Release: staging -> main (2026-07-22 03:53)

[github-actions]

Summary

Promotes staging into main.

• Source branch: staging
• Target branch: main
• Generated by npm run pr:promote

Included PRs

• chore(deps-dev): bump @testing-library/jest-dom from 6.9.1 to 7.0.0 #1139: chore(deps-dev): bump @testing-library/jest-dom from 6.9.1 to 7.0.0 (@app/dependabot)
• chore(deps-dev): bump the npm-development-minor-patch group with 7 updates #1137: chore(deps-dev): bump the npm-development-minor-patch group with 7 updates (@app/dependabot)
• chore(deps): bump the github-actions-all group with 2 updates #1135: chore(deps): bump the github-actions-all group with 2 updates (@app/dependabot)
• Guard character-counter accessibility contract (no live regions) and align palette guidance #1124: Guard character-counter accessibility contract (no live regions) and align palette guidance (@app/copilot-swe-agent)
• Sanitize invitee email lookup error logging in papers invites route #1123: Sanitize invitee email lookup error logging in papers invites route (@app/copilot-swe-agent)
• Restore sanitized invite-route error logging and tighten regression assertions #1122: Restore sanitized invite-route error logging and tighten regression assertions (@app/copilot-swe-agent)
• chore: sync main into staging #1121: chore: sync main into staging (@app/github-actions)

Compare

• https://github.com/Hiroki-org/OpenShelf/compare/main...staging?expand=1

Greptile Summary

This PR promotes staging changes into main. The main changes are:

• GitHub Actions and npm development dependencies updated.
• Invite route error logging changed to sanitized string output.
• Character counter tests updated to guard the no-live-region contract.

Confidence Score: 5/5

The changed flow looks mergeable after a small cleanup to error diagnostics.

• The API responses stay generic on the changed error paths.
• The workflow and dependency updates match the Node version used in CI.
• The accessibility test changes match the existing character-counter contract.
• One logging branch can hide fields from non-Error object rejections.

apps/api/src/routes/invites.ts

Important Files Changed

Filename	Overview
apps/api/src/routes/invites.ts	Adds a local caught-error formatter and uses it in invite response failures; non-Error object rejections can lose diagnostic fields.
apps/api/src/routes/papers.ts	Uses the existing caught-error formatter for invitee email lookup failures while keeping the client response generic.
apps/api/src/routes/tests/invites.test.ts	Updates invite error logging assertions and adds coverage for string rejections.
apps/api/src/routes/tests/papers.test.ts	Adds an assertion that invitee email lookup failures are logged through the sanitized formatter.
apps/web/src/app/tests/collections-new.test.tsx	Adds assertions that collection character counters are described by inputs without live-region attributes.
apps/web/src/app/tests/orgs-new.test.tsx	Adds assertions that the org description counter avoids live-region attributes.
.github/workflows/ci.yml	Updates checkout and setup-node actions across CI jobs while keeping Node 24.
apps/web/package.json	Updates web development dependencies, including jest-dom, Tailwind PostCSS, and PostCSS.
apps/api/package.json	Updates API development dependencies for Cloudflare Workers types and Wrangler.

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
apps/api/src/routes/invites.ts:19
**Object Rejections Lose Details**

When this handler catches a rejected plain object, `String(error)` logs only `[object Object]`. A D1 or binding failure shaped like `{ message, code }` would still return 500, but the log would lose the error fields that the previous `console.error(..., error)` output kept.

```suggestion
        : typeof error === "object" && error !== null
          ? JSON.stringify(error)
          : String(error);
```

_{Reviews (1): Last reviewed commit: "Merge pull request #1139 from Hiroki-org..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

Context used:

• Knowledge Base — Collections, Orgs, and Invites
• Knowledge Base — Paper Upload, Storage, and Viewing Flow

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
open-shelf	Ignored		Jul 22, 2026 3:53am

[greptile-apps]

Object Rejections Lose Details

When this handler catches a rejected plain object, String(error) logs only [object Object]. A D1 or binding failure shaped like { message, code } would still return 500, but the log would lose the error fields that the previous console.error(..., error) output kept.

Suggested change

	: String(error);
	: typeof error === "object" && error !== null
	? JSON.stringify(error)
	: String(error);

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/api/src/routes/invites.ts
Line: 19

Comment:
**Object Rejections Lose Details**

When this handler catches a rejected plain object, `String(error)` logs only `[object Object]`. A D1 or binding failure shaped like `{ message, code }` would still return 500, but the log would lose the error fields that the previous `console.error(..., error)` output kept.

```suggestion
        : typeof error === "object" && error !== null
          ? JSON.stringify(error)
          : String(error);
```

How can I resolve this? If you propose a fix, please make it concise.

[is0692vs]

Closing this generated staging-to-main release PR per the staging-first policy; this review loop does not merge staging into main.