[haofeif]

Summary

This PR puts the open Dependabot updates #920, #922, #923, #924, #925, #926 and #928 into one change. It adds only the changes that CI needs to pass. It also repairs main: on eb2c9d3, Unit Tests (3.12) and CAO MCP Apps fail.

#921 and #927 are already merged, so this PR does not include them.

Supersedes #920, #922, #923, #924, #925, #926, #928. Dependabot closes these PRs when main has the updates.

The PR changes 26 files. 16 files are the Dependabot changes. The other 10 files are the necessary fixes below.

Commits

1. Merge #922 and #920

These are the Dependabot commits with no change. #921 changed the adjacent typescript line in examples/aidlc-portfolio, so the #920 merge had a conflict in package.json and bun.lock. The resolution keeps the two changes.

2. ci: align the setup-trivy pin (repairs main)

#927 moved aquasecurity/setup-trivy in ci.yml to v0.3.1 (81e5143…). The Dependency Security composite action (.github/actions/dependency-security/action.yml) stayed on v0.2.6. test_real_inventory_regression_has_a_required_scanner_in_ci requires the same pin in the two files, so it fails on main. This commit uses the v0.3.1 pin in the composite action. v0.3.1 has the same inputs as v0.2.6.

3. build(deps): React 19, Vitest 5, fast-check 4, @types/node 26

PR	Directory	Change	Necessary companion update
#923	cao_mcp_apps	@types/node 22 → 26	none
#924	cao_mcp_apps	fast-check 3 → 4	none
#925	cao_mcp_apps	vitest 4 → 5.0.3	@vitest/coverage-v8 5.0.3
#926	cao_mcp_apps	react and @types/react 18 → 19.3	react-dom and @types/react-dom 19.3
#928	web	vitest 4 → 5.0.3	none

Without the companion updates, npm ci fails with ERESOLVE. That is why CI failed on #925 and #926:

• @vitest/coverage-v8 4 has a peer dependency on vitest 4.
• react-dom 18 has a peer dependency on react ^18.
• @types/react-dom 18 has a peer dependency on @types/react ^18.

Code changes that the updates need:

• @types/react 19 (cao_mcp_apps). It removes the global JSX namespace. Eight components now return React.JSX.Element instead of JSX.Element. All of them already import React.
• Vitest 5 (web). jest-dom declares its matcher types in the Vitest 4 shape, so tsc gave 282 errors. That is why CI failed on build(deps-dev): bump vitest from 4.1.11 to 5.0.3 in /web #928 (Vitest 5: matcher types are lost — Assertion<T> augmentation no longer merges with Vitest's Assertion<R, T> testing-library/jest-dom#738, fix pending in feat: support vitest 5 testing-library/jest-dom#742). web/src/test/setup.ts adds the jest-dom matchers to the Vitest 5 Matchers interface. Remove this block when jest-dom ships Vitest 5 types.

I made the lockfiles with npm 10.9.9 and --before=2026-10-06T05:00:00Z, to keep the seven-day release cooldown. A minimal npm install from the main lockfiles (npm 11.21.0) gives the same package versions.

Items for maintainers

• Node 20 and Vitest 5. Vitest 5 declares Node ^22.12.0 || ^24.0.0 || >=26.0.0. The web-build and cao-mcp-apps jobs stay on Node 20, because CI passes on it. npm shows only EBADENGINE warnings, and .npmrc does not set engine-strict. A separate PR can move these jobs to Node 22.

• Dependabot scope. The github-actions entry in .github/dependabot.yml uses directory: "/". Dependabot thus does not update the pins in .github/actions/*, and the setup-trivy mismatch can occur again. A separate PR can add directories: ["/", "/.github/actions/*"].

• Bundle size. React 19 adds about 22 KB gzip to each view bundle. All bundles stay under their limits, but graph.html has less headroom:

  Bundle (KB gzip)	main	This PR	Limit
  dashboard.html	49.2	71.3	250
  agent.html	48.7	70.8	250
  event-stream.html	48.0	70.1	150
  graph.html	86.5	108.5	120

• Frontend coverage. The total changes from 90.06% to 90.04%. The floor is 90.00%.

• Released wheels. publish-to-pypi.yml builds only web, so React 19 affects only users who build cao_mcp_apps from source.

Local validation

On Node 20.20.2 and npm 10.8.2 (the CI versions):

• web: npm ci, tsc --noEmit clean, 24 files / 335 tests pass on Vitest 5.0.3, npm run build passes.
• cao_mcp_apps: npm ci, typecheck clean, 78/78 tests pass with coverage (lines 90.04%), build:all passes, scan:jit clean, check:size OK.
• test/test_workflow_pins.py and test/test_dependency_security.py: 94 passed, 7 skipped.

[Copilot]

🔵 Needs a closer look

It combines several major frontend and test-toolchain upgrades across 32 files, warranting final human review.

0 open findings

What changed in this PR

Combines scheduled dependency upgrades, adds React/Vitest compatibility changes, and repairs Dependabot coverage for composite-action pins.

Changes:

• Upgrades React, Vitest, Vite, Playwright, fast-check, and related dependencies.
• Adds React 19 JSX typing and Vitest 5 jest-dom compatibility.
• Updates CI runtimes and Dependabot coverage for local actions.

File	Description
.github/​actions/​dependency-security/​action.yml	Updates the Trivy setup pin.
.github/​dependabot.yml	Watches local composite actions.
.github/​workflows/​ci.yml	Uses Node 22 for Vitest jobs.
CHANGELOG.md	Documents dependency and CI changes.
cao_mcp_apps/​README.md	Updates Node prerequisites.
cao_mcp_apps/​package-lock.json	Locks upgraded MCP app dependencies.
cao_mcp_apps/​package.json	Upgrades React and test tooling.
cao_mcp_apps/​scripts/​check-bundle-size.mjs	Updates measured graph bundle size.
cao_mcp_apps/​src/​agent/​AgentView.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​dashboard/​Dashboard.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​event-stream/​EventStreamView.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​graph/​GraphView.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​shared/​AgentStatus.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​shared/​EventStream.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​shared/​HeaderBar.tsx	Uses React’s JSX namespace.
cao_mcp_apps/​src/​shared/​TaskControl.tsx	Uses React’s JSX namespace.
docusaurus/​package-lock.json	Locks updated React dependencies.
docusaurus/​package.json	Upgrades React and its types.
examples/​ag-ui/​ag-ui-construct-demos/​tools/​package-lock.json	Locks recorder tooling updates.
examples/​ag-ui/​ag-ui-construct-demos/​tools/​package.json	Upgrades Playwright and FFmpeg.
examples/​ag-ui/​ag-ui-eventsource-viewer/​tools/​package-lock.json	Locks the Playwright update.
examples/​ag-ui/​ag-ui-eventsource-viewer/​tools/​package.json	Upgrades Playwright.
examples/​agent-plugins/​agent-plugins-dogfood/​tools/​package-lock.json	Locks recorder tooling updates.
examples/​agent-plugins/​agent-plugins-dogfood/​tools/​package.json	Upgrades Playwright and FFmpeg.
examples/​aidlc-portfolio/​bun.lock	Locks Bun dependency updates.
examples/​aidlc-portfolio/​package.json	Upgrades YAML and Bun types.
examples/​aidlc-portfolio/​skills/​aidlc-portfolio/​bun.lock	Locks the YAML update.
examples/​aidlc-portfolio/​skills/​aidlc-portfolio/​package.json	Upgrades YAML.
test/​test_workflow_pins.py	Verifies composite actions are watched.
web/​package-lock.json	Locks upgraded web tooling.
web/​package.json	Upgrades Vite, Vitest, and related tools.
web/​src/​test/​setup.ts	Restores jest-dom types under Vitest 5.

Files not reviewed (6)

• cao_mcp_apps/package-lock.json: Generated file
• docusaurus/package-lock.json: Generated file
• examples/ag-ui/ag-ui-construct-demos/tools/package-lock.json: Generated file
• examples/ag-ui/ag-ui-eventsource-viewer/tools/package-lock.json: Generated file
• examples/agent-plugins/agent-plugins-dogfood/tools/package-lock.json: Generated file
• web/package-lock.json: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[fanhongy]

Great dependency update.

[Copilot]

🟡 Changes recommended

Required Node 22 and Dependabot configuration changes are absent, and the matcher augmentation weakens argument typing.

4 open findings

• CAO MCP Apps CI still uses unsupported Node 20 · New
• Web UI CI still uses unsupported Node 20 · New
• Compatibility shim weakens matcher argument type checking · New
• Dependabot excludes composite-action pins · New

Files not reviewed (6)

• cao_mcp_apps/package-lock.json: Generated file
• docusaurus/package-lock.json: Generated file
• examples/ag-ui/ag-ui-construct-demos/tools/package-lock.json: Generated file
• examples/ag-ui/ag-ui-eventsource-viewer/tools/package-lock.json: Generated file
• examples/agent-plugins/agent-plugins-dogfood/tools/package-lock.json: Generated file
• web/package-lock.json: Generated file

🧠 Review effort: Balanced

[haofeif]

Not changed in this PR. The PR scope is only the changes that CI needs. CI passes on Node 20.20.2 at 4e4b6f5: the CAO MCP Apps job runs 78/78 Vitest 5.0.3 tests, and the coverage ratchet is OK (frontend 90.04%). npm shows only EBADENGINE warnings, and .npmrc does not set engine-strict.

I removed the Node 22 change from this PR on purpose. This review used the earlier PR description. The current description lists the move to Node 22 as a separate follow-up under "Items for maintainers".

[haofeif]

Not changed in this PR, for the same reason as in the CAO MCP Apps thread. CI passes on Node 20.20.2 at 4e4b6f5: the Web UI Build job runs 335/335 Vitest 5.0.3 tests, and tsc --noEmit and npm run build pass.

This review used the earlier PR description. The current description lists the move to Node 22 as a separate follow-up.

[haofeif]

No change. The shim does not weaken the typing that main has:

• jest-dom 6.9.1 uses any for E in its own Vitest types (types/vitest.d.ts: TestingLibraryMatchers<any, T>).
• On main, web gets the matchers from jest-dom types/jest.d.ts, where E is ReturnType<typeof expect.stringContaining>. web does not install @types/jest, so this type is also any.
• In Vitest 5.0.3, expect.stringContaining returns any, and vitest does not export AsymmetricMatcher. Thus the jest-dom form also gives any.

I ran the same tsc probe on main (Vitest 4.1.11) and on 4e4b6f5 (Vitest 5.0.3). On both, toHaveAccessibleName(42) and toHaveAccessibleDescription(42) compile, and the toHaveClass(42) control fails. The result is the same. A stricter type for E is a separate change.

[haofeif]

Not changed in this PR. This PR includes only the changes that CI needs. The pin change alone repairs main: at 4e4b6f5, test_real_inventory_regression_has_a_required_scanner_in_ci passes in the Unit Tests and CAO MCP Apps jobs.

This review used the earlier PR description. The current description lists the directories: ["/", "/.github/actions/*"] change as a separate follow-up under "Items for maintainers".

[gutosantos82]

PR Review: #935 — build(deps): combine Dependabot updates #920, #922–#926, #928 and repair main CI

Summary

This PR merges Dependabot #920/#922 verbatim, re-does #923–#926/#928 with the companion peer-dependency bumps they were missing (react-dom/@types/react-dom 19, @vitest/coverage-v8 5), makes the two code changes the upgrades force (JSX.Element → React.JSX.Element in 8 cao_mcp_apps components; a Vitest 5 jest-dom matcher type shim in web/src/test/setup.ts), and aligns the setup-trivy pin in .github/actions/dependency-security/action.yml with ci.yml — which is what turns main green again (test_real_inventory_regression_has_a_required_scanner_in_ci). The description is unusually faithful to the diff (file counts, component count, companion-bump table, lockfile provenance all verified), lockfiles are clean (all 146 added resolved URLs on registry.npmjs.org, all sha512, no new install scripts, 7-day cooldown respected), and every peer dependency resolves. At the current head (4e4b6f5) the author deliberately cut scope to "only what CI needs", dropping the Node 22 CI move, dependabot.yml directories, CHANGELOG/README/bundle-size-comment edits that were in the previous head. Recommendation: merge (squash), with two one-line doc fixes as optional nits and the Dependabot-coverage follow-up tracked so this drift cannot recur.

Important (should fix)

• [conventions] cao_mcp_apps/README.md:124 — the V8-coverage note still reads "Vitest 4 / @vitest/coverage-v8 4 compute V8 line coverage via AST-based remapping…" while this PR moves cao_mcp_apps to Vitest 5 / coverage-v8 5. The substance still holds; only the major is wrong. The previous head updated this line and the scope cut reverted it. CODEBASE.md's documentation-maintenance rule asks that version claims move with the package metadata in the same change — a one-word fix.
• [tests] .github/dependabot.yml (follow-up to track) — the repair is detection-only: test_real_inventory_regression_has_a_required_scanner_in_ci will catch the next setup-trivy drift, but because the github-actions ecosystem still lists only directory: "/", Dependabot will again bump ci.yml without touching the composite action, and main re-reddens until someone hand-fixes it. Deferring directories: ["/", "/.github/actions/*"] (plus its regression assertion) out of this PR is a reasonable scope call; please make sure the follow-up actually lands, since it is the root-cause fix for exactly the incident this PR repairs.

Nits (optional)

• [consistency] cao_mcp_apps/scripts/check-bundle-size.mjs:8 — comment says graph.html was "measured ~86.3 KB gz … ~28% headroom"; after React 19 the PR's own table puts it at 108.5 KB (≈10% headroom under the 120 KB limit). The enforced budget is unchanged and correct; only the comment is now misleading. Also an acknowledged deferral from the scope cut.
• [conventions] merge commits — the branch carries two non-Conventional Merge commit 'refs/pr/92x' commits. They disappear under squash (the PR title becomes the landed subject and is a valid build(deps):), so use squash rather than rebase-and-merge for this one.
• [conventions] CHANGELOG — no written rule requires an entry for dependency bumps, but React 18 → 19 in cao_mcp_apps is user-visible to anyone who builds MCP Apps from source (as the body notes). A one-line Unreleased note would be reasonable; not required.

Tests

test/test_dependency_security.py::test_real_inventory_regression_has_a_required_scanner_in_ci compares ci.yml's setup-trivy step (uses, with, if) against steps[0] of the composite action; at 4e4b6f5 both read aquasecurity/setup-trivy@81e51434… # v0.3.1 with version: v0.70.0, so the pin bump alone satisfies it. test_every_action_is_pinned_to_a_commit_sha still parametrizes over .github/actions/**/action.yml. The jest-dom shim is exercised by tsc --noEmit in the Web UI Build job (web/tsconfig.json includes src, and matcher call sites live under src/**/*.test.tsx), so a future jest-dom whose own Vitest 5 types conflict would surface at the call sites; a merely-redundant shim would not fail anything, so its removal relies on the code comment. cao_mcp_apps fast-check usage passes explicit numRuns, vitest.config.ts declares no coverage thresholds (the ratchet script reads coverage-summary.json, still emitted under Vitest 5), and a grep for React-19-removed APIs (defaultProps, propTypes, forwardRef, ReactDOM.render, findDOMNode, string refs) finds none — entry points already use createRoot. CI at this head: 29/29 checks green (78/78 cao_mcp_apps, 335/335 web, Python 3.10–3.12 unit suites).

Verification

Dynamic verification did not return in time; not covered. Static evidence above (pin equality in both files at the worktree, peer-dep resolution in the lockfiles, CI green at 4e4b6f5) stands on its own.

Verdict

Approve with nits — the change does exactly what it says, repairs main, and all angles are clean; the two stale doc/comment strings are one-line fixes and the Dependabot-coverage follow-up should be tracked so the drift does not recur. Squash on merge.