...yourself become the cheeseburger #724

Merged
Griefed merged 36 commits from develop into main 2026-10-18 15:15:17 +02:00
Owner
No description provided.
Griefed self-assigned this 2026-10-18 12:26:14 +02:00
deps(deps): update dependency axios to v1.20.0
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 9m53s
Test / Docker image (push) Successful in 13m42s
Qodana / scan (push) Successful in 18m27s
Qodana / notify (push) Successful in 17s
Test / build (push) Failing after 8m33s
377f997c90
deps(deps): update dependency @quasar/cli to v5
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 7m34s
Qodana / scan (push) Successful in 11m39s
Test / Docker image (push) Successful in 11m0s
Qodana / notify (push) Successful in 31s
Test / build (push) Failing after 10m43s
64509ace09
deps(deps): pin dependencies
Some checks failed
Grinder Container IT / containers (push) Successful in 6m5s
Qodana / scan (push) Successful in 10m18s
Test / Docker image (push) Successful in 12m3s
Qodana / notify (push) Successful in 7s
Test / build (push) Failing after 9m21s
2eb573478d
deps(deps): update dependency typescript-eslint to ^8.71.1
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 8m27s
Qodana / scan (push) Successful in 15m6s
Test / Docker image (push) Successful in 15m9s
Qodana / notify (push) Successful in 13s
Test / build (push) Failing after 10m23s
69718fd196
deps(deps): update dependency @babel/eslint-parser to v7.29.9
Some checks failed
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 9m20s
Qodana / scan (push) Successful in 14m46s
Test / Docker image (push) Successful in 14m57s
Qodana / notify (push) Successful in 9s
Test / build (push) Failing after 11m53s
3483cdfec9
chore(config): migrate config renovate.json
Some checks failed
Grinder Container IT / containers (push) Successful in 6m51s
Docker Test / build image (push) Successful in 13m55s
Qodana / scan (push) Successful in 12m43s
Qodana / notify (push) Successful in 10s
Test / build (push) Failing after 6m17s
b3b0da61cb
deps(deps): update dependency quasar to v2.35.1
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 6m34s
Qodana / scan (push) Successful in 13m59s
Test / Docker image (push) Successful in 12m10s
Test / build (push) Successful in 38m8s
Qodana / notify (push) Successful in 33s
815b128313
deps(deps): update dependency vue to v3.5.44
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 5m12s
Qodana / scan (push) Successful in 9m12s
Test / Docker image (push) Successful in 7m45s
Test / build (push) Successful in 33m33s
Qodana / notify (push) Successful in 27s
b847981e72
deps(deps): update dependency @quasar/extras to v1.18.0
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 4m5s
Qodana / scan (push) Successful in 9m42s
Test / build (push) Successful in 12m52s
Test / Docker image (push) Successful in 11m33s
Qodana / notify (push) Successful in 32s
a4a767aff2
deps(deps): update dependency core-js to v3.50.0
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 8m44s
Qodana / scan (push) Successful in 13m42s
Test / build (push) Successful in 12m52s
Test / Docker image (push) Successful in 11m18s
Qodana / notify (push) Successful in 32s
c0b0cace95
deps(deps): update dependency eslint to v8.57.1
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 6m15s
Qodana / scan (push) Successful in 13m40s
Test / Docker image (push) Successful in 13m10s
Test / build (push) Successful in 15m18s
Qodana / notify (push) Successful in 42s
dc51c0fb97
deps(deps): update dependency eslint-config-prettier to v8.10.2
All checks were successful
renovate/stability-days Updates have met minimum release age requirement
Grinder Container IT / containers (push) Successful in 8m30s
Qodana / scan (push) Successful in 12m35s
Test / build (push) Successful in 12m37s
Test / Docker image (push) Successful in 11m11s
Qodana / notify (push) Successful in 41s
87414b3175
Merge pull request 'deps(deps): update dependency eslint-config-prettier to v8.10.2' (#723) from renovate/eslint-config-prettier-8.x into develop
Some checks failed
Documentation and homepage / Version (push) Successful in 42s
Continuous / Preparations (push) Successful in 45s
Continuous / Continuous Pre-Release (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / JARs (push) Has been cancelled
Continuous / AppImage (aarch64) (push) Has been cancelled
Continuous / AppImage (x86_64) (push) Has been cancelled
Continuous / Windows app-image (x86_64) (push) Has been cancelled
Continuous / install4j media (push) Has been cancelled
Continuous / Stage the release assets (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 16m44s
d545cd1aa0
Reviewed-on: #723
Merge pull request 'deps(deps): update dependency core-js to v3.50.0' (#721) from renovate/core-js-3.x into develop
Some checks failed
Continuous / Preparations (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / Continuous Pre-Release (push) Has been cancelled
Documentation and homepage / Version (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 19m44s
cc633646d5
Reviewed-on: #721
Merge pull request 'deps(deps): update dependency @quasar/extras to v1.18.0' (#720) from renovate/quasar-extras-1.x into develop
Some checks failed
Documentation and homepage / Version (push) Successful in 38s
Continuous / Preparations (push) Successful in 47s
Continuous / Continuous Pre-Release (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / JARs (push) Has been cancelled
Continuous / AppImage (aarch64) (push) Has been cancelled
Continuous / AppImage (x86_64) (push) Has been cancelled
Continuous / Windows app-image (x86_64) (push) Has been cancelled
Continuous / install4j media (push) Has been cancelled
Continuous / Stage the release assets (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 15m58s
a4f725ef82
Reviewed-on: #720
Merge pull request 'deps(deps): update dependency vue to v3.5.44' (#719) from renovate/vue-monorepo into develop
Some checks failed
Continuous / Preparations (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / Continuous Pre-Release (push) Has been cancelled
Documentation and homepage / Version (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Grinder Container IT / containers (push) Failing after 13m39s
fb62d8d150
Reviewed-on: #719
Merge pull request 'deps(deps): update dependency quasar to v2.35.1' (#704) from renovate/quasar-2.x-lockfile into develop
Some checks failed
Continuous / Preparations (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / Continuous Pre-Release (push) Has been cancelled
Documentation and homepage / Version (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 13m14s
931089d4e0
Reviewed-on: #704
Merge branch 'renovate/eslint-monorepo' into develop
Some checks failed
Continuous / Preparations (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / Continuous Pre-Release (push) Has been cancelled
Documentation and homepage / Version (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 12m47s
9f7a8f296b
# Conflicts:
#	serverpackcreator-homepage/package-lock.json
#	serverpackcreator-homepage/package.json
Merge pull request 'deps(deps): update dependency typescript-eslint to ^8.71.1' (#717) from renovate/typescript-eslint-monorepo into develop
Some checks failed
Continuous / Preparations (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / Continuous Pre-Release (push) Has been cancelled
Documentation and homepage / Version (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: Quasar build (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Test / build (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 12m25s
219f72d512
Reviewed-on: #717
Merge pull request 'deps(deps): update dependency @babel/eslint-parser to v7.29.9' (#718) from renovate/babel-monorepo into develop
Some checks failed
Continuous / Preparations (push) Successful in 2m56s
Documentation and homepage / Version (push) Successful in 38s
Documentation and homepage / Homepage: Quasar build (push) Successful in 3m24s
Qodana / scan (push) Successful in 17m22s
Test / build (push) Successful in 17m19s
Continuous / JARs (push) Successful in 12m12s
Documentation and homepage / Writerside webhelp (push) Successful in 3m46s
Documentation and homepage / Dokka HTML (push) Successful in 4m57s
Qodana / notify (push) Successful in 26s
Continuous / AppImage (aarch64) (push) Successful in 3m20s
Continuous / AppImage (x86_64) (push) Successful in 2m51s
Continuous / Continuous Pre-Release (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / Stage the release assets (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Continuous / install4j media (push) Has been cancelled
Continuous / Windows app-image (x86_64) (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Grinder Container IT / containers (push) Successful in 9m35s
f3c03f05ac
Reviewed-on: #718
Renovate's pin PR was cut before #717/#718 landed, so both frontend manifests
conflicted. Resolved by taking the pinned `devDependencies` block wholesale --
every pin it proposes is at or above the caret floor develop already carried,
including `typescript-eslint` 8.71.1, which #717 had moved to `^8.71.1` --
and regenerating `package-lock.json` from develop's tree with the toolchain
the build actually uses (`serverpackcreator-web-frontend/node`, Node 24.18.1 /
npm 11.16.0, matching `packageManager`) rather than the host's npm 10.

Verified every one of the 19 pinned packages resolves to exactly its pinned
version in the regenerated lockfile.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Closes CVE-2023-45857 (GHSA-wf5p-g6vw-rhxx) for the homepage.

The branch was cut before `core-js` 3.50.0 landed on develop, so its
`package.json` hunk also carried a stale 3.27.2 alongside the axios bump.
Resolved by taking the axios bump only and keeping develop's `core-js`,
then regenerating `package-lock.json` from develop's tree on Node 22 -- the
version `homepage-build` in `.forgejo/workflows/docs.yml` pins. Lockfile
format stays at version 2.

Verified in the regenerated lockfile: axios 1.20.0, core-js 3.50.0.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Closes CVE-2026-106105 (GHSA-fh39-c73x-5pjv, dev TLS keys cached world-readable)
for the homepage. Net -1410 lines of lockfile: CLI v5 carries far fewer
transitive dependencies than 1.3.2.

Stale-base conflict as in #714/#715 -- the branch also carried a pre-develop
`@quasar/extras` 1.16.2. Resolved by taking the `@quasar/cli` bump only and
keeping develop's 1.18.0, then regenerating `package-lock.json` on Node 22,
the version `homepage-build` in `.forgejo/workflows/docs.yml` pins.

Verified by running the build this bump is supposed to affect:
`npm ci && npx quasar build` emits `dist/spa/index.html`, which is the same
artifact the CI step *Check the build produced a site* tests for.

Note for whoever next touches this: `@quasar/cli` is NOT on the build path.
`node_modules/.bin/quasar` resolves to `@quasar/app/bin/quasar`, so `npx quasar
build` and `npm run build` both run the `@quasar/app` 3.3.3 binary and never
the one this PR bumps. The bump is still worth taking -- it closes the advisory
and sheds the dependencies -- but it buys no build-behaviour change, and the
197-package `@quasar/cli` entry in `dependencies` is arguably dead weight.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Renovate deprecated `baseBranches` in favour of `baseBranchPatterns`; this is
its own self-migration PR. Merged clean, no conflicts.

Nothing in the build reads `renovate.json`, so there is nothing to verify
beyond the file staying valid JSON against the schema it declares.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
PR #715 (`quasar` 2.11.10 -> 2.32.2, CVE-2026-73647) cannot be merged: the
advisory's first patched version is 2.22.0 and `@quasar/app` 3.3.3 caps out
between 2.14.5 and 2.17.0. B49 records the measurements so the next attempt
starts where this one stopped rather than re-deriving them -- the two distinct
failures (a 2021-era pinned `sass`, then `importTransformation is not a
function`), the bisected ceiling, the proof that `@quasar/app-webpack` 4 is a
dead end because qflashcard has no webpack-4 release, the Node floor in all
three places that build the site, and how far a Vite prototype got before its
production build threw `cardImage is not a function` and its dev server went
blank.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fix(docker): the user-facing compose file pinned latest to a digest, freezing every copy of it
Some checks failed
Documentation and homepage / Version (push) Successful in 1m19s
Continuous / Preparations (push) Successful in 1m22s
Documentation and homepage / Homepage: Quasar build (push) Successful in 4m20s
Qodana / scan (push) Successful in 15m36s
Grinder Container IT / containers (push) Successful in 6m33s
Test / Docker image (push) Successful in 14m16s
Documentation and homepage / Writerside webhelp (push) Successful in 2m32s
Documentation and homepage / Dokka HTML (push) Successful in 3m41s
Qodana / notify (push) Successful in 15s
Documentation and homepage / Help image (push) Successful in 2m46s
Continuous / JARs (push) Successful in 9m38s
Continuous / AppImage (aarch64) (push) Successful in 2m56s
Documentation and homepage / Homepage: image (push) Successful in 7m3s
Continuous / AppImage (x86_64) (push) Successful in 3m16s
Continuous / Windows app-image (x86_64) (push) Successful in 9m25s
Continuous / install4j media (push) Successful in 9m8s
Continuous / Stage the release assets (push) Successful in 3m55s
Continuous / Build (push) Successful in 0s
Continuous / Continuous Pre-Release (push) Has been cancelled
Test / build (push) Has been cancelled
7471aab2c2
#707 pinned `griefed/serverpackcreator:latest@sha256:043784a2...`, which is the
one place a digest pin is wrong: `docker-compose.yml` is the file users copy, so
a digest there means `docker compose pull` never brings them a new
ServerPackCreator again. The pinned digest was already stale on arrival --
`latest` is `sha256:0edae87d...`.

Replaced with the concrete newest release instead of a floating tag, so the file
says which version it runs and renovate can bump it:

  griefed/serverpackcreator:latest@sha256:043784a2...  ->  :9.3.0
  mongodb/mongodb-community-server:8.0.5-ubuntu2204@sha256:4d7cd163...
                                                       ->  :8.0.34-ubuntu2204

`9.3.0` and `latest` are the same manifest list (verified: `docker manifest
inspect` returns byte-identical output for both), so this changes nothing about
what a fresh `docker compose up` runs today -- only about what it runs tomorrow.

MongoDB stays on the 8.0 line deliberately. 8.3.13 and 9.0.4 are published, but
8.0.5 is what `de.flapdoodle.mongodb.embedded.version` drives the whole -app
suite against, so crossing a major is a separate, tested change rather than part
of unpinning a digest. 8.0.5 -> 8.0.34 is 29 patch releases inside that line.

Measured against the real images rather than the registry API, which is how the
kernel guard now documented in the file turned up: on this host's
7.0.12-linuxkit, 8.0.5 starts and reports its version, while 8.0.34, 8.3.13 and
9.0.4 all exit 0 with "MongoDB cannot start: Linux kernel versions 6.19.0
through 7.0.13 have a known incompatibility". The guard is the fix for
SERVER-121912, not a regression -- the releases lacking it are the ones that
crash -- so the comment says to move the kernel, not the image.

README.md carries its own copy of the db service and is the source of truth for
the two generated copies, so its tag moves with this one. Its
`serverpackcreator:latest` line stays as it is: it is teaching material and
already points at the tag list.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The file called "dev" was the slowest way to run this project. It built
`docker/Dockerfile`, whose builder stage runs a full Gradle build inside the
container with no cache mount, so a one-line change cost a complete from-scratch
build with no debugger, no hot-swap and no code sync. And it never published
MongoDB's port, so the dev loop this repository already has -- a Spring Boot run
configuration with `UpdateClassesAndResources`, and `spring-boot-devtools`
already a `developmentOnly` dependency -- could not reach the database at all.
The two halves were never connected.

It is now dependencies-only by default: `up -d` gives MongoDB with 27017
published plus mongo-express, and the application runs from the IDE. The image
build survives behind `profiles: ["app"]`, because it is the only thing that
exercises the s6 init script and the `overrides.properties` it composes.

Also in the file, each its own small defect:

  - `version: '3'` is obsolete; `docker compose config` warned on every
    invocation.
  - Both compose files use the same service names, so they fought over the same
    containers. A `name: spc-dev` project and no `container_name:` separates
    them.
  - `restart: unless-stopped` resurrected the whole dev stack on every Docker
    Desktop start.
  - `depends_on` only orders starts. A `mongosh` healthcheck plus
    `condition: service_healthy` closes the race that
    `serverpackcreator-app/CLAUDE.md` records as "the normal first boot".
  - The database volumes were commented out, so the dev database died with the
    stack. Named volumes now, and the file says `down -v` is the reset, because
    `init-mongo.js` only ever runs against an empty /data/db.
  - mongo-express spent ten retries dialling a host named `mongo` on every
    start, because its entrypoint parses `ME_CONFIG_MONGODB_URL` -- which was
    unset -- to decide what to wait for, while the app read the
    SERVER/PORT/ADMINUSERNAME/ADMINPASSWORD quartet and worked anyway. One URL
    replaces the four, and the retry loop is gone (verified: 0 retry lines).

Digests unpinned, finishing what the deployment compose file started:
mongo-express `@sha256:1b23d797...` -> `1.0.2-20-alpine3.19` (that digest is
both `latest` and `1.0.2`, May 2024 on Node 18 / alpine 3.18; this is the
November 2024 rebuild of the same release, which is still the newest one).
MongoDB tracks the deployment file at 8.0.34 rather than lagging it, which on
this host means it does not start at all: kernels 6.19.0-7.0.13 hit
SERVER-121912 and the image refuses, by design, and Docker Desktop's linuxkit
kernel is inside that range. The tag is therefore overridable from an untracked
`docker/.env` via `SPC_DEV_MONGO_IMAGE`, so the version stays correct in git
while remaining runnable per machine.

`.dockerignore` is in this commit because `--profile app` still builds with
`context: ..`, and that context was 1025 MB of which almost none was an input.
Measured by `du -sm` on the extracted context, identically before and after:
**1025 MB -> 112 MB**. The big three were `media/` (789 MB of gitignored
install4j output that nothing excluded), `serverpackcreator-homepage/` (373 MB,
which has its own context and which `docker/Dockerfile` never touches) and
`.git` (119 MB; nothing in the build reads it -- the Dockerfile passes
`-Pversion` explicitly). The patterns are `**/`-prefixed now because a
single-level `*/build` matched `serverpackcreator-api/build` but not
`buildSrc/build`.

Verified: `docker compose config --quiet` is silent; the default `up` starts
exactly the two dependency services and `--profile app` adds the third; the
healthcheck reaches `healthy` and mongo-express waits for it; `mongosh
"mongodb://root:1234567890@127.0.0.1:27017/serverpackcreatordb"` from the host
returns the database, which is the URI the run configuration will carry;
mongo-express answers 401 without and 200 with `mexpress`/`mexpress` and lists
the database. The context was checked file-by-file inside an image rather than
by reading the ignore file: every input Gradle needs is present (wrapper,
catalog, both settings files, all eight module `src/main` trees, buildSrc's
Kotlin, `docker/root`, and the frontend's 50 source and 17 test files) and all
five excluded trees are genuinely absent.

NOT verified, and pre-existing: `--profile app` cannot complete on this machine.
The Gradle daemon inside the container is OOM-killed at Docker Desktop's 1.92 GB
limit, which has nothing to do with this change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`.runConfigurations/` is the legacy location; modern IntelliJ reads `.run/`, and
the split was already visible in the tree -- twenty-one files in the dead
directory and one (`Homepage build`) in the live one, added last week. Every one
of those twenty-one was invisible in the IDE. Moved with `git mv` so the history
follows, which is also what makes the three repairs below legible as repairs
rather than as new files.

Fixed while moving, each a real defect rather than a tidy-up:

  - `Debug Fat Jar` had `WORKING_DIRECTORY` of
    `F:\GitLab\ServerPackCreator\serverpackcreator-app\tests` -- an absolute
    path from a Windows checkout that cannot resolve anywhere else. Now
    `$PROJECT_DIR$/serverpackcreator-app/tests`, matching every other
    configuration here. Its `JAR_PATH` was already correct:
    `serverpackcreator-app-dev.jar` is what the build produces.
  - `Test API` ran `:serverpackcreator-api:clean` and
    `:serverpackcreator-app:test` -- it cleaned one module and tested a
    different one, so it never once tested the API. Now
    `:serverpackcreator-api:test`, verified to resolve.
  - `Build without tests with version` hardcoded `-Pversion=6.3.4`. The project
    is at 9.3.0 and the value was three majors stale, so the configuration is
    deleted rather than re-pinned to a number that will go stale again;
    `Build without tests` plus an explicit `-Pversion` covers the case.

Added two, which is the point of the preceding commit:

  - `Dev stack` runs `docker/docker-compose-dev.yml` from the Services tool
    window.
  - `WebService (dev stack)` is the Spring Boot configuration for the fast loop.
    It carries `--spring.mongodb.uri=...` as a program argument rather than
    relying on the home directory, because
    `serverpackcreator-app/tests/serverpackcreator.properties` is generated and
    untracked and the copy the application writes itself carries no credentials,
    while the dev database requires them. A comment in the file records that the
    key is `spring.mongodb.uri` -- `spring.data.mongodb.uri` is retired at error
    level in Spring Boot 4 and binds nothing -- and that
    `mongodb://localhost/test` in the log is the symptom of getting it wrong.

`misc/Java-References.md` cites `Debug Fat Jar.run.xml` by path for its
`ALTERNATIVE_JRE_PATH`, so that link moves with the file; the two remaining
repository matches for "runConfigurations" are an unrelated field name in the
generated `api-docs.yaml`. The `.dockerignore` entry was swapped from the old
directory to the new one in the preceding commit.

Verified: all 23 configurations parse as XML, every `name` attribute matches its
filename, and no absolute or host-specific path remains anywhere under `.run/`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
B50, no JDWP seam in the container: the new dev loop debugs in IntelliJ against
a containerised MongoDB, so nothing in the common path needs one. The narrow
case that does -- a defect reproducible only under the image, such as the s6
init script or the PUID/PGID remapping -- currently has only log statements.
Recorded with why it is not free: `svc-spc/run`'s argument order already relies
on HotSpot parsing VM options past `-jar`, and shell templates are the category
that must be pinned before being touched.

B51, the image build OOMs at Docker Desktop's ~2 GB default. Measured at
1.92 GB: the builder stage's Gradle daemon dies at ~90 s with "Gradle build
daemon disappeared unexpectedly" and BuildKit reports "cannot allocate memory".
A host-configuration problem the repository cannot fix -- CI builds the image
fine -- but one that will cost the next person an hour if it is not written
down, since the failure names Gradle rather than memory.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
fix(docker): excluding .forgejo/ from the build context broke the image build
Some checks failed
Continuous / Preparations (push) Successful in 1m28s
Documentation and homepage / Version (push) Successful in 1m14s
Documentation and homepage / Homepage: Quasar build (push) Successful in 4m22s
Grinder Container IT / containers (push) Successful in 13m48s
Continuous / Continuous Pre-Release (push) Has been cancelled
Continuous / Build (push) Has been cancelled
Continuous / JARs (push) Has been cancelled
Continuous / AppImage (aarch64) (push) Has been cancelled
Continuous / AppImage (x86_64) (push) Has been cancelled
Continuous / Windows app-image (x86_64) (push) Has been cancelled
Continuous / install4j media (push) Has been cancelled
Continuous / Stage the release assets (push) Has been cancelled
Documentation and homepage / Writerside webhelp (push) Has been cancelled
Documentation and homepage / Dokka HTML (push) Has been cancelled
Documentation and homepage / Help image (push) Has been cancelled
Documentation and homepage / Homepage: image (push) Has been cancelled
Qodana / notify (push) Has been cancelled
Qodana / scan (push) Has been cancelled
Test / Docker image (push) Has been cancelled
Test / build (push) Has been cancelled
7c256ae8da
`ff9b20fa2` added `.forgejo/` to `.dockerignore` as CI-only state. It is not:
`buildSrc/build.gradle.kts` declares
`.forgejo/actions/resolve-version/action.yml` as an input of `:buildSrc:test`,
because `BuildVersionTest` asserts the CI action's normalisation expression
agrees with `BuildVersion.sanitize`. Excluding it fails the image build outright
with

  Input file does not exist
    property 'resolveVersionAction' specifies file
    '/tmp/serverpackcreator/.forgejo/actions/resolve-version/action.yml'

Entry removed, and the file now carries the rule that would have prevented it:
check `inputs.file(` across the build before adding anything. A repository-wide
`grep -rnE 'inputs\.(file|dir|files)\('` finds exactly two declared inputs
outside a module directory -- that action, and root `.gitignore` for
`:serverpackcreator-api`. `.gitignore` was never at risk, since a `.dockerignore`
entry of `.git` matches only a path component named exactly `.git`, but it is
named in the comment so the next person does not have to re-derive it.

`.forgejo/` is 204 KB, so the context is still 112 MB, re-verified along with
both declared inputs being present and `.git`, `media`,
`serverpackcreator-homepage`, `.github` and `.run` still absent.

**Why ff9b20fa2 claimed this was verified when it was not.** That commit checked
the context file-by-file inside an image -- but against the list of files *I*
judged necessary, not the list the build *declares*. The only check that would
have caught it is building the image, and that had failed earlier for an
unrelated reason (the Gradle daemon OOM-killed at Docker Desktop's then 1.92 GB)
at a point before `:buildSrc:test` ever ran. A verification that cannot reach
the failing step is not a verification, and "it failed for another reason" is
not the same as "it would otherwise have passed".

With the memory raised to 3.83 GB the build now gets past `:buildSrc:test` --
"Stored cache entry for task ':buildSrc:test'" -- which is what confirms this
fix, and on through `:serverpackcreator-api:compileKotlin`.

Also corrected two comments from the same commit that asserted a snapshot rather
than a constraint. Both said Docker Desktop's kernel *is* inside MongoDB's
6.19.0-7.0.13 guard range. It crosses it: 29.7.2 ships 7.0.12 and is affected,
29.8.2 ships 7.0.14 and is not. Verified on 29.8.2 -- `8.0.34-ubuntu2204` now
reaches `healthy`, reports `db.version()` 8.0.34, and logs no guard line -- so
`BUILD.md` now names both data points and points at updating Docker Desktop
before reaching for the `SPC_DEV_MONGO_IMAGE` override.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
docs(backlog): B51 named the wrong cause and recommended a fix that does not work
All checks were successful
Continuous / Preparations (push) Successful in 2m41s
Documentation and homepage / Version (push) Successful in 1m29s
Documentation and homepage / Homepage: Quasar build (push) Successful in 4m22s
Grinder Container IT / containers (push) Successful in 14m16s
Qodana / scan (push) Successful in 16m48s
Test / build (push) Successful in 14m59s
Documentation and homepage / Writerside webhelp (push) Successful in 4m35s
Documentation and homepage / Dokka HTML (push) Successful in 5m23s
Continuous / JARs (push) Successful in 13m45s
Qodana / notify (push) Successful in 2m40s
Continuous / AppImage (aarch64) (push) Successful in 2m45s
Continuous / AppImage (x86_64) (push) Successful in 2m54s
Documentation and homepage / Help image (push) Successful in 13m33s
Test / Docker image (push) Successful in 32m12s
Continuous / install4j media (push) Successful in 10m24s
Continuous / Windows app-image (x86_64) (push) Successful in 19m3s
Continuous / Stage the release assets (push) Successful in 3m19s
Continuous / Build (push) Successful in 0s
Continuous / Continuous Pre-Release (push) Successful in 4m45s
Documentation and homepage / Homepage: image (push) Successful in 15m14s
7220b358da
The entry said the image build OOMs "at Docker Desktop's default memory limit"
and told the next person to raise it to "4 GB or more", then to cap the Gradle
heap from inside the builder stage if that failed. Both halves are now
disproven, and the second would have cost somebody a Dockerfile change that buys
nothing.

Raised to 3.83 GB, the build gets much further and still dies. Measured by
sampling /proc/meminfo every 5 s across a full attempt: MemAvailable falls from
3444 MB to **10 MB**, a peak of 3907 MB of 3917 MB. It saturates whatever it is
given rather than overshooting a particular figure, so the honest statement is
"more than 3.9 GB", not a requirement -- the ceiling cannot be known from a run
that was killed at the cap.

The heap theory was the obvious one and it is wrong. `gradle.properties` asks
for `-Xmx4096m` inside a 3.83 GB container, which looks decisive. A build with
`-Dorg.gradle.jvmargs="-Xms128m -Xmx1280m" -Dkotlin.daemon.jvmargs="-Xmx768m"`
failed at the **identical task** with the identical error, taking 417 s instead
of 293 s to get there. So the memory is not the Gradle JVM's Java heap, and the
entry now says so explicitly along with what it costs to re-derive.

What is solid: the failing task is `:generateLicenseReport`, consistently across
all three attempts made after the `.forgejo` context regression was fixed, and
`org.gradle.parallel` is unset with `org.gradle.daemon=false` so worker
concurrency is not it either. The remaining candidates are named and flagged as
untested, and the next step is a measurement at 8 GB rather than another guess
-- two have been wrong here already.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Adds the *Package structure* rule to the root CLAUDE.md, between *Module boundaries* and
*Refactor discipline* — it is an architecture rule, and those are its neighbours.

Griefed's wording, unabridged. The clause that does the most work in practice is the last
pair: use shared packages only for genuinely cross-cutting concerns, and do not impose
rigid package structures without a concrete benefit. Both directions are load-bearing, and
the audit below leaned on the second more often than on the first.

Also records the audit of the five modules the rule was adopted for, in each module's own
CLAUDE.md, so the next session reads a verdict instead of re-deriving it:

  -clientside          VIOLATION  37 files in one flat package; split separately
  -plugin-servertest   VIOLATION  `core` held two features; split separately
  -grinder             COMPLIANT  four feature subpackages; the three base-package
                                  residents that look like strays each have a reason,
                                  and moving ContainerCandidateVerifier into `container`
                                  would make container -> loader -> container
  -plugin-grinder      COMPLIANT  one feature; core -> nothing, gui -> core, root -> both,
                                  so core/gui is the within-feature domain/ui split the
                                  rule sanctions
  -plugin-selfextract  COMPLIANT  five files, one feature, nothing to split

The two COMPLIANT plugin verdicts are the interesting ones, because `core`/`gui` reads as
layering at a glance and is not: the question the rule actually asks is whether the bucket
holds one feature or several. -plugin-servertest's `core` held two that never referenced
each other; -plugin-grinder's holds one. Each note says how to re-derive its edges rather
than asking a reader to trust the sentence.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
All 37 production files sat in `de.griefed.serverpackcreator.clientside`, which is the
"organize by global technical layer" case the root CLAUDE.md's new *Package structure*
rule exists to prevent — there was no layer and no feature, just a bag.

They are now seven feature packages plus the module's API at the root:

    (root)      ClientsideVerifier, ClientsideReportRenderer, ClientsideListEditor
    boot        stage a pack, run a server, keep the evidence          8 files
    verdict     evidence -> conclusion                                 5
    platform    Modrinth/CurseForge, the wire, the shared model        6
    metadata    what a jar says about itself                           6
    selection   which builds get ground                                3
    dependency  attribution and backtracking                           2
    version     version/loader arithmetic, the one shared concern      4

The split was derived from the reference graph, not from names, and the result is
acyclic — root -> all, boot -> everything below it, verdict -> platform,
selection -> {platform, version}, platform -> metadata -> version, dependency -> version.
Acyclicity is the property worth preserving; the layout table in the module's CLAUDE.md
records it along with how to re-derive it.

Behaviour-preserving. No assertion, expected value or fixture changed. Of 222 changed
Kotlin files, 216 differ only in `package`/`import` lines; the other six are
reference-only edits of the kind the conventions' `refactor:` carve-out describes — five
fully-qualified names (four inside KDoc) and one baked-in source path in
`BootVerifierArtifactSinkTest`, which greps BootVerifier's own source and was the single
red in the first full run.

TWO GUARDS WERE SILENTLY WEAKENED BY THE MOVE, and that is the part worth reading.
`JarDownloaderRoutingTest` asserts two things must NOT exist, by `Class.forName` on a
hardcoded name: the removed headless-browser `BrowserDownloader`, and the `JarDownloaderKt`
facade Kotlin would emit if a top-level routing helper came back. Moving the file left both
strings naming the old flat package, so each went on asking about a package the class could
never appear in — still green, and green for ever. A "must not exist" guard cannot fail
when it is weakened, which is why nothing caught it. Both now name `.platform.`, and both
were re-proven red against the thing they exist to catch: adding a top-level `fun` to
JarDownloader.kt fails `noRoutingHelperSurvives`, and a stub `class BrowserDownloader`
fails `aLockedFileIsRecognisedAndHasNoBrowserFallback`.

They were missed on the first pass because the sweep for reflective lookups filtered out
`/src/test/` — reflection in a *test* is exactly where a package move does its quiet damage,
since production code would not compile.

`module.md` is part of this change rather than a follow-up, because nothing shipped in
between and it was wrong in the same way the code was. Dokka reads it, and it named the
pre-split packages: 14 `[X][de.griefed...clientside.X]` links no longer resolved, and the
single `# Package` section still described the whole engine while documenting only the three
files left at the root. It now carries one section per feature package.
`serverpackcreator-grinder/module.md` referenced `clientside.ServerRunner` too; that one
produces no Dokka warning at all, because a cross-module link is not on the other module's
doc classpath — tool silence was not evidence, and the repo-wide grep is what found it.
All five audited modules now report 0 unresolved links, clientside down from 14.

11 production imports were added purely so a KDoc `[Link]` still resolves across the new
seams (13 counting two in tests). They create no bytecode dependency, so the compile-level
graph stays acyclic, but a tool reading imports alone will report edges that are not real.

Tests mirror their subject's package only where the subject is unambiguous: 42 of 89 moved
on a name match against a production file or symbol, and the other 47 are behaviour tests
spanning several features, which stay beside the entry point they drive.

Green: :serverpackcreator-clientside:test 680, plus :serverpackcreator-grinder:test and
:serverpackcreator-app:test, which consume the moved symbols (61 consumer files re-pointed,
including four wildcard imports expanded to the symbols each file actually uses).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
`core` was named for a layer — its own CLAUDE.md described it as "everything testable
without Swing" — which says what the eleven files are *not* rather than what any of them
is for. That is the shape the root CLAUDE.md's new *Package structure* rule rejects.

The two features were already there and already separable:

    pack      what there is to launch: ServerPackCatalog, StartScriptSelector,
              ServerPropertiesPatch, PackVariables, GenerationNotifier
    session   running one: PortAllocator, ServerLauncher, ServerSession,
              SessionState, SessionRegistry

`ServerPackCatalog` and `StartScriptSelector` reference each other, so they stay together;
`session` depends on `pack` and `pack` on nothing, so the result is acyclic. Verified by
reading the imports after the move: pack -> (nothing), session -> pack,
gui -> {pack, session, the root model}.

`ServerTestSettings` went to the root with the plugin wiring rather than into either
feature. It is a typed view over the CommentedConfig SPC owns — a model, not orchestration
— and it is read by `session` (port range) and by `gui` (console scrollback) alike, so
filing it under either would misstate its scope and a package holding one file would be
structure without a benefit. This follows the rule -grinder's base package already
documents: a subpackage may import the composition root's domain models, never its
orchestration.

Behaviour-preserving: package declarations and imports only, no assertion, argument or
expected value touched. Tests moved with their subject; the three with no name match
(ConcurrentAccessTest, RealPackBootTest, SessionLivenessTest) went to `session` on their
reference counts.

`module.md` is updated because Dokka reads its `# Package` headings by name and the `core`
heading would have documented a package that no longer exists.

Green: :serverpackcreator-plugin-servertest:test, 112 tests, 1 skipped — the documented
baseline, the skip being the deliberate real boot.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The package split landed a landmine saying to collapse `platform.textOrNull(field)` and
`BundledJars`' private `textOrNull()` into one function. That advice was wrong, and this
commit replaces it with the evidence. The two ask different questions; merging them breaks
in both directions, proven by mutation rather than argued:

  - Narrowing `platform.textOrNull(field)` to `if (isTextual) ... else null` fails FIVE
    tests — CurseForgeDependencyLineTest (x2), LinkedDependencyTest, PinnedDependencyRefTest
    and CurseForgePlatformTest. It must render a present non-string, because CurseForge
    serves `modId` as a number and `12345` has to read as "12345". Its sibling two lines
    away reads `path("id").asLong()`, which is the tell.
  - Widening `BundledJars`' reader to that lenient form fails
    BundledDemandTest.aRangeThatIsNotAPlainStringYieldsNoOpinion. A Fabric/Quilt descriptor
    field that is not a string is not an id or a range.

So the defect was never duplication — it was one identifier meaning two predicates, which
is why importing the platform one into BundledJars compiled (they overloaded), sat unused,
and was the only thing putting a metadata -> platform cycle into the split. The private one
is now `nonBlankStringOrNull()`, which says what it does, and neither can be reached by
accident. Both doc comments now name the other and say why they differ.

Found while mutating it: the blank half of that reader was NOT pinned. Dropping
`takeIf { it.isNotBlank() }` left all 680 tests green, so the guard existed only for the
`isTextual` half. `aBlankRangeYieldsNoOpinion` covers it now, written before the check and
observed red against exactly that mutation:

    expected: <[(other, null)]> but was: <[(other,    )]>

It matters because a blank string IS textual, so it passes the surviving half and hands
VersionConstraint an empty pattern to satisfy instead of telling it there is nothing to.

Behaviour-preserving: the rename touches a private member and its nine call sites in one
file, no assertion or expected value changed, and the one added test asserts behaviour that
was already correct.

Green: :serverpackcreator-clientside:test 681, full ./gradlew build, and
dokkaGeneratePublicationHtml with 0 unresolved links.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
deps(homepage): take the transitive security updates dependabot PR #1310 is really about
All checks were successful
Documentation and homepage / Version (push) Successful in 47s
Continuous / Preparations (push) Successful in 1m23s
Documentation and homepage / Homepage: Quasar build (push) Successful in 4m27s
Grinder Container IT / containers (push) Successful in 14m11s
Test / build (push) Successful in 19m47s
Qodana / scan (push) Successful in 22m54s
Documentation and homepage / Dokka HTML (push) Successful in 5m35s
Documentation and homepage / Writerside webhelp (push) Successful in 6m54s
Qodana / notify (push) Successful in 21s
Test / Docker image (push) Successful in 20m20s
Documentation and homepage / Help image (push) Successful in 4m16s
Continuous / JARs (push) Successful in 9m30s
Continuous / AppImage (x86_64) (push) Successful in 3m11s
Continuous / AppImage (aarch64) (push) Successful in 3m13s
Documentation and homepage / Homepage: image (push) Successful in 12m27s
Continuous / install4j media (push) Successful in 9m33s
Continuous / Windows app-image (x86_64) (push) Successful in 13m25s
Continuous / Stage the release assets (push) Successful in 2m41s
Continuous / Build (push) Successful in 0s
Continuous / Continuous Pre-Release (push) Successful in 4m11s
08b8549f9f
PR #1310 (`build(deps): Bump the npm_and_yarn group across 1 directory with 20
updates`) is raised against `main` and cannot be applied to `develop` as it stands.
Checked rather than assumed:

  - Two of its three direct bumps are ALREADY on develop — `@quasar/cli` 5.0.4 and
    `axios` 1.20.0, merged by renovate as #716 and #714.
  - The third, `quasar` 2.11.10 -> 2.32.2, is exactly what B49 measured as impossible
    on 2026-10-17: `@quasar/app` 3.3.3 cannot build above roughly 2.14.5, and the
    advisory's first patched version is 2.22.0. develop still pins `@quasar/app` 3.3.3
    and `sass` 1.32.12, so that wall is unmoved. `npm audit` reaches the same verdict
    on its own — `@quasar/app` is `critical`, `range=*`, `fixAvailable=false`.
  - Its lockfile is computed against `main` and is therefore the wrong base: applying
    it to develop upgrades 57 packages and DOWNGRADES 19, including `@quasar/extras`
    1.18.0 -> 1.16.2, `core-js` 3.50.0 -> 3.27.2, `eslint` 8.57.1 -> 8.37.0 and
    `js-yaml` 4.3.2 -> 4.1.0 — back inside the advisory range `4.0.0 - 4.3.1`. It would
    re-open one vulnerability to close others.

What the PR is actually *for* — the transitive security updates — is taken here by
regenerating develop's own lockfile against develop's own `package.json`:
`npm update --package-lock-only`. `package.json` needed no edit at all.

  368 packages upgraded, among them @babel/traverse 7.14.7 -> 7.29.10 (critical),
  vue + @vue/* 3.2.47 -> 3.5.44, postcss 8.4.4 -> 8.5.30, nanoid 3.2.0 -> 3.3.20,
  json5 2.2.0 -> 2.2.3, shell-quote 1.7.3 -> 1.12.0, websocket-driver 0.7.4 -> 0.7.5,
  brace-expansion 1.1.11 -> 1.1.21, lodash 4.17.21 -> 4.18.1.
  10 packages moved down a patch inside their existing webpack-dev-server subtree
  (express 4.17.3 -> 4.17.2 and similar); all ten are inside ranges that were already
  vulnerable before and after, so the risk profile is unchanged.

  npm audit: 82 vulnerabilities -> 52 (critical 10 -> 5, high 38 -> 26).

Every pinned direct dependency is untouched — quasar 2.11.10, @quasar/app 3.3.3,
@quasar/cli 5.0.4, @quasar/extras 1.18.0, axios 1.20.0, core-js 3.50.0, sass 1.32.12.

VERIFIED BY BUILDING IT, because this module has no test suite and its CLAUDE.md says a
change is verified only by looking at the result. `npm ci && npx quasar build` succeeds
on quasar 2.11.10 / @quasar/app 3.3.3, and the output was diffed against a build from the
pre-change lockfile:

  - identical file set, 78 files, once webpack's chunk ids are normalised (the three
    numbered chunks renumber 151/272/859 -> 339/828/90, which newer babel does);
  - all 68 non-code assets byte-identical;
  - `index.html` differs only in the three content-hash filenames it references.

B49 is updated with the PR #1310 verdict and with the shape to expect from the next bot
PR raised against `main`, so this is not re-derived. Note for whoever lands the Vite
migration: `serverpackcreator-homepage` is a squashed subtree of
`Griefed/serverpackcreator-de`, and a lockfile refresh of this size will be overwritten by
the next `git subtree pull --squash` unless it is made upstream too.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
Griefed/ServerPackCreator!724
No description provided.