chore(deps): apply pending renovate updates - #46
Merged
Conversation
Applies every update on the dependency dashboard except TypeScript v7, covering pnpm 11, zod 4, graphql 17, chokidar 5, jsdom 30, cspell 10, lint-staged 17, @vitejs/plugin-react 6, @testing-library/jest-dom 7, @types/node 24, eslint-plugin-unicorn 73 and pnpm/action-setup v6.0.10. TypeScript moves to 6.0.3 rather than 7. typescript-eslint throws on import under TS 7 because the native compiler no longer exposes the JS API its type-aware rules are built on, which takes the whole lint step offline rather than merely producing new errors. The 6.x line exists to bridge that gap; revisit once typescript-eslint ships TS 7 support. Three toolchain changes needed fixing alongside the bumps: pnpm 11 no longer reads `pnpm.overrides` from package.json, which silently dropped the lodash and brace-expansion pins. They move to `overrides` in pnpm-workspace.yaml, where the lockfile picks them up again. `allowBuilds` is declared explicitly to keep esbuild and unrs-resolver unbuilt, as they were before. TypeScript 6 drops automatic inclusion of @types packages, leaving the server without Node globals, so it now names `node` in `types`. It also requires an explicit `rootDir` when emitting, and writes a tsbuildinfo beside the config rather than into the ignored dist directory.
Bundle ReportChanges will increase total bundle size by 3.58kB (0.22%) ⬆️. This is within the configured threshold ✅ Detailed changes
Affected Assets, Files, and Routes:view changes for bundle: beans-web-web-esmAssets Changed:
|
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
`--with-deps` switches to root to install system libraries, and the runners have no passwordless sudo, so the E2E job failed before it ran a single spec. Those libraries are already on the runners; only the browser build has to track the pinned Playwright version, and it lands in the runner user's cache where no elevation is needed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Applies every update on the Renovate dependency dashboard (#44) except TypeScript v7, which is blocked upstream. Alongside the version bumps, three toolchain behaviour changes needed fixing — one of them a silently dropped security override.
Changes
@vitejs/plugin-react6,@testing-library/jest-dom7,@types/node24,eslint-plugin-unicorn73@tanstack/react-router, dompurify, marked, tsx,@hono/node-server, recharts, prettier, typescript-eslint, knip, vite,@types/react,@types/react-dompnpm/action-setupto v6.0.10, SHA-pinnedlodashandbrace-expansionoverrides, which pnpm 11 stopped reading frompackage.jsontypes: ["node"]androotDirto the tsconfigs that TypeScript 6 now requires them in*.tsbuildinfo, which TypeScript 6 writes beside the config rather than intodist/Why not TypeScript 7
typescript-eslint@8.66.0throws on import under TS 7:TS 7 is the native Go port, and its rewritten compiler no longer exposes the JS API that typescript-eslint's type-aware rules are built on. Because the whole ESLint config is typescript-eslint based, this takes the lint step offline entirely rather than merely producing new errors. The
typescript@6.xline is published to bridge exactly this gap; TS >=7.1 support is tracked in typescript-eslint/typescript-eslint#10940. Worth revisiting once that lands.Breaking changes in the toolchain
pnpm 11 no longer reads
pnpm.overridesfrompackage.json. Thelodashandbrace-expansionpins were being dropped without any error — the install simply stopped applying them. They now live underoverridesinpnpm-workspace.yaml, and the lockfile picks them up again.allowBuildsis also declared explicitly so esbuild and unrs-resolver stay unbuilt, matching prior behaviour.TypeScript 6 drops automatic inclusion of
@typespackages. This leftapps/serverwith no Node globals at all — everynode:import, plusBufferandprocess, failed to resolve. Confirmed against a minimal repro outside the repo: TS 5.9 passes and TS 6 fails on identical input. TS 6 also requires an explicitrootDirwhen emitting (TS5011), which only surfaced inpnpm build, not in the gate's typecheck.Contributors get pnpm 11 automatically through
packageManagerand corepack; no local action needed.Test Plan
pnpm format && pnpm lint && pnpm typecheck && pnpm -r test:coverage && pnpm knip && pnpm spell && pnpm codegen:check && pnpm check:pinspnpm buildacross all workspacesdocker build— the pnpm 11 install path in the imagepnpm --filter @beans-web/web e2e— 60/60 passingpnpm install --frozen-lockfilesucceeds; lockfile stays at v9.0715 unit and integration tests pass, coverage 98%+ on every workspace.
To validate the override fix specifically, confirm both pins survive a resolve:
grep -A3 '^overrides:' pnpm-lock.yamlReview Checklist
Open question
pnpm 11's new release-age gate auto-generated
minimumReleaseAgeExcludeinpnpm-workspace.yaml, pinning six exact versions. It works as-is, but will accumulate stale entries with every future Renovate bump. Left as generated — worth deciding whether to keep the gate or disable it withminimumReleaseAge: 0.Refs #44