DavidHLP · Oct 11, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 11, 2026 · Oct 11, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -66,12 +66,18 @@ jobs:
               - '.github/workflows/_backend.yml'
               - '.github/services-matrix.json'
             console:
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
               - 'apps/console/**'
               - 'packages/**'
               - 'shared/**'
               - '.github/workflows/ci.yml'
               - '.github/workflows/_frontend.yml'
             management:
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
               - 'apps/management/**'
               - 'packages/**'
               - 'shared/**'
@@ -87,6 +93,9 @@ jobs:
               - '.github/workflows/ci.yml'
               - '.github/workflows/_contract.yml'
             docker:
+              - 'package.json'
+              - 'pnpm-lock.yaml'
+              - 'pnpm-workspace.yaml'
               - 'services/**'
               - 'apps/console/Dockerfile'
               - 'apps/management/Dockerfile'

diff --git a/apps/console/package.json b/apps/console/package.json
@@ -77,33 +77,33 @@
     "@lucide/vue": "1.50.0"
   },
   "devDependencies": {
-    "@iconify-json/lucide": "^1.2.137",
+    "@iconify-json/lucide": "^1.2.140",
     "@iconify-json/radix-icons": "^1.2.6",
     "@tailwindcss/typography": "^0.5.19",
     "@tsconfig/node22": "^22.0.6",
     "@types/katex": "^0.16.7",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "@types/sockjs-client": "^1.5.4",
     "@vitejs/plugin-vue": "^6.0.9",
     "@vitejs/plugin-vue-jsx": "^5.1.6",
-    "@vitest/coverage-v8": "^5.0.2",
+    "@vitest/coverage-v8": "^5.0.3",
     "@vue/eslint-config-prettier": "^10.2.0",
     "@vue/eslint-config-typescript": "^14.9.0",
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
-    "eslint": "^10.11.0",
+    "eslint": "^10.12.0",
     "eslint-plugin-vue": "^10.11.1",
     "jiti": "^2.7.0",
-    "jsdom": "^30.1.1",
-    "knip": "^6.38.0",
+    "jsdom": "^30.1.2",
+    "knip": "^6.40.0",
     "npm-run-all2": "^9.0.3",
     "prettier": "3.9.9",
     "typescript": "~6.0.3",
     "unplugin-icons": "^24.0.0",
-    "vite": "^8.3.1",
-    "vite-plugin-pwa": "^1.3.0",
+    "vite": "^8.3.3",
+    "vite-plugin-pwa": "^2.0.0",
     "vite-plugin-vue-devtools": "^8.2.1",
-    "vitest": "^5.0.2",
-    "vue-tsc": "^3.3.11"
+    "vitest": "^5.0.3",
+    "vue-tsc": "^3.3.12"
   }
 }
diff --git a/apps/management/package.json b/apps/management/package.json
@@ -79,26 +79,26 @@
   "devDependencies": {
     "@playwright/test": "^1.63.0",
     "@tsconfig/node24": "^24.0.5",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "@vitejs/plugin-vue": "^6.0.9",
-    "@vitest/coverage-v8": "^5.0.2",
-    "@vitest/ui": "^5.0.2",
+    "@vitest/coverage-v8": "^5.0.3",
+    "@vitest/ui": "^5.0.3",
     "@vue/eslint-config-prettier": "^10.2.0",
     "@vue/eslint-config-typescript": "^14.9.0",
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
-    "eslint": "^10.11.0",
+    "eslint": "^10.12.0",
     "eslint-plugin-vue": "~10.11.1",
     "jiti": "^2.7.0",
-    "jsdom": "^30.1.1",
-    "knip": "^6.38.0",
+    "jsdom": "^30.1.2",
+    "knip": "^6.40.0",
     "npm-run-all2": "^9.0.3",
     "prettier": "3.9.9",
     "tw-animate-css": "^1.4.0",
     "typescript": "~6.0.3",
-    "vite": "^8.3.1",
+    "vite": "^8.3.3",
     "vite-plugin-vue-devtools": "^8.2.1",
-    "vitest": "^5.0.2",
-    "vue-tsc": "^3.3.11"
+    "vitest": "^5.0.3",
+    "vue-tsc": "^3.3.12"
   }
 }
diff --git a/apps/management/src/composables/useRemoteTable.ts b/apps/management/src/composables/useRemoteTable.ts
@@ -5,6 +5,7 @@ import {
   shallowRef,
   toValue,
   type ComputedRef,
+  type WritableComputedRef,
   type DeepReadonly,
   type MaybeRefOrGetter,
 } from 'vue'
@@ -64,8 +65,8 @@ export interface UseRemoteTableOptions<TData, TFilters, TParams> {
 
 export interface UseRemoteTableReturn<TData, TFilters> {
   query: ComputedRef<DeepReadonly<RemoteTableQuery<TFilters>>>
-  searchQuery: ComputedRef<string>
-  tablePagination: ComputedRef<PaginationState>
+  searchQuery: WritableComputedRef<string>
+  tablePagination: WritableComputedRef<PaginationState>
   loading: ComputedRef<boolean>
   data: ComputedRef<TData[]>
   total: ComputedRef<number>

diff --git a/apps/management/src/views/problems/components/CodeForm.vue b/apps/management/src/views/problems/components/CodeForm.vue
@@ -253,7 +253,7 @@ defineExpose({
             }}</Label>
             <Textarea
               :model-value="lang.starterCode"
-              @update:model-value="(v) => updateStarterCode(index, String(v))"
+              @update:model-value="updateStarterCode(index, String($event))"
               rows="12"
               :placeholder="`// Starter code for ${lang.language}...`"
               class="font-mono text-sm bg-background"

diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
@@ -232,6 +232,8 @@ pnpm --dir packages/auth-core test:coverage
 dependabot-core 当作 support file 丢弃，PR 只改 manifest，必然过不了 CI 的五处
 `pnpm install --frozen-lockfile`，update job 还会按成员 manifest 报 `misconfigured_tooling`。
 这个根 block 同时覆盖 `packages/*` 与根 manifest。
+根 `package.json`、`pnpm-lock.yaml` 或 `pnpm-workspace.yaml` 变化会触发 Console、Management
+以及 Docker CI 门禁，覆盖共享依赖更新及其镜像安装验证。
 
 ### Optional external Adapters
 

diff --git a/docs/OPERATIONS.md b/docs/OPERATIONS.md
@@ -28,6 +28,8 @@ Trivy JSON reports are uploaded per candidate even when scanning fails; a failed
 
 Runtime images retain pinned base-image digests and apply `apk upgrade --no-cache` for Alpine security updates. Both Verify and Publish bypass cache only for the final `runtime` (backend) or `production` (frontend) stage, so cached upgrade layers cannot retain newly vulnerable packages; builder caches remain enabled. Backend dependencies use Spring Boot's BOM with narrowly scoped security overrides; verify final dependency resolution and image scan results before release.
 
+Backend services retain Java 17 and use the Spring Boot 4 BOM for Spring Framework 7 and Tomcat 11. Existing JSON wire and persisted payload contracts remain on the documented `spring-boot-jackson2` compatibility module, selected by `spring.http.converters.preferred-json-mapper=jackson2`; Jackson 2 security overrides use `jackson-2-bom.version`, not the Jackson 3 BOM property. Do not mix Spring Framework 7 into a Boot 3 parent or retain a Tomcat 10 override under Boot 4. Dependency upgrades must pass owner-context, serialization, security and RPC checks as well as all nine image scans; reverting code must not rewrite application data or applied migrations.
+
 `host-deploy` 在任何 migration、Redis ACL materialization、Judge sandbox provisioning 或 Compose mutation 前检查：
 
 - approved source commit；
@@ -322,6 +324,8 @@ backup、restore-drill、prune 使用同一 fenced database lease（`admin:owner
 
 可选的 `docker/docker-compose.observability.yml` 提供 loopback-only、digest-pinned 的 OpenTelemetry Collector、Prometheus、Alertmanager、Grafana、Tempo 和 Loki。HTTP Owner 暴露 metrics；无 HTTP 的 Judge/Search worker 通过 Micrometer OTLP 输出。日志携带 trace/span 关联，Grafana 可从 Loki 跳转 Tempo。
 
+Boot 4 tracing binds OTLP export settings under `management.opentelemetry.tracing.export.otlp`; the existing `MANAGEMENT_OTLP_TRACING_ENDPOINT` and `MANAGEMENT_OTLP_AUTHORIZATION` environment inputs remain unchanged. The shared observability module enables the tracing integration and validates the effective endpoint/header pair before export: a configured authorization header requires HTTPS. OTLP metrics configuration and the opt-in Collector overlays remain separate from tracing.
+
 生产 telemetry receiver、存储、保留周期、通知 webhook、阈值调优和真实流量 SLO 由外部运维平台负责；仓库 overlay 默认不启动，也不公开 management endpoint 或 secret。
 
 ### 关键指标

diff --git a/package.json b/package.json
@@ -2,12 +2,12 @@
   "dependencies": {
     "@letta-ai/letta-client": "^1.12.1",
     "@vitejs/plugin-vue": "^6.0.9",
-    "dotenv": "^17.4.2"
+    "dotenv": "^18.0.6"
   },
   "devDependencies": {
     "@vue/test-utils": "^2.5.1",
-    "jsdom": "^30.1.1",
+    "jsdom": "^30.1.2",
     "playwright": "1.63.0",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/app-bootstrap/package.json b/packages/app-bootstrap/package.json
@@ -21,7 +21,7 @@
   },
   "devDependencies": {
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43"
   }
 }
diff --git a/packages/auth-core/package.json b/packages/auth-core/package.json
@@ -42,9 +42,9 @@
     "tailwind-merge": "^3.7.0"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^5.0.2",
+    "@vitest/coverage-v8": "^5.0.3",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43"
   }
 }
diff --git a/packages/auth-ui/package.json b/packages/auth-ui/package.json
@@ -39,12 +39,12 @@
     "@vitejs/plugin-vue": "^6.0.9",
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
-    "jsdom": "^30.1.1",
+    "jsdom": "^30.1.2",
     "typescript": "~5.9.3",
-    "vite": "^8.3.1",
-    "vitest": "^5.0.2",
+    "vite": "^8.3.3",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43",
     "vue-router": "^5.0.0",
-    "vue-tsc": "^3.3.11"
+    "vue-tsc": "^3.3.12"
   }
 }
diff --git a/packages/datetime-utils/package.json b/packages/datetime-utils/package.json
@@ -17,8 +17,8 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/design-system/package.json b/packages/design-system/package.json
@@ -62,8 +62,8 @@
     "@vitejs/plugin-vue": "^6.0.9",
     "@vue/tsconfig": "^0.9.1",
     "typescript": "~5.9.3",
-    "vite": "^8.3.1",
+    "vite": "^8.3.3",
     "vue": "^3.5.43",
-    "vue-tsc": "^3.3.11"
+    "vue-tsc": "^3.3.12"
   }
 }
diff --git a/packages/domain-types/package.json b/packages/domain-types/package.json
@@ -17,6 +17,6 @@
   },
   "devDependencies": {
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/http-client/package.json b/packages/http-client/package.json
@@ -23,8 +23,8 @@
     "@ulticode/auth-core": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/i18n-completeness/package.json b/packages/i18n-completeness/package.json
@@ -17,8 +17,8 @@
     "test:watch": "vitest"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/locale-preference/package.json b/packages/locale-preference/package.json
@@ -20,9 +20,9 @@
     "vue": "^3.5.43"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43"
   }
 }
diff --git a/packages/markdown-utils/package.json b/packages/markdown-utils/package.json
@@ -24,9 +24,9 @@
   },
   "devDependencies": {
     "@types/dompurify": "^3.0.5",
-    "@types/node": "^26.6.3",
-    "jsdom": "^30.1.1",
+    "@types/node": "^26.6.4",
+    "jsdom": "^30.1.2",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/request-state/package.json b/packages/request-state/package.json
@@ -20,9 +20,9 @@
     "vue": "^3.5.43"
   },
   "devDependencies": {
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43"
   }
 }
diff --git a/packages/sandbox-types/package.json b/packages/sandbox-types/package.json
@@ -17,6 +17,6 @@
   },
   "devDependencies": {
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/sidebar-menu/package.json b/packages/sidebar-menu/package.json
@@ -40,11 +40,11 @@
     "@vitejs/plugin-vue": "^6.0.9",
     "@vue/test-utils": "^2.5.1",
     "@vue/tsconfig": "^0.9.1",
-    "jsdom": "^30.1.1",
+    "jsdom": "^30.1.2",
     "typescript": "~5.9.3",
-    "vite": "^8.3.1",
-    "vitest": "^5.0.2",
+    "vite": "^8.3.3",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43",
-    "vue-tsc": "^3.3.11"
+    "vue-tsc": "^3.3.12"
   }
 }
diff --git a/packages/submission-status/package.json b/packages/submission-status/package.json
@@ -21,6 +21,6 @@
   },
   "devDependencies": {
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2"
+    "vitest": "^5.0.3"
   }
 }
diff --git a/packages/theme/package.json b/packages/theme/package.json
@@ -27,7 +27,7 @@
     "@vue/test-utils": "^2.5.1",
     "happy-dom": "^20.14.5",
     "typescript": "~5.9.3",
-    "vitest": "^5.0.2",
+    "vitest": "^5.0.3",
     "vue": "^3.5.43"
   }
 }