Repository navigation
fix: query editor hang, MCP startup warning, and 1.7.3 maintenance - #12
Merged
Merged
Conversation
The editor replaced the whole page with "Loading…" until a `hydrated` flag flipped, and that flag never flipped. It was set from zustand persist's `onRehydrateStorage`, which with synchronous localStorage runs inside `create()` — while the `useEditorTabsStore` binding is still in its temporal dead zone. The ReferenceError was swallowed by zustand's own catch, so the page stayed on "Loading…" forever with no console output whenever there were no persisted tabs: a fresh browser, cleared site data, or right after closing the last tab. Take the signal from React instead, via the existing `useIsMounted`. The gate is still needed — zustand hands React `getInitialState()` as the server snapshot and persist pins that to the pre-rehydration state, so the hydration render sees an empty tab list either way — but `useIsMounted` cannot get stuck, and it also makes the first client render match the static export's prerendered markup. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
Clears four DOMPurify advisories (GHSA-cmwh-pvxp-8882, GHSA-55q2-fjhq-7xh7, GHSA-vxr8-fq34-vvx9, GHSA-c2j3-45gr-mqc4), all fixed in 3.4.13. They come in through monaco-editor, which pins dompurify to an exact 3.4.8 and has no newer release, so the pin is lifted with a pnpm override. Note this only cleans the dependency graph: monaco vendors its own copy of DOMPurify under esm/vs/base/browser/dompurify/, and that is what ends up in the AMD bundle we serve. It never calls the APIs the advisories hinge on (IN_PLACE, setConfig, clearConfig, CUSTOM_ELEMENT_HANDLING). Also bumps next 16.3.2, recharts 3.10.1, lucide-react 1.33, shadcn 4.19, @types/node 26 and typescript 6. eslint stays on 9 and typescript on 6 deliberately: eslint-plugin-react 7.37.5 (via eslint-config-next) still calls the `context.getFilename()` removed in ESLint 10, and typescript-eslint refuses TS 7.0 outright, supporting only <6.1.0. Both are upstream blocks, not preferences. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
Starting with MINILAKE_MCP=1 printed an IncompleteFieldDefinitionWarning before the banner. FastMCP's own `Settings` annotates `lifespan` with a forward reference to `FastMCP`, which is defined further down the same module and so is unresolved when the model is built; pydantic-settings >= 2.15 warns about that on every instantiation. Rebuild the model once the module is fully imported, which is exactly what the warning asks for. There is no SDK upgrade to take instead: mcp 1.29.0 is the last of the 1.x line and 2.0 is the rewrite this project pins away from. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
The images and CI were on 3.11, which left bugfix support in April 2024 and now only gets security patches. Move both to 3.14, the current stable. `requires-python` stays at ">=3.11" on purpose: this changes what minilake *runs* on, not what it can be installed into, so nobody on an older interpreter is cut off. The 3.14 classifier is added alongside the existing ones. Verified before switching: every binary dependency has wheels covering 3.14 (duckdb and pyarrow ship cp314, deltalake and cryptography ship abi3), and the full Docker suite passes on the new image with no new failures. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
Twenty patch/minor moves from `uv lock --upgrade`, the notable ones being databricks-sdk 0.133.0, starlette 1.6.0, uvicorn 0.52.4, deltalake 1.6.3, pyarrow 25.0.1 and ruff 0.16.4. No majors, and no pyproject floors change. Not a security fix: pip-audit over the environment and an OSV query across all 147 locked packages (both extras plus the dev group) came back clean either way. mcp stays on 1.29 — 2.0 is the FastMCP -> MCPServer rewrite this project deliberately pins away from. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
The images and CI moved to 3.14, but a contributor's `uv sync` still picked whatever interpreter it found first — here that was 3.12, so local runs and the image disagreed. `.python-version` closes that gap; uv downloads 3.14 on its own if it is missing. `requires-python` still says ">=3.11", so installing minilake into an older interpreter is unaffected. This only governs the development environment. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
Fixes and maintenance. No API changes. The query editor could hang on "Loading…" for anyone with no persisted tabs, and MINILAKE_MCP=1 printed a pydantic-settings warning before the banner. Both are fixed. Alongside those: the images and CI move to Python 3.14 (requires-python stays at >=3.11), the web UI dependencies are updated with the transitive dompurify pin lifted, and the Python lock takes twenty patch/minor moves. Claude-Session: https://claude.ai/code/session_01Ryg8gi4GMwXgLFQMMJ85Jc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two user-facing bugs, plus the maintenance that piled up behind them. Released as 1.7.3.
Fixes
The Query editor could hang on "Loading…" forever. The page gated its first tab on a
hydratedflag set from zustand persist'sonRehydrateStorage. With synchronouslocalStoragethat callback runs insidecreate(), while theuseEditorTabsStorebinding is still in its temporal dead zone — and zustand swallows the resultingReferenceErrorin its own sync-thenable catch. So the flag never flipped, nothing was logged, and anyone with no persisted tabs (fresh browser, cleared site data, or having just closed the last tab) got a blank page that reloading could not fix.The signal now comes from React, via the
useIsMountedhook this codebase already had. The gate is still needed — zustand hands ReactgetInitialState()as the server snapshot and persist pins that to the pre-rehydration state, so the hydration render sees an empty tab list regardless — butuseIsMountedcannot get stuck, and it also makes the first client render agree with the static export's prerendered markup, removing a latent hydration mismatch.MINILAKE_MCP=1printed a pydantic-settings warning before the banner. FastMCP's ownSettingsannotateslifespanwith a forward reference toFastMCP, defined further down the same module, so pydantic-settings >= 2.15 warns about the unresolved reference on every instantiation. The model is now rebuilt once the SDK module is fully imported — which is exactly what the warning asks for. There is no SDK upgrade to take instead:mcp1.29.0 is the last of the 1.x line, and 2.0 is theFastMCP->MCPServerrewrite this project deliberately pins away from.Maintenance
requires-pythonstays>=3.11— this changes what minilake runs on, not what it can be installed into..python-versionaligns local development with the image.dompurifypin lifted to 3.4.14, which closes the four DOMPurify Dependabot alerts on this repo. Worth knowing: monaco-editor vendors its own copy of DOMPurify into the bundle actually served, and never calls the APIs those advisories hinge on, so this cleans the dependency graph rather than the shipped bytes.ESLint stays on 9 and TypeScript on 6 on purpose:
eslint-plugin-reactstill calls thecontext.getFilename()removed in ESLint 10, andtypescript-eslintrefuses TS 7.0 outright. Both are upstream blocks.Verification
ui/src/stores/__tests__/editor-tabs.test.ts,tests/mcp_server/test_build.py) — both confirmed red without their fix.pnpm test(32),typecheck,lint,build.localStoragenow opens aQuery 1tab instead of hanging; closing the last tab reopens one immediately; reload restores tabs with no duplicate and no console error; results grid and Chart tab render on the updated recharts.MINILAKE_MCP=1, clean logs, SQL and the MCP handshake both working.pnpm auditclean, andpip-auditplus an OSV query across all 147 locked Python packages.