Commit Graph
393 Commits
Author SHA1 Message Date
gadgethd cbf78a8a6c fix(ingest): align replay identity and gate shared sessions (F03 F04 F14 F15) 2026-10-11 16:18:39 +00:00
gadgethd b6dc330014 Merge main into perf/mqtt-ingest-20261011 (npm audit fix, PR #123) 2026-10-11 13:06:58 +00:00
hermes-gadgetandgadgethd 57bde8a75f deps: resolve npm advisories (ip-address, proxy-addr, qs, source-map-js) (#123)
- backend: ip-address 10.4.0 -> 10.7.3, proxy-addr 2.0.7 -> 2.0.8 (critical), qs 6.15.3 -> 6.16.0
- frontend: source-map-js 1.2.1 -> 1.2.2
- lockfile-only; no package.json edits. Verified: npm audit 0 vulns (both), backend typecheck clean, backend 408/408, frontend 101/101, frontend build OK.

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-10-11 14:06:51 +01:00
gadgethd e53ce7f785 fix(ingest): re-arbitrated dedupe takeover + bounded post-persist follow-ups
- Concurrent duplicates that arrive while the first persist is in flight now
  re-arbitrate on failure: the successor claim is registered inside
  waitForInFlightPacket in the same microtask as the emptiness check, so exactly
  one waiter takes over and the rest queue behind it (previously two waiters
  could both fall through after a failed attempt and persist concurrently,
  risking a double insert since packets carry no unique constraint).
  Regression tests cover the single- and chained-failure arbitrations.
- Post-persist follow-ups (multibyte evidence / slow-mode / pre-resolve) are now
  bounded at 64 in flight; over the bound they are dropped and counted
  (meshcore_mqtt_post_persist_dropped_total + _inflight gauge), so a database
  stall cannot grow them without limit.
2026-10-11 13:02:30 +00:00
gadgethd d51a36be0c docs(ingest): document MQTT_INGEST_CONNECTIONS/SHARE_GROUP/FLUSH_MS; make queue default 1000 2026-10-11 05:21:19 +00:00
gadgethd ec5be34b00 perf(ingest): bounded ingest connection pool, redelivery guard, off-path follow-ups
- MQTT_INGEST_CONNECTIONS (default 1) runs N durable ingest connections with a
  shared subscription; each connection keeps strict PUBACK-after-commit
  semantics - mqtt.js dispatches the next packet only after the previous
  message is acknowledged, so a single connection is strictly serial and
  concurrency has to come from connections.
- In-flight dedupe registry: a concurrent copy of a packet waits for the first
  attempt outcome, preserving existing duplicate semantics under concurrency.
- QoS 1 redelivery guard: a redelivered message (duplicate flag) is confirmed
  against the retained packet window before persisting, so a commit whose
  PUBACK was lost to a crash is not double-counted after restart.
- Best-effort live-map follow-ups (multibyte evidence, slow resolution, cache
  warm-up) move off the acknowledgement path.
- New metric: receipt-to-acknowledgement latency histogram.
2026-10-11 01:38:54 +00:00
gadgethd 2e875c4304 perf(ingest): adaptive batch flush interval, bounded queue, batch duplicate collapse
- MQTT_INGEST_FLUSH_MS (default 10ms) replaces the fixed 50ms wait; the old
  interval taxed every singleton batch, which is all a serial ingest produces.
- MQTT_INGEST_QUEUE_MAX (default 1000) bounds the pending queue; overflow
  refuses the entry so the broker redelivers instead of growing memory.
- Duplicate packets inside one batch (same hash/observer/hop) resolve the
  first entry outcome instead of being persisted twice - parity with the
  in-memory ingest filter once more than one ingest can be in flight.
- New metrics: queue depth gauge, enqueue-to-commit wait histogram, dedupe counter.
2026-10-11 01:38:54 +00:00
hermes-gadgetandgadgethd fa801dc004 fix: close ukmesh health and advert identity backlog gaps (#117)
* fix(backlog): close ukmesh health and advert identity gaps

* docs(review): record backlog round 2 pull request

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-10-03 19:43:45 +01:00
b40793f36e Fix analysis state, worker observability, feed layout and maintenance (re-land onto main) (#114)
* Fix analysis state, worker observability, feed layout and maintenance (#113)

* fix(analysis): restore tested retired workload policy

* fix(owner): prewarm last-hop cache with bounded progress reporting

* fix(metrics): use real link worker heartbeat for queue alerts

* fix(feed): measure virtual rows and preserve scroll anchors

* fix(ops): reject Compose metadata drift before replacement

* fix(maintenance): archive inactive nodes across roles and bridge states

* docs(review): record validation and heartbeat audit findings

* fix(maintenance): retain private identities during stale cleanup

* fix(ops): consume Compose service output before adoption checks

* test(owner): cover prewarm scheduling recovery and shutdown

* test(e2e): isolate server ports and Vite dependency caches

* test(feed): cover empty filters and arrivals at the top

* test(map): budget two cold bootstraps in mode persistence check

* docs(review): record continuation regressions and final verification

* fix(alerts): match queue heartbeats to their scrape reporter

* test(feed): preserve packet anchors across scroll-mode changes

* test(owner): verify incremental prewarm cache refreshes

* fix(maintenance): preserve packet privacy fence during public cleanup

* fix(maintenance): recheck inactive sightings before archive and delete

* fix(owner): serve fresh cache hits during background prewarm

* test(map): give each viewport its own startup budget

* test(map): load valid terrain and coverage tiles in local fixtures

* fix(metrics): export unknown heartbeat when Redis initialization fails

* test(path): control worker-pool deadlines independently of thread startup

* test(e2e): await owner and map readiness before state assertions

* test(feed): check fractional viewport and spacer invariants

* docs(review): record green expanded verification checkpoint

* fix(maintenance): acquire visibility before node locks and skip busy rows

* test(maintenance): retain concurrent RF-only activity in native fixtures

* fix(owner): replace regrouped last-hop buckets during refresh

* test(owner): verify warm regrouping with actual last-hop SQL

* test(maintenance): retain concurrently committed node consent

* test(maintenance): avoid a waiting consent-trigger deadlock

* test(feed): verify responsive anchoring in Firefox and WebKit

* docs(review): reconcile completed checks and remote CI evidence

* docs(review): correct checkpoint wording

* test(maintenance): verify privacy fences on native PostgreSQL

* test(health): verify link heartbeat publisher lifecycle

* docs(review): record stop-signal handoff and remaining verification

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>

* fix(feed): preserve scroll anchors across scroll-mode flips

React 19.3 fires the window scroll listener before React commits its new
row range, so updateViewport could overwrite the last known content offset
with the new-mode artifact (0) before the anchor-preserving layout effect
ran — dropping the feed to the top on a responsive resize.

Detect the scroll-mode flip (internal container <-> document scrolling) in
updateViewport and transfer the last known content offset into the new mode
before the anchor effect evaluates.

Verified: feed-virtualizer e2e (both viewports) and the full public-desktop
suite under react 19.2.8 and 19.3.0.

* fix(#553): sync replace-container test harness

* test(ops): sync replace-container harness with adoption + infra flows (#553)

Union of both branch evolutions: Compose adoption drills (check-compose-adoption
staging, MOCK_ADOPTION_* modes, adoption/long-service/overlay cases) plus the
infra-compose staging and timescaledb resolver drill assertions. Fixes the
Workers-and-Compose gate failing on this PR.

Verified locally: 16/16 drills pass.

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
Co-authored-by: hermes-gadget <284726080+hermes-gadget@users.noreply.github.com>
2026-10-03 17:14:34 +01:00
dependabot[bot] 42e64884ec chore(deps): bump the frontend-dependencies group (#112)
Bumps the frontend-dependencies group in /frontend with 2 updates: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `maplibre-gl` from 6.10.0 to 6.11.2
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/maplibre/maplibre-gl-js/compare/v6.10.0...v6.11.2)

Updates `vite` from 8.3.0 to 8.3.1
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.3.1/packages/vite)

---
updated-dependencies:
- dependency-name: maplibre-gl
  dependency-version: 6.11.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: vite
  dependency-version: 8.3.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-03 15:35:32 +01:00
dependabot[bot] 89883b7bfb chore(deps-dev): bump @types/node (#111)
Bumps the scripts-dependencies group in /scripts with 1 update: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@types/node` from 26.6.2 to 26.6.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: scripts-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-03 15:35:25 +01:00
dependabot[bot] d0c00ff191 chore(deps): bump the backend-dependencies group (#110)
Bumps the backend-dependencies group in /backend with 2 updates: [ws](https://github.com/websockets/ws) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `ws` from 8.21.3 to 8.22.0
- [Release notes](https://github.com/websockets/ws/releases)
- [Commits](https://github.com/websockets/ws/compare/8.21.3...8.22.0)

Updates `@types/node` from 26.6.2 to 26.6.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: ws
  dependency-version: 8.22.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-03 15:35:18 +01:00
dependabot[bot] 7a36584e6f chore(deps): bump nginx from a9ae6f6 to df221db (#109)
Bumps nginx from `a9ae6f6` to `df221db`.

---
updated-dependencies:
- dependency-name: nginx
  dependency-version: alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-03 15:35:11 +01:00
dependabot[bot] b2be60fd5f chore(deps): bump node from 2d984a1 to 0b36e8c (#108)
Bumps node from `2d984a1` to `0b36e8c`.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-10-03 15:35:04 +01:00
74d3ff156e fix(mqtt): skip offline status telemetry samples (MQTT Will) (#98)
* fix(mqtt): skip offline status telemetry samples

* docs: add MQTT Will telemetry handoff

* chore(db): renumber MQTT status migration to 057

052 is already taken on main by owner packet sharing; 055 predates main (unmerged branch) and is left untouched; 057 is the next free number after 056. Also appends the migration to the fresh-database expectation in packetBatch.integration.test.ts in sorted order.

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
Co-authored-by: hermes-gadget <284726080+hermes-gadget@users.noreply.github.com>
2026-10-01 01:28:50 +01:00
gadgethd 14380c072b perf(frontend): remove unused dependencies, source, and map assets (#89) 2026-10-01 01:10:59 +01:00
gadgethd 9986542810 perf(frontend): preserve chat snapshots for non-chat packet batches (#87) 2026-10-01 00:54:39 +01:00
hermes-gadgetandgadgethd 24206957bb feat(owner): land owner-controlled packet sharing (rescued VPS WIP) (#101)
* feat(owner): add owner-controlled packet sharing

* docs: record B3 packet-sharing handoff

* docs(api): regenerate openapi for packet-sharing routes

* test(db): extend migration registry expectation to 052-054

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-10-01 00:39:40 +01:00
hermes-gadgetandgadgethd 029cc6ac33 fix(ops): ukmesh deploy/alert/stats hardening (#47 #54 #55 #57) (#104)
* test(viewshed): inject post-commit side-effect failures

* fix(deploy): rollback on unhealthy or mismatched sites

* fix(alerts): persist forwarding queue across restarts

* perf(stats): add per-network aggregate cutover controls

* docs: add Mission C5d handoff

* test(viewshed): correct side-effect marker cursor row sets

* fix(alerts): keep archive-only receiver live

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-10-01 00:24:31 +01:00
b285cdb288 fix(security,ops): close ukmesh auth/users findings (#50 #51 #52 #53 #58) (#103)
* docs: add C5a mission handoff

* security: classify channel keys and baseline reviewed findings

* security: revalidate MQTT auth and revoke owner sessions

* test(ops): cover concurrent newuser grant updates

* fix(ops): preserve executable newuser test

* fix(ops): cover partial newuser rollback failures

* fix(owner): preserve password whitespace during login

* docs: add C5c mission handoff

* test(cache): drop stale authCache policy entry (cache removed by auth revalidation)

* docs: keep HANDOFF on current mission

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
Co-authored-by: hermes-gadget <284726080+hermes-gadget@users.noreply.github.com>
2026-10-01 00:09:44 +01:00
hermes-gadgetandgadgethd 4940c2e6b3 fix: ukmesh small batch — run-state policy, measured feed rows, /raw disposition (#102)
* fix(analysis): restore retired run-state policy (#301)

* fix(feed): measure UK feed virtual row heights (#303)

* docs(mqtt): document denied raw publish disposition (#269 #213)

* docs: hand off Mission B4 small batch

* ci: retrigger workflow after hung runner run

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-09-30 23:49:51 +01:00
hermes-gadgetandgadgethd 5574d70139 fix: close High findings #43 + #45 — durable MQTT ingestion, bounded telemetry lifecycle (#100)
* fix(mqtt): ack QoS1 after durable persistence

* fix(retention): bound core telemetry lifecycle

* docs: add C5b durability handoff

* test(rules): 1m cadence for telemetry lifecycle alert windows so for: timers accumulate

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-09-30 23:35:04 +01:00
hermes-gadgetandgadgethd f445a24467 fix: close High findings #42 + #46 — public status DTO, split-infra resolver (#99)
* fix(api): allowlist public node status fields

* fix(ops): resolve split infrastructure containers exactly

* docs: add C5a mission handoff

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-09-30 23:19:31 +01:00
hermes-gadgetandgadgethd 27f1822e75 ops: owner-baseline auto-rebaseline (check tool + timer + reviewed refresh script) (#97)
* feat(ops): auto-rebaseline owner ACL inventory

* docs(ops): handoff owner baseline autorebaseline

* ops: add reviewed owner-authorization baseline refresh script

scripts/refresh-owner-baseline.sh regenerates the owner inventory baseline
with the running backend image, validates it against the live inventory
(fail-closed), backs up .env before repointing, and can recreate the backend.
It refuses to overwrite an existing baseline and keeps the previous file for
rollback. Adds the matching operations runbook section.

* test(ops): cover refresh baseline validation output

---------

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-09-30 23:00:21 +01:00
gadgethd 71a54f2a2d fix(privacy): rematerialize packet privacy asynchronously (#107) 2026-09-30 23:00:07 +01:00
dependabot[bot] 846422e5ad chore(deps): bump the actions group across 1 directory with 3 updates (#106)
Bumps the actions group with 3 updates in the / directory: [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action), [docker/build-push-action](https://github.com/docker/build-push-action) and [anchore/sbom-action](https://github.com/anchore/sbom-action).


Updates `docker/setup-buildx-action` from 4.3.0 to 4.4.1
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](https://github.com/docker/setup-buildx-action/compare/37fe631027851001ddb9b187196cc803df7f5f0e...f87e5991a6d7451dcb8d9637bfbc97413f497069)

Updates `docker/build-push-action` from 7.3.0 to 7.4.0
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](https://github.com/docker/build-push-action/compare/53b7df96c91f9c12dcc8a07bcb9ccacbed38856a...c3c9e263c25d99ce0380d002d59b67737d91b0dc)

Updates `anchore/sbom-action` from 0.24.0 to 0.24.2
- [Release notes](https://github.com/anchore/sbom-action/releases)
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md)
- [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: docker/build-push-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: actions
- dependency-name: anchore/sbom-action
  dependency-version: 0.24.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:59:15 +01:00
dependabot[bot] c77aad07cd chore(deps): bump the backend-dependencies group across 1 directory with 5 updates (#105)
Bumps the backend-dependencies group with 5 updates in the /backend directory:

| Package | From | To |
| --- | --- | --- |
| [compression](https://github.com/expressjs/compression) | `1.8.1` | `1.8.2` |
| [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.2` | `8.7.0` |
| [mqtt](https://github.com/mqttjs/MQTT.js) | `5.15.2` | `5.16.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.2` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.15` |



Updates `compression` from 1.8.1 to 1.8.2
- [Release notes](https://github.com/expressjs/compression/releases)
- [Changelog](https://github.com/expressjs/compression/blob/master/HISTORY.md)
- [Commits](https://github.com/expressjs/compression/compare/v1.8.1...v1.8.2)

Updates `express-rate-limit` from 8.6.2 to 8.7.0
- [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases)
- [Commits](https://github.com/express-rate-limit/express-rate-limit/compare/v8.6.2...v8.7.0)

Updates `mqtt` from 5.15.2 to 5.16.0
- [Release notes](https://github.com/mqttjs/MQTT.js/releases)
- [Changelog](https://github.com/mqttjs/MQTT.js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/mqttjs/MQTT.js/compare/v5.15.2...v5.16.0)

Updates `@types/node` from 26.2.0 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.23.12 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.12...v4.23.15)

---
updated-dependencies:
- dependency-name: compression
  dependency-version: 1.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
- dependency-name: express-rate-limit
  dependency-version: 8.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: mqtt
  dependency-version: 5.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: "@types/node"
  dependency-version: 26.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
- dependency-name: tsx
  dependency-version: 4.23.15
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:59:10 +01:00
dependabot[bot] 3b7992dd7b chore(deps): bump node from aadf416 to 2d984a1 (#81)
Bumps node from `aadf416` to `2d984a1`.

---
updated-dependencies:
- dependency-name: node
  dependency-version: 26-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:59:06 +01:00
dependabot[bot] 05ff009d14 chore(deps): bump nginx from db35bfc to a9ae6f6 (#80)
Bumps nginx from `db35bfc` to `a9ae6f6`.

---
updated-dependencies:
- dependency-name: nginx
  dependency-version: alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:59:02 +01:00
dependabot[bot] 5588742533 chore(deps): bump the frontend-dependencies group across 1 directory with 18 updates (#96)
Bumps the frontend-dependencies group with 18 updates in the /frontend directory:

| Package | From | To |
| --- | --- | --- |
| [@deck.gl/aggregation-layers](https://github.com/visgl/deck.gl) | `9.3.10` | `9.4.0` |
| [@deck.gl/core](https://github.com/visgl/deck.gl) | `9.3.10` | `9.4.0` |
| [@deck.gl/extensions](https://github.com/visgl/deck.gl) | `9.3.10` | `9.4.0` |
| [@deck.gl/layers](https://github.com/visgl/deck.gl) | `9.3.10` | `9.4.0` |
| [@deck.gl/mapbox](https://github.com/visgl/deck.gl) | `9.3.10` | `9.4.0` |
| [maplibre-gl](https://github.com/maplibre/maplibre-gl-js) | `6.5.0` | `6.10.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [react-aria-components](https://github.com/adobe/react-spectrum) | `1.20.0` | `1.21.1` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [react-is](https://github.com/react/react/tree/HEAD/packages/react-is) | `19.2.8` | `19.3.0` |
| [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.3.0` | `8.4.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.18` | `19.3.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.5` | `19.3.0` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.1.0` | `6.1.1` |
| [postcss](https://github.com/postcss/postcss) | `8.5.26` | `8.5.28` |
| [tsx](https://github.com/privatenumber/tsx) | `4.23.12` | `4.23.15` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.2` | `8.3.0` |



Updates `@deck.gl/aggregation-layers` from 9.3.10 to 9.4.0
- [Release notes](https://github.com/visgl/deck.gl/releases)
- [Changelog](https://github.com/visgl/deck.gl/blob/master/CHANGELOG.md)
- [Commits](https://github.com/visgl/deck.gl/compare/v9.3.10...v9.4.0)

Updates `@deck.gl/core` from 9.3.10 to 9.4.0
- [Release notes](https://github.com/visgl/deck.gl/releases)
- [Changelog](https://github.com/visgl/deck.gl/blob/master/CHANGELOG.md)
- [Commits](https://github.com/visgl/deck.gl/compare/v9.3.10...v9.4.0)

Updates `@deck.gl/extensions` from 9.3.10 to 9.4.0
- [Release notes](https://github.com/visgl/deck.gl/releases)
- [Changelog](https://github.com/visgl/deck.gl/blob/master/CHANGELOG.md)
- [Commits](https://github.com/visgl/deck.gl/compare/v9.3.10...v9.4.0)

Updates `@deck.gl/layers` from 9.3.10 to 9.4.0
- [Release notes](https://github.com/visgl/deck.gl/releases)
- [Changelog](https://github.com/visgl/deck.gl/blob/master/CHANGELOG.md)
- [Commits](https://github.com/visgl/deck.gl/compare/v9.3.10...v9.4.0)

Updates `@deck.gl/mapbox` from 9.3.10 to 9.4.0
- [Release notes](https://github.com/visgl/deck.gl/releases)
- [Changelog](https://github.com/visgl/deck.gl/blob/master/CHANGELOG.md)
- [Commits](https://github.com/visgl/deck.gl/compare/v9.3.10...v9.4.0)

Updates `maplibre-gl` from 6.5.0 to 6.10.0
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/maplibre/maplibre-gl-js/compare/v6.5.0...v6.10.0)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `react-aria-components` from 1.20.0 to 1.21.1
- [Release notes](https://github.com/adobe/react-spectrum/releases)
- [Commits](https://github.com/adobe/react-spectrum/compare/react-aria-components@1.20.0...react-aria-components@1.21.1)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `react-is` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-is)

Updates `react-router` from 8.3.0 to 8.4.0
- [Release notes](https://github.com/remix-run/react-router/releases)
- [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/remix-run/react-router/commits/react-router@8.4.0/packages/react-router)

Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](https://github.com/microsoft/playwright/compare/v1.62.1...v1.63.0)

Updates `@types/react` from 19.2.18 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react)

Updates `@types/react-dom` from 19.2.5 to 19.3.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.1.0 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `postcss` from 8.5.26 to 8.5.28
- [Release notes](https://github.com/postcss/postcss/releases)
- [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md)
- [Commits](https://github.com/postcss/postcss/compare/8.5.26...8.5.28)

Updates `tsx` from 4.23.12 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.12...v4.23.15)

Updates `vite` from 8.2.2 to 8.3.0
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/create-vite@8.3.0/packages/vite)

---
updated-dependencies:
- dependency-name: "@deck.gl/aggregation-layers"
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@deck.gl/core"
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@deck.gl/extensions"
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@deck.gl/layers"
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@deck.gl/mapbox"
  dependency-version: 9.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@types/react"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: maplibre-gl
  dependency-version: 6.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: postcss
  dependency-version: 8.5.28
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: react-aria-components
  dependency-version: 1.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: react-is
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: react-router
  dependency-version: 8.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: vite
  dependency-version: 8.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:58:10 +01:00
dependabot[bot] d3eb1e55ef chore(deps): bump the rf-worker-dependencies group across 1 directory with 2 updates (#94)
Bumps the rf-worker-dependencies group with 2 updates in the /viewshed-worker directory: [numpy](https://github.com/numpy/numpy) and [psycopg2-binary](https://github.com/psycopg/psycopg2).


Updates `numpy` from 2.5.2 to 2.5.3
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](https://github.com/numpy/numpy/compare/v2.5.2...v2.5.3)

Updates `psycopg2-binary` from 2.9.12 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](https://github.com/psycopg/psycopg2/compare/2.9.12...2.9.13)

---
updated-dependencies:
- dependency-name: numpy
  dependency-version: 2.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rf-worker-dependencies
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rf-worker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:58:06 +01:00
dependabot[bot] b3dfed014c chore(deps-dev): bump the scripts-dependencies group across 1 directory with 2 updates (#82)
Bumps the scripts-dependencies group with 2 updates in the /scripts directory: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) and [tsx](https://github.com/privatenumber/tsx).


Updates `@types/node` from 26.2.0 to 26.6.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `tsx` from 4.23.12 to 4.23.15
- [Release notes](https://github.com/privatenumber/tsx/releases)
- [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs)
- [Commits](https://github.com/privatenumber/tsx/compare/v4.23.12...v4.23.15)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 26.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: scripts-dependencies
- dependency-name: tsx
  dependency-version: 4.23.13
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: scripts-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-30 22:58:02 +01:00
gadgethd 2fa80fa10d fix(ws): release client state when initial loading fails (#90) 2026-09-23 11:52:15 +01:00
gadgethd 05803a5e74 perf(health): combine repeated packet diagnostic scans (#88) 2026-09-23 11:52:11 +01:00
gadgethd 822fb66af0 perf(cache): skip expiry scans while cached entries are fresh (#86) 2026-09-23 11:52:07 +01:00
ben d44ef5e572 chore: remove obsolete planning documents 2026-09-20 14:07:03 +01:00
hermes-gadgetandgadgethd 2c2b9d9de4 fix(owner): make grant reconciliation rollout-safe (#79)
Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-08-31 16:18:05 +01:00
hermes-gadgetandgadgethd b09e400886 fix(vacuum): resolve timescaledb compose project for two-project layout (#78)
The maintenance script ran bare `docker compose` in the repo dir, which
fails on the deployed layout where the database lives in the separate
meshcore-infra compose project ('db-migrate depends on undefined service
timescaledb'). Mirror scripts/backup.sh: when COMPOSE_FILE is unset,
target the meshcore-infra project (overridable via MESHCORE_INFRA_DIR /
MESHCORE_INFRA_PROJECT_NAME); the test harness keeps working because it
sets COMPOSE_FILE/COMPOSE_PROJECT_NAME (env path unchanged).

Verified: read-only chunk inventory runs on projects-vps; test-vacuum-
maintenance.sh fixture suite re-run.

Co-authored-by: gadgethd <111318106+gadgethd@users.noreply.github.com>
2026-08-31 15:58:00 +01:00
hermes-gadget f906afc995 fix(e2e): align mobile flows and cookie contrast 2026-08-29 11:55:36 +01:00
hermes-gadget cc566b3c28 fix(ci): restore E2E and contract gates 2026-08-29 11:39:38 +01:00
dependabot[bot] 9fc5c99898 chore(deps): bump nginx from 4a73073 to db35bfc (#72)
Bumps nginx from `4a73073` to `db35bfc`.

---
updated-dependencies:
- dependency-name: nginx
  dependency-version: alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-29 11:22:27 +01:00
dependabot[bot] f555b46932 chore(deps): bump osgeo/gdal in /viewshed-worker (#73)
Bumps [osgeo/gdal](https://github.com/OSGeo/gdal) from ubuntu-full-3.13.2 to ubuntu-full-3.13.3.
- [Release notes](https://github.com/OSGeo/gdal/releases)
- [Changelog](https://github.com/OSGeo/gdal/blob/master/NEWS.md)
- [Commits](https://github.com/OSGeo/gdal/compare/v3.13.2...v3.13.3)

---
updated-dependencies:
- dependency-name: osgeo/gdal
  dependency-version: ubuntu-full-3.13.3
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-29 11:22:24 +01:00
dependabot[bot] e2ee775fae chore(deps-dev): bump @types/pg (#74)
Bumps the backend-dependencies group in /backend with 1 update: [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg).


Updates `@types/pg` from 8.21.0 to 8.23.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

---
updated-dependencies:
- dependency-name: "@types/pg"
  dependency-version: 8.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: backend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-29 11:22:21 +01:00
dependabot[bot] db291e72eb chore(deps-dev): bump @types/pg (#75)
Bumps the scripts-dependencies group in /scripts with 1 update: [@types/pg](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/pg).


Updates `@types/pg` from 8.21.0 to 8.23.1
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/pg)

---
updated-dependencies:
- dependency-name: "@types/pg"
  dependency-version: 8.23.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: scripts-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-29 11:22:18 +01:00
dependabot[bot] 6c123979cb chore(deps): bump the frontend-dependencies group (#76)
Bumps the frontend-dependencies group in /frontend with 4 updates: [maplibre-gl](https://github.com/maplibre/maplibre-gl-js), [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom), [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) and [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite).


Updates `maplibre-gl` from 6.4.0 to 6.5.0
- [Release notes](https://github.com/maplibre/maplibre-gl-js/releases)
- [Changelog](https://github.com/maplibre/maplibre-gl-js/blob/main/CHANGELOG.md)
- [Commits](https://github.com/maplibre/maplibre-gl-js/compare/v6.4.0...v6.5.0)

Updates `@types/react-dom` from 19.2.4 to 19.2.5
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.0
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.0/packages/plugin-react)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: maplibre-gl
  dependency-version: 6.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: frontend-dependencies
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: frontend-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-29 11:22:14 +01:00
dependabot[bot] 2be2b498a6 chore(deps): bump scipy (#77)
Bumps the rf-worker-dependencies group in /viewshed-worker with 1 update: [scipy](https://github.com/scipy/scipy).


Updates `scipy` from 1.18.0 to 1.18.1
- [Release notes](https://github.com/scipy/scipy/releases)
- [Commits](https://github.com/scipy/scipy/compare/v1.18.0...v1.18.1)

---
updated-dependencies:
- dependency-name: scipy
  dependency-version: 1.18.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: rf-worker-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-29 11:22:11 +01:00
gadgethd 1eefb50b31 fix(map): remove duplicate attribution controls — default MapLibre attribution is sufficient 2026-08-27 23:59:16 +00:00
gadgethd aee892cc82 fix(ws): improve initial-state size estimator accuracy and drop duplicate viable_pairs 2026-08-27 23:59:16 +00:00
gadgethd 4f4546f31a test(e2e): migrate E2E test route stubs from CARTO to OpenFreeMap 2026-08-27 23:48:01 +00:00
gadgethd 0a41d4bfc6 refactor(map): fix overlay anchors and migrate mini-maps to OpenFreeMap with attribution 2026-08-27 23:48:01 +00:00