STEWARD / 01

All eligible patch updates are merged. Two minor upgrades are isolated in separate PRs: the background-job client and the frontend build tools. Both pass unit tests; the browser suite is still running. Major version upgrades remain outside the daily routine.

NEXT RUN → Check CI on PR #482 and PR #483. Merge only after the required checks pass. Keep the job-client update separate from the Rails migration so regressions have a clear owner.

The latest scan has six open findings: two high and four moderate. A fix for one high finding is ready for review in PR #484. The other depends on an upstream release, tracked in SEC-218. Affected paths have a temporary mitigation; none of the findings is critical.

NEXT RUN → Recheck the upstream patch, rerun the advisory scan after #484 lands, then address the four moderate findings. Do not dismiss findings just because a dependency is transitive. Preserve the mitigation until the patched artifact is deployed.

18 of 24 components now pass against Rails 7. The dual-version CI matrix is green for models, background jobs, and mailers. The migration branch includes compatibility fixes for the new autoloader; PR #479 is ready for review. Two request/session specs are isolated in PR #486.

NEXT RUN → Continue migrating the remaining API controllers. Hold the session-default change until a maintainer chooses the rollout policy in ENG-342; it affects existing signed-in users. Keep the old cookie reader during the transition.