chore(dips): major deps upgrades - #70
Merged
Merged
Conversation
Bumps verified by typecheck alone: - ramda 0.31.3 -> 0.32.0 - @types/ramda 0.30.2 -> 0.32.0 (realigns types with runtime) - next-themes 0.4.4 -> 0.4.6 - @storybook/addon-mcp 0.5.0 -> 0.7.0 Gate: typecheck + lint + unit (96 passed). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bumps whose real gate is the build, not typecheck: - @fontsource/inter 4.5.15 -> 5.3.0 (400/700/900.css paths unchanged) - vite-plugin-checker 0.12.0 -> 0.14.5 (config shape unchanged) - @types/node 25 -> 26.1.1 (root + server/, kept aligned) Verified: root+server typecheck, build, lint, unit (96 passed). Dev server boots with checker reporting 0 errors; Inter woff2 serves over dev (200) and 42 font files emit into dist/. Known non-fatal peer warning: vite-plugin-checker 0.14.5 wants eslint >=9.39.4, repo is on 9.39.2. Resolves in group 11 (eslint 10). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ui 6) - husky 8.0.3 -> 9.1.7: "prepare" is now bare `husky`; dropped the shebang + husky.sh sourcing lines from .husky/pre-commit per the v9 convention. `pnpm prepare` no longer emits the deprecation warning. - concurrently 9.2.1 -> 10.0.4 - @fastify/swagger-ui 5.2.5 -> 6.1.0 (server/) Verified: typecheck (root+server), lint, unit 96 passed. `pnpm dev:all` starts both processes with prefixing intact (5173 + 3001); /docs renders Swagger UI v6, /docs/json serves the OpenAPI spec, static assets and /api/products return 200. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Status: Planning -> In progress, next up group 4 - Execution table rows 0-3 struck through with commit SHAs - Tier A / B3 / B6 / C7 sections annotated so landed packages no longer read as outstanding work (B6 is partial: concurrently done, its three eslint plugins move to group 11c) - Execution log records two findings that carry forward: the vite-plugin-checker -> eslint >=9.39.4 unmet peer (resolves in group 11) and the local `pnpm test` birpc teardown flake that leaves the storybook suite unverified for groups 1-3 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- jsdom 21.1.2 -> 29.1.1 (8 majors; zero fallout in the unit suite) - @testing-library/jest-dom 6.9.1 -> 7.0.0; the /vitest import path in test-setup.ts is retained, no edit needed - Removed @types/testing-library__jest-dom (5.14.9) — types now ship with the package Dropping that stale types package exposed a latent bug: date.test.ts and use-relative-time.test.ts used it/expect/beforeEach/afterEach without importing them, relying on ambient Jest globals leaking in via its transitive @types/jest. Both now import from vitest explicitly, matching every other test file. Test bodies unchanged. Gate: typecheck, lint, unit 96 passed, storybook 27 files / 49 tests passed (run with --fileParallelism=false, see below). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- Status -> groups 1-4 landed; next up group 5 - Table row 4 struck through with SHA; row 5 marked next - B4/B5 sections annotated as done - Corrected the earlier "local concurrency flake" note: the storybook failures are /dev/shm exhaustion (64MB Docker default) crashing the Chromium page. Documented the --fileParallelism=false workaround (27 files / 49 tests green) and the durable --shm-size fix. This clears the storybook status for groups 1-3 too. - Logged the ambient-Jest-globals bug that removing @types/testing-library__jest-dom exposed - Noted the pre-existing unguarded data.meta.total in ProductsPage, verified present on the group-3 baseline and left unfixed as out of scope Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Docker's 64MB /dev/shm default crashes the Chromium page when Vitest runs Storybook story files in parallel, surfacing as "Browser connection was closed while running tests" / "[birpc] rpc is closed" with files reported failed or "Tests no tests". The same suite passes serially, which is what made it look like a flake. Adds "runArgs": ["--shm-size=1g"] (takes effect on container rebuild) and a one-line note in .claude/rules/testing.md pointing at the --fileParallelism=false workaround for pre-rebuild containers. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- zustand 4.5.4 -> 5.0.14
- query-string 8.2.0 -> 9.4.1
zustand v5 uses useSyncExternalStore strictly, so a selector returning
a fresh object every render is now an infinite loop ("The result of
getSnapshot should be cached" -> "Maximum update depth exceeded").
Six dialog components selected multiple keys into an object literal;
each is now split into atomic single-value subscriptions, matching the
selector style already used elsewhere in the codebase. Behavior is
unchanged.
Note: the spec's B1 audit targeted useAuthStore, whose 22 call sites
were all already clean. The breakage was in the modal-store consumers,
which B1 did not cover.
query-string v9 needed no source edits: stringify output is unchanged
(verified directly, incl. arrayFormat "comma"), and the ESM-only build
resolves fine. buildUrl has no unit test of its own; it is covered
indirectly via the MSW handler, which builds its match URL with it.
Gate: typecheck, lint, unit 96 passed, storybook 27 files / 49 tests
passed. E2E not run.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 62.1%
|
0.511.0 -> 1.27.0 (v1 is the first stable release). Spec targeted 1.26.0; 1.27.0 is now latest. Zero source changes needed. The v1 breaking changes are renamed and removed icons plus the deprecated-alias cleanup, but all 20 icons this repo imports across 24 files survived, including the aliases CheckCircle and AlertCircle that looked most at risk. Gates: typecheck clean (covers the LucideIcon/LucideProps seam in Icon.tsx), build ok, unit 96/96, storybook 49/49, lint clean. Also asserted all 20 named exports resolve at runtime, since typecheck alone would not catch an export that resolved to a loose type. Storybook needed --fileParallelism=false: this container predates 99f710d, so /dev/shm is still 64M. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 63.1%
|
src/lib/http/ had no tests at all, though spec 004 names an "MSW-backed src/lib/http unit suite" as group 7's gate and safety net for the ky 0.33 -> 2 migration. Writing it first, against ky 0.33, so it is a real before/after net rather than a description of already-migrated behaviour. Covers the contracts consumers branch on but tsc cannot see: - beforeError mapping to ResourceNotFoundException (GET 404 only), InternalServerException (empty body) and AjaxError otherwise - AjaxError.body carrying the full parsed payload, which parse-checkout-error reads for code/items/changes - the instanceof chain ErrorPageStrategy, ErrorBoundary and the Product page rely on, plus status/name/message - beforeRequest bearer-token injection, present and absent 17 tests, green on ky 0.33.3. Mutation-checked the key one: simulating ky 2's response-body pre-consumption fails the two body tests, which is the silent regression this suite exists to catch. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
0.33.3 -> 2.0.2, spanning two majors. Five breaking changes hit us, three of which tsc caught and two of which it could not: - beforeRequest/beforeError hooks now take a state object rather than positional args, and beforeError no longer receives a response — it comes off error.response, and only for HTTPError. Guarded with the new isHTTPError type guard so network/timeout failures propagate untouched instead of being mislabelled InternalServerException. - ky now pre-consumes the response body into error.data before beforeError runs, so the old response.clone().json() would fail. It sat inside a try/catch, so this would have silently emptied AjaxError.body and broken checkout's OutOfStock/PriceChanged/ PromoInvalid recovery with no type or test error anywhere. - prefixUrl was replaced by baseUrl, which resolves per URL semantics: without a trailing slash the last path segment is replaced, so .../api + products would have dropped /api from every request. - AjaxError now extends KyError rather than HTTPError. ky 2 types HTTPError["name"] as the literal "HTTPError", which makes it unsubclassable when the subclass needs its own name; ky's own NetworkError/TimeoutError extend KyError for exactly this reason. Nothing in the app used instanceof HTTPError or error.response — consumers branch on AjaxError plus status/body/message/name — so the response/request/options fields simply move onto AjaxError. Gates: http suite 17/17 (added in a66d6a7 against 0.33, so it is a true before/after), unit 113/113, storybook 49/49, typecheck, lint, build. Verified against the live API in a browser: products load from /api/products with params intact, and an unknown id still renders the ResourceNotFoundException page. E2E is failing independently of this change — 10 failures on the 0.33 baseline vs 5 here. Not caused by the upgrade; needs its own look, likely test-data state since the runs mutate server db.json. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 62.5%
|
Bump the four version-locked i18n peers together: - i18next 25.7.4 -> 26.3.6 - react-i18next 16.5.1 -> 17.0.11 - i18next-chained-backend 4.6.3 -> 5.0.5 - i18next-http-backend 3.0.2 -> 4.0.0 No source changes needed: the `satisfies InitOptions` / ChainedBackendOptions / HttpBackendOptions blocks in i18n.ts all still conform, and reloadResources/changeLanguage in the HMR block are unchanged. The unit and storybook suites init i18n with in-memory `resources` and never install ChainedBackend/HttpBackend, so the two backend bumps were verified against the running app instead — locale JSON served 200 and rendered copy checked in a browser on / and /products with no raw keys and no console errors. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 63.6%
|
react-router 7.18.1 -> 8.3.0. No source changes: the app only uses v8-stable data-router APIs (createBrowserRouter, createMemoryRouter, RouterProvider, ScrollRestoration, useRouteError, Link, useNavigate, Outlet) and had no `future` flags to retire. storybook-addon-remix-react-router stays at 6.1.0. It is the latest release and declares `react-router: ^7.0.2`, but that range is a declaration lag rather than a real incompatibility: it imports only createMemoryRouter, RouterProvider, UNSAFE_RouteContext, useLocation, useParams, useSearchParams and useNavigationType, all of which still exist in 8.3.0. The story suite passes unchanged, so the peer warning is silenced via pnpm.peerDependencyRules instead of holding back react-router. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 62.5%
|
msw-storybook-addon 2.0.7 -> 3.0.0. v3 removes `initialize()` and inverts control of the worker: rather than the addon creating and starting it for you, you supply a setup function that calls setupWorker(), awaits worker.start(options) and returns it. The CSF 3.0 entry point also moved to the `/csf3` subpath, where `mswLoader` is now called rather than passed by reference. This project is on CSF 3.0, so `parameters.msw` is preserved and the 13 story files using it are untouched. The custom onUnhandledRequest callback moves into worker.start() with its behaviour intact — verified in a browser: an unhandled /api/* request warns, a /locales/*.json request stays silent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 63.3%
|
Bump eslint 9.39.2 -> 10.8.0 and @eslint/js 9.39.2 -> 10.0.1. Migrate the deprecated eslint-plugin-vitest 0.5.4 to @vitest/eslint-plugin 1.6.24 — the plugin's API surface (rules, configs.recommended, environments.env.globals) is unchanged, so only the import specifier moved. eslint-plugin-react-hooks stays pinned at 5 (group 11b). Two config consequences: - settings.react.version moves from "detect" to a pinned "19.2". The plugin's version detection calls context.getFilename(), removed in ESLint 10, which crashed the entire run. Pinning bypasses detection. - eslint-plugin-import and eslint-plugin-react declare eslint peer ranges ending at 9 with no eslint-10-aware release published. Verified their removed-API call sites are all guarded and silenced the warnings with pnpm.peerDependencyRules. Also resolves the vite-plugin-checker@0.14.5 unmet peer (eslint >=9.39.4). Gates: typecheck, lint, 113 unit, 27 files / 49 storybook. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bump eslint-plugin-react-hooks 5.2.0 -> 7.1.1, which ships the React
Compiler-powered rules (2 rules under v5, 17 under v7).
The preset cannot be spread directly: in 7.1.1 every exported config —
including configs.flat["recommended-latest"] — declares `plugins` as a
string array, the eslintrc shape flat config rejects. eslint.config.mjs now
builds the flat config from the plugin object plus that preset's rule list.
Re-check on the next bump.
The violation wave was far smaller than the spec budgeted: 12 errors across
5 files, all from the new react-hooks/refs rule, in two categories:
- False positives (8, MoneyInput/NumberInput). Passing react-hook-form's
field.ref — a callback ref registrar, not a useRef object — to a ref prop
makes the rule treat all of `field` as a ref, flagging every field.* read.
Confirmed by bisection: removing ref={field.ref} clears all four per file.
- Intentional idiom (4, both AuthProviders + use-form). Lazy ref init, where
reading .current during render is the point of the pattern.
Neither is a real defect, so both are suppressed at the site with AIDEV-NOTE
anchors rather than rewriting working code. --report-unused-disable-directives
is enabled, so these fail the build once upstream stops needing them.
Gates: typecheck, lint, 113 unit, 27 files / 49 storybook, E2E 10/10.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Bump the three remaining B6 lint plugins: eslint-plugin-react-refresh 0.4.26 -> 0.5.3, eslint-plugin-react-you-might-not-need-an-effect 0.8.5 -> 1.0.1, eslint-plugin-boundaries 6.0.2 -> 7.1.0. boundaries v7 renamed the `rules` option to `policies`; eslint.feature-slices.mjs follows. The legacy string selector syntax inside typeRules is still honoured (v7 emits an advisory, not an error), so migrating those to object selectors is left as a separate change. Per B6, verified the feature-slice rules still fire rather than trusting a green lint: injected a models/ -> components/ import and confirmed boundaries/dependencies errors with both captured feature="carts" values resolved, proving the capture-based selectors that block cross-feature imports survive the rename. Reverted after. react-refresh 0.5's stricter only-export-components flags two route modules where Component is assigned from an HOC call — the rule cannot prove a call returns a component. pages/Products, which assigns a plain identifier, is not flagged, which isolates the trigger. Suppressed at both sites. ymnnae 1.0 no longer reports no-pass-data-to-parent in conditional-rendering.ts, so its now-unused eslint-disable is removed (it failed --report-unused-disable-directives). Gates: typecheck, lint, 113 unit, 27 files / 49 storybook, E2E 10/10. One storybook run failed 1 test on the documented 64 MB /dev/shm exhaustion; three consecutive reruns were 27/27. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
SummarySummary
CoverageDefault - 62.7%
|
SummarySummary
CoverageDefault - 62.4%
|
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.