chore(deps): routine dependency freshness pass

[lopatnov]

Summary

• Backend: bump System.ServiceModel.Syndication 10.0.10 → 10.0.11 — the only top-level NuGet package actually behind; everything else dotnet list package --outdated --include-transitive reports is transitive-only, pulled in via Microsoft.EntityFrameworkCore.Design's own Roslyn/analyzer dependency tree or Microsoft.Data.SqlClient (via EntityFrameworkCore.SqlServer) — not independently bumpable without the owning package moving first.
• Frontend: npm update within existing semver ranges — @bufbuild/protobuf, @bufbuild/protoc-gen-es, @hookform/resolvers, @testing-library/jest-dom, @testing-library/user-event, globals, shadcn, zustand.

Related issue

Part of the periodic /maintain cycle (2026-08-15) — step 1 (dependency-freshness skill).

Type of change

• Build / CI / tooling

Checklist

• dotnet build --configuration Release passes with 0 errors
• cd src/pressmark-web && npm run build passes with 0 TypeScript errors
• New behavior is covered by tests — dependency bump only, no behavior change; dotnet test (78/78) and npm run test (37/37) verified green
• All UI strings use t('ns:key') — no strings touched

Notes for reviewers

Deliberately not included in this pass (checked and held, not overlooked):

• TypeScript 7 — typescript-eslint@8.67.0 still caps its typescript peer dependency at <6.1.0 (verified via npm view typescript-eslint peerDependencies), unchanged since the chore(deps-dev): bump typescript from 6.0.2 to 7.0.2 in /src/pressmark-web #77/chore(deps): update frontend npm packages, close 5 transitive vulnerabilities #85 decision.
• xunit.runner.visualstudio 3.1.5 → 4.0.0 and **xunit.analyzers 1.18.0 → 2.0.0** — both major; the project's xunit` core package is still v2.9.3, and runner v4 is built for the xunit v3 execution model, so this isn't a drop-in bump — it's an xunit v2→v3 migration decision, left for a dedicated pass.
• Docker base images / GitHub Actions — checked separately (devops-owned section of the skill): node:24-alpine confirmed still Active LTS (Node 26 doesn't reach LTS until October 2026 — consistent with holding Dependabot PR chore(deps): bump node from 24-alpine to 26-alpine in /src/pressmark-web #92 open), all pinned GitHub Actions majors already resolve to their latest release, nginx:1.31.3-alpine3.24-slim is current for its track. No changes needed there this pass.
• mcr.microsoft.com/mssql/server:2022-latest pinned in CI/coverage workflows — a 2025 tag now exists upstream, and docker-compose.yml's local-dev services already float to :latest (so local dev is arguably already ahead of CI here). Flagging this as a real drift, but a SQL Server major bump is a compatibility-review decision (migration/collation behavior), not a routine image patch — left for the repo owner or a dedicated architect/devops pass rather than bundled here.

No security vulnerabilities found in either ecosystem this pass (dotnet list package --vulnerable --include-transitive clean on both projects, npm audit clean).

---

Generated by Claude Code

Summary by CodeRabbit

• Chores
  • Updated the syndication package to a newer maintenance release.
  • Includes dependency updates and improvements from the package provider.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1afd1112-6025-4003-afcc-bce25a804a13

📥 Commits

Reviewing files that changed from the base of the PR and between 76eae30 and 5ebcbe9.

⛔ Files ignored due to path filters (1)

• src/pressmark-web/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (1)

• src/Pressmark.Api/Pressmark.Api.csproj

---

📝 Walkthrough

Walkthrough

The API project updates the System.ServiceModel.Syndication package reference from version 10.0.10 to 10.0.11.

Changes

Syndication package update

Layer / File(s)	Summary
Update syndication package reference src/Pressmark.Api/Pressmark.Api.csproj	The project references System.ServiceModel.Syndication version 10.0.11 instead of 10.0.10.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Suggested reviewers: claude

Poem

A rabbit checked the package line,
And found a newer version fine.
The syndication leaf now grows,
From ten-oh-ten to ten-oh-one-one it goes.
Hop, hop—the project stays aligned!

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependency-freshness-2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[gitar-bot]

Important

You are using the Gitar free plan. Upgrade to unlock code review, CI analysis, auto-apply, custom automations, and more.

_Gitar

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nuget/​system.servicemodel.syndication@​10.0.10 ⏵ 10.0.11
	npm/​globals@​17.9.0 ⏵ 17.11.0			+1	+1
	npm/​@​bufbuild/​protobuf@​2.13.0 ⏵ 2.14.0				+1
	npm/​@​testing-library/​user-event@​14.6.3 ⏵ 14.6.4			+1
	npm/​shadcn@​4.17.0 ⏵ 4.18.0			+1
	npm/​zustand@​5.0.14 ⏵ 5.0.15	+1		+1	+6
	npm/​@​bufbuild/​protoc-gen-es@​2.13.0 ⏵ 2.14.0				+1
	npm/​@​testing-library/​jest-dom@​7.0.0 ⏵ 7.0.1				+3
	npm/​@​hookform/​resolvers@​5.7.1 ⏵ 5.8.0				+2

View full report

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[qodo-code-review]

ⓘ Qodo reviews are paused because the subscription is no longer active. Ask your workspace admin to reactivate the subscription to resume reviews. Manage billing