From af09bf58afe72e890e2ed0de5bf207705e32e298 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 18:34:27 +0000 Subject: [PATCH 01/11] Add renovate.json --- renovate.json | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 renovate.json diff --git a/renovate.json b/renovate.json new file mode 100644 index 0000000..5db72dd --- /dev/null +++ b/renovate.json @@ -0,0 +1,6 @@ +{ + "$schema": "https://docs.renovatebot.com/renovate-schema.json", + "extends": [ + "config:recommended" + ] +} From ff9846ce64e83a66fd96e4b5576491d54a82c6d6 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 23:50:37 +0000 Subject: [PATCH 02/11] chore(deps): update dependency nh3 to >=0.3,<0.4 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 05f7231..eb9619c 100644 --- a/requirements.txt +++ b/requirements.txt @@ -33,7 +33,7 @@ python-dotenv>=1.2,<2.0 structlog>=25.5,<26.0 # HTML sanitization for scraped post descriptions (FC-2d provenance) -nh3>=0.2,<0.3 +nh3>=0.3,<0.4 # Archive extraction (FC-2d-iii filesystem-import aid) rarfile>=4.2,<5 From ba2de60439f8d51738b8f2f1cdf38947ef009c94 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 23:50:38 +0000 Subject: [PATCH 03/11] chore(deps): update dependency cryptography to v49 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index 05f7231..564965e 100644 --- a/requirements.txt +++ b/requirements.txt @@ -14,7 +14,7 @@ celery>=5.6,<5.7 redis>=7.4,<8.0 # Crypto for credential storage (lands in FC-3, but pinned now for stability) -cryptography>=48,<49 +cryptography>=49,<50 # Image handling (lands in FC-2) pillow>=12,<13 From 87d3198f899ce0b6289fb5ceb3d2b84a1c1769ec Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 23:58:52 +0000 Subject: [PATCH 04/11] chore(deps): update dependency pgvector to >=0.5,<0.6 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index a0f22cf..79bd363 100644 --- a/requirements.txt +++ b/requirements.txt @@ -7,7 +7,7 @@ sqlalchemy[asyncio]>=2.0,<2.1 asyncpg>=0.31,<0.32 psycopg[binary]>=3.3,<3.4 alembic>=1.18,<1.19 -pgvector>=0.4,<0.5 +pgvector>=0.5,<0.6 # Task queue celery>=5.6,<5.7 From e00deee451339e61cb52a380aa796cfda01ae47d Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 23:58:54 +0000 Subject: [PATCH 05/11] chore(deps): update docker/dockerfile docker tag to v1.25 --- Dockerfile | 2 +- Dockerfile.ml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 17d7944..c793a0b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile:1.7 +# syntax=docker/dockerfile:1.25 FROM node:22-alpine AS frontend-builder WORKDIR /build diff --git a/Dockerfile.ml b/Dockerfile.ml index ee548fb..13efe30 100644 --- a/Dockerfile.ml +++ b/Dockerfile.ml @@ -1,4 +1,4 @@ -# syntax=docker/dockerfile:1.7 +# syntax=docker/dockerfile:1.25 FROM python:3.14-slim ENV PYTHONUNBUFFERED=1 \ From 466ee898abf41bfebeaefd7e42a2732590074c25 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 23:58:55 +0000 Subject: [PATCH 06/11] chore(deps): update dependency gdown to v6 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index a0f22cf..a0ad689 100644 --- a/requirements.txt +++ b/requirements.txt @@ -42,4 +42,4 @@ py7zr>=1,<2 # Google Drive fetcher for off-platform file-host links (external downloads, # #830). Handles Drive's confirm-token + virus-scan interstitial. mega.nz uses # the `megatools` binary instead (Debian apt pkg in the runtime image, not pip). -gdown>=5,<6 +gdown>=6,<7 From b6c5638eab7ecfcf679a152a7c3a94e62aff7147 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sat, 11 Jul 2026 23:58:56 +0000 Subject: [PATCH 07/11] chore(deps): update dependency structlog to v26 --- requirements.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements.txt b/requirements.txt index a0f22cf..63bc83f 100644 --- a/requirements.txt +++ b/requirements.txt @@ -30,7 +30,7 @@ yt-dlp>=2025.1 # Utilities python-dotenv>=1.2,<2.0 -structlog>=25.5,<26.0 +structlog>=26.1,<26.2 # HTML sanitization for scraped post descriptions (FC-2d provenance) nh3>=0.3,<0.4 From 7f5e0603de6f1b940e1f59bb54ec2df58dc088ca Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Sat, 11 Jul 2026 21:21:17 -0400 Subject: [PATCH 08/11] ci(renovate): pre-merge CI for renovate PRs + group FE toolchain MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ci.yml: add pull_request trigger (base dev) so renovate/* PRs get validated before merge; dev→main flow unchanged (base main), no duplicate runs. renovate.json: group vite/vitest/plugin-vue/happy-dom/@vue-test-utils into one PR (version-coupled). Co-Authored-By: Claude Opus 4.8 (1M context) --- .forgejo/workflows/ci.yml | 13 +++++++++---- renovate.json | 13 +++++++++++++ 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index ec1dcbf..82f8677 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -9,10 +9,15 @@ name: CI on: push: branches: [dev, main] - # pull_request trigger intentionally absent — with branches: [dev, main] - # above, every PR commit already fires CI via the push event on dev. Adding - # pull_request would duplicate runs on dev→main PRs. FC has no fork PRs - # (single-operator Forgejo repo) so push coverage is complete. + # Renovate opens PRs from `renovate/*` branches into `dev`. Those branches + # never push to dev/main, so the push trigger above gives them NO pre-merge + # CI — a bump could only be validated after it was already merged. This + # pull_request trigger (base `dev` only) validates Renovate PRs before merge. + # It deliberately does NOT fire on dev→main PRs (base `main`), which still + # rely on the dev push run — so no duplicate runs. FC has no fork PRs + # (single-operator Forgejo repo), so secrets-on-PR is not a concern. + pull_request: + branches: [dev] jobs: # Fast-fail lint lane. ruff is pre-installed in the ci-python image, so diff --git a/renovate.json b/renovate.json index 5db72dd..6275124 100644 --- a/renovate.json +++ b/renovate.json @@ -2,5 +2,18 @@ "$schema": "https://docs.renovatebot.com/renovate-schema.json", "extends": [ "config:recommended" + ], + "packageRules": [ + { + "description": "Bundle the interlocking frontend build/test toolchain into ONE PR. vite, vitest, @vitejs/plugin-vue, happy-dom and @vue/test-utils are version-coupled — a lone major bump red-fails the build/tests until its peers land, so they must move together.", + "matchPackageNames": [ + "vite", + "vitest", + "@vitejs/plugin-vue", + "happy-dom", + "@vue/test-utils" + ], + "groupName": "frontend build/test toolchain" + } ] } From a2858892e9c7fc8cce2f8b3addfb6be0eacb815e Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 12 Jul 2026 01:24:54 +0000 Subject: [PATCH 09/11] chore(deps): update frontend build/test toolchain --- frontend/package.json | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/frontend/package.json b/frontend/package.json index 5e230c5..9f5da1e 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -21,13 +21,13 @@ "@mdi/font": "^7.4.0" }, "devDependencies": { - "@vitejs/plugin-vue": "^5.0.0", - "vite": "^5.2.0", + "@vitejs/plugin-vue": "^6.0.0", + "vite": "^8.0.0", "vue-tsc": "^2.0.0", "vite-plugin-vuetify": "^2.0.0", "sass": "^1.71.0", - "vitest": "^2.1.0", + "vitest": "^4.0.0", "@vue/test-utils": "^2.4.0", - "happy-dom": "^15.0.0" + "happy-dom": "^20.0.0" } } From c98db303d0d37138fa3160ac146702971a40f525 Mon Sep 17 00:00:00 2001 From: Bryan Van Deusen Date: Sat, 11 Jul 2026 21:31:36 -0400 Subject: [PATCH 10/11] chore(frontend): drop dead vue-tsc devDep + check script Frontend is pure JS (no .ts/JSDoc); CI never ran vue-tsc. Removed the devDep and its orphaned `check` script instead of bumping to v3, and updated the ci.yml comment to match. Co-Authored-By: Claude Opus 4.8 (1M context) --- .forgejo/workflows/ci.yml | 8 ++++---- frontend/package.json | 4 +--- 2 files changed, 5 insertions(+), 7 deletions(-) diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml index 82f8677..4a0af72 100644 --- a/.forgejo/workflows/ci.yml +++ b/.forgejo/workflows/ci.yml @@ -97,10 +97,10 @@ jobs: # If we want strict lockfile-based reproducibility later, commit a # package-lock.json and flip this back to `npm ci`. - run: npm install --no-audit --no-fund - # `npm run check` (vue-tsc --noEmit) skipped: the frontend is pure JS - # with no .ts files and no JSDoc annotations, so vue-tsc has nothing - # to type-check. Re-enable once we add a tsconfig.json and either - # convert to TS or add JSDoc. + # No type-check step: the frontend is pure JS (no .ts files, no JSDoc), + # so a type-checker has nothing to do. The vue-tsc devDep + its `check` + # script were dropped 2026-07-11 rather than bumped to v3. If we add + # TS/JSDoc later, re-add a tsconfig.json + vue-tsc + a type-check step. - run: npm run test:unit - run: npm run build diff --git a/frontend/package.json b/frontend/package.json index 9f5da1e..3c394f1 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -10,8 +10,7 @@ "dev": "vite", "build": "vite build", "preview": "vite preview", - "test:unit": "vitest run", - "check": "vue-tsc --noEmit" + "test:unit": "vitest run" }, "dependencies": { "vue": "^3.4.0", @@ -23,7 +22,6 @@ "devDependencies": { "@vitejs/plugin-vue": "^6.0.0", "vite": "^8.0.0", - "vue-tsc": "^2.0.0", "vite-plugin-vuetify": "^2.0.0", "sass": "^1.71.0", "vitest": "^4.0.0", From 6ab495292a47f76b834b25620835d56469025df8 Mon Sep 17 00:00:00 2001 From: Renovate Bot Date: Sun, 12 Jul 2026 01:33:07 +0000 Subject: [PATCH 11/11] chore(deps): update node.js to v24 --- .forgejo/workflows/extension.yml | 2 +- Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.forgejo/workflows/extension.yml b/.forgejo/workflows/extension.yml index ea12cf2..3a50314 100644 --- a/.forgejo/workflows/extension.yml +++ b/.forgejo/workflows/extension.yml @@ -20,7 +20,7 @@ jobs: lint: runs-on: python-ci container: - image: node:22-bookworm-slim + image: node:24-bookworm-slim steps: - uses: actions/checkout@v4 - name: Install web-ext diff --git a/Dockerfile b/Dockerfile index c793a0b..6c9da51 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ # syntax=docker/dockerfile:1.25 -FROM node:22-alpine AS frontend-builder +FROM node:24-alpine AS frontend-builder WORKDIR /build COPY frontend/package.json frontend/package-lock.json* ./ # No package-lock.json is tracked yet (we don't run npm locally per