fix: bump the admin-ui-minor-patch group across 1 directory with 17 updates

.github/dependabot.yml

@@ -10,11 +10,11 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - dependencies
-      - admin-ui
+      - frontend
     groups:
       admin-ui-minor-patch:
         applies-to: version-updates
         update-types: [minor, patch]
       admin-ui-security:
         applies-to: security-updates
-        patterns: ["*"]
+        patterns: ['*']

.pre-commit-config.yaml

@@ -36,7 +36,7 @@ repos:
     hooks:
       - id: yamlfmt
         args: [--mapping, "2", --sequence, "4", --offset, "2"]
-        exclude: ^charts/[^/]+/templates/
+        exclude: ^charts/[^/]+/templates/|pnpm-lock\.yaml$
 
   - repo: https://github.com/crate-ci/typos
     rev: v1.31.1
@@ -108,6 +108,13 @@ repos:
         types: [rust]
         pass_filenames: false
 
+      - id: admin-ui-lockfile
+        name: admin-ui lockfile in sync with package.json (CI frozen install)
+        language: system
+        entry: bash -c 'cd admin-ui && pnpm install --frozen-lockfile --lockfile-only --ignore-scripts'
+        files: ^admin-ui/(package\.json|pnpm-lock\.yaml|pnpm-workspace\.yaml)$
+        pass_filenames: false
+
       - id: admin-ui-format
         name: admin-ui prettier format check
         language: system

AGENTS.md

@@ -283,6 +283,7 @@ bash .github/scripts/nix.sh --variant saml docker --load --test
 | `server.vendor.static.sha256`               | Cargo vendor hash for static builds        |
 | `server.vendor.dynamic.sha256`              | Cargo vendor hash for dynamic builds       |
 | `auth-verifier.<static\|dynamic\|static-saml>.<arch>.<os>.sha256` | Expected binary hash for determinism check |
+| `admin-ui.pnpm.<linux-x86_64\|linux-aarch64\|darwin>.sha256` | pnpm deps hash for the Nix admin-ui build |
 
 When `Cargo.lock` changes, the vendor hashes become stale. Regenerate:
 
@@ -292,6 +293,17 @@ echo "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=" > nix/expected-hashes
 nix-build -A auth-verifier-static 2>&1 | grep "got:"
 ```
 
+When `admin-ui/pnpm-lock.yaml` changes (including Dependabot PRs), the three
+`admin-ui.pnpm.*` hashes become stale. They are always identical (`fetchDeps`
+fetches every platform's packages), so regenerate once and write the value to
+all three files, without a trailing newline:
+
+```bash
+printf 'sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=' > nix/expected-hashes/admin-ui.pnpm.linux-x86_64.sha256
+nix-build -A admin-ui --no-out-link 2>&1 | grep "got:"
+for p in linux-x86_64 linux-aarch64 darwin; do printf '<got hash>' > nix/expected-hashes/admin-ui.pnpm.$p.sha256; done
+```
+
 ---
 
 ## 7. CI overview

CHANGELOG/dependabot_npm_and_yarn_admin-ui_admin-ui-minor-patch-7da9a57db0.md

@@ -0,0 +1,14 @@
+## Bug Fixes
+
+- Restore the `overrides` block (`ws`, `esbuild`, `js-yaml`, `postcss` security pins) that Dependabot dropped from `admin-ui/pnpm-lock.yaml` while bumping the admin-ui minor/patch group, which made every Admin UI CI job fail its frozen install with `ERR_PNPM_LOCKFILE_CONFIG_MISMATCH` and would have unpinned those packages.
+- Regenerate the `admin-ui.pnpm.*` Nix hashes for the updated lockfile, which Dependabot left stale and would have broken the Nix admin-ui build and packaging.
+
+## CI
+
+- Add an `admin-ui-lockfile` pre-commit hook running a frozen, lockfile-only `pnpm install` when admin-ui's `package.json`, `pnpm-lock.yaml` or `pnpm-workspace.yaml` change, and document the check in the admin-ui agent instructions, so a lockfile out of sync with `package.json` is caught before commit instead of failing every Admin UI CI job.
+- Exclude `pnpm-lock.yaml` from the `yamlfmt` pre-commit hook, which rewrote pnpm's long keys into explicit `? :` form that pnpm reverts on every install, and flatten the nested backlog list in the admin-ui agent instructions, on whose indentation markdownlint and prettier disagreed so no commit touching that file could pass both hooks.
+- Label admin-ui Dependabot PRs with the existing `frontend` label instead of `admin-ui`, which does not exist in the repository and made Dependabot post a warning on every PR.
+
+## Docs
+
+- Document how to regenerate the `admin-ui.pnpm.*` Nix hashes after a lockfile change in `AGENTS.md`, the expected-hashes README and the admin-ui agent instructions, since they were missing from all of them and Dependabot lockfile bumps leave them stale.

admin-ui/CLAUDE.md

@@ -14,13 +14,19 @@ pnpm test:integration # vitest --run -c tests/vitest.int.config.ts
 pnpm test:e2e         # playwright test
 ```
 
+**Lockfile**: after touching `package.json`, `pnpm-lock.yaml` or `pnpm-workspace.yaml` (including
+Dependabot PRs), run `pnpm install --frozen-lockfile --lockfile-only --ignore-scripts`. CI installs with
+`--frozen-lockfile`, so a lockfile missing the `overrides:` block fails every admin-ui job with
+`ERR_PNPM_LOCKFILE_CONFIG_MISMATCH`; fix it with `pnpm install --lockfile-only` and commit the lockfile.
+Any lockfile change also requires regenerating `nix/expected-hashes/admin-ui.pnpm.*.sha256` (see root `AGENTS.md` §6).
+
 ## Stack
 
 React 19 · TypeScript 5.8 · Vite 7 · Ant Design 5 · Tailwind CSS 4 · React Router 7 · Vitest 4 · Playwright 1.59 · pnpm
 
 ## Project Structure
 
-```
+```text
 src/
 ├── main.tsx              # Entry: createRoot, StrictMode, BrowserRouter
 ├── App.tsx               # ConfigProvider, providers, routes
@@ -125,10 +131,11 @@ Coverage target: statements ≥80%, branches ≥75%
 
 ## Backlog / Technical Debt
 
-- **Remove remaining `useMemo` calls** — the following files still use `useMemo` for API factory instances and derived lists; replace with plain variable declarations on the next pass:
-    - `src/pages/RealmsPage.tsx` — `const api = useMemo(...)`
-    - `src/pages/AdminsPage.tsx` — `const api = useMemo(...)`
-    - `src/pages/CredentialsPage.tsx` — `const api = useMemo(...)`
-    - `src/pages/SessionsPage.tsx` — `const api = useMemo(...)`
-    - `src/components/realms/RealmFormDrawer.tsx` — `const api = useMemo(...)`
-    - `src/components/layout/Sidebar.tsx` — `const filteredItems = useMemo(...)`
+**Remove remaining `useMemo` calls** — the following files still use `useMemo` for API factory instances and derived lists; replace with plain variable declarations on the next pass:
+
+- `src/pages/RealmsPage.tsx` — `const api = useMemo(...)`
+- `src/pages/AdminsPage.tsx` — `const api = useMemo(...)`
+- `src/pages/CredentialsPage.tsx` — `const api = useMemo(...)`
+- `src/pages/SessionsPage.tsx` — `const api = useMemo(...)`
+- `src/components/realms/RealmFormDrawer.tsx` — `const api = useMemo(...)`
+- `src/components/layout/Sidebar.tsx` — `const filteredItems = useMemo(...)`

admin-ui/package.json

@@ -19,34 +19,34 @@
     },
     "dependencies": {
         "@ant-design/icons": "^6.3.4",
-        "@tailwindcss/vite": "^4.2.2",
-        "antd": "^6.6.3",
+        "@tailwindcss/vite": "^4.3.3",
+        "antd": "^6.6.5",
         "qrcode": "^1.5.4",
-        "react": "^19.2.8",
-        "react-dom": "^19.2.8",
-        "react-router": "^8.3.1",
+        "react": "^19.3.0",
+        "react-dom": "^19.3.0",
+        "react-router": "^8.4.0",
         "tailwindcss": "^4.3.3"
     },
     "devDependencies": {
         "@eslint/js": "^10.0.1",
-        "@playwright/test": "^1.63.0",
+        "@playwright/test": "^1.64.0",
         "@testing-library/jest-dom": "^7.0.1",
         "@testing-library/react": "^16.3.3",
-        "@types/node": "^26.5.1",
+        "@types/node": "^26.6.5",
         "@types/qrcode": "^1.5.6",
-        "@types/react": "^19.2.18",
-        "@types/react-dom": "^19.2.7",
+        "@types/react": "^19.3.0",
+        "@types/react-dom": "^19.3.0",
         "@vitejs/plugin-react-swc": "^4.3.3",
-        "eslint": "^10.10.0",
+        "eslint": "^10.12.0",
         "eslint-plugin-react-hooks": "^7.1.1",
-        "eslint-plugin-react-refresh": "^0.5.6",
-        "globals": "^17.12.0",
-        "jsdom": "^30.0.1",
-        "prettier": "^3.8.1",
+        "eslint-plugin-react-refresh": "^0.5.7",
+        "globals": "^17.13.0",
+        "jsdom": "^30.1.2",
+        "prettier": "^3.9.10",
         "typescript": "~6.0.3",
-        "typescript-eslint": "^8.68.0",
-        "vite": "^8.3.0",
-        "vitest": "^5.0.0"
+        "typescript-eslint": "^8.71.1",
+        "vite": "^8.3.4",
+        "vitest": "^5.0.3"
     },
     "pnpm": {
         "overrides": {