[devin-ai-integration]

Purpose

• Prepare the 5.5.5 release from development at Add AUTH_TOKENS, per-account API token limits, and a main-site API token menu #1164 (c54c70f): the changelog since 5.2.24 (the last tagged release; 5.4.0 is folded in) plus the two release blockers found during release testing.
• This replaces MMGIS 5.5.5 release: changelog, locked plugin dependency installs, auth:migrate on released databases #1167. MMGIS-* branches are protected, so the bump-version job couldn't push its commit there, and neither can follow-up fixes. This branch has the same commits; MMGIS-5.5.5 already exists at the changelog commit.
• B1: production builds and Docker images broke the Layers tool's per-layer settings and download panels. scripts/install-plugin-deps.js ran npm install --no-package-lock, which re-resolved the whole dependency tree during npm ci's postinstall and moved postcss-minify-selectors from the locked 7.0.6 to 7.1.2. 7.1.2 minifies the li.download_on .layerExport, li.gears_on .settings rule in LayersTool.css into an :is(...) selector that matches nothing.
• B2: npm run auth:migrate, including --dry-run, crashed on any database from 5.2.24 or earlier with column "missions_viewing" does not exist. legacyImport.plan() selected that column unconditionally, but it's only added by the Users plugin's startup ALTER TABLE, and it arrived after 5.2.24.

Proposed Changes

• [FIX] scripts/install-plugin-deps.js: drop --no-package-lock and keep --no-save, so npm reads the lockfile and only adds the plugin packages.
• [FIX] Dockerfile: the runtime stage runs the plugin install with npm_config_omit=dev, so reading the lockfile doesn't pull dev dependencies into the image. The builder stage also runs the new lockfile check.
• [ADD] scripts/check-installed-lockfile.js: exits non-zero if any installed package in node_modules differs from package-lock.json. It runs in the Docker builder stage and in CI after npm ci.
• [FIX] API/permissions/legacyImport.js: plan() reads the users columns with User.describe() and selects only the legacy mission columns that exist. A missing missions_viewing is treated as unset, which matches how those databases behaved. Dry runs still don't change the database.
• [ADD] tests/migration/run-legacy-compat.sh: APPLY_WITH=cli runs the import with npm run auth:migrate before the upgraded server starts. The default still lets the server import on first start.
• [ADD] CI (playwright-tests.yml): a step running APPLY_WITH=cli bash tests/migration/run-legacy-compat.sh 5.2.24 against a database seeded by the 5.2.24 tag, plus the lockfile check after npm ci.
• [ADD] tests/unit/permissions-legacyImport.spec.js: a test for a users table without missions_viewing.
• [CHANGE] CHANGELOG.md: one ## 5.5.5 section covering everything since 5.2.24, replacing Unreleased and the untagged 5.4.0. The date is still November XX and will be set when the release is tagged.
• [CHANGE] CITATION.cff and AGENTS.md version references are set to 5.5.5. package.json gets 5.5.5 from the bump-version job.

Issues

• Found during 5.5.5 release testing (5 test sessions against c54c70f). Other findings, older product bugs and test-suite issues, are deliberately not in this PR.

Testing

• tests/unit: 1779 passed.
• B1:
  • Clean npm ci with the postinstall: postcss-minify-selectors stays at 7.0.6, and node scripts/check-installed-lockfile.js passes.
  • With the old flag, the same plugin install in a scratch copy changed about 470 packages.
  • npm run build succeeds, and tests/e2e/map/dynamic-style.spec.js passes 7/7. Two of those tests failed on the release-test build.
  • docker build:
    • the builder-stage check passes (all 1935 installed packages match the lockfile).
    • the runtime image has no dev dependencies (no webpack) and has ldapts 9.2.0, which is require-able.
    • the built CSS contains #layersToolList>li.download_on .layerExport,#layersTool #layersToolList>li.gears_on .settings{.
• B2 (tests/migration/run-legacy-compat.sh):
  • On a database seeded by 5.2.24, it passes both with the server import (default) and with APPLY_WITH=cli.
  • Before the fix it failed at the dry-run step.
  • Accounts, password hashes, login probes, sessions, tokens, missions and imported role bindings are preserved, and the dry run leaves the database snapshot unchanged.
  • The existing pre-auth-refactor base (10d74e11^) still passes.
• ESLint reports nothing on the changed JS files.

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/f6e20e2ef1744cf4892c180a45852830
Open in Devin Desktop: https://nasa-jpl-demo.devinenterprise.com/desktop/session/f6e20e2ef1744cf4892c180a45852830?variant=devin
Requested by: @tariqksoliman

---

🟢 Devin Review found nothing to fix · View findings

[devin-ai-integration]

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

✅ Version Already Updated

This PR includes a manual version update to 5.5.5-20261111

No automatic version bump needed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud