chore(deps): modernize the web runtime stack for 1.0

Takes every available major on the webapp's runtime surface — ai 7,
@ai-sdk/react 4, TanStack Table 9, Motion 13, GraphQL 17 — plus the
current React, TanStack Query/Router, Sentry and PostHog releases.

web-vitals is removed rather than bumped: reportWebVitals() was called
with no callback, so the library was never loaded. PostHog wraps the
same Chrome library, so Core Web Vitals now flow through the provider
that is already consent-gated.

Deprecated APIs the upgrades surfaced are migrated rather than
suppressed: ensureQueryData/fetchQuery to queryClient.query, and
Sentry's sendDefaultPii to an exhaustive dataCollection map that tsc
holds complete.

Refs #1584

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/core-web-vitals-reach-analytics.md

@@ -0,0 +1,9 @@
+---
+"hephaestus": minor
+---
+
+Instances that run PostHog now receive Core Web Vitals — largest contentful paint, cumulative layout
+shift, first contentful paint and interaction to next paint — for the web application, so a slow
+page is visible in analytics rather than only in a complaint. The application never measured them
+before. Nothing is captured without the analytics consent that already gates every other event, and
+network request timing stays off.

.changeset/current-web-runtime.md

@@ -0,0 +1,7 @@
+---
+"hephaestus": patch
+---
+
+Updates the frameworks the web application is built from. Error reports still infer nothing about
+who reported them, and now say category by category what they may carry. No action is needed to
+upgrade.

.changeset/sorted-columns-say-so.md

@@ -0,0 +1,9 @@
+---
+"hephaestus": patch
+---
+
+The sortable columns in the workspace members and achievements admin tables now say which column is
+sorted and in which direction — the arrow points, and a screen reader announces it. Both showed the
+same static icon whatever the sort was. Their "Columns" menus no longer offer the column of row
+actions, which was never meaningful to hide, and while a search is active both tables now count
+"Showing 5 of 12" against the rows that matched rather than against every row.

bun.lock

@@ -25,8 +25,8 @@
 		"@mermaid-js/layout-elk": "0.2.1",
 		"clsx": "2.1.1",
 		"prism-react-renderer": "2.4.1",
-		"react": "19.2.6",
-		"react-dom": "19.2.6",
+		"react": "19.2.8",
+		"react-dom": "19.2.8",
 		"@docusaurus/plugin-content-docs": "3.10.1",
 		"@docusaurus/plugin-content-pages": "3.10.1",
 		"@docusaurus/plugin-css-cascade-layers": "3.10.1",
@@ -38,8 +38,8 @@
 	"devDependencies": {
 		"@docusaurus/module-type-aliases": "3.10.1",
 		"@docusaurus/types": "3.10.1",
-		"@types/react": "19.2.14",
-		"@types/react-dom": "19.2.3",
+		"@types/react": "19.2.18",
+		"@types/react-dom": "19.2.5",
 		"markdownlint-cli2": "0.22.1",
 		"raw-loader": "4.0.2",
 		"typescript": "7.0.2"

docs/package.json

@@ -122,7 +122,7 @@
 		"commander": "14.0.3",
 		"fast-xml-parser": "^5.11.0",
 		"fast-xml-validator": "1.4.2",
-		"graphql": "16.14.0",
+		"graphql": "17.0.2",
 		"husky": "9.1.7",
 		"jsdom": "29.1.1",
 		"jsonc-parser": "3.3.1",
@@ -154,8 +154,7 @@
 		"lodash": "4.18.1",
 		"lodash-es": "4.18.1",
 		"serialize-javascript": "7.0.5",
-		"js-yaml": "4.3.1",
-		"@opentelemetry/core": "2.8.0"
+		"js-yaml": "4.3.1"
 	},
 	"trustedDependencies": [
 		"@swc/core",

package.json

@@ -81,6 +81,36 @@ if (!isRecord(packages)) throw new Error("bun.lock must contain packages");
 const packageValues = Object.values(packages).filter((value): value is unknown[] =>
 	Array.isArray(value),
 );
+/**
+ * `bunfig.toml#publicHoistPattern` lifts a package to the root `node_modules` so the whole repo
+ * shares one copy. For React and its types a second copy is two incompatible `JSX.Element`s, which
+ * surfaces as a type error deep inside an unrelated library. Hoisting can only lift one, so the
+ * lockfile resolving two is the moment that guarantee is gone — and nothing else notices.
+ */
+const bunfig: unknown = Bun.TOML.parse(readFileSync("bunfig.toml", "utf8"));
+const publicHoistPattern =
+	isRecord(bunfig) && isRecord(bunfig.install) ? bunfig.install.publicHoistPattern : undefined;
+if (!Array.isArray(publicHoistPattern) || publicHoistPattern.length === 0) {
+	throw new Error("bunfig.toml must declare install.publicHoistPattern");
+}
+for (const pattern of publicHoistPattern) {
+	// A glob cannot be matched against a resolution prefix, so it is left to Bun.
+	if (typeof pattern !== "string" || /[*?[\]]/.test(pattern)) continue;
+	const resolutions = new Set(
+		packageValues
+			.map(([resolution]) => resolution)
+			.filter((resolution): resolution is string => typeof resolution === "string")
+			.filter((resolution) => resolution.startsWith(`${pattern}@`)),
+	);
+	if (resolutions.size === 0)
+		throw new Error(`Publicly hoisted ${pattern} matches no lockfile package`);
+	if (resolutions.size > 1) {
+		throw new Error(
+			`Publicly hoisted ${pattern} resolves to ${resolutions.size} versions, so the workspaces cannot share one copy: ${[...resolutions].join(", ")}`,
+		);
+	}
+}
+
 for (const [dependency, expected] of overrideEntries) {
 	const resolutions = packageValues
 		.map(([resolution]) => resolution)

scripts/check-package-manager.ts

@@ -32768,7 +32768,7 @@ type Group implements GroupInterface & Todoable {
     sort: ComplianceViolationSort = SEVERITY_LEVEL_DESC
 
     """Filters applied when retrieving compliance violations."""
-    filters: ComplianceViolationInput = {}
+    filters: ComplianceViolationInput = {  }
 
     """Returns the elements in the list that come after the specified cursor."""
     after: String
@@ -33237,7 +33237,7 @@ type Group implements GroupInterface & Todoable {
   """
   projectComplianceRequirementsStatus(
     """Filters applied when retrieving compliance requirement statuses."""
-    filters: GroupProjectRequirementComplianceStatusInput = {}
+    filters: GroupProjectRequirementComplianceStatusInput = {  }
 
     """Field used to sort compliance requirement statuses."""
     orderBy: ProjectComplianceRequirementStatusOrderBy
@@ -33262,7 +33262,7 @@ type Group implements GroupInterface & Todoable {
   """
   projectComplianceStandardsAdherence(
     """Filters applied when retrieving compliance standards adherence."""
-    filters: ComplianceStandardsAdherenceInput = {}
+    filters: ComplianceStandardsAdherenceInput = {  }
 
     """Returns the elements in the list that come after the specified cursor."""
     after: String
@@ -33284,7 +33284,7 @@ type Group implements GroupInterface & Todoable {
   """
   projectComplianceViolations(
     """Filters applied when retrieving compliance violations."""
-    filters: ProjectComplianceViolationFilterInput = {}
+    filters: ProjectComplianceViolationFilterInput = {  }
 
     """Returns the elements in the list that come after the specified cursor."""
     after: String
@@ -60592,7 +60592,7 @@ type Project implements ProjectInterface & Todoable {
     """
     Filters applied when retrieving compliance control statuses for the project.
     """
-    filters: ProjectComplianceControlStatusInput = {}
+    filters: ProjectComplianceControlStatusInput = {  }
 
     """Returns the elements in the list that come after the specified cursor."""
     after: String
@@ -60634,7 +60634,7 @@ type Project implements ProjectInterface & Todoable {
   """
   complianceRequirementStatuses(
     """Filters applied when retrieving compliance requirement statuses."""
-    filters: ProjectRequirementComplianceStatusInput = {}
+    filters: ProjectRequirementComplianceStatusInput = {  }
 
     """Field used to sort compliance requirement statuses."""
     orderBy: ProjectComplianceRequirementStatusOrderBy
@@ -60657,7 +60657,7 @@ type Project implements ProjectInterface & Todoable {
   """Compliance standards adherence for the project."""
   complianceStandardsAdherence(
     """Filters applied when retrieving compliance standards adherence."""
-    filters: ComplianceStandardsProjectAdherenceInput = {}
+    filters: ComplianceStandardsProjectAdherenceInput = {  }
 
     """Returns the elements in the list that come after the specified cursor."""
     after: String
@@ -62146,7 +62146,7 @@ type Project implements ProjectInterface & Todoable {
     sort: ComplianceViolationSort = SEVERITY_LEVEL_DESC
 
     """Filters applied when retrieving compliance violations."""
-    filters: ComplianceViolationProjectInput = {}
+    filters: ComplianceViolationProjectInput = {  }
 
     """Returns the elements in the list that come after the specified cursor."""
     after: String

server/generated-clients/src/main/resources/graphql/gitlab/schema.gitlab.graphql

@@ -39,7 +39,6 @@ const config: StorybookConfig = {
 			"ai",
 			"posthog-js/react",
 			"uuid",
-			"web-vitals",
 		];
 		return viteConfig;
 	},

webapp/.storybook/main.ts

@@ -181,12 +181,14 @@ suppressed at the call site with their reason.
 `forwardRef` are not imports you may take from `react` — the import line says so and why.
 
 **A `useMemo` that survives is load-bearing, and deleting it breaks something that still type-checks.**
-There are only two shapes that earn the suppression, and each names its own on the line above the
+There are only three shapes that earn the suppression, and each names its own on the line above the
 import: the value is a **dependency of an effect**, so its identity is what decides whether the effect
-re-runs; or the component is **opted out of the compiler** by a library it uses, so nothing memoises
-for it. `useReactTable` is the second case — `react/incompatible-library` names the same fact — and
-TanStack Table rebuilds its column model, and every row model downstream, whenever `columns` changes
-identity. Anything else is the memo the compiler exists to remove.
+re-runs; the component is **opted out of the compiler** by a library it uses, so nothing memoises for
+it — `react/incompatible-library` names that case where it can; or a **library keys a cache on the
+value's identity**, which the compiler memoises as an optimisation rather than promises. TanStack
+Table is the third: `useTable` compares `options.columns` and `options.data` with `!==` and rebuilds
+the column model, and every row model downstream, when either changes — so a table here memoises
+them by hand. Anything else is the memo the compiler exists to remove.
 
 ## The time of day
 
@@ -232,7 +234,7 @@ a routing table on the front page; its `RUBRIC.md` is the grading instrument for
 ## Routing
 
 Declare routes with `createFileRoute`. Keep loaders side-effect free and prefer
-`context.queryClient.ensureQueryData(...)` with the generated options. Put shared data (query client,
+`context.queryClient.query(...)` with the generated options. Put shared data (query client,
 auth) on the router context. Never hand-edit `routeTree.gen.ts` — there is no `tsr` CLI here; the
 TanStack Router Vite plugin regenerates it when the dev server runs.