The billions branch of formatLongNumber divided by 1000000 while
appending the 'b' suffix, so values >= 1e9 rendered about 1000x too
large (1000000000 became '1000.0b' instead of '1.0b'). Divide by
1000000000 to match the 'b' unit, consistent with the sibling
formatLongCurrency. Add regression tests for the billions branch.
The runner stage ships the npm CLI bundled in node:22-alpine, whose
vendored dependencies carry known vulnerabilities that trivy flags on the
published postgresql-latest image:
usr/local/lib/node_modules/npm/node_modules/...
- sigstore 3.1.0 CVE-2026-48815 (HIGH)
- picomatch 4.0.3 CVE-2026-33671 (HIGH)
- @sigstore/core 2.0.0 CVE-2026-48758
- brace-expansion 2.0.2 CVE-2026-33750
- ip-address 10.1.0 CVE-2026-42338
- tar 7.5.11 CVE-2026-53655
npm is only a build-time bootstrap for pnpm; it is not needed at runtime.
Install pnpm with it, then remove npm in the same layer so none of these
vendored packages are present in the final image, and run the container
via pnpm instead of npm. pnpm (and corepack) remain and were never flagged.
The curl/libcurl/c-ares HIGH findings are resolved by rebuilding alone,
since Alpine 3.24 already serves curl 8.21.0-r0 / c-ares 1.34.8-r0 (the
published image is simply stale).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Several keys present in en-US were missing from ru-RU, so the UI showed
raw keys (e.g. label.heatmaps) on the Russian locale. Adds translations
for the missing label.* and message.* keys, including heatmap, replay
recorder, board, LLM, and upgrade/plan strings.
When SASL credentials are present, getClient() connected with
`rejectUnauthorized: false`, so the SASL password was sent over a TLS
connection whose broker certificate was never verified — a MITM could
present any certificate and capture the credentials.
Verify by default; set KAFKA_SSL_ALLOW_UNAUTHORIZED=true to opt out for
self-signed brokers.
- SessionModal: merge caller-provided className with styles.modal instead
of letting it be clobbered by the {...props} spread (matches ReplayModal).
- e2e test: narrow boundingBox()/viewport nullability without non-null
assertions (keeps biome's noNonNullAssertion happy) via a getSheetBox
helper and a shared VIEWPORT constant.
SessionModal and SessionProfileModal set their 1320px max width on an
inner Column rather than on the Modal itself. The react-zen Modal box
(placement="bottom") therefore stretched to the full viewport width
(inset-x-0), so its transparent left/right margins sat on top of the
underlay and swallowed outside-clicks. Only the thin offset strip above
the sheet was dismissable.
Move the width onto the Modal box via a CSS module — matching the
existing pattern in ReplayModal — so the click-catcher is the centered
~1320px sheet and the side margins become real overlay again.
Adds an e2e regression test covering left/right margin dismissal with an
in-sheet control click.
Mike Cao