Merge remote-tracking branch 'origin/main' into app-deployment-delta-adjustments

Author: n1ru4l

.changeset/bright-buses-say.md

@@ -0,0 +1,6 @@
+---
+'hive': patch
+---
+
+Update [`nodemailer`](https://github.com/nodemailer/nodemailer) to address vulnerability
+[GHSA-vvjj-xcjg-gr5g](https://github.com/advisories/GHSA-vvjj-xcjg-gr5g).

.changeset/deep-lies-happen.md

@@ -0,0 +1,13 @@
+---
+'hive': patch
+---
+
+Fix schema contract composition applying `@inaccessible` on the federation types `ContextArgument` and `FieldValue` on the supergraph SDL.
+
+This mitigates the following error in apollo-router upon processing the supergraph:
+
+```
+could not create router: Api error(s): The supergraph schema failed to produce a valid API schema: The following errors occurred:
+  - Core feature type `join__ContextArgument` cannot use @inaccessible.
+  - Core feature type `join__FieldValue` cannot use @inaccessible.
+```

.changeset/fine-pens-lead.md

@@ -0,0 +1,6 @@
+---
+'hive': patch
+---
+
+Update [`opentelemetry-go`](https://github.com/open-telemetry/opentelemetry-go) to address vulnerability
+[CVE-2026-39883](https://github.com/advisories/GHSA-hfvc-g4fc-pqhx).

.changeset/late-kiwis-dig.md

@@ -46,6 +46,7 @@ module.exports = {
     'rules',
     'out',
     '.hive',
+    'packages/web/app/.ladle/**',
     'public',
     'packages/web/app/src/graphql/index.ts',
     'packages/libraries/cli/src/sdk.ts',
@@ -54,6 +55,8 @@ module.exports = {
     'packages/web/app/src/gql/**/*',
     'codegen.cjs',
     'tsup',
+    'packages/libraries/render-laboratory/src/laboratory.ts',
+    'packages/web/app/vite.config.ts',
   ],
   overrides: [
     {
@@ -65,6 +68,10 @@ module.exports = {
         schema: SCHEMA_PATH,
         operations: OPERATIONS_PATHS,
       },
+      rules: {
+        '@graphql-eslint/no-deprecated': 'error',
+        '@graphql-eslint/require-id-when-available': 'error',
+      },
     },
     {
       // Setup processor for operations/fragments definitions on code-files
@@ -75,8 +82,8 @@ module.exports = {
       files: ['packages/web/app/**/*.graphql'],
       plugins: ['@graphql-eslint'],
       rules: {
-        '@graphql-eslint/require-id-when-available': 'error',
         '@graphql-eslint/no-deprecated': 'error',
+        '@graphql-eslint/require-id-when-available': 'error',
       },
     },
     {
@@ -108,6 +115,8 @@ module.exports = {
               'packages/migrations/**',
               // We bundle it all anyway, so there are no node_modules
               'packages/web/app/**',
+              // We bundle it all anyway, so there are no node_modules
+              'packages/libraries/laboratory/**',
               '**/*.spec.ts',
               '**/*.test.ts',
               '**/*.e2e.ts',
@@ -141,6 +150,16 @@ module.exports = {
         '@typescript-eslint/no-empty-function': 'off',
         '@typescript-eslint/ban-types': 'off',
         '@typescript-eslint/triple-slash-reference': 'off',
+        '@typescript-eslint/no-unused-vars': [
+          'error',
+          {
+            argsIgnorePattern: '^_',
+            caughtErrors: 'none',
+            caughtErrorsIgnorePattern: '^_',
+            destructuredArrayIgnorePattern: '^_',
+            varsIgnorePattern: '^_',
+          },
+        ],
       },
     },
     {
@@ -161,7 +180,7 @@ module.exports = {
       rules: {
         // conflicts with official prettier-plugin-tailwindcss and tailwind v3
         'better-tailwindcss/enforce-consistent-class-order': 'off',
-        'better-tailwindcss/enforce-canonical-classes': 'warn',
+        'better-tailwindcss/enforce-canonical-classes': 'off',
         // keeping classes in one line helps prettier-plugin-tailwindcss
         // enable wrapping in text editors to make classes human readable
         'better-tailwindcss/enforce-consistent-line-wrapping': 'off',
@@ -214,10 +233,6 @@ module.exports = {
           {
             ignore: [
               'drag-none',
-              // Tailwind v4 semantic colors from @theme in index.css
-              // Regex patterns to match all utility variants (bg-*, text-*, border-*, etc.)
-              // Includes optional opacity modifier (/40, /60, etc.)
-              '(bg|text|border|ring|outline|shadow|from|via|to|fill|stroke|caret|accent|divide|placeholder)-(background|foreground|card|card-foreground|popover|popover-foreground|primary|primary-foreground|secondary|secondary-foreground|muted|muted-foreground|accent|accent-foreground|destructive|destructive-foreground|border|input|ring|sidebar|sidebar-background|sidebar-foreground|sidebar-primary|sidebar-primary-foreground|sidebar-accent|sidebar-accent-foreground|sidebar-border|sidebar-ring|chart-1|chart-2)(/.*)?',
               // Animation utilities (from index.css, replaces tailwindcss-animate)
               'animate-in',
               'animate-out',

.changeset/slimy-trams-search.md

@@ -25,13 +25,15 @@ runs:
     - name: check pnpm version
       shell: bash
       id: pnpm
+      env:
+        INSTALL_DEPENDENCIES: ${{ inputs.installDependencies }}
       run: |
         PNPM_VERSION=$(cat package.json | jq -r '.packageManager' | awk -F@ '{print $2}')
         PNPM_VERSION=${PNPM_VERSION:-9}
         echo "Using PNPM version $PNPM_VERSION"
         echo "version=$PNPM_VERSION" >> $GITHUB_OUTPUT
 
-        if [ ${{ inputs.installDependencies }} = true ]; then
+        if [ $INSTALL_DEPENDENCIES = true ]; then
           echo "cache=pnpm" >> $GITHUB_OUTPUT
         else
           echo "cache=" >> $GITHUB_OUTPUT
@@ -54,6 +56,12 @@ runs:
       working-directory: ${{ inputs.workingDirectory }}
       run: pnpm install --frozen-lockfile
 
+    - name: build laboratory
+      shell: bash
+      if: ${{ inputs.buildLaboratory == 'true' }}
+      working-directory: ${{ inputs.workingDirectory }}
+      run: pnpm turbo build --filter=./packages/libraries/laboratory --color
+
     - name: generate graphql types
       if: ${{ inputs.codegen == 'true' }}
       shell: bash

.changeset/stale-cooks-talk.md

@@ -220,13 +220,18 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'publish docker multiarch manifest (tag: ${{ inputs.imageTag }})'
+        env:
+          TARGETS: ${{ inputs.targets }}
+          REGISTRY: ${{ inputs.registry }}
+          IMAGE_NAME: ${{ inputs.imageName }}
+          IMAGE_TAG: ${{ inputs.imageTag }}
         run: |
-          targets=$(docker buildx bake -f docker/docker.hcl --print "${{ inputs.targets }}" | jq -r '.group."${{ inputs.targets }}".targets[]')
+          targets=$(docker buildx bake -f docker/docker.hcl --print "$TARGETS" | jq -r '.group."'"$TARGETS"'".targets[]')
 
           for target in $targets
           do
               echo "publishing multi-arch manifest for $target"
-              image_name="${{ inputs.registry }}/${{ inputs.imageName }}/$target:${{ inputs.imageTag }}"
+              image_name="$REGISTRY/$IMAGE_NAME/$target:$IMAGE_TAG"
               echo "image name: $image_name"
 
               docker manifest create $image_name --amend "$image_name-arm64" --amend "$image_name-amd64"
@@ -235,13 +240,17 @@ jobs:
 
       - name: 'publish docker multiarch manifest (tag: latest)'
         if: ${{ inputs.publishLatest }}
+        env:
+          TARGETS: ${{ inputs.targets }}
+          REGISTRY: ${{ inputs.registry }}
+          IMAGE_NAME: ${{ inputs.imageName }}
         run: |
-          targets=$(docker buildx bake -f docker/docker.hcl --print "${{ inputs.targets }}" | jq -r '.group."${{ inputs.targets }}".targets[]')
+          targets=$(docker buildx bake -f docker/docker.hcl --print "$TARGETS" | jq -r '.group."'"$TARGETS"'".targets[]')
 
           for target in $targets
           do
               echo "publishing multi-arch manifest for $target"
-              image_name="${{ inputs.registry }}/${{ inputs.imageName }}/$target:latest"
+              image_name="$REGISTRY/$IMAGE_NAME/$target:latest"
               echo "image name: $image_name"
 
               docker manifest create $image_name --amend "$image_name-arm64" --amend "$image_name-amd64"

.eslintrc.cjs

@@ -74,16 +74,6 @@ jobs:
   typescript:
     uses: ./.github/workflows/typescript-typecheck.yaml
 
-  # Deploy Website to CloudFlare Pages
-  website:
-    uses: ./.github/workflows/website.yaml
-    secrets: inherit
-
-  # Deploy Storybook to CloudFlare Pages
-  storybook:
-    uses: ./.github/workflows/storybook.yaml
-    secrets: inherit
-
   # GraphQL Schema Publish
   graphql-schema:
     uses: ./.github/workflows/graphql-schema-publish.yaml