chore(deps): upgraded stac-browser to version 5.0.0.

[pantierra]

Closes #597

[claude]

Claude finished @pantierra's task in 1m 54s —— View job

---

Reviewing PR #598

• Gather context (diff, repo files, CLAUDE.md)
• Review diff for correctness/security/best-practice issues
• Apply ponytail-review for over-engineering findings
• Post final review

---

✅ No blocking issues — safe to merge.

@lhoupert's earlier concern about browser_redirect_test.yaml being deleted without a replacement guard is already resolved: commits 25d5681 and 70bafed landed exactly the suggested fix.

• charts/eoapi/templates/networking/ingress.yaml:11 now gates the router.middlewares annotation on eoapi.traefikStripPrefixes returning a non-empty list.
• charts/eoapi/templates/networking/traefik-middleware.yaml:2-3 gates Middleware document rendering on the same helper.
• Both consult the single source of truth (eoapi.traefikStripPrefixes in charts/eoapi/templates/_helpers/networking.tpl:77), so the annotation and the Middleware can no longer drift out of sync — the Enabling stac-auth-proxy on Traefik breaks routing twice: dangling strip-prefix middleware (whole host 404s), and probes miss ROOT_PATH (pod never Ready) #568 dangling-router failure mode is structurally prevented rather than kept in sync by convention/comment as before.
• charts/eoapi/tests/traefik_middleware_test.yaml:45-64 adds the exact guard test the reviewer proposed (verifies 0 Middleware documents + no annotation when nothing needs stripping).

Rest of the diff checked out:

• charts/eoapi/templates/services/browser/deployment.yaml:29-31 — SB_pathPrefix computation (eoapi.browserIngressPath trimmed, then re-suffixed with / unless root) is correct and matches the upstream stac-browser v5.0.0 runtime-config convention documented in the now-deleted patches/stac-browser/README.md (this patch was exactly what got merged upstream, which is the stated motivation for the version bump).
• Test updates (stac_browser_tests.yaml, traefik_middleware_test.yaml) line up with the new template output (new SB_pathPrefix env at index 0, env count 2 instead of 1).
• tests/integration/test_browser.py correctly switches from asserting a 301 redirect to a 200, matching the removed redirectRegex Middleware (no longer needed since stac-browser 5.0.0 handles the bare path itself — confirmed no leftover browserRedirect/redirectRegex references anywhere in the repo).
• renovate.json and the deleted .github/workflows/stac-browser.yml / patches/stac-browser/* cleanly remove the now-unnecessary custom image build pipeline, consistent with switching to the upstream ghcr.io/radiantearth/stac-browser:5.0.0 image in values.yaml.
• No security concerns: no secrets, no new privilege/RBAC changes, no injection surface introduced.

Minor, non-blocking: no test exercises SB_pathPrefix when browser.ingress.enabled: false (browser served outside the chart's own ingress) — existing coverage gap, not a regression from this PR.

Simplify (ponytail)

Nothing to flag — this PR is net -472 lines and deletes a custom Docker build pipeline, a vendored patch, and a temporary redirect workaround in favor of consuming upstream directly. That's the lazy/correct direction, not over-engineering.

Note: I was unable to run helm unittest locally to execute the test suite (the helm command required interactive approval unavailable in this session) — review is based on static analysis of the templates and test assertions. Recommend confirming CI's helm-test job passes before merge.

---

💰 Estimated review cost: $0.56 · 1m54s · 31 turns

[lhoupert]

I just tried this release locally asking Claude to start a local kind cluster with traefik, It installed the chart from main, ran the upgrade on this branch and all worked well.

Just one ask, because this PR deletes browser_redirect_test.yaml. I created this test particularly to make sure the ingress annotation and the rendered middlewares are in sync. It is a guardrail against the issue documented #568 : when a Traefik ingress annotation names a Middleware that doesn't exist, Traefik doesn't just ignore it , it disables the whole router ☠️ (every route on the host 404s).

Why do you think about adding these two changes to the PR?

# templates/networking/ingress.yaml — only set the annotation when the middleware renders
{{- if and (eq .Values.ingress.className "traefik") (include "eoapi.traefikStripPrefixes" . | fromJsonArray) }}
{{- $_ := set $annotations "traefik.ingress.kubernetes.io/router.middlewares" (printf "%s-%s-strip-prefix-middleware@kubernetescrd" .Release.Na
mespace .Release.Name) -}}
{{- end }}

# tests/traefik_annotation_consistency_test.yaml
suite: traefik router annotation consistency
templates:
  - templates/_helpers/networking.tpl
  - templates/networking/ingress.yaml
  - templates/networking/traefik-middleware.yaml
set:
  ingress.enabled: true
  ingress.className: traefik
  ingress.host: eoapi.local
tests:
  - it: "omits the strip-prefix annotation when no middleware renders, so the router reference never dangles"
    set:
      browser.enabled: true
      stac.enabled: false
      raster.enabled: false
      vector.enabled: false
      multidim.enabled: false
      docServer.enabled: false
    asserts:
      - template: templates/networking/traefik-middleware.
        hasDocuments:
          count: 0
      - template: templates/networking/ingress.yaml
        notExists:
          path: metadata.annotations["traefik.ingress.kuberes"]

Then once this is merged we will have to make sure #586 (which fixes the same thing as part of the bigger ingress refactor) has a carefull rebase.

[pantierra]

Thanks for the review! Added both of your suggestions.

[lhoupert]

Guard and test look right, thanks!