⬆ Bump monaco-editor from 0.55.1 to 0.56.0 in /dashboard (rebased)

[Chisanan232]

Rebases dependabot #1762 onto current main after Cargo.lock/dashboard churn from other merged dependency PRs left it conflicting.

Verified locally: tsc --noEmit clean, eslint clean, full test suite (3016 tests) passing, pnpm run build succeeds (monaco chunks bundle correctly).

Closes the need for #1762.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Chisanan232]

Closing — monaco-editor 0.56.0 changed its worker-loading strategy to spawn workers via blob: URLs, which the dashboard's strict CSP (script-src 'self', no worker-src set so it falls back to script-src) blocks:

Creating a worker from 'blob:http://localhost:4173/...' violates the following Content Security Policy directive: "script-src 'self'"

This breaks Playwright e2e tests on unrelated pages (Alerts) because Monaco appears to load eagerly somewhere shared, tripping the CSP violation regardless of whether the code editor is visible. Confirmed via local reproduction of the e2e failure — not a fixable dependency-bump issue; needs either a worker-src blob: CSP relaxation or a MonacoEnvironment override to avoid blob workers, both of which are application-level security tradeoffs that should get a deliberate review rather than ride in on a routine version bump. Re-open once that's decided.