chore: resolve dependency alerts

Author: Keith

docs/CHANGELOG.md

@@ -22,6 +22,13 @@ For dev or build tags, use the same logical version string embedded in the tag.
 
 ## [Unreleased]
 
+- Open Dependabot NuGet/npm updates are applied directly to `main`, including
+  `esbuild` `0.28.1`, `Serilog.Sinks.Grafana.Loki` `9.0.0`, `YamlDotNet`
+  `18.0.0`, `react-window` `2.2.7`, Microsoft package alignment on
+  `10.0.9`, and npm transitive audit cleanup. The Web transfers virtual list
+  now uses the `react-window` v2 API, optional Loki logging skips sink
+  construction when no URI is configured, and the player import test fixture no
+  longer ages out of the default 30-day stats range.
 - Vendored slskNet.Runtime is synced with the standalone runtime security and
   dependency updates, including the Vite/npm Web example, CodeQL remediation,
   and legacy peer path-encoding support for Windows-1251/Cyrillic browse and

memory-bank/activeContext.md

@@ -1,3 +1,33 @@
+## Update 2026-06-16 17:12:00Z
+
+- Current task: slskdN open Dependabot PR/security-alert sweep complete locally.
+- Last activity:
+  - Applied the remaining open Dependabot NuGet/npm updates directly to `main`.
+  - Cleared npm audit findings by upgrading `esbuild` to `0.28.1` and accepting
+    the audit transitive fixes.
+  - Migrated the Transfers virtual list to the `react-window` v2 `List` API.
+  - Fixed the `Serilog.Sinks.Grafana.Loki` 9.x startup break by skipping Loki
+    sink construction when no URI is configured.
+  - Fixed the player listening-history import test fixture that aged out of the
+    default 30-day visible stats range.
+  - Documented ADR-0001 gotchas `0z487` and `0z488`.
+- Validation:
+  - Passed: focused Loki startup regression test.
+  - Passed: full Web Vitest suite (`767/767`).
+  - Passed: `npm audit --audit-level=low` with zero vulnerabilities.
+  - Passed: `npm run build` with existing non-fatal Rolldown annotation warnings
+    from `@microsoft/signalr`.
+  - Passed: `dotnet list slskd.sln package --vulnerable --include-transitive`
+    with no vulnerable packages.
+  - Passed: unit tests (`4231/4231`) and integration tests (`278/278`); the
+    serial full solution `dotnet test slskd.sln --no-restore -m:1` exited 0.
+  - Passed: `./bin/lint`.
+  - Passed: `git diff --check`.
+- Next steps:
+  1. Commit and push the dependency sweep.
+  2. Verify GitHub alerts and close superseded Dependabot PRs if GitHub does
+     not auto-close them after main updates.
+
 ## Update 2026-06-16 16:49:39Z
 
 - Current task: slskNet.Runtime standalone and vendored runtime sync complete locally.

memory-bank/decisions/adr-0001-known-gotchas.md

@@ -52,6 +52,62 @@ This is not optional. This is the highest priority action after fixing a bug.
 
 ## 🚨 CRITICAL: Bugs That Keep Coming Back
 
+### 0z488. Date Fixtures Must Stay Inside Time-Windowed Assertions
+
+**The Bug**: Player listening-stats import tests used a fixed historical
+`playedAt` value that aged out of the default 30-day range, so the import
+success message still appeared while the visible stats summary correctly stayed
+at zero.
+
+**Files Affected**:
+- `src/web/src/components/Player/PlayerBar.test.jsx`
+
+**Wrong**:
+```jsx
+'2026-04-30T20:00:00Z,Imported Artist,Imported Album,Imported Track,Imported Genre'
+```
+
+**Correct**:
+```jsx
+const importedAt = new Date(Date.now() - 6 * 24 * 60 * 60 * 1000).toISOString();
+`${importedAt},Imported Artist,Imported Album,Imported Track,Imported Genre`
+```
+
+**Why This Keeps Happening**: Time-windowed UI assertions silently depend on
+the current date unless the test freezes time or keeps fixtures inside the
+asserted range. Import assertions must distinguish total imported history from
+history visible in the active range.
+
+### 0z487. Optional Loki Sink Must Not Be Configured With Empty URI
+
+**The Bug**: `Serilog.Sinks.Grafana.Loki` 9.x validates sink options during
+configuration, so wrapping `GrafanaLoki()` in `WriteTo.Conditional()` still
+throws on startup when the Loki URI is empty.
+
+**Files Affected**:
+- `src/slskd/Bootstrap/StartupLogging.cs`
+
+**Wrong**:
+```csharp
+.WriteTo.Conditional(
+    e => !string.IsNullOrEmpty(optionsAtStartup.Logger.Loki),
+    config => config.GrafanaLoki(optionsAtStartup.Logger.Loki ?? string.Empty))
+```
+
+**Correct**:
+```csharp
+var lokiUri = optionsAtStartup.Logger.Loki;
+if (!string.IsNullOrEmpty(lokiUri))
+{
+    loggerConfiguration = loggerConfiguration.WriteTo.GrafanaLoki(lokiUri);
+}
+```
+
+**Why This Keeps Happening**: Serilog conditional sinks decide whether to emit
+events later; they do not prevent sink construction. Optional external sinks
+with required connection options must be skipped at logger-configuration time
+when their endpoint is absent.
+
 ### 0z486. Legacy Peer Paths Must Round-Trip Their Encoding
 
 **The Bug**: Slow or legacy Soulseek peers could fail browse/download flows

memory-bank/progress.md

@@ -10709,3 +10709,5 @@ Code quality improvements were completed as part of Option A:
 [2026-06-16T16:21:13Z] Tester peer compatibility follow-up: fixed two likely causes behind Bas's TauAs/hrust82/budznbeerz browse/download failures. Default Soulseek peer inactivity and transfer inactivity timeouts now allow 60 seconds instead of the old 15/30 second example/default values, matching the slow remote enqueue acknowledgement report. Soulseek.NET protocol string handling now detects likely Windows-1251 Cyrillic paths, records the encoding on files/directories/folder responses, remembers per-user remote path encodings including directory-joined file names, and serializes later folder/download requests with the same legacy encoding instead of only fixing display mojibake. Updated config examples/docs, added regression coverage, and documented ADR-0001 gotcha `0z486` in docs-only commit `7da8d676d`. Validation passed: focused vendor regressions (`33/33`), broader Soulseek.NET related tests (`265/265`), focused slskd startup/download tests (`41/41`), full `dotnet test` (`4577/4577`: 68 smoke, 4231 unit, 278 integration), and `./bin/lint`.
 
 [2026-06-16T16:49:39Z] slskNet.Runtime sync: pushed the standalone runtime through `74243f52`, re-exported the tracked standalone tree into `vendor/slskNet.Runtime`, and verified the vendored copy matches the archive. This brings in the merged Dependabot/security updates, CodeQL fix, Vite/npm Web example, legacy peer path-encoding fix, and agent instructions while preserving the local slskdN tester-feedback timeout/config/docs changes. Also upgraded slskdN `MessagePack` from `3.1.4` to `3.1.7` after restore reported GHSA-hv8m-jj95-wg3x. Validation passed: `git diff --check`, vulnerable package scan with no vulnerable packages, full `dotnet test` (`4577/4577`: 68 smoke, 4231 unit, 278 integration), vendored Web `npm ci`, `npm audit --audit-level=low`, `npm run build`, and `./bin/lint`. No release tags were created.
+
+[2026-06-16T17:12:00Z] slskdN Dependabot/security sweep: applied the remaining open NuGet/npm Dependabot updates directly to `main`, including the `esbuild` security patch, npm audit transitive cleanup, `react-window` v2 migration, Microsoft 10.0.9 package alignment, YamlDotNet 18, and Loki sink 9.x compatibility. Documented ADR-0001 gotchas for optional Loki sink construction and time-windowed stats fixtures. Validation passed: focused Loki startup regression, full Web Vitest (`767/767`), `npm audit --audit-level=low`, Web production build, vulnerable NuGet scan, unit tests (`4231/4231`), integration tests (`278/278`), serial full solution test exit 0, `./bin/lint`, and `git diff --check`. No release tags were created.

memory-bank/tasks.md

@@ -2954,6 +2954,7 @@
 - [2026-05-25T02:35:11Z] Completed: deploy the tester-feedback build to the live Docker host as manual image `slskdn:0.0.0-manual.20260525023030.9a06ffa8cea0`; verify app/image version match, Docker health, Web root, `/health`, restart count zero, and fresh post-restart logs.
 - [2026-05-25T02:57:06Z] Completed: inspect live logs again, fix sidecar rescue activation, transient DHT announce warning noise, and Lidarr wanted-sync timeout stack traces; deploy manual image `slskdn:0.0.0-manual.20260525025408.ee802eb0347e`, and verify fresh logs are clean except for the intentional DHT hardening notice.
 - [2026-05-25T20:04:29Z] Completed: deploy the Downloads realtime request-identity fix as manual image `slskdn:0.0.0-manual.20260525195707.9654eac5f35d`; verify image/app version match, Docker health, restart count zero, Web route/assets, preserved optional tools, `/health=Healthy`, and clean current-process logs under live transfer activity.
+- [2026-06-16T17:12:00Z] Completed: apply remaining slskdN Dependabot/security updates directly to `main`, clear npm/NuGet vulnerability scans, migrate Web code for upgraded packages, fix Loki 9.x startup compatibility, and validate backend/frontend suites.
 
 - [2026-05-12T23:49:22Z] Follow-up: continue feature-coherence PR series with Program.cs feature-module decomposition, FeatureGate coverage for experimental API/UI surfaces, dependency ownership inventory, DownloadService regression tests, SongID capability reporting, and distributed-feature hard gates.
 

src/slskd/Bootstrap/StartupLogging.cs

@@ -22,7 +22,7 @@ public static ILogger Configure(
         int processId,
         Action<LogRecord> emitLogRecord)
     {
-        Log.Logger = (optionsAtStartup.Debug ? new LoggerConfiguration().MinimumLevel.Debug() : new LoggerConfiguration().MinimumLevel.Information())
+        var loggerConfiguration = (optionsAtStartup.Debug ? new LoggerConfiguration().MinimumLevel.Debug() : new LoggerConfiguration().MinimumLevel.Information())
             .MinimumLevel.Override("Microsoft", LogEventLevel.Error)
             .MinimumLevel.Override("System.Net.Http.HttpClient", optionsAtStartup.Debug ? LogEventLevel.Warning : LogEventLevel.Fatal)
             .MinimumLevel.Override("slskd.Authentication.PassthroughAuthenticationHandler", LogEventLevel.Warning)
@@ -42,12 +42,17 @@ public static ILogger Configure(
                         Path.Combine(logDirectory, $"{appName}-.log"),
                         outputTemplate: (optionsAtStartup.Debug ? "[{SourceContext}] " : string.Empty) + "[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj}{NewLine}{Exception}",
                         rollingInterval: RollingInterval.Day,
-                        retainedFileTimeLimit: TimeSpan.FromDays(optionsAtStartup.Retention.Logs))))
-            .WriteTo.Conditional(
-                e => !string.IsNullOrEmpty(optionsAtStartup.Logger.Loki),
-                config => config.GrafanaLoki(
-                    optionsAtStartup.Logger.Loki ?? string.Empty,
-                    textFormatter: new MessageTemplateTextFormatter("[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj}{NewLine}{Exception}", null)))
+                        retainedFileTimeLimit: TimeSpan.FromDays(optionsAtStartup.Retention.Logs))));
+
+        var lokiUri = optionsAtStartup.Logger.Loki;
+        if (!string.IsNullOrEmpty(lokiUri))
+        {
+            loggerConfiguration = loggerConfiguration.WriteTo.GrafanaLoki(
+                lokiUri,
+                textFormatter: new MessageTemplateTextFormatter("[{Timestamp:HH:mm:ss} {Level:u3}] {Message:lj}{NewLine}{Exception}", null));
+        }
+
+        Log.Logger = loggerConfiguration
             .WriteTo.Sink(new DelegatingSink(logEvent =>
             {
                 string message = string.Empty;

src/slskd/slskd.csproj

@@ -98,18 +98,18 @@
   <ItemGroup>
     <PackageReference Include="Asp.Versioning.Mvc.ApiExplorer" Version="10.0.0" />
     <PackageReference Include="Dapper" Version="2.1.79" />
-    <PackageReference Include="FluentFTP" Version="54.1.2" />
+    <PackageReference Include="FluentFTP" Version="54.2.0" />
     <PackageReference Include="IPAddressRange" Version="6.3.0" />
-    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.8" />
-    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.8" />
-    <PackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.300">
+    <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="10.0.9" />
+    <PackageReference Include="Microsoft.AspNetCore.SignalR.Client" Version="10.0.9" />
+    <PackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="10.0.301">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.8" />
+    <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.9" />
     <PackageReference Include="Microsoft.Diagnostics.NETCore.Client" Version="0.2.661903" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.8" />
-    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite.Core" Version="10.0.8" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore" Version="10.0.9" />
+    <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite.Core" Version="10.0.9" />
     <PackageReference Include="Mono.Nat" Version="3.0.4" />
     <PackageReference Include="MonoTorrent" Version="3.0.3-alpha.unstable.rev0049" />
     <PackageReference Include="OneOf" Version="3.0.271" />
@@ -123,26 +123,26 @@
     <PackageReference Include="Serilog.Sinks.Async" Version="2.1.0" />
     <PackageReference Include="Serilog.Sinks.Console" Version="6.1.1" />
     <PackageReference Include="Serilog.Sinks.File" Version="7.0.0" />
-    <PackageReference Include="Serilog.Sinks.Grafana.Loki" Version="8.3.2" />
+    <PackageReference Include="Serilog.Sinks.Grafana.Loki" Version="9.0.0" />
     <PackageReference Include="Serilog.Sinks.Http" Version="9.2.1" />
     <ProjectReference Include="..\..\vendor\slskNet.Runtime\src\Soulseek.csproj" />
     <PackageReference Include="StyleCop.Analyzers" Version="1.2.0-beta.556">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
-    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.1.7" />
+    <PackageReference Include="Swashbuckle.AspNetCore" Version="10.2.1" />
     <PackageReference Include="TagLibSharp" Version="2.3.0" />
     <PackageReference Include="Utility.CommandLine.Arguments" Version="6.0.0" />
     <PackageReference Include="Utility.EnvironmentVariables" Version="1.0.5" />
-    <PackageReference Include="YamlDotNet" Version="17.1.0" />
+    <PackageReference Include="YamlDotNet" Version="18.0.0" />
     <PackageReference Include="NSec.Cryptography" Version="26.4.0" />
     <PackageReference Include="MathNet.Numerics" Version="5.0.0" />
-    <PackageReference Include="AWSSDK.S3" Version="4.0.23.3" />
+    <PackageReference Include="AWSSDK.S3" Version="4.0.24.4" />
     <PackageReference Include="Zeroconf" Version="3.7.16" />
-    <PackageReference Include="OpenTelemetry" Version="1.15.3" />
-    <PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.15.3" />
-    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.15.3" />
-    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.15.3" />
+    <PackageReference Include="OpenTelemetry" Version="1.16.0" />
+    <PackageReference Include="OpenTelemetry.Exporter.Console" Version="1.16.0" />
+    <PackageReference Include="OpenTelemetry.Exporter.OpenTelemetryProtocol" Version="1.16.0" />
+    <PackageReference Include="OpenTelemetry.Extensions.Hosting" Version="1.16.0" />
     <PackageReference Include="OpenTelemetry.Instrumentation.AspNetCore" Version="1.15.2" />
     <PackageReference Include="OpenTelemetry.Instrumentation.Http" Version="1.15.1" />
     <PackageReference Include="dotNetRDF" Version="3.5.1" />