Repository navigation
chore(deps): full refresh — lock files, Actions, Docker images, and the NLP MeCab fix - #307
Merged
Merged
Conversation
npm: everything in range -- vite 8.3.5 and vitest/@vitest/coverage-v8 5.0.5 (clearing the vite, markdown-it and @vitest/mocker advisories), eslint 10.13.0, the typescript-eslint family 8.72.0, vue 3.5.44, lucide 1.61.0, chart.js 4.6.1, @types/alpinejs 3.17.0 and smaller patches. katex gets an override floor of 0.18.2, next to the esbuild one: micromark-extension-math (under @eslint/markdown) caps it at ^0.16, which GHSA-238p-pmpm-9mq7 covers. It only runs while linting. `npm audit` reports no vulnerabilities. composer: league/commonmark 2.10.4 (clearing its advisory), phpunit 11.5.57, psalm 6.20.1, and the transitive set. One of those is a major: league/oauth2-client 2.9.1 accepts guzzle ^8, so guzzle moves 7.15.5 to 8.3.0 (psr7 3, promises 3). LWT never calls guzzle itself; the Google and Azure providers reach it only through oauth2-client. Checked with both providers: a token exchange, an authenticated resource-owner fetch and an invalid_grant error against a local stub, and Azure's OpenID discovery against login.microsoftonline.com. Verified: Psalm clean, phpcs clean, 9111 PHPUnit tests and 171 integration tests pass, tsc --noEmit and eslint clean, 4347 Vitest tests pass, build:all succeeds.
…ifact v5 The four majors are ESM migrations and dependency bumps. The one behaviour change, checkout v7 refusing a fork PR's code under pull_request_target and workflow_run, does not apply: no workflow uses either trigger.
… Python 3.14 frontend builder node:22-bookworm-slim -> node:24-trixie-slim app image php:8.4-apache-bookworm -> php:8.5-apache-trixie NLP service python:3.11-slim-bookworm -> python:3.14-slim-trixie docker-compose mariadb:12.1 -> mariadb:12.3 CI setup-node 22 -> 24 Node 24 is the active LTS (22 is in maintenance), trixie is Debian stable, and PHP 8.5 is already in the CI matrix. Every compiled NLP dependency ships cp314 manylinux wheels: torch 2.14.1, spaCy 3.8.16 with thinc 8.3.13, onnxruntime 1.31.0, piper-tts 1.8.0, mecab-python3 1.0.12. Verified with podman. The app image builds without the MeCab warning; PHP 8.5.12 has mysqli, pdo_mysql, zip, mbstring and dom; the parser venv is Python 3.13 and both config/parsers.php entries tokenize. Against mariadb:12.3.3 all 56 migrations apply and /, /texts, /languages, /words, /admin/settings and /api/v1/version answer 200 with nothing in the PHP log. The NLP image builds and answers /health, /parse, /whisper/available, /lemmatize/available and /tts/voices/installed.
The mecab-python3 wheel bundles a libmecab built for /usr/local, so MeCab.Tagger() looks for /usr/local/etc/mecabrc and raises: every Japanese parse through the NLP service failed. Reproduced on the old python:3.11-slim-bookworm base too, so it predates the image bump. The app image already symlinks the file; the NLP image now sets MECABRC. POST /parse/ with the mecab parser returns tokens and readings again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Everything that can move does, so nothing is left for next week. One commit per group:
1. Lock files within their constraints (918f6e0)
>=0.18.2override next to the esbuild one (GHSA-238p-pmpm-9mq7, which only applies while linting).npm audit: 0.2. GitHub Actions (ff63180)
checkout v7, setup-node v7, cache v6, upload-pages-artifact v5. The only behavior change (checkout v7 refusing fork code under
pull_request_target/workflow_run) doesn't apply: no workflow uses either trigger.3. Docker images and CI Node (be6427e)
node 22 → 24 LTS (builder and CI), php 8.4 → 8.5-apache, bookworm → trixie, NLP python 3.11 → 3.14, compose mariadb 12.1 → 12.3. Production builds from this Dockerfile through infra, so the next deploy runs PHP 8.5 on trixie.
4. fix(nlp): MeCab never initialized (7d14718)
The mecab-python3 wheel looks for
/usr/local/etc/mecabrc, and Debian puts it in/etc. So every Japanese parse through the NLP service failed. Reproduced on the old bookworm/3.11 base too, so the bug predates this PR. The main image already had a symlink; the NLP image now setsMECABRC.Verified locally
build:allsucceeds/api/v1/versionreturn 200, and the PHP log is clean./health,/parse(mecab returns readings),/whisper/available,/lemmatize/availableand/tts/voices/installedanswerStill held back
Cypress 16.2: no browser runs the suite cleanly (Cypress 15 baseline: 320/320 in 2:55):
cy.screenshot()hangs09-readingMoving means porting the suite to Chrome or Firefox, not bumping a version.
TypeScript 7: typescript-eslint 8.72 still requires
typescript <6.1.0.PHPUnit 12/13: they need PHP ≥ 8.3 / ≥ 8.4, and the floor is 8.2 (security support ends 2026-12-31).