[dependabot]

Update the dependency lockfile and the MCP server template's Zod version. Keep react-router-dom on Router 6 alongside react-router and Backstage, removing the Router 7 bump that caused five frontend test suites to fail with ReferenceError: TextEncoder is not defined.

This is the dependency PR repaired during the scheduled sweep. No user-facing feature or layout changed, so there is no visual screenshot for this maintenance fix.

Verified locally

• mise run install passed with existing peer dependency warnings.
• mise run lint passed across all five packages.
• mise run test -- --runInBand --verbose passed 38 tests in six suites, with one existing skipped test in one skipped suite, after rebasing onto the merged showcase PR fix: clarify search and answer-engine availability #124.
• mise run build was attempted once and blocked by the unavailable local Docker daemon. The required Build workflow must pass its Docker build before merge.
• git diff --check passed.

Checked   1 files in packages/backend
Checked   3 files in plugins/permission-backend-module-default
Checked   1 files in packages/backstage-theme-github
Checked   8 files in plugins/plausible
Checked  51 files in packages/app

Test Suites: 1 skipped, 6 passed, 6 of 7 total
Tests:       1 skipped, 38 passed, 39 total

[build] $ docker compose build backstage
Cannot connect to the Docker daemon at unix:///Users/johnny/.docker/run/docker.sock. Is the docker daemon running?

The lockfile now resolves both direct router dependencies to 6.30.6. This restores the compatible router major without adding test polyfills or changing plugin code. A Router 7 migration needs separate Backstage compatibility work. Existing React/MUI and jsdom warnings remain.

The MCP template's Zod upgrade was checked separately because templates are outside the portal workspaces. A temporary generated fixture retained the template's source and tsconfig and replaced only its name and description placeholders. Temporary local mise tasks ran mise run proof-mcp-install and mise run proof-mcp-typecheck, resolving SDK 1.32.2 and Zod 4.6.7 and passing tsc --noEmit with exit code 0. Those tasks and the fixture are not product changes. The first attempt hit a Yarn PnP cache path problem under macOS /tmp; using the repository's node-modules linker fixed the verification environment.

The pre-rebase Build workflow passed all four mise gates, including the Docker build. The branch has since been rebased onto merged PR #124 and install, lint and all 38 tests passed locally again. Final-head CI is required before merge.

The final-head Build workflow passed mise run install, mise run lint, mise run test and mise run build on fad46a2. CodeQL and both Socket Security checks also passed. The Docker gate is therefore verified in CI despite the unavailable local daemon.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​react-router-dom@​6.30.4 ⏵ 6.30.6		+2

View full report

[johnnyhuy]

The failed build stops in mise run test with ReferenceError: TextEncoder is not defined in five frontend suites. This branch upgrades react-router-dom to 7 while the app keeps react-router 6 and the Backstage packages use Router 6. I will remove the Router 7 bump from this batch, retain the remaining dependency updates, regenerate the lockfile through mise and rerun the gates before merging.