `:latest`, and this is the answer to the "PDS version" part of the issue: there is no version in this repository to bump.** Upstream publishes `latest`, `beta`, a moving `0.4`, and one immutable semver tag — `0.4.0`, which is the **February 2024** build. `latest` is `0.4.5027`, built 2026-08-11, and pinning to the tag that looks like a version would take the PDS two years backwards. It is pulled by `compose pull` inside `deploy.sh`; the unattended timer only moves the app image. So upgrading the PDS is a deploy, not a commit — now written down in `docs/deployment.md`. ## Verified The runner's job container can reach the dind daemon on the default gateway (the trick `release.yml` already uses), so this was checked against real things rather than by inspection: - `dotnet build` + **295/295 unit tests** green. - The **Docker CLI 29.7.2 pin against the daemon it actually dials** — the dind host answers as Engine 29.7.2 / API 1.55. This mattered: a 29.x client refuses to negotiate below API v1.44, so the pin is a statement about that host, and the comment now says so. - The Markdig bump against its safety contract — bold/headings/tables/task lists render, `<script>` is stripped, `javascript:` hrefs are emptied, `ToPlainText` keeps link destinations. - **The whole compose stack built from this tree and the full Playwright suite run against it: 111 of 133 passed.** The 22 failures are the environment, not the bumps. `boards.spec.js:99` fails **3 times out of 3 on an unmodified tree** and 2 of 3 with the bumps, and driving the page by hand pins the cause: the delete button on `/admin/boards` does nothing when clicked immediately after the navigation and works when the identical click is made six seconds later — the prerender/circuit-attach race the suite wins on a normal machine. `docs/testing.md` claimed CI "has no container engine to start the stack with"; that is now corrected to what is true (there is one, reachable) plus the real reason not to wire e2e into CI — it comes back red for reasons no pull request caused. Docs updated in the same commit: `deployment.md` (third-party image tags), `frontend.md` (how to re-vendor SortableJS), `testing.md` (the above). No `Changelog.Unreleased` entry — no member would notice any of this. The stack and volumes I created on the shared dind host are torn down. --- ⏱ 34m 34s · 155 turns · tokens: 156.6k in / 61.3k out (+17249.5k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/Ponente/issue-117/run-289.md) → Opened PR: https://git.grandiras.net/Grandiras/Ponente/pulls/118 → Filed follow-up issue [#119](https://git.grandiras.net/Grandiras/Ponente/issues/119): Plan the Postgres 17 → 18 upgrade (it is a pg_upgrade, not a tag edit) → Filed follow-up issue [#120](https://git.grandiras.net/Grandiras/Ponente/issues/120): The build's one warning: CS8604 on the calendar day cell's conditional @onclick
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
Grandiras/Ponente#117
No description provided.