Consolidate Dependabot dependency bumps (#122–#128)

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run repository checks
         run: bash scripts/ci/repository_checks.sh
@@ -22,10 +22,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -47,10 +47,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'
@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Save PR body
         env:

.github/workflows/nightly.yml

@@ -11,13 +11,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Run repository checks
         run: bash scripts/ci/repository_checks.sh
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v6
         with:
           node-version-file: '.nvmrc'
           cache: 'npm'

apps/doc-approval/web-react/package.json

@@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^24.13.2",
+    "@types/node": "^26.1.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
@@ -27,12 +27,12 @@
     "eslint-plugin-react-refresh": "^0.5.3",
     "globals": "^17.6.0",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.61.0",
+    "typescript-eslint": "^8.63.0",
     "vite": "^8.1.0",
-    "vitest": "^3.0.7",
-    "jsdom": "^26.0.0",
+    "vitest": "^4.1.10",
+    "jsdom": "^29.1.1",
     "@testing-library/react": "^16.2.0",
     "@testing-library/jest-dom": "^6.6.3",
-    "@vitest/coverage-v8": "^3.0.7"
+    "@vitest/coverage-v8": "^4.1.10"
   }
 }

apps/doc-approval/web-react/src/App.test.tsx

@@ -7,15 +7,15 @@ describe('App', () => {
   afterEach(() => { vi.useRealTimers(); vi.restoreAllMocks() })
 
   it('renders UI shell', async () => {
-    vi.spyOn(global, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
     await act(async () => { render(<App />) })
     expect(screen.getByText('Doc Approval')).toBeInTheDocument()
     expect(screen.getByRole('heading', { name: 'Submit Document', level: 2 })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Analyze Document' })).toBeInTheDocument()
   })
 
   it('shows Offline when health check fails', async () => {
-    vi.spyOn(global, 'fetch').mockRejectedValue(new Error('Network error'))
+    vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('Network error'))
     render(<App />)
     await act(async () => { await vi.runOnlyPendingTimersAsync() })
     expect(screen.getByText('Offline')).toBeInTheDocument()
@@ -24,7 +24,7 @@ describe('App', () => {
   })
 
   it('shows Online when health check succeeds', async () => {
-    vi.spyOn(global, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
     render(<App />)
     await act(async () => { await vi.runOnlyPendingTimersAsync() })
     expect(screen.getByText('Online')).toBeInTheDocument()
@@ -38,7 +38,7 @@ describe('App', () => {
       confidence: 0.88,
       recommendation: 'approve',
     }
-    vi.spyOn(global, 'fetch').mockImplementation((url, init) => {
+    vi.spyOn(globalThis, 'fetch').mockImplementation((url, init) => {
       const path = String(url)
       if (path.includes('/healthz')) {
         return Promise.resolve({ ok: true } as Response)
@@ -83,7 +83,7 @@ describe('App', () => {
       confidence: 0.5,
       recommendation: 'review',
     }
-    vi.spyOn(global, 'fetch').mockImplementation((url) => {
+    vi.spyOn(globalThis, 'fetch').mockImplementation((url) => {
       const path = String(url)
       if (path.includes('/healthz')) return Promise.resolve({ ok: true } as Response)
       if (path.includes('/execute')) {

apps/doc-approval/web-react/src/client/traverseClient.test.ts

@@ -13,7 +13,7 @@ function mockFetch(responses: Record<string, unknown>) {
 describe('createTraverseClient', () => {
   it('execute posts and returns execution_id', async () => {
     const fetch = mockFetch({ '/execute': { execution_id: 'exec-1' } })
-    global.fetch = fetch
+    globalThis.fetch = fetch
     const id = await createTraverseClient(BASE).execute('local-default', 'doc-approval.analyze', { document: 'hi' })
     expect(id).toBe('exec-1')
     expect(fetch).toHaveBeenCalledWith(
@@ -23,19 +23,19 @@ describe('createTraverseClient', () => {
   })
 
   it('pollExecution returns result', async () => {
-    global.fetch = mockFetch({ '/executions/exec-1': { execution_id: 'exec-1', status: 'succeeded', output: { docType: 'invoice' } } })
+    globalThis.fetch = mockFetch({ '/executions/exec-1': { execution_id: 'exec-1', status: 'succeeded', output: { docType: 'invoice' } } })
     const result = await createTraverseClient(BASE).pollExecution('local-default', 'exec-1')
     expect(result.status).toBe('succeeded')
   })
 
   it('fetchTrace returns events', async () => {
-    global.fetch = mockFetch({ '/traces/exec-1': [{ event_type: 'start', timestamp: 't0' }] })
+    globalThis.fetch = mockFetch({ '/traces/exec-1': [{ event_type: 'start', timestamp: 't0' }] })
     const trace = await createTraverseClient(BASE).fetchTrace('local-default', 'exec-1')
     expect(trace).toHaveLength(1)
   })
 
   it('execute throws on non-ok response', async () => {
-    global.fetch = vi.fn(() => Promise.resolve({ ok: false, status: 500 })) as unknown as typeof fetch
+    globalThis.fetch = vi.fn(() => Promise.resolve({ ok: false, status: 500 })) as unknown as typeof fetch
     await expect(createTraverseClient(BASE).execute('ws', 'cap', {})).rejects.toThrow('execute failed: 500')
   })
 })

apps/trace-explorer/web-react/package.json

@@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^24.13.2",
+    "@types/node": "^26.1.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
@@ -27,12 +27,12 @@
     "eslint-plugin-react-refresh": "^0.5.3",
     "globals": "^17.6.0",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.61.0",
+    "typescript-eslint": "^8.63.0",
     "vite": "^8.1.0",
-    "vitest": "^3.0.7",
-    "jsdom": "^26.0.0",
+    "vitest": "^4.1.10",
+    "jsdom": "^29.1.1",
     "@testing-library/react": "^16.2.0",
     "@testing-library/jest-dom": "^6.6.3",
-    "@vitest/coverage-v8": "^3.0.7"
+    "@vitest/coverage-v8": "^4.1.10"
   }
 }

apps/trace-explorer/web-react/src/App.test.tsx

@@ -7,14 +7,14 @@ describe('App', () => {
   afterEach(() => { vi.useRealTimers(); vi.restoreAllMocks() })
 
   it('renders empty state', async () => {
-    vi.spyOn(global, 'fetch').mockResolvedValue({ ok: true } as Response)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true } as Response)
     await act(async () => { render(<App />) })
     expect(screen.getByText('Trace Explorer')).toBeInTheDocument()
     expect(screen.getByText(/Paste an execution ID above/)).toBeInTheDocument()
   })
 
   it('shows offline when health check fails', async () => {
-    vi.spyOn(global, 'fetch').mockRejectedValue(new Error('offline'))
+    vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('offline'))
     render(<App />)
     await act(async () => { await vi.runOnlyPendingTimersAsync() })
     expect(screen.getByText('Offline')).toBeInTheDocument()

apps/traverse-starter/web-react/package.json

@@ -18,7 +18,7 @@
   },
   "devDependencies": {
     "@eslint/js": "^10.0.1",
-    "@types/node": "^24.13.2",
+    "@types/node": "^26.1.0",
     "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@vitejs/plugin-react": "^6.0.2",
@@ -27,12 +27,12 @@
     "eslint-plugin-react-refresh": "^0.5.3",
     "globals": "^17.6.0",
     "typescript": "~6.0.2",
-    "typescript-eslint": "^8.61.0",
+    "typescript-eslint": "^8.63.0",
     "vite": "^8.1.0",
-    "vitest": "^3.0.7",
-    "jsdom": "^26.0.0",
+    "vitest": "^4.1.10",
+    "jsdom": "^29.1.1",
     "@testing-library/react": "^16.2.0",
     "@testing-library/jest-dom": "^6.6.3",
-    "@vitest/coverage-v8": "^3.0.7"
+    "@vitest/coverage-v8": "^4.1.10"
   }
 }

apps/traverse-starter/web-react/src/App.test.tsx

@@ -7,15 +7,15 @@ describe('App', () => {
   afterEach(() => { vi.useRealTimers(); vi.restoreAllMocks() })
 
   it('renders UI shell', async () => {
-    vi.spyOn(global, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
     await act(async () => { render(<App />) })
     expect(screen.getByText('Traverse Starter')).toBeInTheDocument()
     expect(screen.getByRole('heading', { name: 'Start Workflow', level: 2 })).toBeInTheDocument()
     expect(screen.getByRole('button', { name: 'Start Workflow' })).toBeInTheDocument()
   })
 
   it('shows Offline when health check fails', async () => {
-    vi.spyOn(global, 'fetch').mockRejectedValue(new Error('Network error'))
+    vi.spyOn(globalThis, 'fetch').mockRejectedValue(new Error('Network error'))
     render(<App />)
     await act(async () => { await vi.runOnlyPendingTimersAsync() })
     expect(screen.getByText('Offline')).toBeInTheDocument()
@@ -25,14 +25,14 @@ describe('App', () => {
   })
 
   it('shows Online when health check succeeds', async () => {
-    vi.spyOn(global, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true, json: () => Promise.resolve({}) } as Response)
     render(<App />)
     await act(async () => { await vi.runOnlyPendingTimersAsync() })
     expect(screen.getByText('Online')).toBeInTheDocument()
   })
 
   it('shows character count for note input', async () => {
-    vi.spyOn(global, 'fetch').mockResolvedValue({ ok: true } as Response)
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue({ ok: true } as Response)
     render(<App />)
     await act(async () => { await vi.runOnlyPendingTimersAsync() })
     fireEvent.change(screen.getByPlaceholderText(/Enter a note/i), { target: { value: 'hello' } })
@@ -47,7 +47,7 @@ describe('App', () => {
       suggestedNextAction: 'review',
       status: 'complete',
     }
-    vi.spyOn(global, 'fetch').mockImplementation((url, init) => {
+    vi.spyOn(globalThis, 'fetch').mockImplementation((url, init) => {
       const path = String(url)
       if (path.includes('/healthz')) {
         return Promise.resolve({ ok: true } as Response)

apps/traverse-starter/web-react/src/client/traverseClient.test.ts

@@ -13,7 +13,7 @@ function mockFetch(responses: Record<string, unknown>) {
 describe('createTraverseClient', () => {
   it('execute posts and returns execution_id', async () => {
     const fetch = mockFetch({ '/execute': { execution_id: 'exec-1' } })
-    global.fetch = fetch
+    globalThis.fetch = fetch
     const id = await createTraverseClient(BASE).execute('local-default', 'cap.foo', { note: 'hi' })
     expect(id).toBe('exec-1')
     expect(fetch).toHaveBeenCalledWith(
@@ -23,19 +23,19 @@ describe('createTraverseClient', () => {
   })
 
   it('pollExecution returns result', async () => {
-    global.fetch = mockFetch({ '/executions/exec-1': { execution_id: 'exec-1', status: 'succeeded', output: { title: 'T' } } })
+    globalThis.fetch = mockFetch({ '/executions/exec-1': { execution_id: 'exec-1', status: 'succeeded', output: { title: 'T' } } })
     const result = await createTraverseClient(BASE).pollExecution('local-default', 'exec-1')
     expect(result.status).toBe('succeeded')
   })
 
   it('fetchTrace returns events', async () => {
-    global.fetch = mockFetch({ '/traces/exec-1': [{ event_type: 'start', timestamp: 't0' }] })
+    globalThis.fetch = mockFetch({ '/traces/exec-1': [{ event_type: 'start', timestamp: 't0' }] })
     const trace = await createTraverseClient(BASE).fetchTrace('local-default', 'exec-1')
     expect(trace).toHaveLength(1)
   })
 
   it('execute throws on non-ok response', async () => {
-    global.fetch = vi.fn(() => Promise.resolve({ ok: false, status: 500 })) as unknown as typeof fetch
+    globalThis.fetch = vi.fn(() => Promise.resolve({ ok: false, status: 500 })) as unknown as typeof fetch
     await expect(createTraverseClient(BASE).execute('ws', 'cap', {})).rejects.toThrow('execute failed: 500')
   })
 })