release: promote beta to main

[steilerDev]

Release Summary

Promotes beta (v2.15.0-beta.6) to main as v2.15.0: two user-facing features — the Invoices "Show only open items" view with nested open deposits, and scroll-driven batch loading on the Diary page replacing the broken numbered pager — plus a full dependency-security sweep (prod, dev, GitHub Actions, and 15 orphan advisory remediations).

Changes

Features

• Invoices — "Show only open items" view (Invoices: 'Show only open items' view with open deposits as child rows #2046): toggle on /budget/invoices showing pending invoices and invoices with pending deposits, with the pending deposits nested as expandable child rows. Adds server-side openOnly filtering with earliest-open-due default ordering, a per-invoice openAmount, and openPayable/refundsDue header totals — all derived from one shared aggregate so row and header figures always agree. Extends the shared DataTable with an opt-in, backward-compatible expandable-child-row capability.
• Diary — infinite scroll (Diary: replace the broken numbered pager with scroll-driven batch loading #2060): replaces the numbered pager with scroll-driven batch loading via a new reusable useInfiniteScroll hook and InfiniteScrollFooter component, both registered in CLAUDE.md's Component Reuse Policy. Fixes the pager's root cause (a debounced search-sync effect resetting page=1 on every searchParams identity change).

Fixes

• Invoice status badges rendered colorless — a wrong CSS module reference (fixed as part of Invoices: 'Show only open items' view with open deposits as child rows #2046).
• Invoices E2E toggle flake and desktop/mobile testid collisions (Invoices: 'Show only open items' view with open deposits as child rows #2046 follow-up): a real dual-mount bug where three badges rendered into both the desktop table and mobile card DOM with identical data-testids, now disambiguated via ColumnDef.renderCard overrides with -mobile- suffixes. Plus a Playwright/React timing race in setOpenItemsOnly() and two E2E test-instrument bugs.
• Diary infinite-scroll races fixed during review (BUG-2060-1: useInfiniteScroll drops fresh page-1 fetch and leaks stale data on resetKey race #2061, BUG-2060-2: DiaryPage initial-load a11y announcement is hardcoded English (not i18n) #2062): stale in-flight fetches on filter/search reset (epoch guard), a hardcoded i18n announcement string, and a stale page URL param on search.

Chores / Dependencies

• Orphan SSRF/DoS advisory remediation: 15 orphan Dependabot alerts closed via root package.json overrides (fast-uri, js-yaml, ip-address, and the npm CLI's bundled undici/ip-address).
• prod-dependencies group: 13 updates (security + changelog reviewed by security-engineer).
• dev-dependencies group: 20 updates plus a later 3-update bump, including Jest 30.5.1 (jest.fn<any>() typing migration), a fontkit type-guard fix, and a real SearchPicker assertion-ordering race fix.
• github-actions group: 4 updates across two bumps (github/codeql-action/upload-sarif -> 4.37.9, actions/deploy-pages -> 5.0.1); all remain SHA-pinned.
• German translations added for all new keys, with verified key parity.

Change Inventory

Backend (server/, shared/)

• server/src/services/invoiceService.ts — openOnly filtering, ordering, openAmount, summary totals
• server/src/services/shared/depositAggregateUtils.ts (new) — shared open-amount aggregate
• server/src/routes/standaloneInvoices.ts — openOnly query param
• server/src/app.ts — minor
• shared/src/types/invoice.ts — openAmount, openPayable, refundsDue types
• Tests: invoiceService.openItems.test.ts, depositAggregateUtils.openAmounts.test.ts, invoiceService.test.ts, standaloneInvoices.test.ts

Frontend (client/)

• Invoices: InvoicesPage.tsx, InvoicesPage.module.css, openItemsUtils.ts (new), lib/invoicesApi.ts
• Diary: DiaryPage.tsx, DiaryPage.module.css
• Shared components: DataTable/ (DataTable.tsx, DataTableCard.tsx, DataTableHeader.tsx, DataTableRow.tsx, DataTable.module.css), InfiniteScrollFooter/ (new), Badge/Badge.module.css
• Hooks: useInfiniteScroll.ts (new), useTableState.ts
• i18n: en/budget.json, de/budget.json, en/diary.json, de/diary.json
• Tests: 10 new/modified test files including DataTable.expandableRows.test.tsx, InvoicesPage.openItems.test.tsx, openItemsUtils.test.ts, useInfiniteScroll.test.tsx, InfiniteScrollFooter.test.tsx, DiaryPage.test.tsx

E2E Tests (e2e/)

• e2e/tests/invoices/invoices-open-items.spec.ts (new, 20 scenarios)
• e2e/tests/diary/diary-list.spec.ts — rewritten for infinite scroll
• e2e/pages/InvoicesPage.ts, e2e/pages/DiaryPage.ts — page objects
• e2e/tests/invoices/invoices.spec.ts, e2e/tests/navigation/dashboard.spec.ts

Docs / Config

• package.json, package-lock.json, client/package.json, server/package.json, e2e/package.json — dependency bumps and security overrides
• jest.config.ts — corrected diagnosis comment (ceiling stays 60000, see below)
• scripts/ci-wait.sh — timeout defaults raised to 2400s beta / 3600s main
• .github/workflows/ci.yml, .github/workflows/release.yml
• CLAUDE.md — Component Reuse Policy entries for InfiniteScrollFooter / useInfiniteScroll
• .claude/agent-memory/**, .claude/checklists/implementation-checklist.md
• wiki submodule pointer

Manual Validation Checklist

• Invoices — open items toggle: go to /budget/invoices, enable "Show only open items". Confirm the list narrows to pending invoices plus invoices that have pending deposits, and that invoices with pending deposits show an expander revealing those deposits as child rows.
• Invoices — figures agree: with the toggle on, confirm the header's "open payable" / "refunds due" totals match the sum of the per-row open amounts, and that default ordering is by earliest open due date.
• Invoices — mobile: repeat on a narrow viewport; confirm the card layout shows the same badges and child rows without duplication.
• Invoices — status badge colors: confirm invoice status badges render with color (this was previously broken).
• Diary — infinite scroll (UAT-1..7, tracked on Diary: replace the broken numbered pager with scroll-driven batch loading #2060): go to /diary, scroll to the bottom and confirm the next batch loads automatically; confirm the "Load more" button works via keyboard; confirm no duplicate entries appear and an end-of-list state is reached.
• Diary — scroll-position stability (AC4): confirm the scroll position does not jump when a new batch appends.
• Diary — focus indicator (AC19): confirm the "Load more" focus ring is clearly visible in both light and dark mode.
• Diary — mobile (AC22): repeat the scroll-load flow on a narrow viewport.
• Diary — filter/search reset: apply a filter or search term after loading several batches; confirm the list resets cleanly to the first batch and the URL carries no stale page= param.
• Diary — legacy bookmark: open /diary?page=3 and confirm it loads sensibly rather than erroring.

CI Timeout Stopgap (read before merging)

Quality Gates blocked this promotion for several runs with 60-second Jest
timeouts in the picker-family component suites — never assertion failures.
Three hypotheses were falsified by measurement before the cause was found:

• The dependency bump. A bisection reproduced identical failures on the
  old jest/testing-library versions, and a binary diff of the two
  user-event tarballs found the hot path byte-identical.
• Real timers in userEvent. beta already shipped SearchPicker and
  HouseholdItemPicker fully converted to fake timers, and both still timed
  out.
• Worker contention. In shard 5 the other 77 suites finished at 19:23:29
  and SearchPicker.test.tsx then ran alone on the runner until 19:49:23 —
  25m54s with zero contention — and still blew the ceiling.

The actual cause is a machine-speed gap: GitHub-hosted runners are ~1.8x
slower single-threaded than the dev boxes the 60s ceiling was calibrated on
(SearchPicker 2326s CI vs 1330s local; WorkItemPicker 436s vs 224s). At
~39s/test the heaviest tests cross 60s and the rest do not.

e3ccf553 raises --testTimeout to 240000 in the CI shard invocation
only; jest.config.ts stays at 60000 so it remains a tight dev-side
regression detector. Every rejected lever is recorded with its evidence in
ci.yml so it is not re-proposed.

This is a stopgap, not a fix. A green Quality Gates here is not evidence
the slowness was solved — the suite was only given more room (shard 5 still
takes ~42 minutes). The unexplained ~21s per-test CPU cost stays open in
#2078; the next step there is node --cpu-prof on a single dropdown test.

Known Open Items (not blocking promotion)

• Diary: replace the broken numbered pager with scroll-driven batch loading #2060 stays In Progress pending the Diary UAT scenarios above — a standalone story with no parent epic. If UAT passes here, it can be closed; if not, it reopens for fixes rather than shipping a follow-up.
• Diary: a first-batch load failure offers no retry affordance (footer is gated on entries.length > 0) #2064 (deferred) — a first-batch load failure offers no retry affordance (footer is gated on entries.length > 0).
• Load more button loses keyboard focus while its batch loads #2065 (deferred) — the "Load more" button loses keyboard focus while its own batch loads; shared-component a11y issue owned by ux-designer's Style Guide.

Testing

• DockerHub beta image: docker pull steilerdev/cornerstone:beta
• PR-specific image: docker pull steilerdev/cornerstone:pr-2075

🤖 Generated with Claude Code

[steilerDev]

Detailed Validation

Run against docker pull steilerdev/cornerstone:beta (or :pr-2075). Each block is one feature; the checkboxes in the PR description summarise these.

---

A. Invoices — "Show only open items" (#2046)

A1. Toggle narrows the list correctly

1. Navigate to /budget/invoices.
2. Note the total invoice count with the toggle off.
3. Enable "Show only open items".
4. Expected: the list now contains only (a) invoices whose own status is pending, and (b) invoices that are themselves settled but still have one or more pending deposits. Fully-settled invoices with no pending deposits disappear.

A2. Open deposits appear as expandable child rows

1. With the toggle on, find an invoice that has pending deposits — it should show an expander control.
2. Click the expander.
3. Expected: the pending deposits render as indented child rows beneath the invoice. Only pending deposits appear — already-settled deposits on the same invoice must not.
4. Collapse it again and confirm the child rows disappear cleanly with no layout shift left behind.

A3. Header totals reconcile with the rows

1. With the toggle on, read the header figures open payable and refunds due.
2. Add up the per-row open amounts shown in the list (expand every invoice with children).
3. Expected: the header totals equal the sum of the rows. These are computed from one shared aggregate, so any mismatch is a real bug worth blocking on.
4. Expected: a negative net position surfaces under refunds due rather than as a negative open payable.

A4. Default ordering

1. With the toggle on and no explicit sort applied, scan the due-date column.
2. Expected: rows are ordered by earliest open due date first — i.e. the most urgent open item is at the top.
3. Now click a different column header to sort, then clear it.
4. Expected: sorting still works, and clearing returns to the earliest-open-due default.

A5. Toggle interaction with pagination and filters

1. With the toggle on, page forward, then toggle off.
2. Expected: the list re-expands to all invoices without a stale page offset stranding you on an empty page.
3. Apply a text search or a status filter alongside the toggle and confirm the two compose rather than fighting each other.

A6. Status badge colours (regression fix)

1. With the toggle off, look at the invoice status badges.
2. Expected: each badge renders with its status colour. These previously rendered colourless due to a wrong CSS-module reference — a plain/grey badge means the fix regressed.

A7. Mobile / narrow viewport (dual-mount fix)

1. Resize to a phone-width viewport (or use device emulation) and reload /budget/invoices.
2. Expected: the card layout renders, each badge appears exactly once per invoice, and the expandable deposit rows still work.
3. This specifically exercises the desktop/mobile data-testid disambiguation fix — visually, watch for any badge or figure appearing twice.

A8. Dark mode

1. Switch to dark mode and repeat A1–A3 briefly.
2. Expected: badges, child-row backgrounds, and the expander control all have adequate contrast; no hardcoded light-mode colours bleed through.

---

B. Diary — infinite scroll (#2060, UAT-1 … UAT-7)

This is the story's actual UAT. #2060 is still In Progress and these scenarios have not been executed. If any of B1–B8 fails, #2060 should stay open and be fixed rather than promoted-and-followed-up.

B1. Scroll-driven loading (UAT-1)

1. Navigate to /diary on an account with more diary entries than one batch.
2. Scroll to the bottom of the list.
3. Expected: the next batch loads automatically without any click, and a loading indicator appears while it does.

B2. Scroll-position stability (UAT-2 / AC4)

1. Note where you are in the list as a batch appends.
2. Expected: the viewport does not jump, scroll up, or lose your place when new entries are inserted.

B3. Keyboard "Load more" (UAT-3)

1. Tab to the "Load more" button in the footer and press Enter/Space.
2. Expected: the next batch loads. Repeat until the end of the list.

B4. No duplicates, clean end-of-list (UAT-4)

1. Load every batch to the end.
2. Expected: no entry appears twice anywhere in the list, and the footer settles into a clear end-of-list state (no perpetual spinner, no dead "Load more" button).

B5. Focus indicator in both themes (UAT-5 / AC19)

1. Tab to the "Load more" button in light mode — confirm a clearly visible focus ring.
2. Switch to dark mode and repeat.
3. Expected: the focus indicator is clearly visible in both. This is an appearance claim only a human can sign off.
4. Known deferred: the button loses keyboard focus while its own batch loads (Load more button loses keyboard focus while its batch loads #2065) — expected behaviour today, not a regression.

B6. Filter / search reset (UAT-6)

1. Load 3+ batches, then type a search term (or apply a filter).
2. Expected: the list resets cleanly to a fresh first batch of matching results — no leftover entries from the pre-search list, no flash of stale content.
3. Check the URL: expected: no stale page= parameter remains.
4. Clear the search and confirm the full list comes back correctly.

B7. Mobile (UAT-7 / AC22)

1. Repeat B1 and B6 on a phone-width viewport.
2. Expected: scroll-triggered loading fires at the right point and the footer is reachable and legible.

B8. Legacy bookmark

1. Open /diary?page=3 directly.
2. Expected: the page loads sensibly (it should not error or render empty) — the old numbered-pager URL shape is gone, so this checks graceful handling rather than exact restoration.
3. Known deferred: if the very first batch fails to load (e.g. offline), there is no retry button — the footer is gated on having at least one entry (Diary: a first-batch load failure offers no retry affordance (footer is gated on entries.length > 0) #2064). Expected today.

---

C. Dependency sweep — smoke only

No user-visible surface, but the bumps touch Fastify, i18next/react-i18next, Jest, and the npm CLI's bundled deps, plus overrides for fast-uri, js-yaml, and ip-address.

C1. Log in and out (exercises Fastify session/cookie handling).
C2. Switch language EN ↔ DE and confirm both the Invoices and Diary strings above render translated, with no raw key names (e.g. diary.loadMore) leaking through.
C3. Confirm pluralised strings read correctly in both locales — the announcement keys moved to native i18next _one/_other suffixes in this release, so a "1 entries" style error would show here.
C4. Load one page that renders a PDF report (exercises the fontkit type-guard fix).

[steilerDev]

CI gate failed — blocked on #2076

Quality Gates is red on this promotion. All 16 E2E shards passed; the failures are 11 Jest tests, all 60-second timeouts with zero assertion failures, confined to two files:

• client/src/components/SearchPicker/SearchPicker.test.tsx — 9
• client/src/components/HouseholdItemPicker/HouseholdItemPicker.breadcrumb.test.tsx — 2

Not a flake

Run	Shards 1-4	Shard 5	Shard 6
PR #2071	7-10 min	8 min PASS	7 min PASS
PR #2070	9-11 min	26 min PASS	needed a retry
This PR	9-12 min	45 min FAIL	22 min FAIL

Shards 1-4 were healthy on the same run, so the runner was fine.

Root cause

Real-timer userEvent scheduling latency, not a dependency regression and not a production bug. Under real timers each userEvent sub-event yields a macrotask, so cost = (yields) x (event-loop latency); on a contended 6-worker runner the latency term dominates. That is why the timings worsen monotonically with no code change between runs — a dependency regression would step once and stay flat.

The decisive evidence is a control group inside the failing file: the two fake-timer tests at lines 79/100 mount the same FloatingPortal via the same interaction and have never failed.

The user-event 14.6.1 -> 14.6.7 bump was my initial hypothesis and is refuted: bisection on #2070 reproduced identical failures on the old versions, and a binary diff of the two tarballs shows wait.js byte-identical with delay: 0 unchanged.

Fix in progress

#2076 converts all 57 real-timer userEvent.setup() call sites in the two files to the fake-timer idiom. testTimeout stays at 60000 — ~592 real-timer call sites remain elsewhere in the client suite and still depend on it; #2077 tracks that rollout, which is the precondition for lowering the ceiling.

This PR will be re-gated once the fix lands on beta. No action needed from you yet.

[github-actions]

🎉 This PR is included in version 2.15.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀