Author	SHA1	Message	Date
iris	f05be94587	frontend: npm dependency updates (#681) ... Bumps: - marked 4.3.0 → 18.0.4 (agent + dashboard) - chart.js 4.4.4 → 4.5.1 (agent stats page) - esbuild 0.25.5 → 0.28.0 (workspace devDep) marked v18 still ships a synchronous `marked.parse(text)` + `marked.setOptions({})`, so our `mdNode()` call sites in dashboard/common.js and agent/app.js work unchanged. `window.marked = marked` global bridge survives the bundler. Verified end-to-end: `** strong **`, `[link](https://…)`, bullets, fenced code blocks all render identically to v4. Agent app.js shrank ~15kb, dashboard tabs.js shrank ~16kb (smaller marked + tighter esbuild). chart.js 4.5.1 is patch-bump within the 4.x line — `new Chart(el, config)` core API unchanged. esbuild 0.28.0 builds cleanly with our existing build.mjs configurations. `npm audit` reports 0 vulnerabilities. nix build passes; recomputed npmDepsHash via `prefetch-npm-deps frontend/package-lock.json`. closes #681	2026-05-31 01:29:35 +02:00
iris	9c7d4df08c	frontend: lock npm dependencies via package-lock.json ... Follow-up to 9e558c3. Runs `npm install` with the new nodejs_22 + npm toolchain that just landed in iris's container (approval dfae406), which generates the lockfile + node_modules tree. Only the lockfile is checked in; node_modules/ stays in .gitignore. Pinned versions (resolved by npm from the package.json constraints): - chart.js 4.4.4 (replaces the jsDelivr CDN script on stats.html) - marked 4.3.0 (replaces hive-fr0nt/assets/marked.umd.js) - esbuild 0.25.5 (bumped from 0.24.0 to clear an audit warning about the dev-server CSRF advisory; bundling behaviour is unaffected) Validated locally: npm install — 0 vulnerabilities reported npm run build — both workspace builds succeed dashboard: dist/{app.js (149kb), dashboard.css (33kb), index.html} agent: dist/{app.js (114kb), stats.js (435kb), agent.css (16kb), index.html, stats.html, screen.html} Stripped-comment diff of dist/dashboard.css vs the runtime concat (BASE_CSS + TERMINAL_CSS + assets/dashboard.css) shows only whitespace + comment-strip differences — selectors/properties match. Hermetic-build wiring (the Nix `buildNpmPackage` derivation that consumes this lockfile) lands in Phase 2 on a follow-up commit. Refs #273.	2026-05-23 14:51:01 +02:00