[BatLeDev]

Routine dependency refresh, plus the parts of the shared data-fair service conventions that touch dependencies, the image and the build.

Before / after

	released 2.3.1 image	this branch
trivy, OS layer	2 CRITICAL, 19 HIGH (alpine 3.21)	0 (alpine 3.24.2)
trivy, Node.js	4 CRITICAL, 62 HIGH	0
npm audit (whole tree)	29 (1 critical, 17 high)	6 low

The 6 low findings are the elliptic chain under vite-plugin-node-polyfills. It is build-time only and not bundled (include: ['path']); see "Deferred".

Changes

• Security / image: in-range npm update (fixes proxy-addr critical, axios, form-data, fast-uri, vue, postcss…). Base image node:24.22.0-alpine3.24 with apk upgrade in base. npm, corepack and yarn removed from the runtime. Dropped the @rollup/rollup-linux-x64-musl install, since vite 8 bundles with rolldown. Added a .dockerignore: ADD /ui ui used to copy the developer's ui/node_modules and a stale dist into local builds.
• Dead / phantom deps: yaml removed (nothing imports it). ofetch declared (imported by ui/src/context.ts, it only resolved through the lib-vue peer).
• Verified majors: marked 18, @vueuse/core 15, unplugin-vue-components 32 (drops the chokidar 3 / braces chain), unplugin-auto-import 21, config 5 (ships its own types, so @types/config and a @ts-ignore go). Old and new versions were run side by side on ui/public/examples and api/config:
  • marked renders 4619 descriptions identically. Only a quote inside a javascript: href is now entity-encoded, and it is sanitized anyway.
  • config resolves the same values in production, development and test, and with env overrides.
• fix(api): the API starts without BUILD.json. Before, an image built outside CI crashed with ENOENT.
• fix(ui): dev pages are excluded from the build by the vite command, not by NODE_ENV.
• Tooling:
  • eslint 10, neostandard 0.14, commitlint 21, @data-fair/lib-utils declared at the root.
  • ui eslint uses flat/recommended and flat/recommended-v4; the 5 new warnings are fixed.
  • commitlint.config.ts; commit-msg passes "$1".
  • engines.node v24, erasableSyntaxOnly.
  • check-types now also runs vue-tsc, after the ui build in quality.
  • The lockfile shrinks by ~2700 lines, mostly because eslint 10 drops most of its dependency tree.
• CI: checkout v7, setup-node v7, setup-buildx v4, login v4, metadata v6, build-push v7. The docker actions still ran on node20, and no input used here was renamed or removed. battila7/get-version-action (node12, unmaintained) is replaced by a shell step. Note that the shared tooling reference lists action majors as "not decided"; they were bumped because of node20's removal.

Verification

• npm run lint, check-types (api + ui), ui build, unit tests 13/13.
• e2e 6/6, run against the built production image.
• Visual snapshots of the 4 pages are pixel-identical to a master build.
• The image boots without BUILD.json and loads config 5 (config.get('port')).
• actionlint: only a pre-existing shellcheck warning in the BUILD.json step.

Untested: the releases.yml change (the major-tag shell step) only runs on the next v* tag. Its logic was checked locally (v2.3.1 → 2).

Deferred

• @apidevtools/json-schema-ref-parser 16: identical output on the fixtures. In the browser, though, it blocks external $refs to localhost / private IPs (safeUrlResolver on by default) and fetches with redirect: "manual", which gives an opaque response on redirects. No fixture has external refs, so it can't be proven neutral. It also keeps vite-plugin-node-polyfills needed (path / Buffer / process).
• js-yaml 5: the default export is removed, and YAML.dump no longer folds long strings, a visible change in the YAML tabs.
• bcoe/conventional-release-labels@v1: node12, last release 2022, no drop-in replacement.
• TypeScript 6: not decided.