Claude: changes for issue #117 #118

Merged

Grandiras merged 1 commit from claude/issue-117 into main

2026-08-19 03:08:52 +00:00

claude-bot commented

2026-08-19 03:06:48 +00:00

Collaborator

Closes #117.

claude-bot added 1 commit

2026-08-19 03:06:48 +00:00

Take the dependencies to current, and write down what pins the rest

CI / build (pull_request) Successful in 49s

Details

675f49a27d

Nothing here changes behaviour; the point is that the next person can see
which versions were a choice and which were simply stale.

Moved: EF Core 10.0.5 → 10.0.11 and Npgsql 10.0.1 → 10.0.3, Markdig 1.1.2
→ 1.3.2, the test stack from Test SDK 17.12 / xunit 2.9.2 / vstest runner
2.8.2 to 18.9.0 / 2.9.3 / 4.0.0 (4.x still runs v1, v2 and v3 tests, so
this is not a migration), Playwright 1.59.1 → 1.62.1, and the vendored
SortableJS 1.15.6 → 1.15.7 — two upstream bug fixes, no API change, and
the file stays the upstream dist byte for byte.

Left where they are, deliberately: .NET stays on 10 (11 is still preview,
and the base image tags already float on the current 10.0 patch); MailKit
and the three ATProtoNet packages are already the newest published;
Postgres stays 17 because the major lives in the data directory and moving
it is a planned pg_upgrade, not a tag edit; the actions stay at v4 because
the runner's job image is node:22 and v5 declares node24.

The release workflow's Docker CLI pin goes 27.5.1 → 29.7.2, checked
against the daemon it actually dials: the dind host answers on the default
gateway as Engine 29.7.2 / API 1.55, and a 29.x client refuses to
negotiate below API v1.44, so the pin is a statement about that host.

Docs: deployment.md gains why the PDS floats on :latest (upstream's only
immutable tag, 0.4.0, is the February 2024 build — latest is 0.4.5027),
frontend.md gains how to re-vendor SortableJS, and testing.md's claim that
CI "has no container engine to start the stack with" is corrected — it
does have one, reachable the way release.yml reaches it; what makes the
e2e suite not worth running there is that it comes back red for timing
reasons no pull request caused.

Verified: build and 295 unit tests green; the full Playwright suite run
against a compose stack built from this tree came back 111/133, and the
two failures re-run against an unmodified tree failed there as well —
boards.spec.js:99 three times out of three.

claude-bot referenced this pull request

2026-08-19 03:06:49 +00:00

Upgrade dependencies, runtimes and PDS version #117

claude-bot commented

2026-08-19 03:06:51 +00:00

Author

Collaborator

🤖 Reviewing this PR — follow along in the action run; the reply will link the full session transcript.

📜 Live transcript — updating every ~5 minutes while the task runs.

🤖 Reviewing this PR — follow along in [the action run](https://git.grandiras.net/Grandiras/claude-bot/actions/runs/290); the reply will link the full session transcript.  📜 [Live transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/Ponente/pr-118/run-290.md) — updating every ~5 minutes while the task runs.

claude-reviewer approved these changes

2026-08-19 03:08:08 +00:00

claude-reviewer left a comment

✅ Verdict: approve — no blocking issues found.

Routine dependency-bump PR (Docker CLI, EF Core/Npgsql, Markdig, xunit toolchain, Playwright, vendored Sortable.js) plus documentation additions explaining the CI/release runner internals, the sortable.min.js vendoring process, and why e2e tests aren't run in CI.

Spot-checked the non-obvious claims against current reality:

Markdig 1.3.2, xunit.runner.visualstudio 4.0.0, and Playwright 1.62.1 are all real, current releases — the jump from xunit.runner.visualstudio 2.8.2 to 4.0.0 looked suspicious at first glance but is legitimate.
Sortable.js 1.15.7 is a real release (Feb 2026); the vendored sortable.min.js diff matches the expected minifier-output churn of a version bump (renamed internal variables etc.), consistent with the new frontend.md note that it must be a byte-for-byte npm pack copy.
The actions/checkout@v4 pin rationale (v5 actions declare using: node24, which breaks on this runner's node:22 job image) matches the actual, well-documented breaking change in actions/checkout v5.
The Docker CLI 29.7.2 bump and updated SHA256 pin are both correctly formatted (valid 64-hex-char digests) and the new comment about client/daemon API-version negotiation is consistent with the existing "Check the daemon answers" step in release.yml, which exists for exactly that failure mode.

No correctness or security issues found. Comment-only doc additions don't change behavior and read as accurate accounts of prior debugging (matching this repo's documentation style).

⏱ 0m 58s · 10 turns · tokens: 85.1k in / 3.6k out (+542.3k cache-read)
📜 Full session transcript

✅ **Verdict: approve** — no blocking issues found. Routine dependency-bump PR (Docker CLI, EF Core/Npgsql, Markdig, xunit toolchain, Playwright, vendored Sortable.js) plus documentation additions explaining the CI/release runner internals, the sortable.min.js vendoring process, and why e2e tests aren't run in CI. Spot-checked the non-obvious claims against current reality: - Markdig 1.3.2, xunit.runner.visualstudio 4.0.0, and Playwright 1.62.1 are all real, current releases — the jump from xunit.runner.visualstudio 2.8.2 to 4.0.0 looked suspicious at first glance but is legitimate. - Sortable.js 1.15.7 is a real release (Feb 2026); the vendored `sortable.min.js` diff matches the expected minifier-output churn of a version bump (renamed internal variables etc.), consistent with the new frontend.md note that it must be a byte-for-byte `npm pack` copy. - The `actions/checkout@v4` pin rationale (v5 actions declare `using: node24`, which breaks on this runner's node:22 job image) matches the actual, well-documented breaking change in actions/checkout v5. - The Docker CLI 29.7.2 bump and updated SHA256 pin are both correctly formatted (valid 64-hex-char digests) and the new comment about client/daemon API-version negotiation is consistent with the existing "Check the daemon answers" step in release.yml, which exists for exactly that failure mode. No correctness or security issues found. Comment-only doc additions don't change behavior and read as accurate accounts of prior debugging (matching this repo's documentation style). --- ⏱ 0m 58s · 10 turns · tokens: 85.1k in / 3.6k out (+542.3k cache-read) 📜 [Full session transcript](https://git.grandiras.net/Grandiras/claude-bot/src/branch/claude-logs/transcripts/Grandiras/Ponente/pr-118/run-290.md)