build(deps): bump zod from 4.3.6 to 4.4.3 in /frontend - #8
Closed
dependabot[bot] wants to merge 14 commits into
Closed
dependabot[bot] wants to merge 14 commits into
dependabot[bot] wants to merge 14 commits into
Conversation
Node 26 ships an inert built-in localStorage that stays unusable unless the process is started with --localstorage-file. That global shadows the implementation jsdom would otherwise install, so localStorage and window.localStorage both resolved to undefined and every spec touching Web Storage failed with "Cannot read properties of undefined". Install a spec-shaped in-memory Storage from the vitest setup file, and only when the runtime does not already provide a working one, so an environment that supplies its own is left untouched. Recovers i18nProvider and layerPreferences coverage.
Align every first-party identifier with the Argus product name across the
runtime, deployment and tooling surfaces:
- environment variables SHADOWBROKER_* -> ARGUS_* (35 variables)
- desktop bridge globals __ARGUS_DESKTOP__ / __ARGUS_LOCAL_CONTROL__ and the
matching runtime types
- container images ghcr.io/olwtelet/argus-{backend,frontend}, compose service
and container names, and the Docker-bridge trusted-host defaults that are
keyed to those container names
- Tauri productName, bundle identifier com.olwtelet.argus, crate name
- Python project metadata, desktop shell package name, release artifacts
- outbound User-Agent product tokens
- repository and release URLs, CODEOWNERS, authorship metadata
Wire-format and cryptographic constants are deliberately left untouched
because they are an interoperability contract with existing peers rather
than branding: the mesh NETWORK_ID, NODE_ID_PREFIX, the gate-envelope and
DM-alias HKDF salts, the RNS destination app name, the signed-context
protocol tag and the DM invite message type. Renaming any of them would
silently stop signature verification against peers already on the network.
The Tauri bundle identifier change moves the operating system's per-app
storage, autostart registration and single-instance lock to a new location.
Replace the cyan/neon HUD treatment with an operations-station look: deep black and graphite surfaces, off-white text, thin borders, no glow, no simulated elevation. Depth comes from contrast and structural division. The interface uses Tailwind cyan-* utilities as its default chrome in roughly 1600 places. Rather than rewriting 73 components, the cyan ramp is redefined once in the theme layer as a neutral graphite scale, so the whole surface retones from a single point of control and no functional component is touched to change it. The SMPTE colours become a signalling system rather than decoration: a seven-bar identity strip, short tick markers for panel labels, and the feed and severity states. Everything else stays neutral. Removed along with the neon treatment: - the Matrix HUD colour mode and the ~150 lines of !important overrides that implemented it, plus its toggle, which would otherwise have become dead - CRT scanline, flicker animation and RGB fringe on the terminal container - text glow, glowing borders, and the pulsing critical-alert shadow Border width and style still carry alert severity independently of hue, so the non-chromatic differentiation for colour-blind operators is preserved. Map and data-provider attribution is restyled to match the new chrome and explicitly kept visible, since it is a licence obligation.
Brazilian Portuguese becomes the product language and the default locale. The interface no longer follows navigator.language: Argus opens in pt-BR and only changes on an explicit operator choice. The i18n architecture is kept. Every string still resolves through a key, so copy stays centralized, components carry no loose text, and adding a language later touches no component. The picker is hidden while a single locale is registered instead of being deleted, so the mechanism stays exercised. The translation is written as Brazilian Portuguese rather than transposed word for word from the previous copy: operational software register, short technical labels, and terms an operator would actually use. The locale preference key moves to argus_locale. It holds a discardable UI preference and has no other reader, so it is changed cleanly rather than migrated. Also lifts the settings subtitle out of hardcoded English into the catalogue.
The product rename reached thirteen string literals that are not names but cryptographic domain-separation inputs: the AES-GCM additional authenticated data and key-derivation info strings for the sealed local store, the MLS welcome HKDF info, the reputation voter-blinding HMAC domain, and the RNS cover-auth info. Renaming them re-derives every key and invalidates every AAD, so previously sealed data no longer authenticates. This surfaced as 14 collection errors, all of them "Failed to decrypt domain JSON sealed_private_outbox.json" with an InvalidTag underneath, and it would have destroyed an operator's sealed private outbox, gate personas and wormhole storage on upgrade. Restore the original literals. They are opaque bytes that are never shown to anyone, so they carry no branding value, and they belong with the wire constants already excluded from the rename.
Rewrite the README as product documentation: what Argus is, architecture, requirements, install, configuration, running, Docker, desktop, security, development, tests and data attribution. Every command and path in it was checked against the repository rather than carried over. Translate the operator-facing output of the startup, shutdown, mesh node and compose scripts. These print to a terminal that may not render accents, so the copy is written to read correctly in plain ASCII instead of relying on them. Point CODEOWNERS at the current maintainer and drop the /helm/ rule, which guarded a path that does not exist in this repository. The README no longer claims a licence the repository does not carry: there is no LICENSE file, while DATA-ATTRIBUTION.md states AGPL-3.0. Naming a licence is the owner's call, so the section points at the data attribution and leaves the code licence to be settled deliberately.
The dashboard title was spelled out one letter at a time and split across a JSX span, so it read as markup rather than as a word and every textual sweep walked straight past it. Replace it with the brand string from the catalogue, add the SMPTE identity strip, and drop the glow class that no longer exists. test_sha256_file writes a known payload and asserts a known digest. The rename changed the payload bytes but not the expected digest, so the test failed against a hash of the old string. Update the expected value to the digest of the payload the test now writes, which keeps the check pinned to a constant rather than recomputing it from the same input it verifies.
The policy was written when the catalogue was authored in English and other languages were checked against it. Portuguese is now the source language, so the section described a comparison that no longer exists and would have sent a translator to a file that is not there. The neutrality requirement is unchanged, including the rejection table: it is the substantive part of the policy and it applies symmetrically regardless of which language the catalogue is authored in.
Also documents where the interface tone is actually controlled — the cyan ramp redefined in globals.css — and the rule that operator-facing text belongs in the catalogue rather than in components.
The initial commit was assembled without several directories, so the tree referenced modules that were never in it. 57 internal frontend modules, the privacy-core crate and the OpenClaw skill package were all imported but absent, which is why the frontend could not build and 59 test files failed to load. Restore them from the project source, and apply the same Argus rename to the restored files so they match the tree they are joining: environment variables, desktop bridge globals, container and repository URLs, and the OpenClaw skill package path. The rename skips the wire and at-rest cryptographic constants here exactly as it does elsewhere. Also restores LICENSE (AGPL-3.0, which DATA-ATTRIBUTION.md already referenced but which was not in the tree) and the Helm chart, and puts the /helm/ rule back in CODEOWNERS now that the path exists. The AIS upstream health wiring came with a test but not with the code it covers: the aishub_fallback fetcher was already present while the settings registry, health probe and onboarding form were a version behind. Complete that wiring rather than drop the test. One test asserted on English button copy and now matches the Portuguese the interface renders. frontend: 84/84 files, 768/768 tests, build succeeds backend: 241 failed / 2421 passed, against 245 / 2415 before — no regressions
The catalogue was already Portuguese, but most components carried their text inline rather than through it, so the interface read as a mix of two languages. Translate the remaining operator-facing copy: panels, modals, the Infonet terminal, settings, onboarding, map popups, and the button, tooltip and placeholder text throughout. Proper nouns and established technical terms stay in English, because translating them would make the interface harder to use, not easier: Wormhole, Infonet, Mesh, Meshtastic, Dead Drop, DM, Shodan, Polymarket, Kalshi, OpenClaw, Tor, SAR, AOI, ADS-B, OSINT, SIGINT, and the identifiers that name real fields such as node_id, gate_id and release_description. Replacement was confined to JSX text nodes and the four attributes that render text, so no identifier, key or other string literal was touched. Ten test assertions matched on the English copy and now match the Portuguese the interface renders. One translation carried a double quote into a placeholder attribute and broke the parse; it uses typographic quotes now. frontend: 84/84 files, 768/768 tests, build succeeds, lint clean backend: untouched
The first pass matched prose, so it required an English function word to fire and walked straight past short chrome labels. That left the parts of the interface a user actually looks at first still in English: DATA LAYERS, TIME MACHINE, RECORDED LAYERS, GLOBAL THREAT INTERCEPT, PLAYBACK, the feed counters, and the status words on panels and popups. Translate those, plus the AI assistant's opening message and example queries, which were whole English blocks held in template literals. Proper nouns and established technical terms stay in English, and so does the reference data they sit next to: airline and aircraft names, ICAO codes, crypto tickers, and acronyms like CVE, MMSI, NDVI and SGP4. Replacement stayed confined to JSX text and the attributes that render text, so values used as enum keys were left alone. One label needed care: the contact trust state is both displayed and compared by string, so its display text and both comparisons were renamed together rather than only where it renders. The pending-contact sentence used to begin with the same words as the badge above it, which made the badge unmatchable by exact text; it is reworded. frontend: 84/84 files, 768/768 tests, build succeeds, lint clean backend: untouched
Bumps [zod](https://github.com/colinhacks/zod) from 4.3.6 to 4.4.3. - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.3.6...v4.4.3) --- updated-dependencies: - dependency-name: zod dependency-version: 4.4.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps zod from 4.3.6 to 4.4.3.
Release notes
Sourced from zod's releases.
... (truncated)
Commits
1fb56a5docs: document release procedure in AGENTS.mdf3c9ec04.4.3c2be4f8fix(v4): generalize optin/fallback to transform; restore preprocess on absent...1cab693fix(v4): restore catch handling for absent object keys (#5937) (#5939)b8dffe9docs: remove Numeric and Speakeasy (2+ missed monthly cycles)9195250docs: remove Mintlify from bronze sponsors (churned)2c70332docs: normalize bronze sponsor logos to github avatar pattern7391be8docs: prune lapsed silver/bronze sponsors and add active ones2aeec83docs: prune lapsed gold sponsors and rebalance logo sizing4c2fa95docs: use Zernio primary wordmark for gold sponsor logoMaintainer changes
This version was pushed to npm by GitHub Actions, a new releaser for zod since your current version.
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)