Update dependencies (client pnpm, server Gradle, Docker/CI) and resolve Dependabot alerts

[krusche]

Summary

Consolidates the outstanding dependency updates (client pnpm, server Gradle, and Docker/CI images) into one PR and resolves all 9 open Dependabot security alerts.

Security fixes (Dependabot alerts — all client/npm)

Package	Change	How	Alerts
dompurify	3.4.10 → 3.4.11	direct dep	GHSA (×2)
undici	7.25.0 → 7.28.0	pnpm override (transitive via jsdom)	GHSA-vmh5-mc38-953g, GHSA-hm92-r4w5-c3mj +4
http-proxy-middleware	2.0.9 → 3.0.6	pnpm override (transitive via webpack-dev-server)	GHSA-64mm-vxmg-q3vj

The two transitive fixes are added to client/pnpm-workspace.yaml overrides (the repo's existing mechanism for pinning vulnerable transitive deps). webpack-dev-server is configured without a proxy, so http-proxy-middleware is never instantiated at runtime — the v3 override only satisfies the alert.

Client routine updates

• @mantine/* 9.3.1 → 9.3.2 (Update mantine monorepo to v9.3.2 - abandoned #1107)
• @tiptap/* 3.26.1 → 3.27.1 (Update tiptap monorepo to v3.27.0 - abandoned #1110)
• react-router 7.17.0 → 7.18.0 (Update react-router monorepo to v7.18.0 - abandoned #1109)
• serialize-javascript override 7.0.5 → 7.0.6 (Update dependency serialize-javascript to v7.0.6 - abandoned #1111)

Server

• Gradle wrapper 9.5.1 → 9.6.0 — server + keycloak provider-deps (Update Gradle to v9.6.0 #1119)
• checkstyle 13.4.2 → 13.6.0 (Update dependency checkstyle to v13.6.0 - abandoned #1108)

Docker / CI

• client Node image 24.16.0 → 24.17.0 (Update dependency node to v24.18.0 #1113)
• CI Node 24.16.0 → 24.17.0 (run_tests, e2e_tests, refresh_sbom)

SBOMs (client/sbom/, server/sbom/) regenerated so the "Verify SBOM is up-to-date" checks pass.

Intentionally excluded

• react-router v8 (Update react-router monorepo to v8 - abandoned #1112) — major/breaking and not security-relevant (the react-router CVE was already fixed by 7.15.0; develop is on 7.17.0). Warrants its own focused PR.
• @eslint-react/eslint-plugin 5.9.1 and mantine-datatable 9.3.1 — still within the pnpm minimumReleaseAge supply-chain cooldown (this is exactly why Renovate lists them under "Pending Status Checks" rather than as open PRs). They'll land automatically once the cooldown elapses.
• The Keycloak Dockerfile base image stays at gradle:9.5.1-jdk25 — no gradle:9.6.0-jdk25 image is published yet, and that stage builds via ./gradlew (the wrapper, now 9.6.0), so the base tag doesn't affect the Gradle version used.

Verification

• Client: pnpm build ✓, tsc --noEmit ✓ (no errors), eslint src/ ✓ (0 errors), pnpm test ✓ (26 pass)
• Server: ./gradlew test with Gradle 9.6.0 + checkstyle 13.6.0 ✓ (864 pass, 0 fail), spotlessCheck ✓
• SBOM hashes verified to match the CI staleness checks for both client and server.

Closes

• Closes dompurify-3.4.2.tgz: 3 vulnerabilities (highest severity is: 6.1) #1100 (dompurify vulnerabilities — fixed by 3.4.11)

Supersedes the individual bot PRs #1107, #1108, #1109, #1110, #1111, #1113, #1116, #1118, #1119 (and the abandoned #1060); they should auto-close once these versions land on develop. #1093 (react-router) is already resolved on develop.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated Node.js to version 24.17.0 across CI/CD workflows and Docker builds.
  • Upgraded Gradle to version 9.6.0 and Checkstyle to version 13.6.0.
  • Bumped client dependencies: Mantine, TipTap, react-router, and dompurify to latest stable versions.
  • Applied security patches for transitive dependencies (undici, http-proxy-middleware, serialize-javascript).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Warning

Review limit reached

@krusche, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 20 minutes and 55 seconds. Learn how PR review limits work.

Your organization has used up its prepaid credits, and credit purchases are no longer available. Enable the review add-on in the billing tab to keep reviews running — you're only billed for reviews past your plan's rate limits ($0.25/file).

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan refill rate.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, the refill rate gradually slows as usage increases. The highest same-day bursts are limited more strictly.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 60f4b30d-e1d5-4f11-94b4-69859ae38bdd

📥 Commits

Reviewing files that changed from the base of the PR and between 629feca and abe08c9.

⛔ Files ignored due to path filters (1)

• client/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

• .github/workflows/e2e_tests.yml
• .github/workflows/refresh_sbom.yml
• .github/workflows/run_tests.yml
• client/package.json
• client/sbom/.lock-hash
• client/sbom/bom.json
• keycloak/provider-deps/build.gradle

Walkthrough

Node.js is bumped from 24.16.0 to 24.17.0 across three CI workflows and the client Dockerfile. Gradle wrapper is updated to 9.6.0 for both the server and Keycloak modules. Checkstyle is upgraded to 13.6.0. Frontend dependencies (@mantine, @tiptap, dompurify, react-router) are version-bumped, and security overrides for undici and http-proxy-middleware are added. SBOM artifacts are regenerated accordingly.

Changes

Toolchain & Dependency Bumps

Layer / File(s)	Summary
Node.js 24.17.0 across CI and Docker client.Dockerfile, .github/workflows/e2e_tests.yml, .github/workflows/run_tests.yml, .github/workflows/refresh_sbom.yml	Base image and all three workflow setup-node steps bumped from 24.16.0 to 24.17.0.
Gradle 9.6.0 and Checkstyle 13.6.0 server/gradle/wrapper/gradle-wrapper.properties, keycloak/provider-deps/gradle/wrapper/gradle-wrapper.properties, server/build.gradle	Gradle wrapper distributionUrl updated to 9.6.0 for server and Keycloak; Checkstyle toolVersion bumped to 13.6.0.
Frontend dependency and security override bumps client/package.json, client/pnpm-workspace.yaml	Bumps @mantine/* → 9.3.2, @tiptap/* → 3.27.1, dompurify → 3.4.11, react-router → 7.18.0; updates serialize-javascript override to 7.0.6; pins undici ≥ 7.28.0 and http-proxy-middleware ≥ 3.0.6 for GHSA advisories.
SBOM and lock hash refresh client/sbom/.lock-hash, server/sbom/.input-hash, server/sbom/bom.json	Regenerated hashes and Checkstyle 13.6.0 artifact identity (bom-ref, version, hashes, purl, dependency refs) updated in the server BOM.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• ls1intum/thesis-management#1101: Touches the same files (client/package.json, client/pnpm-workspace.yaml, client/sbom/.lock-hash) with overlapping frontend dependency and override bumps.

Suggested labels

ready for review

Suggested reviewers

• Claudia-Anthropica

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main objective: consolidating multiple dependency updates across client, server, and Docker/CI infrastructure to resolve Dependabot alerts.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/dependency-updates-2026-06

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@client.Dockerfile`:
- Line 1: The Dockerfile currently runs all commands as the root user, which is
a security vulnerability flagged by Trivy DS-0002. Add a USER directive before
the command execution steps in the final stage of the Dockerfile to specify a
non-root user (such as node or a custom user). Create the user if necessary
using a RUN directive with appropriate system commands, then add the USER
directive to switch to that user before any app/build commands are executed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 36d13768-e0eb-4851-ae6b-4eee7fc45c53

📥 Commits

Reviewing files that changed from the base of the PR and between 20f320b and 629feca.

⛔ Files ignored due to path filters (1)

• client/pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (13)

• .github/workflows/e2e_tests.yml
• .github/workflows/refresh_sbom.yml
• .github/workflows/run_tests.yml
• client.Dockerfile
• client/package.json
• client/pnpm-workspace.yaml
• client/sbom/.lock-hash
• client/sbom/bom.json
• keycloak/provider-deps/gradle/wrapper/gradle-wrapper.properties
• server/build.gradle
• server/gradle/wrapper/gradle-wrapper.properties
• server/sbom/.input-hash
• server/sbom/bom.json