Merge branch 'release/7.23' into feat/mock-getddl-parity

.gitea/workflows/build.yaml

@@ -15,16 +15,37 @@ concurrency:
 
 env:
   # the server the mocked services and app tests run against - bump deliberately.
+  #
+  # 4.14.0 is the pin because it is the first release that compresses its
+  # responses and sends cache headers for the app it streams (sasjs/server#575).
+  # That is not cosmetic here: the audit runs against this server, and the app it
+  # serves is a single 4.83MB build output. Measured on the previous pin, same
+  # build and same machine: FCP 8.48s and 0.34 performance with the assets served
+  # raw, 2.81s and 0.49 with the same bytes gzipped and hashed files immutable.
+  #
+  # 4.0.0's breaking change is the auth statuses - `POST /SASjsApi/auth/token` and
+  # `/auth/refresh` answer 401 where they answered 403, the undocumented DELETE on
+  # the logout route is gone, and `GET /SASLogon/logout` answers 500 where it
+  # answered 403 when the session store fails. The estate does touch all three,
+  # through @sasjs/adapter: auth/AuthManager.js logs out with a GET on the logout
+  # route and auth/getAccessTokenForSasjs.js posts the token. What it keys on is
+  # the call succeeding rather than the code being 403 in particular, so 403 to
+  # 401 changes nothing here - and the suite on this pin checks the logout path
+  # still completes.
+  #
+  # The floors this pin also carries, kept because a future bump has to keep
+  # clearing them:
+  #
   # 3.12.0 is the floor: /ddc-host carries `timing=early` from there, which
   # client/cypress/e2e/va-ddc-host.cy.ts needs. 3.12.2 also carries the
   # packaged-executable fix for the same page, so the version the tests run
   # against is the one that ships.
   #
-  # 3.14.0 ships @sasjs/lint 5.0.0 (the studio reports OS commands) and is the
-  # release the estate runs. It still declares @sasjs/utils ^4.7.0, so the
-  # envelope *formats* (SYSCC as text, DATE7, TIME5, E8601DT26.6 from utils 4.8)
-  # are only guaranteed once the next server release raises that floor - a fresh
-  # install resolves 4.8.0 today, a cached tree need not. Bump again when it lands.
+  # 3.14.0 ships @sasjs/lint 5.0.0 (the studio reports OS commands). It declared
+  # @sasjs/utils ^4.7.0, which is why the envelope *formats* (SYSCC as text,
+  # DATE7, TIME5, E8601DT26.6) used to depend on what a fresh install resolved:
+  # 4.8 introduced them, a 4.7 tree did not have them. 4.14.0 declares ^4.8.0,
+  # so the pin guarantees them now rather than being a floor that hoped for them.
   #
   # 3.13.0 is the one that matters for licensing: @sasjs/utils 4.7 reports
   # SYSSITE, which %webout takes from &syssite. Before it the prelude wrote an
@@ -36,9 +57,9 @@ env:
   # options argument. getdata, viewdata and getcolvals pass { showmeta }, and a
   # 4.5 install drops it without a word - so the pin is what makes the metadata
   # members guaranteed here rather than whatever a fresh install happens to
-  # resolve. requireWeboutOptions in sasjs/mocks/sasjs/services/dcMockUtils.js
-  # refuses a runtime without it.
-  SASJS_SERVER_VERSION: '3.14.0'
+  # resolve. sas/mocks/test/harness-webout.test.js is what holds that: showmeta
+  # is written beside the rows, before CLOSE.
+  SASJS_SERVER_VERSION: '4.14.0'
   NODE_VERSION: '24.15.0'
 
 jobs:

.gitea/workflows/release.yaml

@@ -7,7 +7,9 @@ on:
 
 env:
   # the server the mocked services and app tests run against - bump deliberately
-  SASJS_SERVER_VERSION: '3.14.0'
+  # (build.yaml carries the full rationale; this workflow runs the same mocked
+  # estate, so it stays on the same pin).
+  SASJS_SERVER_VERSION: '4.14.0'
   NODE_VERSION: '24.15.0'
 
 jobs:

.gitea/workflows/sites.yaml

@@ -11,7 +11,9 @@ on:
 
 env:
   # the server the mocked services and app tests run against - bump deliberately
-  SASJS_SERVER_VERSION: '3.14.0'
+  # (build.yaml carries the full rationale; this workflow runs the same mocked
+  # estate, so it stays on the same pin).
+  SASJS_SERVER_VERSION: '4.14.0'
   NODE_VERSION: '24.15.0'
   APP_LOC: /Public/app/dc
   SURFER_HOST: https://demo.datacontroller.io