chore(deps): Update frontend pnpm dependencies

[renovate]

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@eslint/js (source)	^9.39.4 → ^9.39.5
@playwright/test (source)	^1.60.0 → ^1.64.1
@radix-ui/react-collapsible (source)	^1.1.13 → ^1.2.1
@radix-ui/react-dialog (source)	^1.1.16 → ^1.3.1
@radix-ui/react-label (source)	^2.1.9 → ^2.1.17
@radix-ui/react-popover (source)	^1.1.16 → ^1.3.1
@radix-ui/react-scroll-area (source)	^1.2.11 → ^1.4.0
@radix-ui/react-separator (source)	^1.1.9 → ^1.2.0
@radix-ui/react-slot (source)	^1.2.5 → ^1.5.0
@radix-ui/react-tabs (source)	^1.1.14 → ^1.2.1
@radix-ui/react-toast (source)	^1.2.16 → ^1.3.1
@radix-ui/react-tooltip (source)	^1.2.9 → ^1.4.1
@tailwindcss/postcss (source)	^4.3.0 → ^4.3.3
@tanstack/react-router (source)	^1.170.15 → ^1.170.44
@tanstack/react-router-devtools (source)	^1.167.0 → ^1.167.2
@tanstack/router-plugin (source)	^1.168.18 → ^1.168.46
@types/lodash (source)	^4.17.24 → ^4.17.26
@types/react (source)	^19.2.17 → ^19.3.0
@types/react-dom (source)	^19.2.3 → ^19.3.0
@typescript-eslint/eslint-plugin (source)	^8.61.0 → ^8.71.2
@typescript-eslint/parser (source)	^8.61.0 → ^8.71.2
eslint (source)	^9.39.4 → ^9.39.5
eslint-plugin-prettier	^5.5.6 → ^5.5.7
eslint-plugin-react-refresh	^0.5.2 → ^0.5.7
pnpm (source)	10.34.1+sha512.b58fbde6dca66a929538021581f648b4570b6ca19b18e7cbd7f2c07a7b24454155388dacdf08f2af3678e88a6d1fe04f9d609df24bf51735a060ea041b374ab7 → 10.34.7
postcss (source)	^8.5.23 → ^8.5.30
prettier (source)	^3.8.4 → ^3.9.10
radix-ui (source)	^1.5.0 → ^1.8.1
react (source)	^19.2.7 → ^19.3.1
react-dom (source)	^19.2.7 → ^19.3.1
socket.io-client (source)	^4.8.3 → ^4.8.4
tailwind-merge (source)	^3.6.0 → ^3.7.0
tailwindcss (source)	^4.3.0 → ^4.3.3
vite (source)	^7.3.5 → ^7.3.7

---

Release Notes

eslint/eslint (@​eslint/js)

v9.39.5

Compare Source

Bug Fixes

• 253be16 fix: handle unavailable require cache (backport of #​20812 to v9.x) (#​21065) (Eric)

Documentation

• 74930ed docs: switch build to Node.js 24 (#​20894) (Milos Djermanovic)
• eaec8bb docs: Add ESLint v9.x EOL notice (#​20828) (Milos Djermanovic)

Chores

• 458205f chore: update @eslint/eslintrc and @eslint/js for v9.39.5 (#​21077) (Francesco Trotta)
• 202117b chore: package.json update for @​eslint/js release (Jenkins)
• d9eb6ed test: disable warning for vm.constants.USE_MAIN_CONTEXT_DEFAULT_LOADER (#​21074) (Francesco Trotta)
• 7b431a7 chore: override re2 dependency for @metascraper/helpers (#​21068) (Milos Djermanovic)
• daf7791 chore: pin fflate@​0.8.2 (#​20895) (Milos Djermanovic)
• daee8ba ci: use pnpm in eslint-flat-config-utils type integration test (#​20829) (Milos Djermanovic)
• 116d4be ci: unpin Node.js 25.x in CI (#​20619) (Copilot)

microsoft/playwright (@​playwright/test)

v1.64.1

Compare Source

Bug Fixes

• #​43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #​43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #​333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});

• New fps option in testOptions.video, recordVideo and
  screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
• New style option takes CSS declarations for the point marker, the target
  highlight and the action title. It replaces the fontSize option, which is now deprecated.
• The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
• Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
  quality.
• All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

• New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

  // playwright.config.ts
  import { defineConfig, devices } from '@playwright/test';
  
  export default defineConfig({
    projects: [
      { name: 'chromium', use: devices['Desktop Chrome'] },
      { name: 'firefox', use: devices['Desktop Firefox'], default: false },
      { name: 'webkit', use: devices['Desktop Safari'], default: false },
    ],
  });

  npx playwright test                     # runs chromium only
  npx playwright test --project=firefox   # runs firefox
  npx playwright test --project="*"       # runs all three, for example on CI

• New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

  npx playwright test --shuffle
  # Running 42 tests using 4 workers, shuffle seed 271828182
  # ...
  
  # Pass the seed to reproduce the same order.
  npx playwright test --shuffle 271828182

• New lock option in test.describe.configure() adds test locks to all tests in a file or a group:

  test.describe.configure({ lock: 'user-settings' });

• New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

  // playwright.config.ts
  export default defineConfig({
    expect: {
      toHaveScreenshot: { type: 'webp' },
    },
  });

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

• New page.getByRef() locates an element by its aria ref, such as e2, reported by page.ariaSnapshot() in the 'ai' mode.

• New option includeShadow in page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.

• New option signCount sets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the current signCount, and it is saved and restored together with the credentials in the storage state.

• New fullConfig.filteredProjects lists the projects that were selected to run after applying the --project filter. It is available in global setup and reporters.

• New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:

  await request.addCookies([{ name: 'session-id', value: '42', url: 'https://example.com' }]);
  console.log(await request.cookies('https://example.com'));
  await request.clearCookies({ name: 'session-id' });

Breaking changes ⚠️

• screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:

  // playwright.config.ts
  export default defineConfig({
    use: {
      ...devices['Desktop Chrome'],
      screen: undefined,
    },
  });

• JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.

• --update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.

• Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

• Chromium 156.0.8078.4
• Mozilla Firefox 157.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 155
• Microsoft Edge 155

v1.63.0

Compare Source

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example, Click with subtitle getByRole('button').
Both are rendered next to the step title in the trace viewer and the HTML report.

🖼️ Aria and screen snapshots in traces

The snapshots option of tracing.start() and the testOptions.trace fixture option now accept an
object selecting what to capture on every action:

// playwright.config.ts
export default defineConfig({
  use: {
    trace: {
      mode: 'on',
      snapshots: { dom: true, aria: true, screen: true }
    },
  },
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

• httpCredentials now also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.
• New option opfs includes the origin private file system in the storage state, so it can be persisted and restored into later contexts.
• New events page.on('dialogclosed') and browserContext.on('dialogclosed') are emitted when a JavaScript dialog is accepted, dismissed or closed by the user.

Locators

• New locator.ariaSnapshotJSON() and page.ariaSnapshotJSON() return the aria snapshot as a JSON value instead of YAML markup, with mode, depth and boxes options.
• apiRequestContext.get() and other request methods accept a type argument that types the response json():

const response = await request.get<User>('/api/users/42');
const user = await response.json(); // typed as User

Test runner

• New standalone testOptions.reducedMotion, testOptions.forcedColors and testOptions.contrast options.
• New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config, instead of replacing them like --reporter does.
• New omitTags option for the list, line, dot, github and junit reporters suppresses the tags that are automatically appended to test titles.

Command line

• npx playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
• npx playwright codegen --http-credentials records against pages behind HTTP authentication.

Miscellaneous

• New built-in perfetto reporter writes a Trace Event Format file for the Perfetto UI or chrome://tracing, rendering the test run as a timeline with a lane per worker.
• The HTML report renders a duration waterfall next to test steps.

Announcements

• ⚠️ The experimental @playwright/experimental-ct-react, @playwright/experimental-ct-react17 and @playwright/experimental-ct-vue packages will no longer be updated. Follow the migration guide to move to the stories model introduced in 1.62. Story ids passed to fixtures.mount() can now be typed through the generated Stories registry.
• ⚠️ Ubuntu 20.04 is not supported anymore.
• 🐧 On Linux arm64, Playwright now downloads the Chrome for Testing build of Chromium, the same build used on all other platforms.

Browser Versions

• Chromium 153.0.8010.12
• Mozilla Firefox 155.0
• WebKit 26.6

This version was also tested against the following stable channels:

• Google Chrome 153
• Microsoft Edge 153

v1.62.1

Compare Source

Bug Fixes

• #​41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #​41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #​41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #​42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #​42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

v1.61.1

Compare Source

Bug Fixes

• #​41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #​41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #​41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #​41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #​41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
• New -G command line shorthand for --grep-invert.

🛠️ Other improvements

• Playwright now supports Ubuntu 26.04.
• HAR and trace recordings now include WebSocket requests.

Browser Versions

• Chromium 149.0.7827.55
• Mozilla Firefox 151.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 149
• Microsoft Edge 149

radix-ui/primitives (@​radix-ui/react-collapsible)

v1.2.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.

v1.2.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-use-controllable-state@1.3.0

v1.1.21

• Updated dependencies: @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11

v1.1.20

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-id@1.1.4, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

v1.1.19

• Updated dependencies: @radix-ui/react-primitive@2.1.9

v1.1.18

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-id@1.1.3, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

v1.1.17

• Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
• Updated dependencies: @radix-ui/react-presence@1.1.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-use-layout-effect@1.1.2

v1.1.16

• Updated dependencies: @radix-ui/primitive@1.1.5, @radix-ui/react-context@1.2.0, @radix-ui/react-presence@1.1.7

v1.1.15

• Updated dependencies: @radix-ui/react-primitive@2.1.7

v1.1.14

• Updated dependencies: @radix-ui/react-primitive@2.1.6

radix-ui/primitives (@​radix-ui/react-dialog)

v1.3.1

• Fixed a type regression where callback props that were previously declared as methods rejected handlers whose parameter is narrower than the prop's.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.2.1, @radix-ui/react-focus-scope@1.3.1

v1.3.0

• Allow explicit undefined for all optional types for compatibility with TypeScript's exactOptionalPropertyTypes flag.
• Updated dependencies: @radix-ui/primitive@1.2.0, @radix-ui/react-context@1.3.0, @radix-ui/react-dismissable-layer@1.2.0, @radix-ui/react-focus-guards@1.2.0, @radix-ui/react-focus-scope@1.3.0, @radix-ui/react-portal@1.2.0, @radix-ui/react-primitive@2.2.0, @radix-ui/react-slot@1.5.0, @radix-ui/react-use-controllable-state@1.3.0

v1.2.0

• Added support for multiple aria-describedby attributes.
• Fixed nested, portalled layers being unusable inside a modal layer. A non-modal popover rendered inside a modal Dialog previously broke some user interactions because the modal layer's trapped FocusScope reclaimed focus, and its RemoveScroll only allowed scrolling within the modal content.
• Updated dependencies: @radix-ui/react-focus-scope@1.2.0, @radix-ui/react-slot@1.4.0, @radix-ui/react-dismissable-layer@1.1.20, @radix-ui/react-primitive@2.1.11, @radix-ui/react-presence@1.1.11, @radix-ui/react-portal@1.1.18

v1.1.23

• Reverted breaking changes that caused compatibility issues with React Server Components.
• Updated dependencies: @radix-ui/react-compose-refs@1.1.5, @radix-ui/react-context@1.2.2, @radix-ui/react-dismissable-layer@1.1.19, @radix-ui/react-focus-guards@1.1.6, @radix-ui/react-focus-scope@1.1.16, @radix-ui/react-id@1.1.4, @radix-ui/react-portal@1.1.17, @radix-ui/react-presence@1.1.10, @radix-ui/react-primitive@2.1.10, @radix-ui/react-slot@1.3.3, @radix-ui/react-use-controllable-state@1.2.6, @radix-ui/react-use-layout-effect@1.1.4

v1.1.22

• Updated dependencies: @radix-ui/react-slot@1.3.2, @radix-ui/react-primitive@2.1.9, @radix-ui/react-dismissable-layer@1.1.18, @radix-ui/react-focus-scope@1.1.15, @radix-ui/react-portal@1.1.16

v1.1.21

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4, @radix-ui/react-context@1.2.1, @radix-ui/react-dismissable-layer@1.1.17, @radix-ui/react-focus-guards@1.1.5, @radix-ui/react-focus-scope@1.1.14, @radix-ui/react-id@1.1.3, @radix-ui/react-portal@1.1.15, @radix-ui/react-presence@1.1.9, @radix-ui/react-primitive@2.1.8, @radix-ui/react-slot@1.3.1, @radix-ui/react-use-controllable-state@1.2.5, @radix-ui/react-use-layout-effect@1.1.3

v1.1.20

• Fixed broken ARIA references in Dialogs where a title or description elements are not rendered.
• Improved tree-shaking so bundlers can drop unused components. Component parts are now marked /* @__PURE__ */ and use named render functions instead of Component.displayName = ... assignments, which previously prevented dead-code elimination with some bundlers.
• Updated dependencies: @radix-ui/react-dismissable-layer@1.1.16, @radix-ui/react-focus-scope@1.1.13, @radix-ui/react-portal@1.1.14, @radix-ui/react-presence@1.1.8, @radix-ui/react-use-controllable-state@1.2.4, @radix-ui/primitive@1.1.6, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.2.0, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.7, @radix-ui/react-slot@1.3.0, @radix-ui/react-use-layout-effect@1.1.2

[!IMPORTANT]
✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • "before 8am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
autoglm-gui	Ready	Preview	Oct 14, 2026 7:43pm UTC

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.90%. Comparing base (b356fca) to head (6c9146c).

@@           Coverage Diff           @@
##             main     #448   +/-   ##
=======================================
  Coverage   82.90%   82.90%           
=======================================
  Files         116      116           
  Lines       12331    12331           
=======================================
  Hits        10223    10223           
  Misses       2108     2108           

Flag	Coverage Δ
e2e-backend	33.29% <ø> (ø)
e2e-frontend	0.60% <ø> (ø)
integration	38.99% <ø> (ø)
unit	81.29% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b356fca...6c9146c. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🚀 Lint & Format Check Results: ❌ FAILED

What was checked:

• 🐍 Backend: Ruff linting + formatting
• 📱 Frontend: ESLint + Prettier + TypeScript types
• 🔧 Unified: Custom lint script validation

❌ Some checks failed!

How to fix:

1. Run locally to auto-fix most issues:

uv run python scripts/lint.py

2. Commit the fixes and push:

git add .
git commit -m "fix: apply lint and format fixes"
git push

3. The checks will run again automatically.

Individual fix commands:

Backend:

uv run ruff check --fix
uv run ruff format

Frontend:

cd frontend
pnpm lint --fix
pnpm format
cd ..

---

This is an automated check. For questions, ask in the PR discussion.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0ad58b5b48

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin packageManager to an existing pnpm release

When Corepack/pnpm honors this packageManager field (for example the Dockerfile enables Corepack and then runs pnpm install --frozen-lockfile in frontend), it will try to activate pnpm@10.34.4; the published pnpm 10.x release line currently ends at 10.34.3, so this version cannot be resolved and frontend installs/builds fail before dependencies are installed. Pin this to a published version such as 10.34.3, with the matching integrity, or remove the invalid pin.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c4c8ae0d3

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin Playwright to a published stable release

With this specifier and the committed lockfile resolving @playwright/test, playwright, and playwright-core to 1.61.1, fresh pnpm install --frozen-lockfile runs will need to fetch that exact version. I checked the public package indexes/release notes for this update and they list stable 1.61.0 plus 1.61.1-beta-* prereleases, but not a stable 1.61.1, so CI/Docker builds will fail before tests can run. Pin this to the published 1.61.0 release or wait until 1.61.1 is actually available.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 663e003939

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin PostCSS to a published release

In fresh frontend installs that use the committed lockfile, pnpm install --frozen-lockfile has to fetch postcss@8.5.21, but the public npm package page currently lists 8.5.20 as the latest published version (https://www.npmjs.com/package/postcss). This means CI/Docker installs will fail during dependency resolution before the frontend can lint or build; pin this back to a published PostCSS version or wait until 8.5.21 is published.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin aggregate Radix to a published release

Fresh evidence for the earlier aggregate Radix dependency issue: this diff now pins radix-ui@1.6.4, while the public npm versions page currently lists 1.6.2 as the latest published radix-ui release (https://www.npmjs.com/package/radix-ui?activeTab=versions). Because the lockfile also records the exact radix-ui@1.6.4 tarball and the app imports from radix-ui, fresh pnpm install --frozen-lockfile runs will fail before lint/build can start.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9378f42cf0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin React to a published release

With this update, fresh frontend installs have to resolve the exact react@19.2.8 tarball recorded in the lockfile, and react-dom@19.2.8 now peers on react: ^19.2.8; however the current React npm/GitHub release listings still stop at 19.2.7, so pnpm install --frozen-lockfile fails before the frontend can build or lint. Pin React back to a published patch or wait until 19.2.8 is actually available.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 898d85746a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin router plugin to a published release

Fresh evidence for the earlier TanStack dependency-resolution concern is that this commit now requires @tanstack/router-plugin@1.168.23 in both package.json and the lockfile, while the npm package page still lists the latest published router-plugin version below that (https://www.npmjs.com/package/%40tanstack/router-plugin?activeTab=versions). Any fresh cd frontend && pnpm install --frozen-lockfile path will stop before the frontend can lint or build, so this needs to be pinned to a published plugin version or deferred until 1.168.23 exists.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin Radix UI to published versions

This commit now pins radix-ui@1.6.5 in package.json and resolves the same exact tarball in pnpm-lock.yaml, but the public npm page for the aggregate package still shows 1.6.2 as the latest published release (https://www.npmjs.com/package/radix-ui?activeTab=versions). Fresh frontend installs therefore cannot resolve the locked dependency; pin this and the matching Radix primitive bumps back to published releases before merging.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 89698b8886

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin Playwright to a published release

Fresh evidence relative to the earlier Playwright comment: this commit now pins @playwright/test and the lockfile to 1.62.0, while the npm versions page still lists 1.61.1 as the latest published stable release (https://www.npmjs.com/package/%40playwright/test?activeTab=versions). Any fresh frontend install path, including the Docker build's pnpm install --frozen-lockfile, will fail resolving that tarball before e2e tests or builds can run; pin this back to a published Playwright version or wait until 1.62.0 exists.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8fff3e23b5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep Playwright Node 18-compatible

For users following the documented Node.js 18+ setup, this bump makes the frontend e2e tooling require Node 20: the committed lockfile now records @playwright/test, playwright, and playwright-core 1.62.0 with engines: {node: '>=20'}, whereas the previous 1.60.0 lockfile allowed >=18. CI uses Node 24, but local/documented Node 18 installs are still supported, so keep Playwright on a Node 18-compatible release or raise the documented runtime requirement.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5c9320169d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin PostCSS to a published release

Fresh evidence compared with the previous PostCSS comment: this diff now pins postcss and the lockfile to 8.5.25, while the current npm/PostCSS release listings stop at 8.5.24. Any fresh frontend install path, including the Dockerfile’s pnpm install --frozen-lockfile before build, will try to fetch a non-existent postcss@8.5.25 tarball and fail before linting or building can run; pin this back to a published PostCSS version until 8.5.25 exists.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: deda042408

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Keep Playwright e2e on Node 18

For developers using the documented Node.js 18+ setup, this bump makes the e2e runner unsupported: the lockfile moves @playwright/test/playwright/playwright-core from 1.60.0 with engines: {node: '>=18'} to 1.62.1 with engines: {node: '>=20'}. Fresh evidence relative to the earlier comment is that the current lockfile now records 1.62.1 rather than 1.62.0, so keep Playwright on a Node 18-compatible release or raise the documented runtime requirement.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0457023147

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to stable published versions

Fresh evidence relative to the earlier TanStack install comments: this diff now requires the exact @tanstack/react-router@1.170.19 and @tanstack/react-router-devtools@1.167.1 tarballs in both package.json and pnpm-lock.yaml, while the current npm listings still top out at stable 1.170.18 and 1.167.0 (the .19/.1 builds only appear as prereleases). A fresh cd frontend && pnpm install/frozen install therefore cannot resolve these direct dependencies before lint/build can run; pin them to published stable versions or wait for stable releases.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9753bab4c4

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack router to a published npm version

For a fresh frontend setup using the documented cd frontend && pnpm install, this specifier plus the lockfile require @tanstack/react-router@1.170.20, but the npm versions page still advertises 1.170.18 as the latest published stable version (https://www.npmjs.com/package/%40tanstack/react-router?activeTab=versions), so dependency resolution can fail before lint/build runs. Fresh evidence relative to the earlier TanStack comments is that this reviewed commit now pins 1.170.20 rather than the previously flagged 1.170.19; pin back to a published version or wait for npm publication.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b5443cdf2d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin PostCSS to a published version

For a fresh frontend setup using the repo-documented cd frontend && pnpm install, this new ^8.5.26 specifier and the lockfile's postcss@8.5.26 entry require a tarball that the npm package page currently does not publish (https://www.npmjs.com/package/postcss lists 8.5.25 as latest). Fresh evidence relative to the earlier PostCSS comments is that this commit now asks for 8.5.26, not the previously discussed 8.5.25, so dependency resolution fails before lint/build can run; pin to 8.5.25 or wait for 8.5.26 to be published.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c98cee7d7d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack router to a published version

Fresh evidence relative to the earlier TanStack install comments: this commit now asks for @tanstack/react-router@^1.170.21, while the npm versions page I checked today still lists 1.170.20 as the latest published stable version, and the committed lockfile also requires the exact 1.170.21 tarball. Any fresh cd frontend && pnpm install path therefore fails before lint/build can run, so pin this back to a published router release or wait for the npm publication.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e17e3447a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to published releases

Fresh evidence relative to the earlier TanStack install comments is that this hunk now pins @tanstack/react-router to ^1.170.24 and @tanstack/router-plugin to ^1.168.28; the current npm versions pages still top out below those versions (the same commit's Renovate metadata only targeted 1.170.23/1.168.27, and the package pages at https://www.npmjs.com/package/%40tanstack/react-router?activeTab=versions and https://www.npmjs.com/package/%40tanstack/router-plugin?activeTab=versions do not list the pinned versions). Since the lockfile resolves those exact tarballs, a fresh documented cd frontend && pnpm install fails before lint/build; pin to published versions or wait for npm publication.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 924da78ee8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin router plugin to a published tarball

Fresh evidence relative to the earlier TanStack install comments: this revision now pins @tanstack/router-plugin to ^1.168.29, but the current npm listing I checked (https://www.npmjs.com/package/%40tanstack/router-plugin) still tops out below that version rather than providing a stable 1.168.29 tarball. A documented fresh cd frontend && pnpm install must resolve this direct dependency and will fail before lint/build can run, so pin to a published router-plugin release or wait until 1.168.29 is actually on npm.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f564e131d

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin React Router to a published npm release

For the documented fresh frontend setup (cd frontend && pnpm install), this new specifier plus the lockfile's exact @tanstack/react-router@1.170.25 entry forces pnpm to fetch a tarball that the npm package page currently still lists only up to 1.170.24 (https://www.npmjs.com/package/%40tanstack/react-router). That stops dependency resolution before lint/build can run; fresh evidence relative to earlier TanStack comments is that this commit now pins 1.170.25, not 1.170.24, so pin to a published version or wait until npm publishes it.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52d7659a35

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to published releases

Fresh evidence relative to the earlier TanStack comments is that this revision now requires @tanstack/react-router@1.170.28 and @tanstack/router-plugin@1.168.31, while the same commit's Renovate metadata identifies only 1.170.27 and 1.168.30 as the released update targets. Because the lockfile also resolves the newer exact versions, documented fresh installs and the Docker/CI pnpm install --frozen-lockfile paths cannot fetch these tarballs and stop before linting or building; pin both packages to published versions.

AGENTS.md reference: AGENTS.md:L12-L16

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63e246367f

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to published versions

Fresh evidence relative to the earlier TanStack comments is that this revision now requires @tanstack/react-router@1.170.29 and @tanstack/router-plugin@1.168.32, while this commit's own Renovate metadata identifies only 1.170.28 and 1.168.31 as the released update targets. Because the lockfile resolves the newer exact versions, a documented fresh cd frontend && pnpm install cannot fetch these tarballs and stops before linting or building; pin both dependencies to published releases.

AGENTS.md reference: AGENTS.md:L12-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3f9e58060b

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to the released versions

The Dockerfile's frontend stage runs pnpm install --frozen-lockfile, but these specifiers and the lockfile require exact @tanstack/react-router@1.170.30 and @tanstack/router-plugin@1.168.33 tarballs while this commit's own Renovate metadata identifies only 1.170.29 and 1.168.32 as the released update targets. Fresh evidence relative to the earlier TanStack comments is that this revision has advanced both dependencies another patch beyond those previously flagged versions, so a fresh install stops before the frontend can build; pin them to the released versions.

AGENTS.md reference: AGENTS.md:L12-L15

Useful? React with 👍 / 👎.

[suyiiyii]

@renovate rebase

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1cf46300c5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve Node 18 support for Playwright

For documented Node.js 18+ users, this resolves Playwright 1.63.0, while frontend/pnpm-lock.yaml:586-588 (and its playwright/playwright-core entries) declares node: >=20; the previous 1.60.0 lock entries allowed Node 18. This leaves the documented Node 18 environment unsupported for pnpm test:e2e. Fresh evidence relative to the existing 1.62.1 comment is that this revision now resolves 1.63.0 with the same Node 20 floor. Keep a Node-18-compatible Playwright release or raise the documented runtime requirement.

AGENTS.md reference: AGENTS.md:L12-L12

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-14T19:46:50.282429Z	6c9146c	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2fb6122696

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin Radix packages to published releases

Fresh evidence relative to the earlier Radix comments: @radix-ui/react-dialog@1.2.0 is not a published stable release (npm currently stops at 1.1.23, with 1.2.0 only available as RC builds); the same applies to the other updated Radix primitives and the aggregate radix-ui@1.7.0 pin. The lockfile records these exact unavailable versions, so both the documented frontend install and Docker's frozen install fail before the frontend can build. Pin the Radix packages to their published releases.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin TypeScript ESLint plugin to a published release

Fresh evidence relative to the earlier TypeScript ESLint comments: this commit requires @typescript-eslint/eslint-plugin@8.71.1, but npm currently publishes 8.71.0 as the latest stable version and only prerelease 8.71.1 builds. Because the lockfile also resolves the unavailable exact version, a fresh frontend install cannot complete, blocking linting and builds; use the published plugin version (and regenerate the lockfile).

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 63c0225ed5

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin Playwright to the released stable version

Fresh evidence relative to the earlier Playwright dependency comment is that this revision now pins and locks @playwright/test@1.64.0, while the current npm versions page lists 1.63.0 as latest and only prerelease builds for 1.64.0; the PR metadata also identifies 1.63.0 as the intended update. Consequently, the documented fresh frontend install and Docker's frozen install cannot fetch the exact locked tarball, so keep this on 1.63.0 until the stable 1.64.0 release is published.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aed1ae9da8

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Preserve Node 18 support for Playwright

For developers using the documented Node.js 18+ setup, this upgrade makes the frontend e2e runner unsupported: frontend/pnpm-lock.yaml:586-588 raises @playwright/test's engine requirement from Node 18 to >=20, as do its playwright and playwright-core dependencies. Fresh evidence relative to the earlier 1.63.0 compatibility comment is that this revision now resolves 1.64.0 with the same Node 20 floor; keep a Node-18-compatible Playwright release or raise the documented runtime requirement.

AGENTS.md reference: AGENTS.md:L10-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 03a0ac9324

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to the released versions

Fresh evidence relative to the earlier TanStack comments: this revision pins @tanstack/react-router@1.170.42 and @tanstack/router-plugin@1.168.43, while this commit's own Renovate update table identifies only 1.170.41 and 1.168.42 as the released targets. Because the lockfile resolves the newer exact versions, documented frontend installs and Docker's pnpm install --frozen-lockfile attempt to fetch unavailable tarballs and stop before linting or building; use the released versions and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L14-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin Prettier to the released update

This revision requires prettier@3.9.10 in both the manifest and lockfile, but the commit's Renovate update table identifies 3.9.9 as the released update target. Fresh installs therefore try to fetch an unavailable 3.9.10 tarball and fail before the frontend lint/format/build commands can run; pin Prettier to 3.9.9 and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L14-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5e0c5a738e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin Radix dependencies to published releases

Fresh evidence relative to the earlier Radix comment: this revision now pins and locks radix-ui@1.8.0, while the commit's own Renovate update table identifies 1.7.0 as the released target; the direct primitives are likewise advanced beyond their listed targets, such as dialog 1.3.0 versus 1.2.0. A documented fresh frontend install must fetch these exact locked versions and therefore stops before linting or building; use the released Radix versions and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 20cfe799d1

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin TanStack packages to published releases

Fresh evidence relative to the earlier TanStack comments is that this revision now requires @tanstack/react-router@1.170.44 and @tanstack/router-plugin@1.168.45, while this commit's Renovate update table identifies only 1.170.42 and 1.168.43 as the released targets. Because the lockfile resolves these newer exact versions, a fresh documented frontend install or the Dockerfile's frozen install cannot fetch the tarballs and stops before linting or building; use published versions and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin Radix primitives to published releases

Fresh evidence relative to the earlier Radix comments is that this revision advances the primitives another patch beyond the releases listed in its Renovate table—for example, collapsible is pinned to 1.2.1 instead of 1.2.0 and dialog/popover to 1.3.1 instead of 1.3.0. The lockfile records these exact unavailable versions, so fresh frontend and Docker installs fail during dependency resolution; restore the released Radix versions and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin PostCSS to the published release

Fresh evidence relative to the earlier PostCSS comments is that this revision now pins and locks postcss@8.5.30, while the commit's Renovate update table identifies 8.5.29 as the released target. A fresh documented pnpm install or Docker frozen install therefore attempts to fetch an unavailable tarball and fails before frontend linting or building; use 8.5.29 and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin TypeScript ESLint to published releases

Fresh evidence relative to the earlier TypeScript ESLint comment is that this revision now requires both packages at 8.71.2, whereas the commit's Renovate update table identifies 8.71.1 as the released target. Since the lockfile also resolves the exact 8.71.2 tarballs, fresh frontend installs fail before linting or building can run; pin the plugin and parser to the published version and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2768e84b56

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin the router plugin to the published release

Fresh evidence relative to the earlier TanStack comments is that this revision now requires and locks @tanstack/router-plugin@1.168.46, while the current npm package listing and this commit's Renovate update table identify 1.168.45 as the latest published release. Consequently, the documented frontend install and the frozen install at Dockerfile:19 cannot fetch the locked tarball and stop before the frontend builds; use the published version and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Pin Playwright to the published stable release

Fresh evidence relative to the earlier Playwright comments is that this revision now requires and locks the exact stable version @playwright/test@1.64.1, whereas the current npm versions listing exposes 1.64.0 as latest and only prerelease builds for 1.64.1. Because the Docker build installs development dependencies with pnpm install --frozen-lockfile at Dockerfile:19, dependency resolution fails before the frontend build; keep this at 1.64.0 until a stable 1.64.1 is published.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c9146cf35

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Pin React to the published version

At review time, npm lists React and React DOM 19.3.0 as the latest stable releases and does not expose 19.3.1, while this manifest and the lockfile require exact 19.3.1 tarballs. The documented fresh cd frontend && pnpm install path therefore fails before the frontend can build; use the published matching React versions and regenerate the lockfile.

AGENTS.md reference: AGENTS.md:L15-L15

Useful? React with 👍 / 👎.