[nadaverell]

Summary

One evidence-backed dependency PR replacing this week's open Dependabot PRs. Every included version was published at least 72 hours before screening, was reviewed against upstream release notes / commit ranges, and was judged by how Radar actually uses the package. Dependency-only: no application source changes.

Screening time: 2026-09-16T10:11:50Z · 72-hour cutoff: 2026-09-13T10:11:50Z

Included

Dependabot PR	Dependency	Old → New	Published (UTC)	Soak	Risk conclusion
#1779	react, react-dom, @types/react, @types/react-dom	19.2.8 / 19.2.18 / 19.2.3 → 19.3.0 (+ scheduler 0.27→0.28)	2026-09-09 17:17–18:08	6.7d	Minor with new opt-in APIs (ViewTransition, Fragment refs, browser()) Radar doesn't use. Behavioral changes reviewed: independent transition rendering (Radar uses useDeferredValue in ResourcesView / log search — full suites pass), Trusted Types integration (Radar sets no Trusted Types CSP), resize batching / form submitter / type=number defaultValue (no affected call sites). No upstream regressions filed against client-only usage since release. Dependabot's PR only bumped react; react-dom must move in lockstep (ensureCorrectIsomorphicReactVersion hard-fails otherwise — that was its CI failure).
#1781	@vitejs/plugin-react	6.1.0 → 6.1.1	2026-08-28	19d	Only change is React Compiler diagnostics logging (compiler.logDiagnostics) + a builder.sharedPlugins sourcemap fix. Radar's Vite config uses react() with no compiler.
#1780	typescript-eslint (+ all @typescript-eslint/*, nested ignore 7.0.6→7.0.9)	8.67.0 → 8.70.0	2026-09-07	8.7d	8.68–8.70: rule fixes + one new rule not in recommended. Before/after npm run lint in web/ is identical: 365 warnings, 0 errors (before = main@77a4a2f5 CI). ignore changes are gitignore-pattern parsing fixes.
#1778	@fontsource-variable/dm-sans	5.2.8 → 5.3.0	2026-07-19	59d	Tarball diff: font files and index.css byte-identical; only adds index.d.css.ts + types export. Visually inert.
#1777	golang.org/x/net (+ x/sync 0.23.0, x/text 0.42.0, x/crypto 0.57.0, x/mod 0.41.0 via MVS)	0.58.0 → 0.59.0	2026-09-08 (all ≤ 2026-09-08)	≥7.6d	Radar imports only x/net/http/httpguts (no commits in range); http2 is used transitively by client-go — changes are Transport/Server deprecation notes, IDNA lookup for non-ASCII hosts, http3/quic fixes. x/sync: semaphore negative-capacity panic (Radar uses only singleflight/errgroup). x/crypto: ssh/acme fixes (unused by Radar). x/mod: sumdb auth-bypass fix. All require go 1.26.0, which Radar already is.
#1775	golang.org/x/term	0.45.0 → 0.46.0	2026-09-08	7.7d	Single commit: Terminal.ReadLine now surfaces a read error after processing the bytes returned with it.
#1774	golang.org/x/oauth2	0.36.0 → 0.37.0	2026-08-25	21d	Single change in google/: GCE metadata path universe/universe_domain → universe/universe-domain. Radar's OIDC code uses the core package only.
#1773	github.com/prometheus/client_model	0.6.2 → 0.6.3	2026-08-31	16d	Only Go-visible change is a comment edit in metrics.proto; rest is repo tooling.
#1709	baseline-browser-mapping (transitive of browserslist)	2.10.38 → 2.11.21	2026-09-03	12.7d	Data-only package; Radar has no browserslist query so it's never consulted. 2.11.0 also fixed CVE-2026-45819. Pinned explicitly — npm update would float to 2.11.24 (2026-09-15, unsoaked).

Excluded / held

• deps(go): bump github.com/modelcontextprotocol/go-sdk from 1.6.1 to 1.8.0 #1776 github.com/modelcontextprotocol/go-sdk 1.6.1 → 1.8.0 — excluded, needs a Radar source change. Its Backend CI fails TestInvestigationHandlerAnnotatesRealToolCallWithoutChangingPublicContract ("private mount handshake did not mark the scope connected"). Root cause: v1.7.0 implements protocol 2026-07-28, which drops the initialize handshake in favor of server/discover; stateless handlers negotiate it, and investigationEvidenceReferenceMiddleware (internal/mcp/server.go) only marks the scope connected on initialize / tools/list. Also worth noting for the follow-up: 1.7 stateless servers ignore Mcp-Session-Id entirely and 1.8 changes the stateful rejection body and cancel-notify semantics. Independently, its GitHub Release was only published 2026-09-14 (<72h) even though the tag is older. Left open.

Graph movement beyond the PR titles

• scheduler 0.27.0 → 0.28.0 — react-dom 19.3.0's pinned dependency, published in the same release (2026-09-09).
• golang.org/x/{sync,text,crypto,mod} — pulled by x/net 0.59.0's go.mod; each reviewed above. Identical to the set Dependabot's deps(go): bump golang.org/x/net from 0.58.0 to 0.59.0 #1777 produced.
• pkg/go.mod (separately-versioned shared module) is untouched: no Dependabot PR targeted it and the root replace means the root build already uses the root versions.

Full resolved-graph diffs (go list -m all, lockfile package list) contain exactly the entries above — no other churn.

Verification

• make tsc ✓
• make test (Go, -v ./...) — 40 packages ok, 0 failed
• web/: vitest 108 files / 1254 tests ✓ · packages/k8s-ui/: 189 files / 3763 tests ✓ (1 pre-existing skip)
• node --test scripts/workload-metrics-demo/capture.test.mjs ✓ · cd pkg && go test ./... ✓
• make build ✓ (frontend + embed + binary)
• go mod verify — all modules verified · git diff --check clean · worktree clean after build
• web/ lint before/after: 365 warnings / 0 errors both sides
• visual-test: skipped — React 19.3's runtime changes are covered by the 5,000+ rendering tests across both suites and the production build; no rendered surface in Radar changes by design (fonts byte-identical, no new components). Happy to run one on request before merge.

Upstream references

• React 19.3.0: https://github.com/facebook/react/releases/tag/v19.3.0
• @vitejs/plugin-react 6.1.1: https://github.com/vitejs/vite-plugin-react/releases/tag/plugin-react%406.1.1
• typescript-eslint: https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.68.0 · v8.69.0 · v8.70.0
• x/net: golang/net@v0.58.0...v0.59.0 · x/term: golang/term@v0.45.0...v0.46.0 · x/oauth2: golang/oauth2@v0.36.0...v0.37.0 · x/crypto: golang/crypto@v0.55.0...v0.57.0 · x/mod: golang/mod@v0.39.0...v0.41.0 · x/sync: golang/sync@v0.22.0...v0.23.0 · x/text: golang/text@v0.41.0...v0.42.0
• client_model: prometheus/client_model@v0.6.2...v0.6.3
• baseline-browser-mapping 2.11.0: https://github.com/web-platform-dx/baseline-browser-mapping/releases/tag/v2.11.0
• go-sdk (excluded): https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.7.0 · https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.8.0

Supersedes #1779, #1781, #1780, #1778, #1777, #1775, #1774, #1773, #1709

---

Note

Low Risk
Lockfile and manifest bumps only; excluded packages like MCP go-sdk were not upgraded, limiting exposure to reviewed minor/patch releases.

Overview
This PR is dependency-only: it updates lockfiles and package.json / go.mod manifests with no application source changes.

Go bumps include golang.org/x/net (0.58→0.59) with related MVS pulls (x/sync, x/text, x/crypto, x/mod), plus x/oauth2, x/term, and prometheus/client_model.

Frontend moves react / react-dom and matching @types/* to 19.3.0 (with scheduler 0.28 via react-dom) in both web/ and packages/k8s-ui. Dev tooling updates cover typescript-eslint 8.67→8.70, @vitejs/plugin-react 6.1.1, and @fontsource-variable/dm-sans 5.3.0. The root package-lock.json also refreshes transitive entries such as baseline-browser-mapping.

^{Reviewed by Cursor Bugbot for commit 1e036fe. Bugbot is set up for automated code reviews on this repo. Configure here.}

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Batch soaked React 19.3 and Go dependency updates

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Bumps React runtime and types to 19.3 across both frontend workspaces.
• Refreshes Vite, linting, and font dependencies with screened releases.
• Advances selected Go modules and records resulting dependency graph checksums.

Diagram

graph TD
  MANIFESTS["Version manifests"] --> WEB["Radar web"] --> REACT["React 19.3"]
  MANIFESTS --> KUI["K8s UI"] --> REACT
  MANIFESTS --> BACKEND["Go backend"] --> GODEPS["Go modules"]

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Keep separate Dependabot PRs

• ➕ Provides smaller, independently revertible changes
• ➕ Simplifies regression attribution to one dependency family
• ➖ Cannot safely update React without coordinating react-dom and scheduler
• ➖ Repeats CI and review work across closely related updates
• ➖ Makes transitive Go graph movement harder to assess holistically

2. Merge updates immediately

• ➕ Reduces dependency lag
• ➕ Minimizes manual release screening effort
• ➖ Admits unsoaked releases and newly introduced regressions
• ➖ May float transitive packages beyond reviewed versions
• ➖ Provides less evidence for behavioral compatibility

Recommendation: Retain the screened batch approach. It coordinates React packages that must move together, captures Go MVS changes as one reviewed graph, and avoids unsoaked releases while preserving the incompatible MCP SDK upgrade for a source-aware follow-up.

Files changed (4) +34 / -34

Other (4) +34 / -34

go.modAdvance selected Go dependencies +7/-7

Advance selected Go dependencies

• Bumps Prometheus client models and selected golang.org/x modules. It also records MVS-driven synchronization of text and crypto dependencies while retaining the MCP SDK at 1.6.1.

go.mod

go.sumRefresh Go module checksums +16/-16

Refresh Go module checksums

• Replaces checksums for the updated direct and transitive Go modules, including x/crypto, x/mod, x/net, x/oauth2, x/sync, x/term, and x/text.

go.sum

package.jsonAlign K8s UI with React 19.3 +4/-4

Align K8s UI with React 19.3

• Updates React, React DOM, and their TypeScript definitions to 19.3 for the shared UI workspace's development and test environment.

packages/k8s-ui/package.json

package.jsonUpgrade web runtime and tooling dependencies +7/-7

Upgrade web runtime and tooling dependencies

• Moves React and its type definitions to 19.3 in lockstep. It also upgrades the DM Sans font package, Vite React plugin, and typescript-eslint release line.

web/package.json

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can group findings by type and pick your Finding display, from Minimal to Full

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗