Main/frontend has package.json but no package-lock.json, yarn.lock, or bun.lockb (verified on main @ efa935c). Nothing pins transitive versions, so two installs of the same commit can differ — the opposite of the backend's uv.lock + uv sync --locked discipline (#364).
Consequence: Dependabot can only edit manifest ranges. #363 (dompurify) touched package.json only, so the tree that actually gets built was never pinned before or after.
Not folded into #364: generating a lockfile is a large diff that deserves its own review, and Main/frontend/Dockerfile.dev may need a matching --frozen-lockfile install step.
Note Main/backend/package-lock.json is gitignored (.gitignore:26) — worth confirming that is still intended.
Main/frontendhaspackage.jsonbut nopackage-lock.json,yarn.lock, orbun.lockb(verified onmain@ efa935c). Nothing pins transitive versions, so two installs of the same commit can differ — the opposite of the backend'suv.lock+uv sync --lockeddiscipline (#364).Consequence: Dependabot can only edit manifest ranges. #363 (dompurify) touched
package.jsononly, so the tree that actually gets built was never pinned before or after.Not folded into #364: generating a lockfile is a large diff that deserves its own review, and
Main/frontend/Dockerfile.devmay need a matching--frozen-lockfileinstall step.Note
Main/backend/package-lock.jsonis gitignored (.gitignore:26) — worth confirming that is still intended.