fix(deps): update dependency graphql to v17

.gitea/workflows/ci.yaml

@@ -18,30 +18,16 @@ jobs:
       - name: Build and push
         run: unset GITEA_TOKEN && build && push
 
-  deploy-prod-frostmoln:
+  deploy-prod:
     needs: build
     if: gitea.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     env:
-      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_FROSTMOLN_PRODUCTION }}
+      BUILDTOOLS_CONTENT: ${{ secrets.BUILDTOOLS_CONTENT }}
       GITEA_REPOSITORY: ${{ gitea.repository }}
-      FM_TENANT: 9ae61342-0f76-476f-8176-e46f6b0b0c32
     environment: prod
     steps:
       - uses: actions/checkout@v7
       - uses: buildtool/setup-buildtools-action@v1
-      - name: Install fm
+      - name: Deploy to production
-        run: |
+        run: deploy prod
-          sudo install -d -m 0755 /etc/apt/keyrings
-          sudo curl -fsSL -o /etc/apt/keyrings/frostmoln.gpg https://get.frostmoln.cloud/deb/frostmoln.gpg
-          sudo curl -fsSL -o /etc/apt/sources.list.d/frostmoln.sources https://get.frostmoln.cloud/deb/frostmoln.sources
-          sudo apt-get update && sudo apt-get install -y fm
-      - name: Deploy to Frostmoln production
-        env:
-          FROSTMOLN_API_KEY: ${{ secrets.FROSTMOLN_PRODUCTION_DEPLOY_KEY }}
-        # The cluster API is private: the kubeconfig's exec plugin opens an fm
-        # tunnel on demand. fm reads the key from its config file, not the env.
-        run: |
-          fm auth api-key set "$FROSTMOLN_API_KEY" > /dev/null
-          fm kubernetes cluster kubeconfig ${{ vars.FROSTMOLN_PRODUCTION_CLUSTER_ID }} --exec --file "$RUNNER_TEMP/kubeconfig"
-          KUBECONFIG_CONTENT="$(cat "$RUNNER_TEMP/kubeconfig")" deploy prod-frostmoln -n schemas

.pre-commit-config.yaml

@@ -11,7 +11,7 @@ repos:
     - --allow-multiple-documents
   - id: check-added-large-files
 - repo: https://github.com/markdownlint/markdownlint
-  rev: v0.18.1
+  rev: v0.17.0
   hooks:
   - id: markdownlint
 - repo: https://gitlab.com/devopshq/gitlab-ci-linter
@@ -22,13 +22,13 @@ repos:
     - --project
     - unboundsoftware/schemas-app
 - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook
-  rev: v9.27.0
+  rev: v9.26.0
   hooks:
   - id: commitlint
     stages: [ commit-msg ]
     additional_dependencies: [ '@commitlint/config-conventional' ]
 - repo: https://github.com/pre-commit/mirrors-eslint
-  rev: v10.12.0
+  rev: v10.7.0
   hooks:
   - id: eslint
     types: [ file ]

Dockerfile

@@ -12,10 +12,9 @@ RUN npm run postinstall && npm run generate && npm run lint && npm run test:cove
 FROM scratch as export
 COPY --from=builder /build/coverage /
 
-# Unprivileged (uid 101, port 8080): Frostmoln enforces restricted Pod Security.
+FROM amd64/nginx:1.31.3@sha256:1f1cd3af9bef5157e6f3956669aa67b4699ee21e7c6f4d7e749b86a01647ad96
-FROM nginxinc/nginx-unprivileged:1.31.6@sha256:1d26a516fb93b18f9c0214dc9c645054486e516f13ff09ef63d5bd5c622278a2
 MAINTAINER Joakim Olsson <joakim@unbound.se>
 
-COPY --chmod=644 ./nginx/nginx.conf /etc/nginx/nginx.conf
+COPY ./nginx/nginx.conf /etc/nginx/nginx.conf
-COPY --chmod=644 ./nginx/security_headers.conf /etc/nginx/security_headers.conf
+COPY ./nginx/security_headers.conf /etc/nginx/security_headers.conf
 COPY --from=builder /build/.output/public/ /usr/share/nginx/html/

app/components/__tests__/OrganizationSwitcher.spec.ts

@@ -14,23 +14,20 @@ const mockOrganizations = [
 // For now, the component is indirectly tested through useOrganizationSelector tests
 // and manual testing shows it works correctly
 
-// vi.mock is hoisted above the imports and the factory runs once, on the first
-// import of the mocked module -- it was never re-applied per test despite sitting
-// in beforeEach. vitest 5 rejects the nested call outright rather than silently
-// hoisting it, so declare it where it actually executes.
-vi.mock('~/composables/useOrganizationSelector', () => ({
-  useOrganizationSelector: () => ({
-    organizations: ref([mockOrganizations[0]]),
-    selectedOrganization: ref(mockOrganizations[0]),
-    selectedOrgId: ref('1'),
-    selectOrganization: mockSelectOrganization,
-  }),
-}))
-
 describe('OrganizationSwitcher - Single Organization', () => {
   beforeEach(() => {
     vi.resetModules()
     mockSelectOrganization.mockClear()
+
+    // Mock with single organization
+    vi.mock('~/composables/useOrganizationSelector', () => ({
+      useOrganizationSelector: () => ({
+        organizations: ref([mockOrganizations[0]]),
+        selectedOrganization: ref(mockOrganizations[0]),
+        selectedOrgId: ref('1'),
+        selectOrganization: mockSelectOrganization,
+      }),
+    }))
   })
 
   it('should show a chip for single organization', async () => {

k8s/deploy.yaml

@@ -23,11 +23,6 @@ spec:
         app.kubernetes.io/name: schemas-app
         app.kubernetes.io/instance: schemas
     spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 101
-        seccompProfile:
-          type: RuntimeDefault
       affinity:
         podAntiAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
@@ -42,25 +37,21 @@ spec:
               topologyKey: kubernetes.io/hostname
       containers:
       - name: schemas-app
-        image: ${IMAGE}
+        image: oci.unbound.se/unboundsoftware/schemas-app:${COMMIT}
         imagePullPolicy: IfNotPresent
-        securityContext:
-          allowPrivilegeEscalation: false
-          capabilities:
-            drop: ["ALL"]
         ports:
-        - containerPort: 8080
+        - containerPort: 80
         readinessProbe:
           httpGet:
             path: /
-            port: 8080
+            port: 80
           initialDelaySeconds: 5
           periodSeconds: 5
           timeoutSeconds: 5
         livenessProbe:
           httpGet:
             path: /
-            port: 8080
+            port: 80
           initialDelaySeconds: 10
           periodSeconds: 10
           timeoutSeconds: 5
@@ -80,8 +71,9 @@ metadata:
   labels:
     app.kubernetes.io/name: schemas-app
 spec:
+  type: NodePort
   selector:
     app.kubernetes.io/name: schemas-app
   ports:
   - port: 80
-    targetPort: 8080
+    targetPort: 80

k8s/ingress-prod-frostmoln.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: schemas-app
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: "schemas.unbound.se"
-      http:
-        paths:
-          # Everything but /query, which the schemas API's longer path takes.
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: schemas-app
-                port:
-                  number: 80

k8s/ingress-prod.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: schemas-app-ingress
+  annotations:
+    alb.ingress.kubernetes.io/group.name: "default"
+    alb.ingress.kubernetes.io/group.order: "15"
+    alb.ingress.kubernetes.io/scheme: internet-facing
+    alb.ingress.kubernetes.io/target-type: instance
+    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
+    alb.ingress.kubernetes.io/ssl-redirect: "443"
+    alb.ingress.kubernetes.io/healthcheck-path: '/'
+spec:
+  ingressClassName: "alb"
+  rules:
+    - host: "schemas.unbound.se"
+      http:
+        paths:
+          - path: /*
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: schemas-app
+                port:
+                  number: 80

nginx/nginx.conf

@@ -1,20 +1,14 @@
+user  nginx;
 worker_processes  auto;
 
 error_log  /var/log/nginx/error.log notice;
-pid        /tmp/nginx.pid;
+pid        /var/run/nginx.pid;
 
 events {
   worker_connections  1024;
 }
 
 http {
-  # Writable by the unprivileged (uid 101) worker.
-  client_body_temp_path /tmp/client_temp;
-  proxy_temp_path       /tmp/proxy_temp_path;
-  fastcgi_temp_path     /tmp/fastcgi_temp;
-  uwsgi_temp_path       /tmp/uwsgi_temp;
-  scgi_temp_path        /tmp/scgi_temp;
-
   include       /etc/nginx/mime.types;
   default_type  application/octet-stream;
   types {
@@ -28,7 +22,7 @@ http {
   keepalive_timeout  65;
 
   server {
-    listen       8080;
+    listen       80;
     server_name  localhost;
     root         /usr/share/nginx/html;
     index        index.html index.htm;

package.json

@@ -19,12 +19,12 @@
   },
   "dependencies": {
     "@apollo/client": "3.14.1",
-    "@auth0/auth0-vue": "2.11.0",
+    "@auth0/auth0-vue": "2.9.0",
     "@vue/apollo-composable": "4.2.2",
-    "graphql": "16.14.2",
+    "graphql": "17.0.2",
-    "graphql-ws": "6.3.0",
+    "graphql-ws": "6.1.1",
-    "nuxt": "4.6.1",
+    "nuxt": "4.5.0",
-    "vue": "3.5.43",
+    "vue": "3.5.40",
     "vuetify-nuxt-module": "0.19.5"
   },
   "version": "1.0.0",
@@ -34,31 +34,31 @@
   "author": "",
   "license": "ISC",
   "devDependencies": {
-    "@commitlint/cli": "21.2.3",
+    "@commitlint/cli": "21.2.1",
-    "@commitlint/config-conventional": "21.2.3",
+    "@commitlint/config-conventional": "21.2.0",
-    "@graphql-codegen/cli": "7.4.6",
+    "@graphql-codegen/cli": "7.2.0",
-    "@graphql-codegen/typed-document-node": "7.1.1",
+    "@graphql-codegen/typed-document-node": "7.1.0",
-    "@graphql-codegen/typescript": "6.1.2",
+    "@graphql-codegen/typescript": "6.1.0",
-    "@graphql-codegen/typescript-operations": "6.1.10",
+    "@graphql-codegen/typescript-operations": "6.1.1",
     "@graphql-codegen/typescript-vue-apollo": "5.0.1",
-    "@nuxt/devtools": "3.4.2",
+    "@nuxt/devtools": "3.2.4",
-    "@nuxt/eslint": "1.17.0",
+    "@nuxt/eslint": "1.16.0",
     "@nuxtjs/stylelint-module": "5.2.1",
     "@stylistic/eslint-plugin": "5.10.0",
-    "@vitejs/plugin-vue": "6.0.10",
+    "@vitejs/plugin-vue": "6.0.8",
-    "@vitest/coverage-v8": "5.0.3",
+    "@vitest/coverage-v8": "4.1.10",
-    "@vue/test-utils": "2.5.1",
+    "@vue/test-utils": "2.4.11",
-    "eslint": "10.12.0",
+    "eslint": "10.7.0",
     "eslint-plugin-simple-import-sort": "14.0.0",
-    "eslint-plugin-vue": "10.11.1",
+    "eslint-plugin-vue": "10.10.0",
-    "jsdom": "30.1.2",
+    "jsdom": "29.1.1",
-    "postcss-html": "2.0.0",
+    "postcss-html": "1.8.1",
-    "stylelint": "17.16.0",
+    "stylelint": "17.14.1",
-    "stylelint-config-recommended-vue": "2.0.0",
+    "stylelint-config-recommended-vue": "1.6.1",
     "stylelint-config-standard": "40.0.0",
     "typescript": "6.0.3",
-    "typescript-eslint": "8.71.1",
+    "typescript-eslint": "8.65.0",
-    "vitest": "5.0.3",
+    "vitest": "4.1.10",
     "vue-eslint-parser": "10.4.1"
   },
   "overrides": {

test/setup.ts

@@ -31,15 +31,7 @@ class LocalStorageMock {
   }
 }
 
-// jsdom defines localStorage as a getter-only accessor on the window object, so a
+global.localStorage = new LocalStorageMock() as unknown as Storage
-// plain assignment throws ("Cannot set property localStorage ... which has only a
-// getter") under vitest 5, which no longer shadows it with a writable global.
-// defineProperty replaces the accessor outright and works on both.
-Object.defineProperty(globalThis, 'localStorage', {
-  value: new LocalStorageMock() as unknown as Storage,
-  writable: true,
-  configurable: true,
-})
 
 // Make Vue composables globally available
 global.ref = Vue.ref