Extends docs/upgrading-libraries.md into the full platform inventory - #5267
Merged
Conversation
Records what the app runs on, not just what it links against: the runtimes (Java, Node, both Pythons), both container base images, and the dev/prod Postgres/PostGIS/GEOS/PROJ/GDAL stacks, each with a latest and an EOL column. Prod's numbers come from the #4398 audit; prod's JVM has never been collected. Adds tools/check-vendor-versions.mjs, which cross-checks public/vendor/ against the doc: every folder listed, every filename version documented, every documented version on disk. Dependabot only reads package.json, so that doc is the whole inventory for the self-hosted libraries and nothing caught it drifting. It found vega and animate.css missing from the list entirely; both now have entries. Wired in as make lint-vendor-versions, in the make lint loop and as a blocking step in the frontend CI job. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEcwN4MLDty5wnkhZ8Et75
The section-wide search passed things it shouldn't: prose exempted whatever it mentioned (the selectize entry names tom-select, so a tom-select folder would have passed unlisted), and the intro's example filename alone satisfied a library whose entry had been deleted. Every check now runs against the entry that covers a folder, with version sets compared as parsed tokens rather than substrings, so 1.4.1 no longer matches inside 21.4.15. Also fails on a file loose in the vendor root, and prints the unversioned-file list on failure as well as on success. Doc fixes from the same review: animate.css is used by the tutorial's fades as well as the compass, sbtn wants glibc 2.32 and 2.34, the Python patch versions no longer appear twice, and Dependabot does watch pip/docker/actions — what it never watches is public/vendor/. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FEcwN4MLDty5wnkhZ8Et75
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
resolves #4399
Two of that issue's three bullets had never landed anywhere; the third (a committed
package-lock.json) landed with #5152.The platform inventory
docs/upgrading-libraries.mdgains a Platform section covering what the app runs on rather than links against:python3mean 3.8 and what makessbt --clientunusable (glibc 2.31 vs the 2.32sbtnneeds), and thepostgis/postgis:16-3.5line is a dead end — pgdg's bullseye pool stops at PostGIS 3.5.2 and there's no16-3.6tag or bookworm variant for 16, so newer geospatial libraries mean moving the Postgres major and the base OS together.withJitOffwrapper inConfigTable.Every "latest" and EOL figure was checked on 2026-09-09 against endoflife.date, the upstream release APIs, Docker Hub and apt.postgresql.org; the section is date-stamped so the next reader re-checks rather than trusts.
Two things surfaced that are worth a maintainer's eyes, both recorded in the doc:
need upgradeat the end of itsPostGIS_Full_Version()). It wants anALTER EXTENSION postgis UPDATE.The vendor freshness check
tools/check-vendor-versions.mjscloses the frontend blind spot from the third bullet. Dependabot only readspackage.json(build tooling), so for the self-hosted libraries underpublic/vendor/this doc is the inventory — and it's a hand-copy of the versions baked into the filenames, so the two drift silently. The check enforces:public/vendor/is listed in the doc,It found vega (5.30.0 / vega-lite 5.21.0 / vega-embed 6.29.0) and animate.css missing from the inventory entirely — both now have entries. The 12 vendor files with no version in their name are reported rather than failed, since they can't be checked either way.
It deliberately doesn't ask npm for the newest release. Several of these aren't plain npm packages (the Infra3d build is locally patched, the photo-sphere-viewer bundle is ours, bootstrap-accessibility vendors two other libraries inside itself) and a third of the list is frozen on purpose, so such a report would need a hand-kept map of npm names and freeze reasons — a second copy of the doc — and would nag about decisions already made.
Wired in as
make lint-vendor-versions, in themake lintloop, and as a blocking step in the existingfrontendCI job, so it rides the already-requiredFrontend (build)check and needs no branch-protection change.Verification
make lintpasses with the new gate in it. The check was confirmed to fail correctly by faking a version bump in the doc, and the runtime versions in the table were read out of the running containers.🤖 Generated with Claude Code
https://claude.ai/code/session_01FEcwN4MLDty5wnkhZ8Et75