build(deps): bump npm, github-actions en compose-image dependencies

robbertbos · robbertbos · commit ebdac0824e8c · 2026-06-13T17:52:33.000+02:00
Combineert de drie gegroepeerde Dependabot-PR's (#372 npm, #371 github-actions, #370 compose-images) tot één update: - npm: o.a. vite 7→8, vue-router 4→5, vue-tsc 2→3, eslint 9→10, marked 17→18, @fastify/rate-limit 10→11, @fastify/swagger-ui 5→6, @types/node 24→25 en vele patches. @nl-rvo/* (component-library-css naar 4.20, design-tokens naar 2.x) is BEWUST teruggehouden op 4.8.0/1.9.0: die upgrade bevat een breaking button/link class-migratie en een design-tokens major. Apart opgepakt in #377. - github-actions: upload/download-artifact, docker/* en setup-* acties. - compose-images: alleen keycloak 26.0→26.6 (containers/compose.dev.yaml). Postgres blijft bewust op 17-alpine: ZAD/productie draait op PostgreSQL 17. dependabot.yml negeert voortaan postgres major-updates zodat de bump naar 18 niet opnieuw wordt voorgesteld. Bumpt typescript ~5.7.3 → ~5.9.3: vue-tsc 3 heft het oude TS-plafond op en @vue/tsconfig 0.9.1 vereist TypeScript >= 5.8 (libReplacement-optie). Verwijdert drie nu-overbodige @ts-expect-error directives in pdfExport.ts die @types/pdfmake 0.3.3 voortaan zelf typeert. Geverifieerd: builds (standalone/backend), 100% coverage in alle vier workspaces, eslint 10 clean, actionlint OK.
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -56,3 +56,8 @@ updates:
       compose-images:
         patterns:
           - "*"
+    ignore:
+      # ZAD/production runs on PostgreSQL 17; do not propose major bumps to
+      # 18+ (the data volume does not auto-upgrade across a major version).
+      - dependency-name: "postgres"
+        update-types: ["version-update:semver-major"]
diff --git a/.github/workflows/_build-images.yaml b/.github/workflows/_build-images.yaml
@@ -58,7 +58,7 @@ jobs:
             --begrippen-yaml sources/begrippenkader_iama.yaml \
             --output-json sources/generated/IAMA.json \
             --definitions-once-per-page
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: generated-sources
           path: sources/generated/
@@ -80,23 +80,23 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: generated-sources
           path: sources/generated/
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ inputs.backend-image }}
           tags: |
             type=sha,prefix=${{ inputs.tag-prefix }}
             type=raw,value=latest,enable=${{ inputs.tag-latest }}
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: containers/backend/Containerfile
@@ -118,23 +118,23 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: generated-sources
           path: sources/generated/
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
         with:
           images: ${{ inputs.frontend-image }}
           tags: |
             type=sha,prefix=${{ inputs.tag-prefix }}
             type=raw,value=latest,enable=${{ inputs.tag-latest }}
-      - uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+      - uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
         with:
           context: .
           file: containers/frontend/Containerfile
@@ -164,7 +164,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -200,7 +200,7 @@ jobs:
           TRIVY_USERNAME: ${{ github.actor }}
           TRIVY_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload SBOM artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sbom-${{ matrix.component }}
           path: trivy-sbom-${{ matrix.component }}.json
diff --git a/.github/workflows/build-standalone.yaml b/.github/workflows/build-standalone.yaml
@@ -46,7 +46,7 @@ jobs:
             --definitions-once-per-page
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
 
@@ -62,7 +62,7 @@ jobs:
         run: cd apps/standalone-form && pnpm build
 
       - name: Upload build artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: standalone-form
           path: apps/standalone-form/dist/
diff --git a/.github/workflows/deploy-productie.yaml b/.github/workflows/deploy-productie.yaml
@@ -70,7 +70,7 @@ jobs:
             exit 1
           fi
 
-      - uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+      - uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/pre-commit-autoupdate.yaml b/.github/workflows/pre-commit-autoupdate.yaml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.14"
 
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
@@ -14,7 +14,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -117,7 +117,7 @@ jobs:
             --definitions-once-per-page
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
@@ -31,7 +31,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '22'
 
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload coverage reports
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-reports
           path: |
diff --git a/apps/boekhouding-backend/package.json b/apps/boekhouding-backend/package.json
@@ -17,21 +17,21 @@
   "dependencies": {
     "@fastify/cors": "^11.0.0",
     "@fastify/helmet": "^13.0.2",
-    "@fastify/rate-limit": "^10.3.0",
+    "@fastify/rate-limit": "^11.0.0",
     "@fastify/swagger": "^9.7.0",
-    "@fastify/swagger-ui": "^5.2.5",
+    "@fastify/swagger-ui": "^6.0.0",
     "drizzle-orm": "^0.45.2",
     "fastify": "^5.8.5",
-    "jose": "^6.0.11",
-    "nanoid": "^5.1.5",
-    "postgres": "^3.4.7"
+    "jose": "^6.2.3",
+    "nanoid": "^5.1.11",
+    "postgres": "^3.4.9"
   },
   "devDependencies": {
-    "@types/node": "^24.0.3",
+    "@types/node": "^25.9.3",
     "@vitest/coverage-istanbul": "^4.1.4",
-    "drizzle-kit": "^0.31.1",
-    "tsx": "^4.19.4",
-    "typescript": "~5.7.3",
+    "drizzle-kit": "^0.31.10",
+    "tsx": "^4.22.4",
+    "typescript": "~5.9.3",
     "vitest": "^4.1.4"
   }
 }
diff --git a/apps/boekhouding-frontend/package.json b/apps/boekhouding-frontend/package.json
@@ -17,23 +17,23 @@
     "@nl-rvo/component-library-css": "4.8.0",
     "@nl-rvo/design-tokens": "1.9.0",
     "@overheid-assessment/core": "workspace:*",
-    "@tabler/icons-vue": "^3.40.0",
-    "keycloak-js": "^26.0.7",
-    "pdfmake": "^0.3.6",
+    "@tabler/icons-vue": "^3.44.0",
+    "keycloak-js": "^26.2.4",
+    "pdfmake": "^0.3.11",
     "pinia": "^3.0.3",
-    "vue": "^3.5.17",
-    "vue-router": "^4.5.1"
+    "vue": "^3.5.38",
+    "vue-router": "^5.1.0"
   },
   "devDependencies": {
-    "@vitejs/plugin-vue": "^6.0.1",
+    "@vitejs/plugin-vue": "^6.0.7",
     "@vitest/coverage-istanbul": "^4.1.4",
     "@vue/test-utils": "^2.4.6",
-    "@vue/tsconfig": "^0.7.0",
-    "jsdom": "^29.0.1",
-    "npm-run-all2": "^8.0.4",
-    "typescript": "~5.7.3",
-    "vite": "^7.3.1",
+    "@vue/tsconfig": "^0.9.1",
+    "jsdom": "^29.1.1",
+    "npm-run-all2": "^9.0.2",
+    "typescript": "~5.9.3",
+    "vite": "^8.0.16",
     "vitest": "^4.1.4",
-    "vue-tsc": "^2.2.10"
+    "vue-tsc": "^3.3.5"
   }
 }
diff --git a/apps/standalone-form/package.json b/apps/standalone-form/package.json
@@ -18,31 +18,31 @@
     "@nl-rvo/component-library-css": "4.8.0",
     "@nl-rvo/design-tokens": "1.9.0",
     "@overheid-assessment/core": "workspace:*",
-    "pdfmake": "^0.3.6",
+    "pdfmake": "^0.3.11",
     "pinia": "^3.0.3",
-    "vue": "^3.5.17"
+    "vue": "^3.5.38"
   },
   "devDependencies": {
     "@tsconfig/node22": "^22.0.5",
     "@types/jexl": "^2.3.4",
-    "@types/node": "^24.0.3",
-    "@vitejs/plugin-vue": "^6.0.1",
+    "@types/node": "^25.9.3",
+    "@vitejs/plugin-vue": "^6.0.7",
     "@vitest/coverage-istanbul": "^4.1.4",
     "@vue/eslint-config-prettier": "^10.2.0",
-    "@vue/eslint-config-typescript": "^14.6.0",
+    "@vue/eslint-config-typescript": "^14.8.0",
     "@vue/test-utils": "^2.4.6",
-    "@vue/tsconfig": "^0.7.0",
-    "eslint": "^9.38.0",
-    "eslint-plugin-vue": "^10.5.1",
-    "jiti": "^2.4.2",
-    "jsdom": "^29.0.1",
-    "npm-run-all2": "^8.0.4",
-    "prettier": "^3.6.2",
-    "typescript": "~5.7.3",
-    "vite": "^7.3.1",
-    "vite-plugin-singlefile": "^2.3.0",
-    "vite-plugin-vue-devtools": "^8.0.3",
+    "@vue/tsconfig": "^0.9.1",
+    "eslint": "^10.5.0",
+    "eslint-plugin-vue": "^10.9.2",
+    "jiti": "^2.7.0",
+    "jsdom": "^29.1.1",
+    "npm-run-all2": "^9.0.2",
+    "prettier": "^3.8.4",
+    "typescript": "~5.9.3",
+    "vite": "^8.0.16",
+    "vite-plugin-singlefile": "^2.3.3",
+    "vite-plugin-vue-devtools": "^8.1.2",
     "vitest": "^4.1.4",
-    "vue-tsc": "^2.2.10"
+    "vue-tsc": "^3.3.5"
   }
 }
diff --git a/containers/compose.dev.yaml b/containers/compose.dev.yaml
@@ -16,7 +16,7 @@ services:
       retries: 10
 
   keycloak:
-    image: quay.io/keycloak/keycloak:26.0
+    image: quay.io/keycloak/keycloak:26.6
     command: start-dev --import-realm
     environment:
       KC_DB: postgres
diff --git a/package.json b/package.json
@@ -19,7 +19,7 @@
     "jexl": "^2.3.0"
   },
   "devDependencies": {
-    "playwright": "1.58.0"
+    "playwright": "1.60.0"
   },
   "pnpm": {
     "onlyBuiltDependencies": [
diff --git a/packages/assessment-core/package.json b/packages/assessment-core/package.json
@@ -14,27 +14,27 @@
     "fp-ts": "^2.16.11",
     "io-ts": "^2.2.22",
     "jexl": "^2.3.0",
-    "marked": "^17.0.5",
-    "nanoid": "^5.1.5",
-    "pdfmake": "^0.3.6",
+    "marked": "^18.0.5",
+    "nanoid": "^5.1.11",
+    "pdfmake": "^0.3.11",
     "pinia": "^3.0.3",
-    "vue": "^3.5.17"
+    "vue": "^3.5.38"
   },
   "scripts": {
     "test": "vitest run",
     "test:coverage": "vitest run --coverage"
   },
   "devDependencies": {
     "@types/jexl": "^2.3.4",
-    "@types/pdfmake": "^0.2.13",
-    "@vitejs/plugin-vue": "^6.0.1",
+    "@types/pdfmake": "^0.3.3",
+    "@vitejs/plugin-vue": "^6.0.7",
     "@vitest/coverage-istanbul": "^4.1.4",
     "@vue/test-utils": "^2.4.6",
-    "@vue/tsconfig": "^0.7.0",
-    "ajv": "^8.18.0",
+    "@vue/tsconfig": "^0.9.1",
+    "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "jsdom": "^29.0.1",
-    "typescript": "~5.7.3",
+    "jsdom": "^29.1.1",
+    "typescript": "~5.9.3",
     "vitest": "^4.1.4"
   }
 }
diff --git a/packages/assessment-core/src/utils/pdfExport.ts b/packages/assessment-core/src/utils/pdfExport.ts
@@ -20,7 +20,6 @@ interface AssessmentDocumentInformation extends TDocumentInformation {
   AssessmentData: string
 }
 
-// @ts-expect-error pdfmake 0.3.x types not yet in @types/pdfmake
 pdfMake.addVirtualFileSystem(pdfFonts)
 
 const dutchDateFormatter = new Intl.DateTimeFormat('nl-NL', {
@@ -184,9 +183,7 @@ export async function exportToPdf(
     const vfs = await FontService.getVFS()
 
     // pdfmake 0.3: register fonts and VFS on the instance before creating PDF
-    // @ts-expect-error pdfmake 0.3.x types not yet in @types/pdfmake
     pdfMake.addFonts(fontDefinitions)
-    // @ts-expect-error pdfmake 0.3.x types not yet in @types/pdfmake
     pdfMake.addVirtualFileSystem(vfs)
     pdfMake.createPdf(docDefinition).download(actualFilename)
 
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
