Repository navigation
[Wave 4] Watch — Technology: items confirmed current, with follow-ups (part 2/2) #838
Description
Wave 4 · 17 technology item(s) the review found current on 2026-10-01. They are not defects, but most carry a follow-up — a floor to raise, a sentence to correct, a pin to bump — and every one should be re-checked before each release.
Items
-
TECH-T08-008 (technology, Watch) — Export and serving targets: SGLang as a serving target (absent from forgelm deploy) (current)
severity Watch
Item. SGLang as a serving target (absent from forgelm deploy) · verdict:current· urgency: Watch
State in ForgeLM. forgelm deploy supports only ollama, vllm, tgi and hf-endpoints (forgelm/deploy.py:7-11, :33; forgelm/cli/_parser.py:118). SGLang is not mentioned.
State of the ecosystem on 2026-10-01. SGLang is very active: PyPI 0.5.21 on 2026-10-01, 0.5.20 on 2026-09-18 and 0.5.19 on 2026-09-04, Apache-2.0. The official quickstart (docs.sglang.io, fetched today) launches withsglang serve MODEL_PATH --host 0.0.0.0 --port 30000, or the docker image lmsysorg/sglang:latest. python/sglang/launch_server.py on main warns that "'python -m sglang.launch_server' is still supported, but 'sglang serve…
Recommendation. Raise with the owner adding an 'sglang' target, either a docker-compose file using lmsysorg/sglang withsglang serve <model> --port ...or a YAML file forsglang serve --config. It could also be an image choice (vLLM/sGLang) for hf-endpoints. Check the exact flag names against SGLang's server-arguments docs when implementing.
Sources.- PyPI sglang (0.5.21, 2026-10-01) (2026-10-01)
- SGLang docs quickstart (sglang serve MODEL_PATH; lmsysorg/sglang image) (2026-10-01)
-
TECH-T09-010 (technology, Watch) — Experiment tracking, webhooks and monitoring: training.report_to tensorboard / wandb / mlflow / none (forgelm/config.py:604, forgelm/trainer.py:519) (current)
severity Watch
Item. training.report_to tensorboard / wandb / mlflow / none (forgelm/config.py:604, forgelm/trainer.py:519) · verdict:current· urgency: Watch
State in ForgeLM. A Literal of four values (default tensorboard) is passed straight to TrainingArguments.report_to at forgelm/trainer.py:519. There is no ForgeLM tracker code and no --report-to CLI flag.
State of the ecosystem on 2026-10-01. transformers 5.18.0 (PyPI 2026-09-30) still ships TensorBoardCallback (integration_utils.py:577), WandbCallback (:695) and MLflowCallback (:1286). Its TrainingArguments.report_to default is 'none' (checked in the latest venv), so ForgeLM's explicit default matters. Both researchers ran the three callbacks: xcheck with a 2-step tiny-qwen run on transformers 5.13.0, where MLflow needed a non-file U…
Recommendation. Keep the Literal. Add a CI smoke job that runs the three callbacks offline (sqlite URI for mlflow, WANDB_MODE=offline) at the lower and upper bound of each extra.
Sources.- transformers v5.18.0 integration_utils.py (TensorBoard/Wandb/MLflow callbacks) (2026-09-30)
- PyPI transformers metadata (5.18.0) (2026-09-30)
Related. Shares its root cause with CR-A01-035; fix them together.
-
TECH-T10-009 (technology, Watch) — Regulation: EU AI Act: Digital Omnibus on AI: the official number, OJ publication and entry into force of Regulation (EU) 2026/1744 (current)
severity Watch
Item. Digital Omnibus on AI: the official number, OJ publication and entry into force of Regulation (EU) 2026/1744 · verdict:current· urgency: Watch
State in ForgeLM. Only roadmap records name the act: docs/roadmap/risks-and-decisions.md:211 and docs/roadmap/phase-16-trust-surface-hardening.md:125,753-755 (planned S15 sweep). Code, README, user manuals, guides and site do not cite it.
State of the ecosystem on 2026-10-01. Regulation (EU) 2026/1744 of the European Parliament and of the Council of 8 July 2026 amends Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 (Digital Omnibus on AI). It was published in OJ L series 2026/1744 on 24.7.2026 (ELI http://data.europa.eu/eli/reg/2026/1744/oj, CELEX 32026R1744). Under its Art. 4 it entered into force on the third day after publication, 27.7.2026. Procedure…
Recommendation. Wherever the AI Act timeline or Art. 4a/10 is discussed, cite it as 'Regulation (EU) 2026/1744 (OJ L, 2026/1744, 24.7.2026, ELI http://data.europa.eu/eli/reg/2026/1744/oj)'. Do this as part of the S15 date sweep.
Sources. -
TECH-T10-010 (technology, Watch) — Regulation: EU AI Act: Harmonised standards for Art. 9-15/17 (CEN-CENELEC JTC 21: EN 18286, prEN 18228, 18229, 18282, 18284, 18285) and whether ForgeLM should map to them (current)
severity Watch
Item. Harmonised standards for Art. 9-15/17 (CEN-CENELEC JTC 21: EN 18286, prEN 18228, 18229, 18282, 18284, 18285) and whether ForgeLM should map to them · verdict:current· urgency: Watch
State in ForgeLM. ForgeLM maps to no harmonised standard and claims no conformity with one. docs/qms/ and docs/reference/ reference neither EN 18286 nor any prEN; the only standard mapping is ISO/IEC 27001 (docs/reference/iso27001_control_mapping.md:1). The Annex IV artefact and verifier have no point-7 'standards applied' entry (forgelm/verify/_annex_iv.py:34-44).
State of the ecosystem on 2026-10-01. EN 18286:2026 (QMS for EU AI Act regulatory purposes) was published by CEN-CENELEC in July 2026 (news posted 2026-07-31). No Commission implementing decision citing AI Act harmonised standards is in the OJ: - A Cellar SPARQL query run today for acts titled 'harmonised standard' since 2026-06-01 returned only other sectors (latest new decision 2026/2048 of 14.9.2026, batteries). - A query for AI o…
Recommendation. Do not claim conformity with, or presumption under, any harmonised standard. Watch the OJ for citations. Optionally add an Annex IV point-7 'standards_applied / solutions adopted' field. Later, map the evidence bundle to EN 18286 Annex ZA and, once cited, to prEN 18229-1, 18228 and 18284.
Sources. -
TECH-T10-011 (technology, Watch) — Regulation: EU AI Act: Art. 6 high-risk classification guidelines and an Annex IV template (simplified Art. 11(1) form) (current)
severity Watch
Item. Art. 6 high-risk classification guidelines and an Annex IV template (simplified Art. 11(1) form) · verdict:current· urgency: Watch
State in ForgeLM. The risk-tier fields are labelled 'Article 6 risk tier' (forgelm/config.py:1268,1320). ForgeLM has no classification logic: classification is operator input. The Annex IV artefact uses ForgeLM's own '§1-9' layout (forgelm/compliance.py:1770-1870).
State of the ecosystem on 2026-10-01. Art. 6(5) of Reg. 2024/1689 required the guidelines by 2 Feb 2026; the Omnibus did not change that deadline. The Commission published only DRAFT guidelines, in three parts (general principles, Annex I, Annex III), on 19 May 2026, with a targeted consultation to 23 June 2026. Retrieved today (2026-10-01), the library page is still titled 'Draft Commission guidelines', last updated 23 July 2026, an…
Recommendation. Do not present the tier field as a classification determination. Link the draft Art. 6 guidelines from the risk-classification docs as 'draft'. Watch for the final guidelines, the SME/SMC simplified form and the PMM-plan template, and add an export to the form once it is published.
Sources. -
TECH-T11-009 (technology, Watch) — Regulation and standards: GDPR, ISO/IEC 27001, SOC 2, ISO/IEC 42001, EDPB, EU Cyber Resilience Act: EDPB Guidelines 03/2026 on web scraping in the context of generative AI (relevance to ForgeLM's ing…
severity Watch
Item. EDPB Guidelines 03/2026 on web scraping in the context of generative AI (relevance to ForgeLM's ingest and data-collection docs) · verdict:current· urgency: Watch
State in ForgeLM. ForgeLM ingests external documents (forgelm ingest) and Hub datasets. The GDPR page covers lawfulness only as a one-line Art. 5(1)(a) table row (docs/usermanuals/en/compliance/gdpr.md:14) and does not address scraped-data lawfulness.
State of the ecosystem on 2026-10-01. Guidelines 03/2026 on web scraping in the context of generative AI, Version 1.0, were 'Adopted on 07 July 2026' as 'adoption of the guidelines for public consultation'. The EDPB news of 8 July 2026 says they cover the legal basis for scraping and the conditions for special-category data, that there is 'no general exemption from the requirements of Art. 9 GDPR', and that they 'will be subject to p…
Recommendation. After the final version is published, add a pointer in the GDPR page's lawfulness section (EN+TR). No code change.
Sources. -
TECH-T11-010 (technology, Watch) — Regulation and standards: GDPR, ISO/IEC 27001, SOC 2, ISO/IEC 42001, EDPB, EU Cyber Resilience Act: GDPR Art. 35 DPIA flag (data.governance.dpia_completed) and the planned ForgeLM DPIA template (curr…
severity Watch
Item. GDPR Art. 35 DPIA flag (data.governance.dpia_completed) and the planned ForgeLM DPIA template · verdict:current· urgency: Watch
State in ForgeLM. forgelm/config.py:799-801 defines a boolean dpia_completed described as 'Article 35 GDPR: Data Protection Impact Assessment completed for this dataset'. docs/usermanuals/en/compliance/gdpr.md:101-108 says ForgeLM does not write the DPIA, lists the audit outputs that feed it, and states 'A dedicated DPIA template is on the roadmap'.
State of the ecosystem on 2026-10-01. GDPR Art. 35 is unchanged (no amending act in CELLAR). The EDPB ran a public consultation on a common DPIA template from 14 April to 09 June 2026. Its page says the template 'will be finalised' and then adopted by all DPAs 'as their unique template or as a meta-template'. Regulation (EU) 2026/1744 (OJ L 2026/1744, 24.7.2026) replaces AI Act Art. 27(4): where a fundamental rights impact assessment…
Recommendation. No code change. When the EDPB template is final, point gdpr.md:108 to it instead of a ForgeLM template, and map data_audit_report.json, risk_assessment and compliance.risk_classification to its sections. Note the Art. 27(4) DPIA-to-FRIA cross-reference option in the AI Act docs (coordinate with T10).
Sources. -
TECH-T12-014 (technology, Watch) — Supply-chain tooling, network dependencies and vulnerability scanning: ubuntu-latest migration to Ubuntu 26.04 (every Linux job uses ubuntu-latest) (current)
severity Watch
Item. ubuntu-latest migration to Ubuntu 26.04 (every Linux job uses ubuntu-latest) · verdict:current· urgency: Watch
State in ForgeLM. All Linux jobs use runs-on: ubuntu-latest (e.g. ci.yml:24, publish.yml:17,115, nightly.yml:18,283); Python comes only from actions/setup-python (3.10-3.13); no apt-get, sudo or Docker steps in any workflow.
State of the ecosystem on 2026-10-01. GitHub (2026-09-17): the Ubuntu 26.04 image is GA; ubuntu-latest migrates from 24.04 to 26.04 gradually between 2026-10-19 and 2026-11-19, and the migration 'may break builds that rely on tools, packages, or versions that changed'; pinning ubuntu-24.04 keeps the current image. The actions/python-versions manifest has linux x64 26.04 builds for 3.10 (3.10.22), 3.11, 3.12, 3.13 and 3.14; the 26.04…
Recommendation. Run one workflow_dispatch of ci/nightly on ubuntu-26.04 before 2026-10-19, or pin ubuntu-24.04 for the release jobs until validated.
Sources.- GitHub Changelog: Ubuntu 26 GA and ubuntu-latest migration (2026-10-19..2026-11-19) (2026-09-17)
- actions/python-versions manifest (linux x64 26.04 builds for 3.10-3.14) (2026-10-01 (live main branch))
-
TECH-T12-017 (technology, Watch) — Supply-chain tooling, network dependencies and vulnerability scanning: tensorboard>=2.15.0,<3.0.0 (core) and rich>=13.0.0 ([chat] extra) (current)
severity Watch
Item. tensorboard>=2.15.0,<3.0.0 (core) and rich>=13.0.0 ([chat] extra) · verdict:current· urgency: Watch
State in ForgeLM. pyproject.toml:60 tensorboard>=2.15.0,<3.0.0 (core, default report_to); pyproject.toml:172 rich>=13.0.0 with no upper bound; installed tensorboard 2.21.0 (2.15.0 in the lower venv) and rich 15.0.0.
State of the ecosystem on 2026-10-01. tensorboard 2.21.0 (2026-06-29) and rich 15.0.0 (2026-04-12) are the latest; PyPI lists no advisories for tensorboard 2.15.0/2.21.0 or rich 13.0.0/15.0.0. The lower venv resolves protobuf 4.23.4 under tensorboard 2.15.0, which carries CVE-2025-4565 and CVE-2026-0994.
Recommendation. No change; consider moving tensorboard to an extra and adding rich<16 only if a future major breaks the chat REPL.
Sources.- PyPI tensorboard 2.21.0 (2026-06-29)
- PyPI rich 15.0.0 (2026-04-12)
-
TECH-T12-018 (technology, Watch) — Supply-chain tooling, network dependencies and vulnerability scanning: EU Cyber Resilience Act (Regulation (EU) 2024/2847): Art. 14 reporting from 2026-09-11 and the SBOM duty (current)
severity Watch
Item. EU Cyber Resilience Act (Regulation (EU) 2024/2847): Art. 14 reporting from 2026-09-11 and the SBOM duty · verdict:current· urgency: Watch
State in ForgeLM. No ForgeLM doc mentions the CRA; the SBOM is positioned for ISO 27001 / SOC 2 (docs/reference/supply_chain_security.md). ForgeLM is an Apache-2.0 toolkit published to PyPI by the HodeTech organisation.
State of the ecosystem on 2026-10-01. Regulation (EU) 2024/2847, CELEX 32024R2847, ELI http://data.europa.eu/eli/reg/2024/2847/oj, OJ L series 2024/2847 of 20.11.2024 (adopted 23 October 2024). Art. 71(1): in force on the twentieth day after publication (2024-12-10). Art. 71(2): applies from 11 December 2027; Art. 14 from 11 September 2026; Chapter IV (Articles 35 to 51) from 11 June 2026. Annex I Part II(1): manufacturers draw up 'a…
Recommendation. Record a written CRA scoping decision and, if in scope, an Art. 14 vulnerability and incident reporting procedure (security contact, CVD policy). Keep the SBOM format-neutral until an Art. 13(24) act exists. Not legal advice.
Sources. -
TECH-T12-019 (technology, Watch) — Supply-chain tooling, network dependencies and vulnerability scanning: setuptools>=83.0.0 build floor and PYSEC-2026-3447 (pyproject.toml:10-14) (current)
severity Watch
Item. setuptools>=83.0.0 build floor and PYSEC-2026-3447 (pyproject.toml:10-14) · verdict:current· urgency: Watch
State in ForgeLM. pyproject.toml:14 requires setuptools>=83.0.0; the comment at :10-13 calls it a security floor; nightly.yml:306 upgrades setuptools before pip-audit; MANIFEST.in contains only include/recursive-include lines. Installed: setuptools 81.0.0 in the project venv and the extras venv (affected), 84.0.0 in the latest and lower venvs.
State of the ecosystem on 2026-10-01. PYSEC-2026-3447 is real (OSV published 2026-07-08, modified 2026-07-14; aliases CVE-2026-59890, GHSA-h35f-9h28-mq5c; introduced 0, fixed 83.0.0): MANIFEST.in exclude/global-exclude/recursive-exclude/prune rules could fail to drop NFD-named files on macOS APFS/HFS+ from an sdist. GHSA rates it medium, CVSS 3.1 6.1 (AV:L/AC:L/PR:N/UI:R/C:H/I:L). setuptools 83.0.0 was released 2026-07-04 and require…
Recommendation. Keep the floor; correct the HIGH wording; upgrade the local venvs still on 81.0.0.
Sources.- OSV PYSEC-2026-3447 (setuptools, fixed 83.0.0) (2026-07-14 (modified; published 2026-07-08))
- GHSA-h35f-9h28-mq5c (medium, CVSS 6.1) (2026-07-21)
-
TECH-T12-020 (technology, Watch) — Supply-chain tooling, network dependencies and vulnerability scanning: pypa/gh-action-pypi-publish SHA-pinned v1.14.0 (publish.yml:136), PEP 740 attestations and SLSA provenance (current)
severity Watch
Item. pypa/gh-action-pypi-publish SHA-pinned v1.14.0 (publish.yml:136), PEP 740 attestations and SLSA provenance · verdict:current· urgency: Watch
State in ForgeLM. publish.yml:136 pins cef221092ed1bacb1cc03d23a2d87d1d172e277b ('# v1.14.0') with nowith:block; the publish job (ubuntu-latest, environment pypi, id-token: write) uses Trusted Publishing. No doc mentions PEP 740, Sigstore or SLSA.
State of the ecosystem on 2026-10-01. The signed annotated tag v1.14.0 (6733eb7, 2026-04-07) points at cef2210. Its action.yml setsattestationsdefault 'true' (PyPI/TestPyPI via Trusted Publishing). It contains a nested actions/setup-python v5.6.0 (node20) step guarded byif: steps.pre-installed-python.outputs.python-path == ''; GitHub's Ubuntu 24.04 and 26.04 images ship Python (3.12.3 and 3.14.4), so the step is skipped on ubu…
Recommendation. Re-pin to the v1.14.2 SHA (after verifying the tag object) together with the other action bumps; document PEP 740 verification (for example with pypi-attestations); do not claim a SLSA level; optionally add actions/attest-build-provenance for dist and SBOMs.
Sources. -
TECH-T13-011 (technology, Watch) — Python, platform, CI, container and GPU prices: GitHub-hosted runners: ubuntu-latest CI, release cross-OS ubuntu/macos/windows-latest x Python 3.10-3.13 installing torch>=2.4 from PyPI (current)
severity Watch
Item. GitHub-hosted runners: ubuntu-latest CI, release cross-OS ubuntu/macos/windows-latest x Python 3.10-3.13 installing torch>=2.4 from PyPI · verdict:current· urgency: Watch
State in ForgeLM. ci.yml:111,117 ubuntu-latest x 3.10-3.13; publish.yml:48-49 ubuntu/macos/windows-latest x 3.10-3.13 via actions/setup-python@v6; wheel install resolves torch from PyPI.
State of the ecosystem on 2026-10-01. runner-images README: ubuntu-latest = Ubuntu 24.04 x64, macos-latest = macOS 26 arm64, windows-latest = Windows Server 2025; -latest migrations are gradual over 1-2 months. actions/python-versions has darwin-arm64 and win32-x64 builds 3.10.11, 3.11.9, 3.12.10, 3.13.16, 3.14.8 (security-only lines get no new binaries). torch 2.14.1 ships cp310-cp314 wheels for macosx_14_0_arm64 and win_amd64 (and…
Recommendation. No change required. Optionally install the CPU torch build from https://download.pytorch.org/whl/cpu on Linux legs; pin runner labels if reproducibility matters; add 3.14 when the matrix widens.
Sources.- actions/runner-images README (available images and -latest labels) (2026-10-01 (main))
- actions/python-versions manifest (setup-python builds) (2026-10-01 (main))
-
TECH-T13-012 (technology, Watch) — Python, platform, CI, container and GPU prices: Intel macOS (x86_64) dropped because PyPI has no torch>=2.4 x86_64 macOS wheel (current)
severity Watch
Item. Intel macOS (x86_64) dropped because PyPI has no torch>=2.4 x86_64 macOS wheel · verdict:current· urgency: Watch
State in ForgeLM. pyproject.toml:47-51 comment, README.md:180 and docs/usermanuals/en/getting-started/installation.md:25: Intel Macs unsupported.
State of the ecosystem on 2026-10-01. torch 2.4.0 ships macOS wheels only as macosx_11_0_arm64; torch 2.14.1 only as macosx_14_0_arm64 (cp310-cp314). PyTorch RELEASE.md: macOS arm64 builds actively tested against macOS 14; MPS enabled on macOS 14 or later. GitHub's Intel macOS runners exist only as macos-26-intel/-large labels.
Recommendation. Keep. Optionally state 'Apple Silicon, macOS 14+' in installation.md (EN+TR).
Sources.- torch 2.14.1 PyPI metadata (files, requires_dist, classifiers) (2026-09-30 (upload))
- torch 2.4.0 PyPI metadata (files) (2024-07-24 (release))
-
TECH-T14-005 (technology, Watch) — Hard-coded model identifiers and model-merging methods: Llama 3.1 and Llama 4 community licences versus quickstart use, and gating versus the 'one-command quickstart' claim (README.md:10, docs/guides…
severity Watch
Item. Llama 3.1 and Llama 4 community licences versus quickstart use, and gating versus the 'one-command quickstart' claim (README.md:10, docs/guides/quickstart.md:25) · verdict:current· urgency: Watch
State in ForgeLM. README.md:10 says 'forgelm quickstart customer-support' generates a config and seed dataset, trains it and drops into chat. docs/guides/quickstart.md:25-58 sells a 'One-Command Quickstart Template' and lists only Qwen2.5/SmolLM2 ids. No bundled template enables the safety gate. Llama-3.1-8B appears only on the wizard / config_template surfaces (item 2). ForgeLM contains no Llama 4 reference (rg o…
State of the ecosystem on 2026-10-01. LLAMA 3.1 COMMUNITY LICENSE AGREEMENT (Version Release Date: July 23, 2024): a royalty-free licence that includes derivative works. On distribution of the materials or a derived AI model, the licensee must provide the Agreement, prominently display 'Built with Llama', and begin the derived model's name with 'Llama' (s.1.b.i). More than 700M MAU on the release date requires a separate Meta licence…
Recommendation. Hardening: emit the base model's licence id (from the Hub card metadata) aslicense:in the generated model card. For Llama-family bases, add a note on the 'Built with Llama' and 'Llama'-prefix duties. Do not adopt any Llama 4 model as a default without flagging the AUP's EU multimodal exclusion. Keep the quickstart templates on ungated repos (see item 1).
Sources.- LLAMA 3.1 COMMUNITY LICENSE AGREEMENT (Version Release Date: July 23, 2024) (2024-07-23)
- LLAMA 4 COMMUNITY LICENSE AGREEMENT (Version Effective Date: April 5, 2025) (2025-04-05)
Related. Shares its root cause with CR-A08-037; fix them together.
-
TECH-T14-006 (technology, Watch) — Hard-coded model identifiers and model-merging methods: Merge-method coverage: native linear, TIES, DARE (DARE-linear), SLERP (2 adapters) and the README 'model merging (TIES, DARE, SLERP, linear)' c…
severity Watch
Item. Merge-method coverage: native linear, TIES, DARE (DARE-linear), SLERP (2 adapters) and the README 'model merging (TIES, DARE, SLERP, linear)' claim (forgelm/merging.py:115-452, forgelm/config.py:186, README.md:159, docs/usermanuals/en/deployment/model-merging.md:22-27) · verdict:current· urgency: Watch
State in ForgeLM. config.py:186 is Literal['ties','dare','slerp','linear']. merging.py:115 implements linear; :181-185 SLERP (exactly two adapters, otherwise a warning and a linear fallback); TIES with sign election; and DARE without sign election (merging.py:432-452). README.md:159 lists 'model merging (TIES, DARE, SLERP, linear)'. docs/usermanuals/en/deployment/model-merging.md:27 (TR :27) says DARE 'pairs well…
State of the ecosystem on 2026-10-01. mergekit is the reference tool (main pushed 2026-09-12; PyPI 0.1.4, 2025-10-31; LGPL-3.0). It registers linear, slerp, nuslerp, multislerp, karcher, task_arithmetic, ties, dare_linear, dare_ties, breadcrumbs(_ties), della(_linear), sce, ram, model_stock, nearswap, arcee_fusion and passthrough. Its guide still documents SLERP (two models), TIES and DARE as first-class methods. It recommends linear…
Recommendation. Scope the docs: 'four baseline methods (linear, SLERP for two adapters, TIES, DARE-linear); for DARE-TIES, DELLA, Breadcrumbs, Model Stock or Karcher, use mergekit'. Reword the DARE-TIES sentence in the EN and TR manuals, or add dare_ties / task_arithmetic later as opt-in methods.
Sources.- mergekit Merge Method Guide (main): linear/slerp/nuslerp/multislerp/karcher/task_arithmetic/ties/dare/della/breadcrumbs… (main, retrieved 2026-10-01 (repo pushed 2026-09-12))
- mergekit merge-method registry (main) (2026-09-12 (repo pushed_at))
Related. Shares its root cause with CR-A01-041; fix them together.
-
TECH-T16-004 (technology, Watch) — Site and browser stack: ES2022+ browser APIs used by site/js/.js (current)
severity Watch
Item. ES2022+ browser APIs used by site/js/.js · verdict:current· urgency: Watch
State in ForgeLM. The site JS is ES5 in style: var and function expressions, with no arrow functions, let/const, async/await, ?. / ??, classes, .at(), structuredClone, replaceAll or regex lookbehind. The only ES2022 built-in is Object.hasOwn, called unguarded at site/js/i18n.js:53 (labelled ES2022 in the comment at i18n.js:47) and site/js/wizard.js:296. Post-ES5 APIs that predate 2022: Object.values (guide.js:364)…
State of the ecosystem on 2026-10-01. web-features 3.40.1 is still the npm latest today. object-hasown is Baseline widely available (low 2022-03-14, high 2024-09-14; Chrome/Edge 93, Firefox 92, Safari/iOS 15.4). dialog and scroll-behavior reached high on 2024-09-14, globalthis and string-trim-startend on 2022-07-15, promise-finally on 2021-04-02 and intersection-observer on 2021-09-25. color-mix reached high on 2025-11-09 (Chrome 111…
Recommendation. No change is required. Optionally state 'Baseline widely available' as the supported target in site/README.md. Keep the guards on clipboard and showModal. Recheck the floor before any move to mermaid 12 (ES2024 / Safari 17.4).
Sources.- WebDX web-features 3.40.1 data.json (Baseline status per feature) (2026-10-01 (npm publish of 3.40.1))
- web-features 3.40.1 data.json (independent fetch, same object-hasown status) (2026-10-01)
Related. Shares its root cause with CR-A18-065; fix them together.
Done when
- Each item's follow-up is done, or the item is re-checked and noted as still current (tick it here).
Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.
Metadata
Metadata
Assignees
Labels
Type
Projects
- StatusShow more project fieldsTodo
Activity