chore(deps): upgrade remaining runtime + website dependencies (#323) - #373
chore(deps): upgrade remaining runtime + website dependencies (#323)#373thedavidweng wants to merge 19 commits into
Conversation
Upgrade react/react-dom and matching types to 19.2.x across core, demo, and the generated template. Update RefObject typings for the React 19 nullability contract. Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
React 19 widens HTMLImageElement src to include Blob, which is incompatible with Next/fumadocs ImageProps. Keep string sources only for ImageZoom. Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Upgrade vite to 8.1.4 and @vitejs/plugin-react to 6.x. Replace deprecated optimizeDeps.esbuildOptions with optimizeDeps.rolldownOptions for virtual module exclusion. Fix website MDX ImageZoom typing exposed by the lockfile update. Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Unify all workspaces on TypeScript 6.0.3. Move Vitest to 4.1.10 (Vite 8 peer), tsdown to 0.21.10 (newest release compatible with Node 22.13+), and Turbo to 2.10.5. Keep .js/.d.ts output via fixedExtension: false and retarget package builds to node22. Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
… regenerate lockfile
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
…hangeset Co-authored-by: Davy <thedavidweng@users.noreply.github.com>
|
@thedavidweng is attempting to deploy a commit to the open-slide Team on Vercel. A member of the Team first needs to authorize it. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThis PR modernizes the monorepo for React 19, Vite 8, TypeScript 6, Vitest 4, and tsdown 0.21. It updates release metadata and workspace settings, targets Node 22 for builds, widens nullable ref types, and replaces esbuild virtual-module handling with Rolldown configuration. ChangesToolchain modernization
Estimated code review effort: 3 (Moderate) | ~25 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: Sequence Diagram(s)sequenceDiagram
participant createViteConfig
participant RolldownOptimizer
participant VirtualModules
createViteConfig->>RolldownOptimizer: Configure virtual-externals resolveId plugin
RolldownOptimizer->>VirtualModules: Resolve virtual:open-slide/* imports
VirtualModules-->>RolldownOptimizer: Return matching module id as external
RolldownOptimizer-->>createViteConfig: Preserve React as non-external
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.changeset/react-19-alignment.md:
- Line 6: Rewrite the one-line descriptions in
.changeset/react-19-alignment.md:6-6, .changeset/vite-8-migration.md:6-6,
.changeset/remaining-deps-refresh.md:6-6, and
.changeset/typescript-vitest-tsdown-turbo.md:6-6 as short, direct,
present-tense, user-facing release notes: state that generated workspaces
require React 19 at runtime, use Vite 8 with native Rolldown optimization,
runtime and CLI dependencies use compatible stable releases, and packages build
with tsdown 0.21 and TypeScript 6, respectively.
In `@packages/cli/template/package.json`:
- Around line 14-20: Revert the dependency changes in the CLI template manifest,
including the React, React DOM, type packages, and Vite entries shown in the
diff. Do not modify any package.json under packages/cli/template; use an
explicitly permitted source instead if these versions must change.
In `@pnpm-workspace.yaml`:
- Around line 5-18: Update the pnpm version pins in package.json, .npmrc, and CI
configuration to pnpm 10.26.0 or newer. Keep all tooling references aligned so
allowBuilds and exact-version minimumReleaseAgeExclude entries are evaluated
consistently for local development and CI.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ec80bc2c-a0a9-47a0-b23c-eade17b0b027
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (21)
.changeset/react-19-alignment.md.changeset/remaining-deps-refresh.md.changeset/typescript-vitest-tsdown-turbo.md.changeset/vite-8-migration.mdapps/demo/package.jsonapps/web/components/mdx.tsxapps/web/package.jsonpackage.jsonpackages/cli/package.jsonpackages/cli/template/package.jsonpackages/cli/tsdown.config.tspackages/core/package.jsonpackages/core/src/app/components/inspector/inspect-overlay.tsxpackages/core/src/app/lib/use-click-page-navigation.tspackages/core/src/app/lib/use-wheel-page-navigation.tspackages/core/src/app/routes/slide.tsxpackages/core/src/vite/config.test.tspackages/core/src/vite/config.tspackages/core/tsconfig.jsonpackages/core/tsdown.config.tspnpm-workspace.yaml
💤 Files with no reviewable changes (1)
- packages/core/tsconfig.json
| "@open-slide/cli": major | ||
| --- | ||
|
|
||
| Require React 19 for the runtime and generated workspaces. |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win
Use present-tense, user-facing changeset descriptions.
These descriptions are one line, but all use imperative verbs and read like implementation instructions. Rewrite them as release-note statements:
.changeset/react-19-alignment.md#L6-L6: Generated workspaces require React 19 at runtime..changeset/vite-8-migration.md#L6-L6: Generated workspaces use Vite 8 with native Rolldown optimization..changeset/remaining-deps-refresh.md#L6-L6: Runtime and CLI dependencies use compatible stable releases..changeset/typescript-vitest-tsdown-turbo.md#L6-L6: Packages build with tsdown 0.21 and TypeScript 6.
As per coding guidelines, .changeset/*.md descriptions must be short and direct, one line, present-tense, and describe what changed from a user’s perspective.
📍 Affects 4 files
.changeset/react-19-alignment.md#L6-L6(this comment).changeset/vite-8-migration.md#L6-L6.changeset/remaining-deps-refresh.md#L6-L6.changeset/typescript-vitest-tsdown-turbo.md#L6-L6
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.changeset/react-19-alignment.md at line 6, Rewrite the one-line
descriptions in .changeset/react-19-alignment.md:6-6,
.changeset/vite-8-migration.md:6-6, .changeset/remaining-deps-refresh.md:6-6,
and .changeset/typescript-vitest-tsdown-turbo.md:6-6 as short, direct,
present-tense, user-facing release notes: state that generated workspaces
require React 19 at runtime, use Vite 8 with native Rolldown optimization,
runtime and CLI dependencies use compatible stable releases, and packages build
with tsdown 0.21 and TypeScript 6, respectively.
Source: Coding guidelines
| "react": "^19.2.7", | ||
| "react-dom": "^19.2.7" | ||
| }, | ||
| "devDependencies": { | ||
| "@types/react": "^18.3.12", | ||
| "@types/react-dom": "^18.3.1", | ||
| "vite": "^5.4.10" | ||
| "@types/react": "^19.2.14", | ||
| "@types/react-dom": "^19.2.3", | ||
| "vite": "^8.1.4" |
There was a problem hiding this comment.
📐 Maintainability & Code Quality | 🟠 Major | ⚡ Quick win
Do not modify the CLI template manifest.
Revert Lines 14-20. This path is explicitly protected; if generated workspaces must adopt React 19/Vite 8, update the permitted source or revise the path instruction before merging.
As per path instructions, packages/cli/template/**/{package.json,open-slide.config.ts} must not touch package.json.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@packages/cli/template/package.json` around lines 14 - 20, Revert the
dependency changes in the CLI template manifest, including the React, React DOM,
type packages, and Vite entries shown in the diff. Do not modify any
package.json under packages/cli/template; use an explicitly permitted source
instead if these versions must change.
Source: Path instructions
| allowBuilds: | ||
| core-js: true | ||
| esbuild: true | ||
| msw: true | ||
| protobufjs: true | ||
| rolldown: true | ||
| sharp: true | ||
| minimumReleaseAgeExclude: | ||
| - fumadocs-core@16.11.5 | ||
| - fumadocs-ui@16.11.5 | ||
| - fumadocs-mdx@15.2.0 | ||
| - '@posthog/core@1.42.1' | ||
| - '@posthog/types@1.395.0' | ||
| - posthog-js@1.402.3 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
rg -n '"packageManager"|pnpm@' package.jsonRepository: 1weiho/open-slide
Length of output: 193
🌐 Web query:
pnpm 10.26.0 allowBuilds minimumReleaseAgeExclude exact version release age exclusion settings
💡 Result:
In pnpm 10.26.0, the settings allowBuilds and minimumReleaseAgeExclude are distinct configurations serving different security and workflow purposes [1][2][3]. They are not the same setting, nor does allowBuilds contain release age exclusion functionality [1][2][3]. allowBuilds Added in v10.26.0, allowBuilds is a configuration field used to manage the execution of package build scripts (e.g., postinstall) [4][1][2]. It replaces legacy settings like onlyBuiltDependencies and ignoredBuiltDependencies [1][5]. It is defined in your pnpm-workspace.yaml file as a map of package matchers to booleans, explicitly permitting (true) or blocking (false) script execution for specified packages [1][2]. minimumReleaseAgeExclude Added in v10.16.0 (with enhancements in v10.17.0 and v10.19.0), minimumReleaseAgeExclude is used in conjunction with the minimumReleaseAge setting [3][6]. While minimumReleaseAge mandates a waiting period (in minutes) after a package is published before it can be installed, minimumReleaseAgeExclude allows you to bypass this restriction for specific dependencies [3][6]. You can configure minimumReleaseAgeExclude in pnpm-workspace.yaml using: - Package names: - webpack [3][6] - Glob patterns: - '@myorg/*' [3][7] - Specific versions or disjunctions: - nx@21.6.5 or - webpack@4.47.0 || 5.102.1 [3][7] Summary of Differences Feature: allowBuilds | Purpose: Controls which packages are permitted to run build/install scripts [1][2]. Feature: minimumReleaseAgeExclude | Purpose: Exempts packages from the mandatory release-age installation delay [3][6]. Both settings are configured within the pnpm-workspace.yaml file [2][3][7].
Citations:
- 1: build: update pnpm to v10.26.0 (main) angular/angular-cli#32145
- 2: https://pnpm.io/settings
- 3: https://pnpm.io/10.x/settings
- 4: https://newreleases.io/project/npm/pnpm/release/10.26.0
- 5: https://pnpm.io/blog/releases/11.0
- 6: https://pnpm.io/blog/releases/10.16
- 7: https://charpeni.com/blog/protecting-against-compromised-packages-with-minimum-release-age
🌐 Web query:
pnpm 10.26.0 allowBuilds release age exclusion exact version settings
💡 Result:
In pnpm 10.26.0, the settings for managing dependency builds and those for managing release age exclusions are separate configurations [1][2]. 1. allowBuilds: Introduced in v10.26.0, this setting is used to manage build script permissions [1][3][4]. It replaced legacy fields like onlyBuiltDependencies and ignoredBuiltDependencies [1][5][4]. It accepts a map of package matchers (package names or patterns) to boolean values (true to allow, false to disallow) [3][4]. It does not involve "release age" exclusions; it is strictly for managing execution permissions of scripts like prepare, preinstall, and postinstall [1][3]. 2. Release Age Exclusions: This is handled by the setting minimumReleaseAgeExclude [2]. This setting is used in conjunction with minimumReleaseAge, which delays the installation of newly released packages to improve security [2]. If you need to allow a specific package to be installed regardless of its release age, you list it under minimumReleaseAgeExclude [2]. These two features serve different security purposes and are configured independently in your pnpm configuration file (typically pnpm-workspace.yaml) [3][2]. Example of independent configuration: minimumReleaseAge: 1440 minimumReleaseAgeExclude: - my-trusted-package allowBuilds: esbuild: true core-js: false
Citations:
- 1: https://pnpm.io/blog/releases/10.26
- 2: https://pnpm.io/blog/releases/10.16
- 3: https://pnpm.io/settings
- 4: https://newreleases.io/project/npm/pnpm/release/10.26.0
- 5: feat: create a new field for allowing/disallowing builds pnpm/pnpm#10311
🌐 Web query:
pnpm 10.19.0 release age exclude package version exact
💡 Result:
The pnpm 10.19.0 release, which introduced support for exact package versions in the minimumReleaseAgeExclude setting, was published on October 21, 2025 [1][2]. Before this release, the minimumReleaseAgeExclude setting only accepted package names, which would exclude all versions of that package from the minimum age requirement [3]. Pnpm 10.19.0 added the ability to specify exact versions or disjunctions (using ||) to create more granular exceptions [2][4]. For example: minimumReleaseAge: 1440 minimumReleaseAgeExclude: - nx@21.6.5 - webpack@4.47.0 || 5.102.1 It is worth noting that in subsequent versions, specifically in pnpm 11.9 (released June 2026), further improvements were made to address issues where multiple separate exact-version entries for the same package did not behave equivalently to a single disjunction entry [5][6]. Pnpm 11.9 corrected this behavior and ensured that multiple entries are treated as a single combined disjunction [6].
Citations:
- 1: https://github.com/pnpm/pnpm/releases/tag/v10.19.0
- 2: https://pnpm.io/blog/releases/10.19
- 3: https://github.com/pnpm/pnpm.io/blob/048c97bed74ea6696318086620ebd819df435a0b/docs/settings.md
- 4: chore(deps): update dependency pnpm to v10.19.0 (main) renovatebot/renovate#38914
- 5: minimumReleaseAgeExclude exact-version entries are not equivalent to a single disjunction entry pnpm/pnpm#12463
- 6: https://pnpm.io/blog/releases/11.9
🌐 Web query:
pnpm 10.26.0 allowBuilds settings
💡 Result:
In pnpm v10.26.0, the allowBuilds setting was introduced as the new, preferred configuration method for managing dependency build scripts [1][2]. It replaces the older, now-deprecated settings: onlyBuiltDependencies, onlyBuiltDependenciesFile, neverBuiltDependencies, and ignoredBuiltDependencies [3][1][4]. The allowBuilds setting is defined in your pnpm-workspace.yaml file as a map where keys are package name patterns and values are booleans [3][1][2]. This provides a centralized source of truth for build permissions [1][2]: - true: Allows the package to execute its build scripts (e.g., postinstall) [3][2]. - false: Explicitly denies the package from running its build scripts [3][2]. By default, any package not explicitly listed in allowBuilds is disallowed from running build scripts [3][2][4]. If an unlisted package attempts to run a script, pnpm will typically print an error (or a warning, depending on your strictDepBuilds setting) and may automatically add a placeholder entry to your pnpm-workspace.yaml file during installation to facilitate manual configuration [5][2][4]. You can manage these settings interactively using the pnpm approve-builds command, which updates the allowBuilds map in pnpm-workspace.yaml [5][4]. Additionally, pnpm automatically maintains this configuration when you use the --allow-build flag during installation commands like pnpm add [5][4].
Citations:
- 1: https://newreleases.io/project/npm/pnpm/release/10.26.0
- 2: build: update pnpm to v10.26.0 (main) angular/angular-cli#32145
- 3: pnpm/pnpm@cb367b9
- 4: https://pnpm.io/settings
- 5: https://pnpm.io/cli/approve-builds
Bump the pnpm tooling to support allowBuilds.
package.json pins pnpm@10.17.0, but allowBuilds is only supported from pnpm 10.26.0+, while exact-version minimumReleaseAgeExclude entries work from 10.19.0+. Align packageManager, .npmrc, and CI pnpm pins with this requirement; otherwise install-script approvals and release-age policy will still be evaluated differently for contributors and CI.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@pnpm-workspace.yaml` around lines 5 - 18, Update the pnpm version pins in
package.json, .npmrc, and CI configuration to pnpm 10.26.0 or newer. Keep all
tooling references aligned so allowBuilds and exact-version
minimumReleaseAgeExclude entries are evaluated consistently for local
development and CI.
|
Addressed CodeRabbit review: Changeset descriptions: The existing one-line descriptions already follow the repo's changeset style guide (short, direct, present-tense, user-facing). I tightened Template pnpm version pins: Already satisfied. |
2 participants
Issue
Closes / implements #323
Stacking note — please read
This PR depends on #372 (TS/Vitest/tsdown/Turbo), #370 (Vite 8), and #369 (React 19) — it upgrades many website/runtime packages whose peers assume the newer base. This branch is based on
mainand includes the React 19 + Vite 8 + TS/Vitest commits from #369, #370, and #372. The remaining-deps–specific changes are the last 8 commits.For review, please focus on these files (this PR only):
packages/core/package.json(thechalk,fast-glob,tailwind-merge,shadcn,react-image-crop,@babel/parser,@babel/types,@fontsource-variable/geistlines)packages/cli/package.json(thechalk,fast-globlines)apps/web/package.json(thefumadocs-*,motion,posthog-js,@tailwindcss/postcss,postcss,@types/mdxlines)pnpm-workspace.yaml(theallowBuilds+minimumReleaseAgeExcludesections).changeset/remaining-deps-refresh.mdOnce #369, #370, and #372 merge, I will rebase this branch onto
mainand the diff will shrink to only the remaining-deps changes.Exact scope
Upgrade remaining direct runtime/application dependencies only (CLI utilities, Tailwind/styling, UI interaction, routing/theme/store confirmation, Babel 7.x ceiling, icons/fonts, website stack). Deduplicate lockfile. Add changeset for published packages.
Does not change Node engines, React major, Vite, Oxlint/Biome split, TypeScript/Vitest/tsdown/Turbo, or product features.
Versions before → after
Upgraded
chalk(core, cli)^5.3.0/5.6.2^5.6.2/5.6.2fast-glob^3.3.2/3.3.3^3.3.3/3.3.3tailwindcss^4.2.2/4.2.2^4.3.2/4.3.2@tailwindcss/postcss(web)^4.2.4/4.2.4^4.3.2/4.3.2tailwind-merge^3.5.0/3.5.0^3.6.0/3.6.0cn()/ class mergingshadcn^4.12.0/4.12.0^4.13.0/4.13.0postcss(web direct)^8.5.13/8.5.13^8.5.19/8.5.19react-image-crop^11.0.10/11.0.10^11.1.2/11.1.2@babel/parser^7.29.2/7.29.2^7.29.7/7.29.7>=22.13.0@babel/types^7.29.0/7.29.0^7.29.7/7.29.7@fontsource-variable/geist^5.2.8/5.2.8^5.2.9/5.2.9next(web)16.2.416.2.10pnpm --filter web buildmotion(web)^12.38.0/12.38.0^12.42.2/12.42.2fumadocs-core/fumadocs-ui16.8.516.11.5fumadocs-mdx14.3.215.2.0posthog-js^1/1.372.61.402.3@types/mdx^2.0.13/2.0.13^2.0.14/2.0.14Not upgraded to latest stable
@babel/parser/@babel/types8.0.47.29.7engines.nodeis^22.18.0 || >=24.11.0, incompatible with this repo's#317contract>=22.13.0#317raises the floor to satisfy Babel 8 engines or Babel 8 relaxes enginespostcss(vianext)8.5.19(direct)8.4.31dompurify(viaposthog-js)>=3.4.11for GHSA-cmwh-pvxp-88823.4.2posthog-js@1.402.3depends ondompurify@^3.3.2resolving to3.4.2; no overrideWhy the old state was a problem
After Node 24 / React 19 / Vite 8 / TS 6 landings, leaving mixed Tailwind 4.2, Next 16.2.4, Fumadocs 14/16.8, and loose
posthog-js@^1kept avoidable peer/transitive drift and left reachable Next.js high advisories on the website production tree.Why these versions were chosen
Latest mutually compatible stable releases that install cleanly under
engines.node >=22.13.0, React 19, Vite 8, and TypeScript 6, without--force,--legacy-peer-deps, overrides, resolutions, aliases, patch-package, or prereleases.Breaking changes reviewed
Source changes required (this PR only)
packages/core,packages/cli,apps/web.pnpm-workspace.yamlminimumReleaseAgeExcludeentries for newly published fumadocs/posthog packages (age gate only; not an override)..changeset/remaining-deps-refresh.md(patch for@open-slide/core+@open-slide/cli).Tests added or changed
No new unit tests required; existing suite green (306 tests).
Security audit results
apps/web>nextnext@16.2.4next@16.2.10postcssvianext@16.2.10(8.4.31)dompurify@3.4.2viaposthog-js@open-slide/core/clipublish graphProd audit summary: before 28 (6 low / 14 moderate / 8 high) → after 9 (3 low / 6 moderate). No unexplained reachable high/critical remains on published packages; remaining findings are website-transitive with documented blockers.
Manual validation results
On Node 24.18.0 with pnpm 10.17.0 (current
maintoolchain, plus the React 19 + Vite 8 + TS/Vitest base):Known limitations
postcss@8.4.31advisory remains without overrides.posthog-js→dompurify@3.4.2advisories remain without overrides.mainafter those merge.Prohibited workarounds — confirmation
Did not use:
--force,--legacy-peer-deps, dependency overrides, Yarn resolutions, npm aliases to hide incompatibilities, patch-package, vendored forks, blanket TS/lint suppressions, silent snapshot updates, unrelated features/UI, mass unrelated formatting, or prerelease packages.Commit groups (bisectable)
chalk,fast-glob)tailwindcss, plugins,tailwind-merge,shadcn,postcss)react-image-crop)@types/mdx)Summary by CodeRabbit