Deps/frontend safe subset by ervcz · Pull Request #1420 · flatcar/nebraska

ervcz · 2026-07-17T10:22:29Z

What

This is a curated version of the Dependabot npm group PR (#1409). It takes the safe majority of that group and holds back the two upgrades that aren't ready, so we can land the bulk now instead of blocking on a big migration.

Supersedes and lets us close: #1409, #1404, #1399, #1402.

Kept

react-router 7→8, Vite 7→8, @vitejs/plugin-react 5→6, Storybook 10.2→10.5, Playwright 1.59→1.61, jsdom 28→29, lint-staged 16→17, @types/node 25→26, typescript-eslint 8.58→8.63, react 19.2.4→19.2.7, plus the remaining recharts/redux-toolkit/i18next/etc. patch and minor bumps.

Held back (follow-ups)

typescript 6→7 — incompatible with @typescript-eslint 8.x (peer <6.1.0); breaks npm ci and lint. Wait for typescript-eslint TS7 support.
@mui/* 7→9 — needs the Grid v2 / sx migration (~160 type errors across ~37 files). Deserves its own PR.
eslint-plugin-react-hooks 7.0→7.1 and eslint-plugin-simple-import-sort 12→13 — new lint rules that require code changes; out of scope for a dep bump.

Notes

react-router 8 is low-risk here: we only use the declarative API (BrowserRouter, useParams/useNavigate/useLocation) and import everything from react-router (no react-router-dom), so the v8 breaking changes don't apply.
Snapshots and one e2e chart screenshot are refreshed for the MUI 7.3.x / recharts 3.9 patch bumps (generated-hash / sub-pixel churn, no behaviour change).
Companion change: the dev-shell flake bumps the pinned Playwright browsers to 1.61.1 to match, committed separately.

Testing

npm ci, tsc, vite build, lint, unit tests (79/79), Storybook build + test-runner (45/45), production image build, and the full Playwright e2e (18/18) and OIDC (39/39) suites all pass locally.

Copilot

Pull request overview

This PR applies a curated “safe subset” of frontend dependency upgrades (React, react-router, Vite, Storybook, Playwright, jsdom, lint-staged, etc.) and refreshes the affected Storybook/Vitest snapshot outputs.

Changes:

Bump a set of frontend runtime/dev dependencies in frontend/package.json (notably react-router 8, Vite 8, Storybook 10.5 packages, Playwright 1.61, jsdom 29, recharts 3.9).
Refresh Storybook story snapshots for charts/lists/components impacted by dependency-driven render/markup/hash changes.
Refresh a Vitest snapshot impacted by MUI class hash churn.

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
frontend/package.json	Updates a curated set of frontend dependencies/devDependencies.
frontend/src/components/Groups/GroupCharts/snapshots/VersionCountTimeline.stories.tsx.snap	Recharts markup changes + legend icon output changes in snapshot.
frontend/src/components/Groups/GroupCharts/snapshots/StatusCountTimeline.stories.tsx.snap	Recharts markup changes in snapshot.
frontend/src/components/Groups/snapshots/GroupItem.stories.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.
frontend/src/components/common/AutoCompletePicker/snapshots/AutoCompletePicker.stories.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.
frontend/src/components/Channels/snapshots/ChannelList.stories.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.
frontend/src/components/Channels/snapshots/ChannelItem.stories.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.
frontend/src/components/Applications/snapshots/ApplicationList.stories.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.
frontend/src/components/Applications/snapshots/ApplicationItem.stories.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.
frontend/src/components/Activity/snapshots/ActivityList.stories.tsx.snap	Snapshot refresh; now shows Iconify SVG children as `undefined`.
frontend/src/components/Activity/snapshots/ActivityItemIcon.stories.tsx.snap	Snapshot refresh; now shows Iconify SVG children as `undefined`.
frontend/src/components/Activity/snapshots/ActivityItem.stories.tsx.snap	Snapshot refresh; now shows Iconify SVG children as `undefined`.
frontend/src/components/Activity/snapshots/ActivityContainer.stories.tsx.snap	Snapshot refresh; now shows Iconify SVG children as `undefined`.
frontend/src/tests/Common/snapshots/ListSearch.spec.tsx.snap	Snapshot refresh due to MUI-generated class hash changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+     viewbox="0 0 16 16"
     style="color: rgb(0, 211, 255);"
 >
-  <path fill="currentColor"
-        d="M11 15h2v2h-2v-2m0-8h2v6h-2V7m1-5C6.47 2 2 6.5 2 12a10 10 0 0 0 10 10a10 10 0 0 0 10-10A10 10 0 0 0 12 2m0 18a8 8 0 0 1-8-8a8 8 0 0 1 8-8a8 8 0 0 1 8 8a8 8 0 0 1-8 8Z"
-  >
-  </path>
+  undefined
 </svg>


+                 viewbox="0 0 16 16"
                 style="color: rgb(0, 211, 255);"
            >
-              <path fill="currentColor"
-                    d="M11 15h2v2h-2v-2m0-8h2v6h-2V7m1-5C6.47 2 2 6.5 2 12a10 10 0 0 0 10 10a10 10 0 0 0 10-10A10 10 0 0 0 12 2m0 18a8 8 0 0 1-8-8a8 8 0 0 1 8-8a8 8 0 0 1 8 8a8 8 0 0 1-8 8Z"
-              >
-              </path>
+              undefined
            </svg>


+               viewbox="0 0 16 16"
               style="color: rgb(0, 211, 255);"
          >
-            <path fill="currentColor"
-                  d="M11 15h2v2h-2v-2m0-8h2v6h-2V7m1-5C6.47 2 2 6.5 2 12a10 10 0 0 0 10 10a10 10 0 0 0 10-10A10 10 0 0 0 12 2m0 18a8 8 0 0 1-8-8a8 8 0 0 1 8-8a8 8 0 0 1 8 8a8 8 0 0 1-8 8Z"
-            >
-            </path>
+            undefined
          </svg>


+                         viewbox="0 0 16 16"
                         style="color: rgb(0, 211, 255);"
                    >
-                      <path fill="currentColor"
-                            d="M11 15h2v2h-2v-2m0-8h2v6h-2V7m1-5C6.47 2 2 6.5 2 12a10 10 0 0 0 10 10a10 10 0 0 0 10-10A10 10 0 0 0 12 2m0 18a8 8 0 0 1-8-8a8 8 0 0 1 8-8a8 8 0 0 1 8 8a8 8 0 0 1-8 8Z"
-                      >
-                      </path>
+                      undefined
                    </svg>


+                   viewbox="0 0 16 16"
                   style="color: rgb(44, 152, 240); vertical-align: -0.125em;"
              >
-                <path fill="currentColor"
-                      d="M3 3v18h18V3"
-                >
-                </path>
+                undefined
              </svg>


+    "@storybook/addon-docs": "^10.5.0",
+    "@storybook/addon-links": "^10.5.0",
+    "@storybook/react-vite": "^10.5.0",
+    "@storybook/test-runner": "^0.24.4",


Copilot

Pull request overview

Copilot reviewed 14 out of 16 changed files in this pull request and generated 2 comments.

              <svg xmlns="http://www.w3.org/2000/svg"
                   xmlns:xlink="http://www.w3.org/1999/xlink"
                   aria-hidden="true"
                   role="img"
                   width="15"
                   height="15"
-                   viewbox="0 0 24 24"
+                   viewbox="0 0 16 16"
                   style="color: rgb(44, 152, 240); vertical-align: -0.125em;"
              >
-                <path fill="currentColor"
-                      d="M3 3v18h18V3"
-                >
-                </path>
+                undefined
              </svg>


 <svg xmlns="http://www.w3.org/2000/svg"
     xmlns:xlink="http://www.w3.org/1999/xlink"
     aria-hidden="true"
     role="img"
     width="30px"
     height="30px"
-     viewbox="0 0 24 24"
+     viewbox="0 0 16 16"
     style="color: rgb(0, 211, 255);"
 >
-  <path fill="currentColor"
-        d="M11 15h2v2h-2v-2m0-8h2v6h-2V7m1-5C6.47 2 2 6.5 2 12a10 10 0 0 0 10 10a10 10 0 0 0 10-10A10 10 0 0 0 12 2m0 18a8 8 0 0 1-8-8a8 8 0 0 1 8-8a8 8 0 0 1 8 8a8 8 0 0 1-8 8Z"
-  >
-  </path>
+  undefined
 </svg>


…ons-mdi Curated subset of the Dependabot npm group (#1409): bumps Vite 7->8, react-router 7->8 and the other safe deps; holds typescript and @mui/* at current majors (TS 7 breaks the typescript-eslint peer; MUI 9 needs a Grid migration). Vite 8's rolldown bundler doesn't honor the __esModule/exports.default interop that the deprecated CJS-only @iconify/icons-mdi relies on, so those icons rendered empty. Vendor the used icons as ESM JSON generated from the maintained @iconify-json/mdi (npm run build-mdi-icons), matching the existing src/icons/*.json convention. Snapshots refreshed for the newer, pixel-identical glyph data. Signed-off-by: Ervin Rácz <ervin.racz@protonmail.com>

Copilot

Pull request overview

Copilot reviewed 35 out of 36 changed files in this pull request and generated 2 comments.

+    "@iconify-json/mdi": "^1.2.3",
    "@iconify/react": "^6.0.2",
-    "@iconify/tools": "^5.0.11",
-    "@playwright/test": "1.59.1",
-    "@storybook/addon-docs": "^10.2.16",
-    "@storybook/addon-links": "^10.2.16",
-    "@storybook/react-vite": "^10.2.16",
-    "@storybook/test-runner": "^0.24.2",
+    "@iconify/tools": "^5.0.12",
+    "@playwright/test": "1.61.1",


    "react-window": "^2.2.7",
-    "recharts": "^3.8.1",
-    "semver": "^7.7.4",
+    "recharts": "3.8.1",


Copilot AI review requested due to automatic review settings July 17, 2026 10:22

Copilot started reviewing on behalf of ervcz July 17, 2026 10:22 View session

ervcz force-pushed the deps/frontend-safe-subset branch from ff19dea to 1e4c5d1 Compare July 17, 2026 10:25

ervcz marked this pull request as ready for review July 17, 2026 10:26

ervcz requested a review from a team as a code owner July 17, 2026 10:26

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 17, 2026 10:28

Copilot started reviewing on behalf of ervcz July 17, 2026 10:28 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

ervcz force-pushed the deps/frontend-safe-subset branch from 1e4c5d1 to 271d0cd Compare July 17, 2026 13:41

Copilot AI review requested due to automatic review settings July 17, 2026 13:41

Copilot started reviewing on behalf of ervcz July 17, 2026 13:42 View session

Copilot AI reviewed Jul 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Deps/frontend safe subset#1420

Deps/frontend safe subset#1420
ervcz wants to merge 1 commit into
mainfrom
deps/frontend-safe-subset

ervcz commented Jul 17, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ervcz commented Jul 17, 2026

Kept

Held back (follow-ups)

Notes

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants