[efraespada]

Consolidates backend and frontend dependency updates with refreshed build images and GitHub Actions. It also adds a pull request smoke check for the backend’s declared JRE and startup against private PostgreSQL, helping catch runtime compatibility issues before merge.

Closes #62. Promotes the consolidated dependency update from #68 and the Trivy cold-start correction from #70, via develop commit be989e591134f396c875f040391be36d203f0f0f.

What changed

• Updates Kotlin, Ktor, Exposed, Flyway, testing, AndroidX, and related dependencies across the backend and frontend.

• Moves Docker builders to Gradle 9.8 and the backend runtime to Temurin JRE 25; adds a private PostgreSQL startup and health check for pull request images.

• Updates checkout, Codecov, and release Actions while preserving existing workflow configuration.

• Adapts Exposed 1.0 persistence and pagination APIs while retaining the existing datetime model and SQL timestamp mapping.

• Gives the complete Trivy container scan 30 minutes and its job 60 minutes so isolated caches can bootstrap their vulnerability databases before analysis.

Validation

• Backend verification passed: 1,756 tests, formatting, Detekt, coverage reporting, and distribution installation.
• Frontend verification passed: 1,127 desktop tests, Detekt, Android debug assembly, and Web/Wasm production distribution; full ktlint formatting reports eight pre-existing violations in unchanged tests.
• Both candidate Docker images built for linux/amd64; the backend passed JRE 25 and private PostgreSQL startup and health checks.
• Three Docker client isolation contract tests passed; Actionlint reported no new findings compared with develop.

Current-head CI and Copilot technical review passed before promotion, including both Docker image builds, the backend JRE/startup smoke check, container analysis with SARIF upload, CodeQL, dependency and secret checks, builds/tests, lint, Docker client isolation and coverage. Copilot technical review found no issues and no unresolved conversations remain. Copilot automatic approval is neutral because these workflow changes are outside its configured approval scope; the maintainer explicitly authorized promotion after verification.

[docs-page]

To preview the documentation for this pull request, visit the following URL:

docs.page/vypdev/vaultstadio~69

Documentation is deployed and generated using docs.page

[vypbot]

Bugbot: review complete

Current status: No active findings on be989e5.

Pull request · Verified commit · Workflow run

[vypbot]

Copilot approval · Human review needed

Status: This pull request is outside the configured approval scope.
Completed: 7/7 observed checks succeeded; Bugbot complete.
Action required: Ask a human reviewer to decide.
Impact: No new approval is confirmed for this revision.
See checks

Technical evidence

Revision: be989e591134; base: b36f2a9a40f4; reason: scope.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 25.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 15.33%. Comparing base (740a15f) to head (be989e5).
⚠️ Report is 15 commits behind head on master.

Files with missing lines	Patch %	Lines
...frastructure/persistence/ExposedShareRepository.kt	0.00%	2 Missing ⚠️
...ucture/persistence/ExposedFileVersionRepository.kt	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master      #69      +/-   ##
============================================
+ Coverage     14.91%   15.33%   +0.42%     
- Complexity      181      192      +11     
============================================
  Files           149      149              
  Lines         16454    16462       +8     
  Branches       2051     2379     +328     
============================================
+ Hits           2454     2525      +71     
+ Misses        13901    13834      -67     
- Partials         99      103       +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.