Merge remote-tracking branch 'origin/main' into fix/playwright/env-template-gate

package-lock.json

@@ -10,7 +10,7 @@
       "devDependencies": {
         "@eslint/js": "^10.0.1",
         "@playwright/test": "^1.62.1",
-        "eslint": "^10.6.0",
+        "eslint": "^10.8.1",
         "eslint-plugin-playwright": "^2.10.5",
         "globals": "^17.9.0"
       }
@@ -73,9 +73,9 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.6.0.tgz",
-      "integrity": "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==",
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz",
+      "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -363,9 +363,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.6.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.6.0.tgz",
-      "integrity": "sha512-6lVbcqSodALYo+4ELD0heG6lFiFxnLMuLkiMi2qV8LMp54N8tE8FT1GMH+ev4Ti00nFjNze2+Su6DsV5OQW3Dg==",
+      "version": "10.8.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.8.1.tgz",
+      "integrity": "sha512-wqA7W2jbsC/BnV9Iv1UZpKVFkO1AdNoSmYW8NWG4HNOBbkAMvIqDZ27pI2f07dqn583NcIC44ckjAcOXDL1QbQ==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -375,7 +375,7 @@
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.2",
         "@eslint/config-array": "^0.23.5",
-        "@eslint/config-helpers": "^0.6.0",
+        "@eslint/config-helpers": "^0.7.0",
         "@eslint/core": "^1.2.1",
         "@eslint/plugin-kit": "^0.7.2",
         "@humanfs/node": "^0.16.6",
@@ -399,7 +399,7 @@
         "imurmurhash": "^0.1.4",
         "is-glob": "^4.0.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
-        "minimatch": "^10.2.4",
+        "minimatch": "^10.2.5",
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.3"
       },

package.json

@@ -10,7 +10,7 @@
   "devDependencies": {
     "@eslint/js": "^10.0.1",
     "@playwright/test": "^1.62.1",
-    "eslint": "^10.6.0",
+    "eslint": "^10.8.1",
     "eslint-plugin-playwright": "^2.10.5",
     "globals": "^17.9.0"
   },

pyproject.toml

@@ -27,7 +27,7 @@ deploy = [
   "requests",
 ]
 dev = [
-  "ruff==0.16.1",
+  "ruff==0.16.2",
   "import-linter",
   "pre-commit",
   "git-maintainer-tools",

roles/svc-ai-ollama/meta/services.yml

@@ -11,7 +11,7 @@ ollama:
   backup:
     no_stop_required: true
   image: ollama/ollama
-  version: 0.32.6
+  version: 0.32.9
   name: ollama
   min_storage: 3473MB
   cpus: "4.0"

roles/sys-ctl-hlth-csp/meta/services.yml

@@ -8,4 +8,4 @@ csp:
       categories: [web]
 csp-checker:
   image: ghcr.io/kevinveenbirkenbach/csp-checker
-  version: 2.2.0
+  version: 2.2.1

roles/web-app-dashboard/files/package-lock.json

@@ -6,33 +6,17 @@
     "": {
       "name": "web-app-dashboard-assets",
       "dependencies": {
-        "keycloak-js": "24.0.5"
-      }
-    },
-    "node_modules/js-sha256": {
-      "version": "0.11.1",
-      "resolved": "https://registry.npmjs.org/js-sha256/-/js-sha256-0.11.1.tgz",
-      "integrity": "sha512-o6WSo/LUvY2uC4j7mO50a2ms7E/EAdbP0swigLV+nzHKTTaYnaLIWJ02VdXrsJX0vGedDESQnLsOekr94ryfjg==",
-      "license": "MIT"
-    },
-    "node_modules/jwt-decode": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/jwt-decode/-/jwt-decode-4.0.0.tgz",
-      "integrity": "sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18"
+        "keycloak-js": "26.2.4"
       }
     },
     "node_modules/keycloak-js": {
-      "version": "24.0.5",
-      "resolved": "https://registry.npmjs.org/keycloak-js/-/keycloak-js-24.0.5.tgz",
-      "integrity": "sha512-VQOSn3j13DPB6OuavKAq+sRjDERhIKrXgBzekoHRstifPuyULILguugX6yxRUYFSpn3OMYUXmSX++tkdCupOjA==",
+      "version": "26.2.4",
+      "resolved": "https://registry.npmjs.org/keycloak-js/-/keycloak-js-26.2.4.tgz",
+      "integrity": "sha512-PnXpR3ubETGOt0B/Qt2lxmPbkZr5bc3vlQsOqDoTPPQsZRp7JjhTKxlJ187uWh8qJhvBab6Gsjb06a8ayOPfuw==",
       "license": "Apache-2.0",
-      "dependencies": {
-        "js-sha256": "^0.11.0",
-        "jwt-decode": "^4.0.0"
-      }
+      "workspaces": [
+        "test"
+      ]
     }
   }
 }

roles/web-app-dashboard/files/package.json

@@ -3,6 +3,6 @@
   "private": true,
   "description": "Browser-served frontend assets for web-app-dashboard, mirrored by web-svc-cdn.",
   "dependencies": {
-    "keycloak-js": "24.0.5"
+    "keycloak-js": "26.2.4"
   }
 }

roles/web-app-dashboard/templates/javascript/oidc.js.j2

@@ -63,14 +63,12 @@ function setItemVisible(el, visible) {
 /* ==============================================
    3) Dynamically load the Keycloak.js adapter
    ============================================== */
-function loadKeycloakAdapter(src) {
-  return new Promise((resolve, reject) => {
-    const s = document.createElement("script");
-    s.src = src;
-    s.onload = resolve;
-    s.onerror = () => reject(new Error("Failed to load keycloak.js from " + src));
-    document.head.appendChild(s);
-  });
+async function loadKeycloakAdapter(src) {
+  const mod = await import(src);
+  if (typeof mod.default !== "function") {
+    throw new Error("keycloak.js exposed no default export at " + src);
+  }
+  return mod.default;
 }
 
 /* ==============================================
@@ -137,19 +135,15 @@ async function initAuthUI() {
   syncAuthMenuVisibility(false);
 
   // Load keycloak.js
-  const kcJsUrl = "{{ lookup('asset', application_id, 'keycloak-js', 'dist/keycloak.js') }}";
+  const kcJsUrl = "{{ lookup('asset', application_id, 'keycloak-js', 'lib/keycloak.js') }}";
+  let Keycloak;
   try {
-    await loadKeycloakAdapter(kcJsUrl);
+    Keycloak = await loadKeycloakAdapter(kcJsUrl);
   } catch (e) {
     console.error("[oidc] Failed to load adapter:", e);
     return; // nothing else to do
   }
 
-  if (typeof window.Keycloak !== "function") {
-    console.error("[oidc] window.Keycloak is not available after loading:", kcJsUrl);
-    return;
-  }
-
   // Initialize the Keycloak instance
   try {
     keycloak = new Keycloak({ url: KC_CONFIG.url, realm: KC_CONFIG.realm, clientId: KC_CONFIG.clientId });

roles/web-app-littlejs/files/package-lock.json

@@ -6,15 +6,14 @@
     "": {
       "name": "web-app-littlejs-assets",
       "dependencies": {
-        "@fortawesome/fontawesome-free": "6.5.1",
+        "@fortawesome/fontawesome-free": "7.3.1",
         "bootstrap": "5.3.8"
       }
     },
     "node_modules/@fortawesome/fontawesome-free": {
-      "version": "6.5.1",
-      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-6.5.1.tgz",
-      "integrity": "sha512-CNy5vSwN3fsUStPRLX7fUYojyuzoEMSXPl7zSLJ8TgtRfjv24LOnOWKT2zYwaHZCJGkdyRnTmstR0P+Ah503Gw==",
-      "hasInstallScript": true,
+      "version": "7.3.1",
+      "resolved": "https://registry.npmjs.org/@fortawesome/fontawesome-free/-/fontawesome-free-7.3.1.tgz",
+      "integrity": "sha512-wmglKKPDIkgV3aWlZzWECCPoGIkYCulzBwxG9+w7rc5BGapZ6cPMpoPOT8k36J0Ni7PPX6c/rsoMWfS4d1MUMg==",
       "license": "(CC-BY-4.0 AND OFL-1.1 AND MIT)",
       "engines": {
         "node": ">=6"

roles/web-app-littlejs/files/package.json

@@ -4,6 +4,6 @@
   "description": "Browser-served frontend assets for web-app-littlejs, mirrored by web-svc-cdn.",
   "dependencies": {
     "bootstrap": "5.3.8",
-    "@fortawesome/fontawesome-free": "6.5.1"
+    "@fortawesome/fontawesome-free": "7.3.1"
   }
 }

roles/web-app-snipe-it/meta/services.yml

@@ -51,7 +51,7 @@ snipe-it:
       enabled: true
     swarm:
       enabled: true
-  version: v8.6.3-alpine
+  version: v8.7.0-alpine
   custom: true
   name: snipe-it
   image: snipe/snipe-it

roles/web-app-wordpress/meta/services.yml

@@ -34,7 +34,7 @@ wordpress:
       enabled: true
     swarm:
       enabled: true
-  version: 7.0.2
+  version: 7.0.3
   image: wordpress
   custom: true
   name: wordpress

roles/web-svc-cdn/tasks/00_core.yml

@@ -11,6 +11,8 @@
     - name: "🧩 Deploy the CDN stack (one-shot npm-mirror build) + front proxy"
       include_role:
         name: sys-stk-full
+      vars:
+        aca_origin: "* always"
 
 - name: "🧩 Front proxy only (external CDN flavor)"
   include_role:

roles/web-svc-coturn/meta/services.yml

@@ -9,7 +9,7 @@ coturn:
   enabled: true
   shared: true
   image: coturn/coturn
-  version: 4.17.0
+  version: 4.17.2
   min_storage: 246MB
   user_auth_enabled: false
   cpus: 1.0

tests/unit/plugins/lookup/test_asset.py

@@ -202,7 +202,7 @@ class TestCommittedRoleLockfiles(unittest.TestCase):
             return lookup.run([app, package, path], variables={"group_names": []})[0]
 
     def test_dashboard_keycloak_js(self):
-        url = self._url("web-app-dashboard", "keycloak-js", "dist/keycloak.js")
+        url = self._url("web-app-dashboard", "keycloak-js", "lib/keycloak.js")
         self.assertRegex(url, self.URL_RE)
 
     def test_littlejs_bootstrap(self):