[DEFERRED] Major dependency migrations queue

[matthewod11-stack]

Description

Tracking issue for major-version dependency upgrades that need dedicated migration sessions, not fire-and-forget Dependabot merges.

Current backlog

Frontend

• React 18.3.1 → 19.x (closed PR npm: bump react-dom and @types/react-dom #51). Breaking changes: ref API, removed propTypes, suspense behavior. Needs npm run type-check + manual click-through across chat / roster / settings / import wizard before merge.
• Tailwind 3.x → 4.x (closed PR npm: bump tailwindcss from 3.4.19 to 4.2.4 #50). Rewrite, not bump — CSS-first config (@theme directives), new engine, tailwind.config.js gets gutted. Needs visual QA across every screen, especially the warm-stone palette + teal accents + Instrument Serif italic gradient + radial-glow hero treatment.

Rust (src-tauri)

All 5 cargo majors landed and were reverted in 2026-05-01 because of compile errors. PR CI only runs cargo audit (vulnerability check), not cargo build — so green CI didn't catch the API changes.

• rand 0.8 → 0.10: RngCore moved out of rand:: root; OsRng.fill_bytes() API changed. 4 call sites in backup.rs.
• hmac 0.12 → 0.13: new_from_slice removed/relocated. Affects chat.rs:556 (the trial proxy signing path — load-bearing, recently verified live in production).
• sha2 0.10 → 0.11: knock-on with hmac (Hmac binding).
• notify 7 → 8: type-conflict between notify::RecursiveMode and the debouncer's bundled notify::RecursiveMode. Affects documents/watcher.rs (just refactored in [MEDIUM] Document watcher: folder-deletion handling, debouncing, thread cleanup #38).
• calamine 0.26 → 0.34: Excel parsing. Errors short-circuited before this surfaced; may or may not need code changes.

Why this is one issue, not five

These should be migrated together in a single dedicated session because:

• The Rust cargo bumps share Cargo.lock and conflict on rebase
• The hmac/sha2/rand chain is interconnected (hmac depends on sha2 macros, RNG used in HMAC tests)
• A single migration session can run cargo test after each step instead of relying on PR CI

Approach when picking this up

1. Add a CI job that runs cargo build + cargo test + npm run type-check on PRs (not just cargo audit). This is the prerequisite — without it, the same trap will re-fire next time. Open this as a separate PR first.
2. After CI is real: reopen the cargo bump PRs (or let Dependabot re-offer), let them re-rebase, and merge as the new CI passes. Each major should land in its own commit.
3. Frontend (React 19 + Tailwind v4) belongs in its own session after cargo is sorted.

Automation Hints

scope: src-tauri/Cargo.toml + Cargo.lock + .github/workflows/, package.json + tailwind.config.js
do-not-touch: trial signing path until CI changes land
approach: refactor-types
risk: high
max-files-changed: 30
blocked-by: needs CI changes first
bail-if: cargo test fails after any single major bump

Priority

Low — all current deps are functional. Migrate when there's appetite for an intentional 2-3 hour session, not as a hot fix.

Related closed PRs (for reference)

• ci: bump actions/checkout from 4 to 6 #41-43 — GHA action bumps (merged, kept)
• npm: bump @tauri-apps/plugin-shell from 2.3.3 to 2.3.5 #44-48 — npm minor/patch bumps (merged, kept)
• npm(proxy): bump typescript from 5.9.3 to 6.0.2 in /proxy #49 — typescript proxy 5→6 (applied directly to main, kept)
• npm: bump tailwindcss from 3.4.19 to 4.2.4 #50 — tailwind v4 (closed, deferred — this issue)
• npm: bump react-dom and @types/react-dom #51 — react 19 (closed, deferred — this issue)
• cargo: update hmac requirement from 0.12 to 0.13 in /src-tauri #55-59 — cargo majors (merged then reverted in 2026-05-01)

[matthewod11-stack]

CI sub-task complete — 2026-05-01

PR-time CI now runs cargo build + test + tsc on every PR + push to main.

Workflow: ci.yml on main (commit 453beb3)

Verified on first push:

• tsc --noEmit (root): 18s ✓
• tsc --noEmit (proxy): 10s ✓
• cargo build + test (macOS): 3m29s ✓
• Run 25221479760

The Rust job runs on macOS-latest because src-tauri/Cargo.toml has cfg(target_os = "macos") blocks and notify uses macos_fsevent — Linux would skip those code paths and miss real bugs. Cost is 10x but the runtime is short (~30s warm, 3-4 min cold) so amortized cost per PR is acceptable.

This unblocks the rest of the migration backlog: the cargo majors (rand, hmac, sha2, notify, calamine), Tailwind v4, and React 19 can now be reattempted with confidence that real build/test failures will fail CI loudly, instead of merging on green-audit signal and breaking main.

The migration sessions themselves are still TBD per the issue body's rollout plan (cargo first, then frontend separately).

[matthewod11-stack]

2026-07-09 dependabot triage: told dependabot to ignore this major version on the 8 open major-bump PRs so the PR list reflects actionable work — the queue lives here, not as perpetually-stale PRs. Ignored (PR → migration):

• cargo: update notify-debouncer-full requirement from 0.4 to 0.7 in /src-tauri #137 notify-debouncer-full 0.4 → 0.7
• ci: bump tauri-apps/tauri-action from 0 to 1 #128 tauri-apps/tauri-action 0 → 1 ⚠️ release/signing workflow — take only inside a release cycle with a real signed-install verification (per the signed-install-before-release rule)
• cargo: update notify requirement from 7 to 8 in /src-tauri #86 notify 7 → 8
• cargo: update hmac requirement from 0.12 to 0.13 in /src-tauri #85 hmac 0.12 → 0.13
• cargo: update thiserror requirement from 1 to 2 in /src-tauri #84 thiserror 1 → 2 (was green on May CI — likely the easiest opener when this queue is picked up)
• npm: bump typescript from 5.9.3 to 6.0.3 #82 typescript 5 → 6
• npm: bump react and @types/react #79 react + @types/react major
• cargo: update sha2 requirement from 0.10 to 0.11 in /src-tauri #78 sha2 0.10 → 0.11

@dependabot ignore suppresses re-opening for that major only; the next major after these will still file a PR. When picking up this queue: @dependabot recreate on a closed PR resurrects it, or just bump manually.