Drop the global ajv override that forced ESLint onto an incompatible major, then move @mosaic/config lint tooling deps to devDependencies so production audit stays clean without impacting runtime deps.
Apply RLS context at task service boundaries, harden orchestrator/web integration and session startup behavior, re-enable targeted frontend tests, and lock vulnerable transitive dependencies so QA and security gates pass cleanly.
Better Auth generates nanoid-style IDs by default, but our Prisma
schema uses @db.Uuid columns for all auth tables. This caused
P2023 errors when Better Auth tried to insert non-UUID IDs into
the verification table during OAuth sign-in.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
The Swarm deployment uses docker-compose.swarm.portainer.yml, not the
root docker-compose.yml. Add NEXT_PUBLIC_APP_URL, NEXT_PUBLIC_API_URL,
and TRUSTED_ORIGINS to the API service environment. Also log trusted
origins at startup for easier CORS debugging.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Remove Docker Compose profiles from postgres and valkey services so they
start by default without --profile flag. Add NEXT_PUBLIC_APP_URL,
NEXT_PUBLIC_API_URL, and TRUSTED_ORIGINS to the API service environment
so CORS works in production.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
- Combine production stage RUN commands into single layers
(each RUN triggers a full Kaniko filesystem snapshot)
- Remove BuildKit --mount=type=cache for pnpm store
(Kaniko builds are ephemeral in CI, cache is never reused)
- Remove syntax=docker/dockerfile:1 directive (no longer needed
without BuildKit cache mounts)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Kaniko fundamentally cannot run apt-get update on bookworm (Debian 12)
due to GPG signature verification failures during filesystem snapshots.
Neither --snapshot-mode=redo nor clearing /var/lib/apt/lists/* resolves
this.
Changes:
- Replace apt-get install dumb-init with ADD from GitHub releases
(static x86_64 binary) in api, web, and orchestrator Dockerfiles
- Switch coordinator builder from python:3.11-slim to python:3.11
(full image includes build tools, avoids 336MB build-essential)
- Replace wget healthcheck with node-based check in orchestrator
(wget no longer installed)
- Exclude telemetry lifecycle integration tests in CI (fail due to
runner disk pressure on PostgreSQL, not code issues)
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Kaniko's default full-filesystem snapshots corrupt GPG verification
state, causing "invalid signature" errors during apt-get update on
Debian bookworm (node:24-slim). Using --snapshot-mode=redo avoids
this by recalculating layer diffs instead of taking full snapshots.
Also keeps the rm -rf /var/lib/apt/lists/* guard in Dockerfiles as
a defense-in-depth measure against stale base-image APT metadata.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Kaniko's layer extraction can leave base-image APT metadata with
expired GPG signatures, causing "invalid signature" failures during
apt-get update in CI builds. Adding rm -rf /var/lib/apt/lists/*
before apt-get update ensures a clean state.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
Next.js 16 requires useSearchParams() to be inside a <Suspense> boundary
for static prerendering. Extracted LoginPageContent inner component and
wrapped it in Suspense with a loading fallback that matches the existing
loading spinner UI.
Co-Authored-By: Claude Opus 4.6 <[email protected]>
jason.woltje
Jason Woltje