[ryuknull]

Agrupa updates de dependencias verdes en una sola PR para un solo merge.

Incluye (3 commits, 13 archivos)

Origen	Contenido	Estado
#283	Docker base images (8 Dockerfiles)	Limpio, merge directo
#365	actions/create-github-app-token digest bcd2ba4 -> 64ab729 (release.yml)	Limpio, merge directo
#347	JS pins (plugin-vue 6.0.9->6.0.10, vue-tsc 3.3.12->3.3.13, commitlint/lefthook pins, pnpm-lock regenerado con pnpm install --fix-lockfile)	Resuelto + regenerado

Excluye a propósito (rotas de origen, van a migración separada)

PR	Motivo con evidencia
#360 keyring v3->v4	Mantiene features v3 inexistentes en v4 (apple-native, sync-secret-service, crypto-rust); cargo update -p keyring falla; su CI en rojo (Check/Clippy/Doc/E2E/artifacts)
#286 rust deps	Sube reqwest 0.12->0.13 manteniendo feature eliminada rustls-tls; just ci-check-only falla; su CI en rojo igual
#290 JS majors	Combo vue 3.6-rc + vite 8 + TS 7 + vitest 5 rompe build dashboard (61 errores compiler-sfc); su CI falla en Build Dashboard/Frontend
#178 actions (dependabot Ago-10)	SUPERSEDED: main ya trae todo más nuevo (checkout v7.0.1, setup-node v7.1.0, upload-artifact v7.0.2, download-artifact v8.0.2, common-actions v2.3.0)
#181, #175, #136 (dependabot Jun-Sep)	SUPERSEDED por Renovate reciente (codecov 2.0.1 ya cubierto)

Fuera de alcance por decisión: feat #330, releases #337 y #97.

Verificación en rama (2026-10-16)

• just ci-lint-only PASS (markdown 0 issues, fmt-check ok)
• just ci-check-only PASS (cargo check workspace + dashboard build ok)
• pnpm --filter @dallay/rook-dashboard run build PASS (2.24s)
• CI de la PR (pendiente al abrir)
• just ci-local completo (no corrido; E2E requiere Docker según dev/README)

Cierre sugerido tras merge

Cerrar como superseded/completed referenciando esta PR: #283, #365, #347. Dejar abiertas para migración separada: #360, #286, #290. Cerrar stale: #178, #181, #175, #136.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository YAML (base), Organization UI (inherited)
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a770956e-c2e5-434e-8cc7-926cdbb5eb1c

📥 Commits

Reviewing files that changed from the base of the PR and between f80d5a2 and e76ea14.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing: 12

• .github/workflows/release.yml
• Dockerfile.dev
• Dockerfile.dev.alpine
• apps/rook/Dockerfile
• apps/rook/dashboard/package.json
• dev/Dockerfile.alpine
• dev/Dockerfile.dev
• dev/Dockerfile.runtime
• dev/Dockerfile.test-server
• dev/Dockerfile.ubuntu
• package.json
• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Summary

Summary by CodeRabbit

• Chores
  • Updated the Rust and Linux base images used across development, testing, and runtime environments.
  • Updated dashboard and workspace tooling and libraries, including Vue-related packages and PostCSS.
  • Updated release automation and pinned its supporting action to a specific version.

Rust builder versions and container image references were updated. The release workflow’s GitHub App token action pin changed. Dashboard and workspace development dependency versions and overrides were updated.

Changes: Build and tooling inputs

Layer / File(s)	Summary
Container image references Dockerfile.dev, Dockerfile.dev.alpine, apps/rook/Dockerfile, dev/Dockerfile.*	Rust builder images were updated to Rust 1.98. Runtime image references were pinned by digest, and Alpine references were updated to Alpine 3.24.
Release workflow action pin .github/workflows/release.yml	The pinned commit for actions/create-github-app-token changed in the release-please and upload-assets jobs. Both retain the v3 action reference.
JavaScript development dependencies apps/rook/dashboard/package.json, package.json, pnpm-workspace.yaml	Dashboard development dependencies were updated. Commitlint versions were set as exact pins, lefthook was updated, and PostCSS and Vue workspace overrides changed. The Vapor overrides remain at 3.5.43.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e76ea

The image, release-action, and tooling updates show no concrete new build, release, or dashboard failure. No actionable merge-blocking risk is established; proceed with normal CI checks.

Security architecture risk: 🔵 Low · up to e76ea

The changes primarily refresh and pin dependencies without changing declared runtime privileges or release-token consumers. An existing release-token permission finding remains, so risk is not minimal. No newly expanded authority was established, but the configured App grants and the updated token action’s lifecycle behavior remain unverified.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The supported credential exposure is the authority available to release steps receiving App tokens. The configured installation grants are unavailable, so neither the maximum permission set nor the repository scope can be quantified. The evidence does not establish cross-tenant or installation-wide repository compromise.

Security Findings and Attack Paths

• observed — The retained medium-severity finding concerns omitted permission inputs allowing tokens to inherit installation permissions. That workflow configuration predates this PR. A compromised token consumer could exercise the issued token’s grants, but attacker reachability remains unknown. No new consumer or YAML-level permission expansion was found; equivalence of the external action implementations remains unresolved rather than proven safe.

Trust Boundaries and Controls

• observed — The workflow entrusts App identity credentials to the pinned token action and passes its output to release consumers. Token cleanup is delegated to that external action rather than an explicit workflow revoke step. Repository evidence preserves release gating and concurrency behavior, but does not establish revocation behavior across success, partial failure, interruption, or repetition for both action commits.

Hardening Proposals

• proposed — Explicitly narrow each App token to the permissions and repository scope required by its consumers. Validate the updated action’s default scope and revocation behavior for failure and cancellation, rather than relying on workflow-token permissions to constrain App credentials.

Pre-merge checks: 10

Check name	Status	Explanation
Title check		The title follows Conventional Commits with the chore(deps) type and scope. It concisely describes the grouped dependency updates.
Description check		The description directly explains the consolidated Docker, action, and JavaScript dependency updates. It also documents exclusions and verification results.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Huginn Inward Dependency Boundaries		Not applicable. The reviewed diff changes release workflow, Dockerfiles, JavaScript manifests, pnpm-lock.yaml, and pnpm-workspace.yaml. It does not change crates/huginn/, Cargo manifests, or the Hugin…
Plugin Lifecycle And Revocation		Not applicable. The PR changes only dependency metadata, Docker base-image references, and a GitHub Actions digest. The @vitejs/plugin-vue change is a dashboard devDependency pin, not plugin lifecyc…
Approvals And Terminal Authority		Not applicable. The PR changes Docker base-image pins, JavaScript dependency pins, lockfile data, and only the actions/create-github-app-token digest in .github/workflows/release.yml. No Huginn ap…
Rook Architecture And Provider Contracts		PASS. The PR changes infrastructure references, but it does not change Rook architecture or provider contracts. The Dockerfile diffs change only base-image tags and digests. The workflow diff changes …
Security And Supply Chain Regressions		No concrete security or supply-chain regression is introduced. The workflow change only updates both actions/create-github-app-token references to the upstream v3 commit 64ab729...; secret input…
External Compatibility And Regression Tests		PASS. The PR changes only dependency versions and lockfile entries, pinned Docker base images, and a GitHub Actions digest. The diff contains no changes to Rook HTTP APIs, model/provider configuration…

Full details: Huginn Inward Dependency Boundaries

Explanation

Not applicable. The reviewed diff changes release workflow, Dockerfiles, JavaScript manifests, pnpm-lock.yaml, and pnpm-workspace.yaml. It does not change crates/huginn/, Cargo manifests, or the Huginn architecture guard. No ADR-0012 boundary review is required.

Full details: Plugin Lifecycle And Revocation

Explanation

Not applicable. The PR changes only dependency metadata, Docker base-image references, and a GitHub Actions digest. The @vitejs/plugin-vue change is a dashboard devDependency pin, not plugin lifecycle code. No plugin kernel, runtime, tool registry, MCP lifecycle, lease, rollback, revocation, cancellation, or generation-handle implementation changed.

Full details: Approvals And Terminal Authority

Explanation

Not applicable. The PR changes Docker base-image pins, JavaScript dependency pins, lockfile data, and only the actions/create-github-app-token digest in .github/workflows/release.yml. No Huginn approval, effect, CLI, session, presentation, headless, or JSON behavior changes. No affected trust boundary requires negative or cancellation tests.

Full details: Rook Architecture And Provider Contracts

Explanation

PASS. The PR changes infrastructure references, but it does not change Rook architecture or provider contracts. The Dockerfile diffs change only base-image tags and digests. The workflow diff changes only the pinned GitHub App token action. The JavaScript changes affect dashboard/tooling dependencies and Vue/PostCSS overrides. No Rook Rust source, API, provider, storage, persistence, or Cargo manifest file changed. No port, entrypoint, authentication, fallback mapping, stream cleanup, idempotence, or storage/API consistency behavior changed.

Full details: Security And Supply Chain Regressions

Explanation

No concrete security or supply-chain regression is introduced. The workflow change only updates both actions/create-github-app-token references to the upstream v3 commit 64ab729...; secret inputs, permissions, and commands are unchanged. All Docker digests resolve to the declared official rust, debian, and alpine tags. The lockfile records integrity hashes for the updated npm packages, including lefthook, pnpm, Vue, PostCSS, and Zod, and the checked hashes match the npm registry. The diff adds no new secret handling, network endpoint, command execution, or sensitive logging path.

Full details: External Compatibility And Regression Tests

Explanation

PASS. The PR changes only dependency versions and lockfile entries, pinned Docker base images, and a GitHub Actions digest. The diff contains no changes to Rook HTTP APIs, model/provider configuration, Huginn CLI/JSON, sessions, plugin contracts, or application behavior. No migration or behavior-specific tests are required by this check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Some tools did not complete. Review the errors below.

🔧 Biome (2.5.14)

apps/rook/dashboard/package.json

Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.

package.json

Biome could not lint this file: nested root configuration. Check the repository's Biome configuration and plugins.

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​lucide/​vue@​1.54.0 ⏵ 1.56.0	+1		+1	+1
	npm/​@​vitejs/​plugin-vue@​6.0.10
	npm/​vue@​3.5.44
	npm/​vue-tsc@​3.3.13
	npm/​lefthook@​2.2.1 ⏵ 2.2.2				+1
	npm/​zod@​4.6.5 ⏵ 4.6.7

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Maintainability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE