chore(deps): update all dependency updates (major) #396
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -37,16 +37,16 @@ | |
| "eslint": "^10.0.0", | ||
| "globals": "^17.0.0", | ||
| "husky": "^9.1.7", | ||
| "jsdom": "^30.0.0", | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== package.json excerpt =="
nl -ba package.json | sed -n '34,46p'
echo
echo "== yarn.lock jsdom entries =="
rg -n '^jsdom@|jsdom@' yarn.lock | sed -n '1,40p'
echo
echo "== published jsdom metadata (registry) =="
python3 - <<'PY'
import json, urllib.request
url = "https://registry.npmjs.org/jsdom"
with urllib.request.urlopen(url, timeout=20) as r:
data = json.load(r)
print("dist-tags.latest:", data.get("dist-tags", {}).get("latest"))
versions = sorted(data.get("versions", {}).keys(), key=lambda s: [int(x) if x.isdigit() else x for x in __import__('re').split(r'(\d+)', s)])
print("recent versions:", versions[-8:])
PYRepository: ftrackhq/ftrack-javascript Length of output: 231 🌐 Web query:
💡 Result: As of today, July 27, 2026, the latest version of the jsdom package on npm is 29.1.1 [1][2][3]. This version was released on April 30, 2026 [4][5][3]. There is no official release of the jsdom package itself at version 30.0.0 [2][3]. While version 30.0.0 exists for related packages such as jest-environment-jsdom [6], it does not apply to the core jsdom library. Users should continue to track the official jsdom repository on GitHub for future release announcements [2]. Citations:
🏁 Script executed (no clone): Length of output: 2411 Use a published 🤖 Prompt for AI AgentsSource: MCP tools |
||
| "lint-staged": "^17.0.0", | ||
|
There was a problem hiding this comment. 🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win 🧩 Analysis chain🌐 Web query:
💡 Result: The minimum Node.js version required by lint-staged v17 is Node.js v22.22.1 [1][2][3]. Starting with v17, support for Node.js v20 was removed [1][2]. Citations:
🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== package.json ==\n'
sed -n '1,220p' package.json
printf '\n== Husky/pre-commit hooks ==\n'
for f in .husky/pre-commit .husky/*; do
[ -f "$f" ] && { echo "--- $f"; sed -n '1,120p' "$f"; }
done
printf '\n== CI/workflow Node references ==\n'
rg -n --hidden --glob '.github/workflows/*.yml' --glob '.github/workflows/*.yaml' 'node-version|setup-node|actions/setup-node|node [0-9]|NODE_VERSION|volta|engines' .github/workflows || trueRepository: ftrackhq/ftrack-javascript Length of output: 2709 🏁 Script executed: #!/bin/bash
set -euo pipefail
printf '\n== .nvmrc ==\n'
sed -n '1,40p' .nvmrc
printf '\n== CI workflow ==\n'
sed -n '1,120p' .github/workflows/ci.ymlRepository: ftrackhq/ftrack-javascript Length of output: 1395 Raise the Node engine floor or downgrade 🤖 Prompt for AI Agents
Comment on lines
+40
to
+41
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
echo "== package.json (relevant deps) =="
cat -n package.json | sed -n '1,140p'
echo
echo "== package manager config files =="
fd -a -t f 'package.json|yarn.lock|.yarnrc.yml|.npmrc|pnpm-lock.yaml|package-lock.json' .
echo
echo "== yarn.lock entries for mentioned packages =="
rg -n '^(jsdom|lint-staged|typescript|vite-plugin-dts)@|^ version "|^ resolution:|^ dependencies:|^ (jsdom|lint-staged|typescript|vite-plugin-dts):' yarn.lockRepository: ftrackhq/ftrack-javascript Length of output: 28880 Regenerate 🤖 Prompt for AI AgentsSource: MCP tools |
||
| "msw": "^2.12.7", | ||
| "pinst": "^3.0.0", | ||
| "prettier": "^3.7.4", | ||
| "typescript": "^7.0.0", | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | 🏗️ Heavy lift 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
printf '%s\n' '--- package.json dependency and engine sections ---'
cat -n package.json | sed -n '1,80p'
printf '%s\n' '--- vite.config.ts references ---'
rg -n -C 4 'vite-plugin-dts|rollupTypes|dts' vite.config.ts '**/vite.config.ts' 2>/dev/null || true
printf '%s\n' '--- typescript-eslint declarations and configuration ---'
rg -n -C 3 'typescript-eslint|`@typescript-eslint`|typescript' package.json .eslintrc* eslint.config.* 2>/dev/null || true
printf '%s\n' '--- lockfile entries ---'
rg -n -C 2 'typescript@|typescript-eslint|`@typescript-eslint/typescript-estree`|vite-plugin-dts' yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null | head -160 || trueRepository: ftrackhq/ftrack-javascript Length of output: 11824 🌐 Web query:
💡 Result: As of today, September 3, 2026, the status of TypeScript and its compatibility with the compiler API and ecosystem tools like typescript-eslint is as follows: TypeScript 7.0 Release TypeScript 7.0 was officially released on July 8, 2026 [1][2][3]. This version represents a major architectural shift, as it is a complete rewrite of the TypeScript compiler and language service into Go, designed for native execution and shared-memory multi-threading [4][5][1][6]. Microsoft reports that this native port typically provides speedups between 8x and 12x compared to the previous JavaScript-based compiler [1][6]. Compiler API Status TypeScript 7.0 does not currently include a stable programmatic compiler API [1][6]. Microsoft has stated that a new API will be introduced in the upcoming TypeScript 7.1 release [1][6]. In the interim, developers and tools that rely on the programmatic compiler API—such as certain features in Vue, Angular, Svelte, and linting tools—must continue using the JavaScript-based TypeScript 6.0 compiler, which is still maintained and can be used in parallel with TypeScript 7.0 [1][6]. typescript-eslint Compatibility Because TypeScript 7.0 involves a fundamental change in the underlying compiler architecture, compatibility with tools that rely on the TypeScript Compiler API is currently in a transitional state [1][6]. While TypeScript 6.0 remains fully compatible with existing tooling, the typescript-eslint project is actively working on integration for the new environment [7]. For environments requiring programmatic access to the compiler, or for specific linting workflows that depend on existing compiler API behaviors, developers are advised to utilize TypeScript 6.0 until the official release of TypeScript 7.1 and subsequent ecosystem updates [1][6]. Citations:
Keep TypeScript 6 for The resolved 🤖 Prompt for AI AgentsSource: MCP tools |
||
| "typescript-eslint": "^8.57.2", | ||
| "vite": "^8.0.0", | ||
| "vite-plugin-dts": "^5.0.0", | ||
|
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🔎 Supported by static analysis🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- package.json dependency and engine context ---'
sed -n '1,80p' package.json
printf '%s\n' '--- vite.config.ts ---'
sed -n '1,70p' vite.config.ts
printf '%s\n' '--- vite-plugin-dts references ---'
rg -n -C 3 'vite-plugin-dts|rollupTypes|bundleTypes' --glob '!node_modules/**' --glob '!dist/**' .
printf '%s\n' '--- lockfile entries ---'
rg -n -A 12 -B 2 'vite-plugin-dts@|vite-plugin-dts:' yarn.lock package-lock.json pnpm-lock.yaml 2>/dev/null || trueRepository: ftrackhq/ftrack-javascript Length of output: 6000 🌐 Web query:
💡 Result: In vite-plugin-dts v5, the rollupTypes option has been renamed to bundleTypes [1][2]. This change is part of a broader consolidation of all API Extractor-related configurations into a single, nested bundleTypes object [1]. Key migration details for the bundleTypes option include: - Consolidation: Previously top-level options related to bundling are now nested under bundleTypes [1]. - Configuration Mapping: - rollupTypes: true/false is now controlled by setting bundleTypes: true or omitting it (as false is the default) [1][3]. - bundledPackages is now bundleTypes.bundledPackages [1]. - rollupConfig is now bundleTypes.extractorConfig [1]. - rollupOptions is now bundleTypes.invokeOptions [1]. - New Configuration: You can now specify a path to an API Extractor configuration file using bundleTypes.configPath [1][4]. Example migration: // v4 dts({ rollupTypes: true, bundledPackages: ['my-package'], rollupConfig: { /*... / } }) // v5 dts({ bundleTypes: { bundledPackages: ['my-package'], extractorConfig: { /... */ } } }) Additionally, please note that the project has transitioned to the unplugin architecture [5]. While vite-plugin-dts v5 continues to serve as a compatibility shim, new projects or those performing migrations are encouraged to use the unplugin-dts package directly [6][5][7]. Citations:
Update the declaration-plugin configuration and lockfile.
🤖 Prompt for AI AgentsSource: MCP tools |
||
| "vitest": "^5.0.0", | ||
| "ws": "^8.19.0" | ||
| }, | ||
| "repository": { | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: ftrackhq/ftrack-javascript
Length of output: 1359
Disable persisted checkout credentials.
actions/checkoutleaves the GitHub token available to later repo-controlled commands by default. Addpersist-credentials: falseunless this job needs authenticated git access.Proposed fix
📝 Committable suggestion
🧰 Tools
🪛 zizmor (1.26.1)
[warning] 15-15: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
🤖 Prompt for AI Agents
Source: Linters/SAST tools