security(deps): bump the dataviewer-frontend-patch-minor group in /data-management/viewer/frontend with 2 updates

[dependabot]

Bumps the dataviewer-frontend-patch-minor group in /data-management/viewer/frontend with 2 updates: lucide-react and eslint-plugin-react-refresh.

Updates lucide-react from 1.45.0 to 1.46.0

Release notes

Sourced from lucide-react's releases.

Version 1.46.0

What's Changed

• feat(icons): Added new icons: clef-g, clef-f and clef-c by @​rrod497 in lucide-icons/lucide#4083
• chore(deps-dev): bump astro from 7.3.0 to 7.3.2 in the astro-deps group by @​dependabot[bot] in lucide-icons/lucide#4860
• feat(icons): added monitor-pc icon by @​karsa-mistmere in lucide-icons/lucide#4791

Full Changelog: lucide-icons/lucide@1.45.0...1.46.0

Commits

• See full diff in compare view

Updates eslint-plugin-react-refresh from 0.5.6 to 0.5.7

Release notes

Sourced from eslint-plugin-react-refresh's releases.

v0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

Changelog

Sourced from eslint-plugin-react-refresh's changelog.

0.5.7

Add allowCompoundComponents option (#117)

Default: false (true in vite config)

Don't warn when components are exported as an object gathering them. Every member of the object must be a component, and a member holding an anonymous function requires a component name as key.

This should be enabled if the fast refresh implementation correctly handles this case. Vite supports it since @vitejs/plugin-react 4.7.0, @vitejs/plugin-react-swc 3.11.0.

{
  "react-refresh/only-export-components": [
    "error",
    { "allowCompoundComponents": true }
  ]
}

Enabling this option allows code such as the following:

const Root = () => <></>;
const Label = () => <></>;
export const Tag = { Root, Label };

Commits

• fd40d83 Add allowCompoundComponents option [publish] (#117)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 428eb3d.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

Package	Version	Score	Details
npm/eslint-plugin-react-refresh	0.5.7	Unknown	Unknown
npm/lucide-react	1.46.0	🟢 6.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 25/28 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Security-Policy ⚠️ 0 security policy file not detected License 🟢 9 license file detected Binary-Artifacts 🟢 10 no binaries found in the repo Fuzzing ⚠️ 0 project is not fuzzed Pinned-Dependencies 🟢 9 dependency not pinned by hash detected -- score normalized to 9 Signed-Releases ⚠️ 0 Project has not signed or included provenance with any releases. Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 2 SAST tool is not run on all commits -- score normalized to 2

Scanned Files

• data-management/viewer/frontend/package-lock.json

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.07%. Comparing base (8a22b69) to head (428eb3d).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1628      +/-   ##
==========================================
+ Coverage   88.01%   88.07%   +0.05%     
==========================================
  Files         281      279       -2     
  Lines       23440    23211     -229     
  Branches     3181     3166      -15     
==========================================
- Hits        20631    20442     -189     
+ Misses       2114     2079      -35     
+ Partials      695      690       -5     

Flag	Coverage Δ		*Carryforward flag
go	100.00% <ø> (ø)
pester	86.64% <ø> (-0.11%)	⬇️	Carriedforward from d0cd423
pytest-data-pipeline	100.00% <ø> (ø)		Carriedforward from d0cd423
pytest-dataviewer	89.65% <ø> (-0.20%)	⬇️	Carriedforward from d0cd423
pytest-dm-tools	100.00% <ø> (ø)		Carriedforward from d0cd423
pytest-evaluation	95.40% <ø> (ø)
pytest-fuzz	4.00% <ø> (+0.10%)	⬆️	Carriedforward from d0cd423
pytest-inference	100.00% <ø> (ø)		Carriedforward from d0cd423
pytest-shared-ci	100.00% <ø> (ø)		Carriedforward from d0cd423
pytest-training	92.60% <ø> (ø)		Carriedforward from d0cd423
vitest	85.55% <ø> (ø)
vitest-app	85.55% <ø> (ø)
vitest-components	85.55% <ø> (ø)
vitest-features	85.55% <ø> (ø)
vitest-lib	85.55% <ø> (ø)
vitest-state	85.55% <ø> (ø)

*This pull request uses carry forward flags. Click here to find out more.
see 9 files with indirect coverage changes

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Marcel Bindseil (bindsi)]

Validated the exact head with a clean npm install, dependency resolution, the full frontend validation suite (148 files, 1,687 tests), and a production build. CI is green; the dependency delta is limited to lucide-react 1.46.0 and eslint-plugin-react-refresh 0.5.7; the head merges cleanly with current main.