chore: upgrade TypeScript 6, Vitest 4, tsdown 0.21, Turbo 2.10 (#322)

[thedavidweng]

Issue

Implements 1weiho#322 (parent 1weiho#318).

Stacked on: cursor/oxlint-biome-split-21be (PR for 1weiho#321). Merge after that branch.

Exact scope

Upgrade repository build/test/typecheck tooling only:

• TypeScript
• @types/node
• Vitest
• tsdown
• Turbo

No React/Vite/Biome/Oxlint/runtime library upgrades in this PR.

Versions before → after

Package	Before	After
typescript (core/cli)	^5.9.3	^6.0.3
typescript (web)	^6.0.3	^6.0.3 (aligned)
typescript (root)	(none)	6.0.3
@types/node (core/cli)	^22.19.17	^22.19.21
@types/node (web)	^25.6.0	^22.19.21 (aligned to Node 22 contract)
vitest	^2.1.9	^4.1.10
tsdown	^0.9.9	^0.21.10
turbo	^2.9.18	^2.10.5

Base tip before this PR: eedfeaa9c21bb9dbaaf2c312863d6b0c7d0b2c87.

Why the old state was a problem

• Split TypeScript generations (5.x in core/cli vs 6.x on web) hid compatibility issues
• Vitest 2 still pulled Vite 5 into the test graph after the Vite 8 migration
• tsdown 0.9 lagged the Rolldown generation used by Vite 8
• Larger future migration gaps

Why these versions were chosen

TypeScript 6.0.3 (not 7)

TypeScript 7.0.2 is the latest stable, but it is not adopted here:

Candidate	Blocker
tsdown@0.22.8 (peers include typescript@^7)	engines.node is ^22.18.0 || >=24.11.0, incompatible with the repo’s Node >=22.13.0 contract from 1weiho#317
tsdown@0.21.10 (Node >=20.19.0, OK for 22.13+)	peers are typescript: ^5 || ^6 only — no TypeScript 7

Selected: TypeScript 6.0.3 (newest common stable supported by tsdown 0.21.10 + the Node 22.13+ contract).

Follow-up trigger: adopt TypeScript 7 when either (a) tsdown ≥0.22 lowers Node engines to include 22.13+, or (b) the repo intentionally raises engines to match tsdown 0.22+.

Official references:

• tsdown 0.22.8 engines / peers on npm
• tsdown 0.21.10 peers on npm
• Crash when running tsgolint: Option 'baseUrl' has been removed. oxc-project/tsgolint#351 (related toolchain Node/TS constraints elsewhere)

Other selections

• Vitest 4.1.10: latest stable; peers vite: ^6 \|\| ^7 \|\| ^8 — resolves the Vitest→Vite 5 leftover
• tsdown 0.21.10: newest stable compatible with Node 22.13+
• Turbo 2.10.5: latest stable
• @types/node 22.19.21: matches published engines.node >=22.13.0

Breaking changes reviewed

• Vitest 2→4: config still valid; 306 tests pass unchanged (no silent snapshot updates)
• tsdown 0.9→0.21: default output became .mjs/.d.mts; set fixedExtension: false to preserve .js/.d.ts export paths
• Deprecated external → deps.neverBundle
• Build target node18 → node22 (matches package engines)

Source changes required

• packages/core/tsdown.config.ts / packages/cli/tsdown.config.ts
• Workspace package.json version bumps + lockfile
• Changeset for core + cli

Tests added or changed

None required; existing suite green on Vitest 4 (306 tests).

Benchmark results

Same machine, Node 24.18.0, pnpm 11.13.1. Warm-up + 5 measured runs; medians.

Metric	Before	After	Change
pnpm typecheck warm	427 ms	387 ms	−40 ms
pnpm test	2138 ms	1859 ms	−279 ms
core package build	1582 ms	1652 ms	+70 ms
CLI package build	462 ms	488 ms	+26 ms
full monorepo build cold (turbo --force)	16736 ms	15766 ms	−970 ms
full monorepo build warm	~418 ms (cached)	366 ms	faster/cache
packed core size	275447 B	274869 B	−578 B
packed CLI size	54366 B	54374 B	+8 B

Core build is slightly slower; acceptable given newer Rolldown-based tsdown and preserved declaration quality.

Declaration / package comparison

• Public export paths unchanged (dist/index.js, dist/vite/index.js, dist/locale/index.js, .d.ts)
• Declaration internals remapped (hashed helper names / type export syntax for Locale/Plural) — no intentional public API change
• sync CLI code now inlined into dist/cli/bin.js (tsdown warns about ineffective dynamic import); CLI behavior unchanged

Security audit results

pnpm audit still reports ~28 lockfile findings (mostly website transitive). Vitest upgrade removes the Vitest→Vite 5 path. Remaining advisories deferred to 1weiho#323.

Advisory	Package/path	Severity	Runtime?	Before	After	Resolution
GHSA-gvmj-g25r-r7wr	apps/web>posthog-js>dompurify	low	website only	present	present	1weiho#323
(other unchanged web/transitive)	various	mixed	mostly no	present	present	1weiho#323

Manual validation

pnpm format:check / lint / typecheck / test / build  # pass (Node 24)
pnpm typecheck / test                                # pass (Node 22.13.0)
pnpm --filter @open-slide/core|cli pack              # pass

Clean fixture:

1. Installed packed CLI + core tarballs
2. open-slide init scaffold
3. Installed generated workspace with packed core (no workspace links)
4. open-slide build succeeded
5. Single React 19.2.7 instance (no duplicates)

Exports verified: @open-slide/core/vite (createViteConfig), @open-slide/core/locale (en/ja/zhCN/zhTW/format/plural). Main @open-slide/core entry still requires Vite virtual modules at runtime (unchanged).

Known limitations

• TypeScript 7 blocked as documented above
• tsdown 0.22+ blocked by Node engines vs chore: adopt Node.js 24 for development and support maintained LTS runtimes 1weiho/open-slide#317 contract

Prohibited workarounds

Confirmed not used: --force, --legacy-peer-deps, overrides/resolutions, patch-package, prereleases, blanket suppressions, silent snapshot churn, unrelated features.

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.

[thedavidweng]

Superseded by upstream PR 1weiho#372 (1weiho#372). The stacked fork branch has been rebased onto current main and re-pushed to the upstream repo as an independent/stacked PR. Closing this fork PR to avoid duplicate review.