chore(deps): update dependencies and hold typescript at 6.0.3 - #1062
Conversation
Adapts the workspace to the dependency bumps and reverts the TypeScript 7 upgrade, which the ecosystem cannot yet support. TypeScript is pinned back to 6.0.3 in both catalog entries. typescript-eslint caps its peer range at <6.1.0 in every published release including canary, and @visulima/packem-rollup at ^5 || ^6, so TS 7 breaks the build at @typescript-eslint/typescript-estree. TS 7 also drops the classic compiler API from the package root, which is what surfaced this. Adapts to three breaking changes that were masked behind that failure: - scripts/global-vitest.ts: extract the vitest globals by scanning the `declare global` block instead of calling ts.createProgram. Removes the only compiler-API dependency in the repo, so this survives a future TS 7 attempt. - eslint-plugin-tailwindcss 4.x: configs["flat/recommended"] was renamed to configs.recommended and collapsed from a two-element array to a single flat config object. - eslint-plugin-unicorn 72.x: prevent-abbreviations was renamed to name-replacements, and no-array-for-each to no-for-each. The latter stays "off" to preserve the existing intent, since it is "error" in the recommended config. The stale prevent-abbreviations overrides in both eslint.config.js files are renamed too; they had silently stopped applying. Also updates @visulima/fs to 5.0.5 and fixes the 60 lint errors that the new unicorn 72 and sonarjs 4.2 rules raised against this package's own source. Most were mechanical (consistent-conditional-object-spread); the rest were boolean renames, redundant optional types, and a memoisation rewritten as a cache object so it no longer assigns to a top-level binding from inside a function. Fixes a lint-staged-config bug surfaced along the way: removeIgnoredFiles built a bare ESLint instance, so it resolved the nearest config per file rather than the configured one. Files ignored by the configured config survived the filter and then failed the run with an "ignored file" warning under --max-warnings=0. Updates the two *-with-formatters markdown fixtures: prettier 3.9.5 preserves setext headings where 3.8.3 normalized them to ATX. Build, type check, lint and tests are green across all packages. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Moves the anolilab/workflows reusable workflows to 8249d8e (v20.2.10) and step-security/harden-runner to v2.20.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
browserslist-config-anolilab to @anolilab/prettier-config 10.0.1 and commitlint-config to @anolilab/eslint-config 28.0.1. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Adds the @visulima/vis security config with secure defaults from defineConfig() and an empty allowBuilds list. The package is not installed yet, so defineConfig() has no resolvable type and trips @typescript-eslint/no-unsafe-call. The file is added to the root eslint ignores alongside the other root tool configs until the dependency lands. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Peer resolution keys picked up supports-color@7.2.0; no version changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The eslint-config tests write generated projects into packages/eslint-config/tmp_fixtures/<name>/, each with its own package.json. The directory is gitignored, but its side effects were not: an install run while tests were in flight registered tmp_fixtures/js as a workspace project, and generate-labeler-config.js emitted labels for the scratch directories. Both landed in tracked files as spurious diffs. Excludes tmp_fixtures from the workspace globs, mirroring the existing __fixtures__ exclusion, and adds it to the labeler generator's EXCLUDED_DIRS. Verified by placing the artifacts on disk and re-running both: workspace scope stays at 8 projects and neither tracked file changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 9 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (53)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
Thank you for following the naming conventions! 🙏 |
|
Warning Review the following alerts detected in dependencies. According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.
|
Dependency ReviewThe following issues were found:
|
Three independent CI failures on this PR: - lint: the published @anolilab/eslint-config pulls sonarjs 4.0.3 transitively, which reads AST_NODE_TYPES.FunctionType at load and crashes against the eslint 10.7 bump. The sibling packages lint themselves with the published config, so an override pins sonarjs to the 4.2.0 this workspace already uses. All four lint:eslint projects pass again. - dependency-review: axios 1.16.1 carries GHSA-pmv8-rq9r-6j72, GHSA-xj6q-8x83-jv6g and GHSA-42h9-826w-cgv3, all patched in 1.18.0. Adds an override, following the existing pattern in this file. main is on 1.16.0 and equally affected; review only flagged it here because the version changed. - preview-release: the job pinned node-version 20.x while the repo requires >=22.12.0, so the newer setup step's npm 12 refused to install. Raised to 22.x, matching semantic-release and lock-file-maintenance. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The lint job never reached attw before — nx bailed at an eslint task first — so these three defects were latent. With eslint fixed they surface. - stylelint-config: `files` shipped index.d.ts but not index.d.cts/index.d.mts, which is what `exports` points at. The published package therefore resolves to no types at all on every condition. Live in v11.0.5. - browserslist-config-anolilab: `types` was hoisted to a single ./dist/index.d.cts covering both conditions, so ESM consumers got CJS declarations and attw reported it masquerading as CJS. Split into per-condition types; the build already emitted index.d.mts. - eslint-config, lint-staged-config: genuinely ESM-only, no CJS entry or output. CJSResolvesToESM is the expected shape rather than a defect, so these declare --profile esm-only instead of being papered over. All 7 attw projects pass. stylelint-config and browserslist now resolve types on node10, node16 from CJS, node16 from ESM and bundler. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Records the catalog:lint references for the @anolilab devDependencies and the browserslist-config-anolilab catalog entry. No version changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
browserslist-config-anolilab
@anolilab/commitlint-config
@anolilab/eslint-config
@anolilab/lint-staged-config
@anolilab/stylelint-config
commit: |
1 participant
Summary
Reverts the TypeScript 7 upgrade, which the ecosystem cannot yet support, and adapts the workspace to the dependency bumps that were sitting in the working tree behind it.
nx run eslint-config:buildwas failing atts.createProgram is not a function. That turned out to be the first of several independent breakages, each masked by the one before it — the&&chain inbuildshort-circuited beforepackemever ran.Why TypeScript 7 is reverted
TypeScript
7.0.2is genuinelylateston npm, so the bump wasn't a mistaken prerelease pull. The ecosystem just hasn't caught up:12 installed packages declare a typescript peer range excluding 7.x, including all 9
@typescript-eslint/*packages. TS 7 also drops the classic compiler API from the package root (exports: { ".": "./lib/version.cjs" }), so anything callingts.createProgrambreaks outright.typescriptis pinned back to6.0.3in both catalog entries — the newest version keeping the compiler API and inside typescript-eslint's<6.1.0range. The prior pin was deliberate, not stale.Breaking changes adapted
scripts/global-vitest.ts— extracts the vitest globals by scanning thedeclare globalblock instead of callingts.createProgram. Same 19 globals, and it removes the repo's only compiler-API dependency, so it survives a future TS 7 attempt.configs["flat/recommended"]renamed toconfigs.recommendedand collapsed from a two-element array to a single flat config object.prevent-abbreviations→name-replacements,no-array-for-each→no-for-each. The staleprevent-abbreviationsoverrides in botheslint.config.jsfiles are renamed too; they had silently stopped applying.Lint debt from the new rules
The plugin bumps raised 60 errors against this package's own source. 41 were mechanical (
consistent-conditional-object-spread); the rest were boolean renames, redundant optional types, condition reordering, and a memoisation rewritten as a cache object so it no longer assigns to a top-level binding from inside a function.Important
These rules arrive via
...pluginUnicorn.configs.recommended.rules, so adopting unicorn v72 ships them to every consumer of@anolilab/eslint-config. The 60 self-violations are a preview of what users hit on upgrade — worth a changelog note.Also included
@visulima/fs5.0.4 → 5.0.58249d8e(v20.2.10), harden-runner → v2.20.0@anolilab/lint-staged-configbug:removeIgnoredFilesbuilt a bareESLintinstance, resolving the nearest config per file rather than the configured one, so files ignored by the configured config survived the filter and then failed under--max-warnings=0tmp_fixtures/is gitignored but an install during a test run registered it as a 9th workspace project and the labeler emitted labels for itVerification
Build, type check, lint and tests green across all packages — 6 build, 7 type check, 16 tests.
Known issues, not addressed here
lint:eslintwill fail forcommitlint-config,lint-staged-config,stylelint-config. They lint themselves via the published@anolilab/eslint-config@28.0.1, whose transitivesonarjs@4.0.3crashes against theeslint 10.4.0 → 10.7.0bump (Cannot read properties of undefined (reading 'FunctionType')). Standard self-hosting lag — clears once this branch releases.minimumReleaseAge: 1440—@eslint-react/eslint-plugin5.17.3,@tanstack/eslint-plugin-query5.101.3,stylelint17.14.1,eslint-plugin-jsdoc63.2.0. All published within 24h. Not force-listed intominimumReleaseAgeExclude; they age out and a plainpnpm installpicks them up.vis.config.tsis committed but added to the root eslint ignores —@visulima/visisn't installed, sodefineConfig()has no resolvable type. Remove the ignore entry once the dependency lands.lib: ["es2021"]putse18e/prefer-object-has-ownand@typescript-eslint/no-unsafe-callin direct conflict atpackages/eslint-config/src/index.ts:1127. Left askey in optionswith a documented disable; bumpinglibto es2022 resolves it but changes the compile target for every package.Renovate
Supersedes 10 open Renovate PRs (#1051–#1061); every target is met or exceeded. Best left to auto-close once this lands, rather than closed manually — a manual close reads as rejection to Renovate.
🤖 Generated with Claude Code
https://claude.ai/code/session_014Hm4zrh4o8w3Qcs24BvpV9