# Dependency triage Reviewed all 47 initially open requests by production risk. 4 independently tested patches merged; 6 stale requests closed because their requested versions already exist on main. 37 original requests remain held. A later backend query-parser request (#67) is also held. This is a dated snapshot, not an automatic merge policy. Framework, database, build-tool and media changes are separate validation work. Majors are not bulk merged. React/ReactDOM must remain a compatible pair; database patches still affect production data. ## Merged groups and evidence - [#41](https://github.com/mguhlin/drawsplat/pull/41): Rebased head retested: 51 unit tests, production build, 4 Chromium/Firefox editing checks; paragraph/selection/formatting commands. Merge `db5d46937de9`. - [#44](https://github.com/mguhlin/drawsplat/pull/44): 134 VideoSplat unit tests; development test-library patch only; audit found no vulnerabilities. Merge `60cbc465ecd5`. - [#50](https://github.com/mguhlin/drawsplat/pull/50): GridSplat lint, 46 unit tests (1 skipped), production build; development lint-plugin patch only. Merge `2a8144071dcb`. - [#51](https://github.com/mguhlin/drawsplat/pull/51): 51 unit tests, production build, 4 Chromium/Firefox editing checks; history/Undo/Redo patch. Merge `b5da28923a20`. WriteSplat production assets were rebuilt after both editor patches. Development-only VideoSplat and GridSplat updates do not require replacing their runtime bundles. ## Every request | PR | Risk | Disposition | Validation or next gate | |---|---|---|---| | [#1](https://github.com/mguhlin/drawsplat/pull/1) Add Cloudflare Workers configuration | high | hold | Review hosting target, routes, build commands, secrets and rollback separately; do not change production hosting to clear the unrelated Workers check. | | [#15](https://github.com/mguhlin/drawsplat/pull/15) Bump brace-expansion in /splatworks/gridsplat | low | closed-superseded | Requested manifest and all changed lockfile package versions already match main; close as superseded rather than merge stale changes. | | [#16](https://github.com/mguhlin/drawsplat/pull/16) Bump vite from 8.0.16 to 8.3.5 in /splatworks/gridsplat | medium | closed-superseded | Requested manifest and all changed lockfile package versions already match main; close as superseded rather than merge stale changes. | | [#17](https://github.com/mguhlin/drawsplat/pull/17) Bump undici from 7.27.2 to 7.30.1 in /splatworks/gridsplat | low | closed-superseded | Requested manifest and all changed lockfile package versions already match main; close as superseded rather than merge stale changes. | | [#18](https://github.com/mguhlin/drawsplat/pull/18) Bump postcss from 8.5.16 to 8.5.32 in /splatworks/listsplat | low | closed-superseded | Requested manifest and all changed lockfile package versions already match main; close as superseded rather than merge stale changes. | | [#19](https://github.com/mguhlin/drawsplat/pull/19) Bump source-map-js from 1.2.1 to 1.2.2 in /splatworks/gridsplat | low | closed-superseded | Requested manifest and all changed lockfile package versions already match main; close as superseded rather than merge stale changes. | | [#20](https://github.com/mguhlin/drawsplat/pull/20) Bump @vitest/mocker and vitest in /splatworks/gridsplat | medium | closed-superseded | Requested manifest and all changed lockfile package versions already match main; close as superseded rather than merge stale changes. | | [#21](https://github.com/mguhlin/drawsplat/pull/21) Bump actions/setup-node from 4.4.0 to 7.1.0 | high | hold | Review action release/migration notes, runner requirements, SHA provenance, permissions and artifact behavior; update one action family at a time. | | [#22](https://github.com/mguhlin/drawsplat/pull/22) Bump actions/checkout from 4.4.0 to 7.0.1 | high | hold | Review action release/migration notes, runner requirements, SHA provenance, permissions and artifact behavior; update one action family at a time. | | [#23](https://github.com/mguhlin/drawsplat/pull/23) Bump actions/setup-python from 5.6.0 to 7.1.0 | high | hold | Review action release/migration notes, runner requirements, SHA provenance, permissions and artifact behavior; update one action family at a time. | | [#24](https://github.com/mguhlin/drawsplat/pull/24) Bump actions/upload-artifact from 4.6.2 to 7.0.2 | high | hold | Review action release/migration notes, runner requirements, SHA provenance, permissions and artifact behavior; update one action family at a time. | | [#25](https://github.com/mguhlin/drawsplat/pull/25) Bump @playwright/test from 1.60.0 to 1.64.1 | medium | hold | Coordinated test-runner/browser alignment with representative root, editor, audio/video browser suites; keep out of runtime-library groups. | | [#26](https://github.com/mguhlin/drawsplat/pull/26) Bump vitest from 4.1.12 to 5.0.5 in /solutions/audiosplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#27](https://github.com/mguhlin/drawsplat/pull/27) Bump typescript from 6.0.3 to 7.0.2 in /solutions/audiosplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#28](https://github.com/mguhlin/drawsplat/pull/28) Bump jsdom from 29.1.1 to 30.1.3 in /solutions/audiosplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#29](https://github.com/mguhlin/drawsplat/pull/29) Bump vite from 7.3.7 to 8.3.5 in /solutions/clipsplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#30](https://github.com/mguhlin/drawsplat/pull/30) Bump @playwright/test from 1.60.0 to 1.64.1 in /solutions/audiosplat | medium | hold | Coordinated test-runner/browser alignment with representative root, editor, audio/video browser suites; keep out of runtime-library groups. | | [#31](https://github.com/mguhlin/drawsplat/pull/31) Bump @types/node from 24.10.1 to 26.6.5 in /solutions/audiosplat | high | hold | Align Node types with supported runtime instead of importing unsupported Node 26 API types; compile and run on declared Node versions. | | [#32](https://github.com/mguhlin/drawsplat/pull/32) Bump dotenv from 16.6.1 to 18.0.9 in /server/mysql-backend | high | hold | Dedicated environment-loading migration: precedence, startup configuration, secret handling and Docker/native launcher checks. | | [#33](https://github.com/mguhlin/drawsplat/pull/33) Bump mysql2 from 3.24.4 to 3.24.6 in /server/mysql-backend | high | hold | Database path: hold for backend unit/privacy/roster tests plus real MariaDB and MySQL integration on this driver. Existing head checks cover audit/hosting only; do not infer database coverage. | | [#34](https://github.com/mguhlin/drawsplat/pull/34) Bump express from 4.22.3 to 5.3.0 in /server/mysql-backend | high | hold | Dedicated Express 5 migration with route, async-error, authentication/classroom authorization and real MariaDB/MySQL integration tests. | | [#35](https://github.com/mguhlin/drawsplat/pull/35) Bump vitest from 4.1.12 to 5.0.5 in /solutions/mediasplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#36](https://github.com/mguhlin/drawsplat/pull/36) Bump @vitejs/plugin-react from 6.1.0 to 6.1.2 in /solutions/mediasplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#37](https://github.com/mguhlin/drawsplat/pull/37) Bump react-dom and @types/react-dom in /solutions/mediasplat | high | hold | React/React DOM versions would differ. Require a coordinated per-app pair upgrade, production build and browser tests before merge. | | [#38](https://github.com/mguhlin/drawsplat/pull/38) Bump jsdom from 26.1.0 to 30.1.3 in /solutions/mediasplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#39](https://github.com/mguhlin/drawsplat/pull/39) Bump @testing-library/jest-dom from 6.9.1 to 7.0.1 in /solutions/mediasplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#40](https://github.com/mguhlin/drawsplat/pull/40) Bump rolldown from 1.2.4 to 1.2.15 in /solutions/pdfsplat | medium | hold | Build tool: hold for an isolated compiler rebuild and PDF/OCR/offline/export regressions before publishing changed generated assets. | | [#41](https://github.com/mguhlin/drawsplat/pull/41) Bump prosemirror-commands from 1.7.1 to 1.7.2 in /splatworks/writesplat | medium | merged-tested | Rebased head retested: 51 unit tests, production build, 4 Chromium/Firefox editing checks; paragraph/selection/formatting commands. | | [#42](https://github.com/mguhlin/drawsplat/pull/42) Bump @testing-library/jest-dom from 6.9.1 to 7.0.1 in /solutions/videosplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#43](https://github.com/mguhlin/drawsplat/pull/43) Bump eslint from 10.4.1 to 10.13.0 in /splatworks/gridsplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#44](https://github.com/mguhlin/drawsplat/pull/44) Bump @testing-library/react from 16.3.2 to 16.3.3 in /solutions/videosplat | low | merged-tested | 134 VideoSplat unit tests; development test-library patch only; audit found no vulnerabilities. | | [#45](https://github.com/mguhlin/drawsplat/pull/45) Bump vitest from 4.1.12 to 5.0.5 in /splatworks/writesplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#46](https://github.com/mguhlin/drawsplat/pull/46) Bump vitest from 4.1.12 to 5.0.5 in /solutions/videosplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#47](https://github.com/mguhlin/drawsplat/pull/47) Bump react and @types/react in /splatworks/gridsplat | high | hold | React/React DOM versions would differ. Require a coordinated per-app pair upgrade, production build and browser tests before merge. | | [#48](https://github.com/mguhlin/drawsplat/pull/48) Bump @playwright/test from 1.60.0 to 1.64.1 in /splatworks/writesplat | medium | hold | Coordinated test-runner/browser alignment with representative root, editor, audio/video browser suites; keep out of runtime-library groups. | | [#49](https://github.com/mguhlin/drawsplat/pull/49) Bump react and @types/react in /solutions/videosplat | high | hold | React/React DOM versions would differ. Require a coordinated per-app pair upgrade, production build and browser tests before merge. | | [#50](https://github.com/mguhlin/drawsplat/pull/50) Bump eslint-plugin-react-refresh from 0.5.2 to 0.5.7 in /splatworks/gridsplat | medium | merged-tested | GridSplat lint, 46 unit tests (1 skipped), production build; development lint-plugin patch only. | | [#51](https://github.com/mguhlin/drawsplat/pull/51) Bump prosemirror-history from 1.5.0 to 1.5.1 in /splatworks/writesplat | medium | merged-tested | 51 unit tests, production build, 4 Chromium/Firefox editing checks; history/Undo/Redo patch. | | [#52](https://github.com/mguhlin/drawsplat/pull/52) Bump @playwright/test from 1.62.1 to 1.64.1 in /solutions/videosplat | medium | hold | Coordinated test-runner/browser alignment with representative root, editor, audio/video browser suites; keep out of runtime-library groups. | | [#53](https://github.com/mguhlin/drawsplat/pull/53) Bump typescript from 6.0.3 to 7.0.2 in /splatworks/writesplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#54](https://github.com/mguhlin/drawsplat/pull/54) Bump vitest from 4.1.12 to 5.0.5 in /splatworks/gridsplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#55](https://github.com/mguhlin/drawsplat/pull/55) Bump vitest from 4.1.12 to 5.0.5 in /splatworks/listsplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#56](https://github.com/mguhlin/drawsplat/pull/56) Bump @huggingface/transformers from 3.8.1 to 4.3.1 in /solutions/shared/subtitles | high | hold | Isolated media/model migration: update linked consumers and lockfiles, preserve local processing, validate codec/transcription outputs and offline/network behavior. | | [#57](https://github.com/mguhlin/drawsplat/pull/57) Bump hyperformula from 3.3.0 to 3.5.0 in /splatworks/gridsplat | high | hold | Isolated formula-engine upgrade: calculation fixtures, workbook import/save/reopen, browser and production-build regression checks. | | [#58](https://github.com/mguhlin/drawsplat/pull/58) Bump typescript from 6.0.3 to 7.0.2 in /splatworks/listsplat | high | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#59](https://github.com/mguhlin/drawsplat/pull/59) Bump mediabunny from 1.56.2 to 1.62.1 in /solutions/shared/subtitles | high | hold | Isolated media/model migration: update linked consumers and lockfiles, preserve local processing, validate codec/transcription outputs and offline/network behavior. | | [#60](https://github.com/mguhlin/drawsplat/pull/60) Bump jsdom from 29.1.1 to 30.1.3 in /splatworks/listsplat | medium | hold | Major or broad build/test-tool change: review migration and engine/peer requirements, test the affected app separately and inspect production artifacts before merge. | | [#67](https://github.com/mguhlin/drawsplat/pull/67) Bump qs from 6.16.0 to 6.16.2 in /server/mysql-backend | high | hold | New arrival after original 47: backend query parser lock update; validate malformed/duplicate/nested query handling, auth routes and backend integration independently of Express/database changes. | ## Check interpretation and follow-up The pre-existing `Workers Builds: drawsplat` failure is a separate hosting configuration problem; Cloudflare Pages is the public deployment. No hosting migration or administrator bypass was used to merge patches. A successful audit or Pages preview does not prove backend/database correctness. Held PRs carry risk and hold labels. Exact reviewed heads and merge commits are in the [machine-readable snapshot](dependency-triage-2026-10-31.json). Dependabot may rebase held branches; retest the new head before merging. Published accessibility gaps now have tracked acceptance criteria: [whiteboard keyboard #61](https://github.com/mguhlin/drawsplat/issues/61), [screen-reader structure #62](https://github.com/mguhlin/drawsplat/issues/62), [reduced motion #63](https://github.com/mguhlin/drawsplat/issues/63), [localized administration #64](https://github.com/mguhlin/drawsplat/issues/64), [game keyboard alternatives #65](https://github.com/mguhlin/drawsplat/issues/65), and [OCR device/assistive-technology matrix #66](https://github.com/mguhlin/drawsplat/issues/66). Tracking is not remediation or a conformance claim.