Post-V1 ops: major dependency bumps (TS 6, @types/node 26, eslint 10)

[GmanFooFoo]

Three major Dependabot bumps were deliberately deferred from the V1 cut — a major version passing CI does not prove TS/eslint behaviour, and #7 is red. Tracked here so the deferral reason is not lost.

PR	Bump	State
#5	typescript 5.9 → 6.0	open, CI-green — major strictness/behaviour shifts CI will not catch
#6	@types/node 20 → 26	open, CI-green — major type surface; compiles green, needs a real check
#7	eslint 9 → 10	open, CI red — needs a red→green fix before merge

DoD: each bump lands behind a real behaviour check (not just green CI); #7 needs its red fixed first.

Context: TrustScope V1 close-out (2026-07-03), handoff neckarshore-planning:docs/plans/2026-07-03-trustscope-v1-closeout-handoff.md.

[GmanFooFoo]

Update 2026-07-09 (Linus): 2 von 3 gelandet, #7 upstream-blockiert.

PR	Bump	Ergebnis
#6	@types/node 20 → 26	✅ MERGED — full suite (tsc + Vitest + Playwright e2e) grün auf frischem main-Base; push:main grün
#5	typescript 5.9 → 6.0	✅ MERGED — tsc --noEmit unter TS 6 + full behaviour suite grün; push:main grün
#7	eslint 9 → 10	❌ upstream-blockiert, NICHT mergebar

Verhaltens-Check (DoD): Für #5/#6 = die 238-Test-Suite inkl. 48 Playwright-e2e auf frischem Base — grün. Das ist der echte Verhaltens-Nachweis, nicht nur tsc-Kompilierung.

#7 root cause (verifiziert, nicht vermutet):

• Fehler: TypeError: rule 'react/display-name': contextOrFilename.getFilename is not a function — ESLint 10 hat context.getFilename() entfernt.
• eslint-plugin-react kommt transitiv über eslint-config-next@16.2.10 (= neueste stabile).
• eslint-plugin-react@7.37.5 (neueste) hat Peer eslint: ...|| ^9.7 — keine veröffentlichte Version unterstützt ESLint 10.
• ESLint-10-Support bei Next nur in 16.3.0-preview.* (Pre-Release).
• → Kein npm-overrides-Fix möglich (kein kompatibles Ziel). Ein Fix ginge nur durch Abschalten der React-Regeln oder Preview-Pakete = Degradierung des Lint-Gates.

Empfehlung: #7 bleibt bei ESLint 9 geparkt, bis eslint-config-next stable ESLint 10 trägt. Issue bleibt offen für genau diesen Rest.

[GmanFooFoo]

#7 (eslint 9→10) reclassified: CI red, needs a fix → blocked upstream.

Root cause (primary-source verified): eslint 10 removed context.getFilename(). eslint-config-next@16.2.10 bundles eslint-plugin-react@7.37.5, which still calls it → lint crashes at rule-load. eslint-plugin-react@latest IS 7.37.5 (peer eslint: … || ^9.7) — there is no ESLint-10-compatible release to bump to. Not a red→green fix; an upstream wait.

Actions: PR #7 closed; Dependabot ignore for the eslint semver-major added (#87, merged) so it stops re-proposing (minor/patch still flow). Re-enable when eslint-config-next supports ESLint 10.

Note: the #5/#6 rows in the table are stale — typescript already moved to 6 (PR #68 now proposes 7); those are separate from this eslint block.

[GmanFooFoo]

TypeScript major (6 → 7) deferred 2026-07-12 — same class as the eslint-10 defer.

Dependabot PR #68 (TS 6.0.3 → 7.0.2) went red: @typescript-eslint/typescript-estree (bundled by eslint-config-next) reads TS internal APIs reshaped by the TS 7 native compiler port → the ESLint gate crashes at parser-load with TypeError: Cannot read properties of undefined (reading 'Cjs'). tsc --noEmit is green on TS 7 — lint-toolchain lag, not a compiler problem.

• Codified as a Dependabot ignore (typescript semver-major) in chore(ci): defer typescript major — Next lint stack can't parse TS 7 #89.
• chore(deps): Bump typescript from 6.0.3 to 7.0.2 #68 closed via @dependabot ignore this major version.
• Re-enable condition: remove the ignore once eslint-config-next's bundled typescript-eslint supports the TS 7 native API.

[GmanFooFoo]

Status reconciliation (2026-07-12) — the table in the issue body predates the actual outcomes; current ground truth:

PR	Bump	Outcome
#5	typescript 5.9 → 6.0	merged
#6	@types/node 20 → 26	merged
#7	eslint 9 → 10	closed — deferred; eslint-config-next peer-caps at eslint ^9.7
#68	typescript 6 → 7	closed — deferred; the Next lint stack (typescript-estree) cannot parse the TS 7 native port yet

Both deferred majors (eslint 10, TS 7) are now codified as version-update:semver-major ignores in .github/dependabot.yml, each with a documented re-enable condition (remove the ignore once the upstream lint stack supports it). This issue stays open as the standing tracker for that upstream unblock. The body table above is kept as history.

[GmanFooFoo]

TS7 blocker probe — 2026-07-14 (still deferred)

Live-tested the TypeScript 7 major against both CI gates on a throwaway branch off main (bef1dac); nothing merged/pushed.

Gate	Result on TS 7.0.2
tsc --noEmit (compiler)	✅ green (exit 0)
ESLint strict (npm run lint -- --max-warnings 0)	❌ crash at parser-load

Crash is unchanged from #89:

TypeError: Cannot read properties of undefined (reading 'Cjs')
  at .../eslint-config-next/node_modules/typescript-eslint/node_modules/@typescript-eslint/typescript-estree/dist/create-program/shared.js:59

Precise waterline (new): eslint-config-next@16.2.10 currently bundles typescript-eslint@8.64.0, which still reads the TS internal APIs reshaped by the TS7 native port. The compiler is ready; only the lint toolchain lags.

Re-enable condition (sharpened): remove the typescript semver-major ignore in .github/dependabot.yml once eslint-config-next bundles typescript-eslint > 8.64.0 with TS7-native support. Cheapest trigger: when a typescript-eslint / eslint-config-next bump lands via Dependabot, re-run this probe.

No action this round — defer stands. — Linus