build: upgrade minor dependencies - #1366
Merged
Merged
Conversation
Run npm-check-updates across all workspaces with --target minor to bump every package to its latest minor (and patch) release. Notable upgrades: - React 18.2 -> 18.3, @types/react 18.2 -> 18.3 - TypeScript 4.8 -> 4.9 (root), 5.2 -> 5.9 (website) - eslint 8.24 -> 8.57, eslint-plugin-react 7.31 -> 7.37 - @docusaurus/* 3.3 -> 3.10 - webpack 5.76 -> 5.111, webpack-dev-server 4.11 -> 4.15 - prettier 2.4 -> 2.8 - jest/ts-jest 29.1 -> 29.7 - react-spring 9.5 -> 9.7, broadcast-channel 4.17 -> 4.20 - formidable-oss-badges 1.4 -> 1.7 Code changes required to keep CI green after the bump: - use-full-screen.ts: TS 4.9 narrows the post-`in` operand type more strictly, so type the webkit-prefixed element explicitly instead of relying on a non-null assertion. - slide.tsx + print-mode/index.tsx: TS 4.9 blocks emitting .d.ts that reference private @react-spring/web paths (TS2742). Annotate AnimatedDiv with a public React.ComponentType<AnimatedProps<any>> and cast the styled-components selector interpolation accordingly. Also drop the now-unused @ts-expect-error on the onClick handler. - remark-rehype-directive.ts: prettier 2.8 wraps `typeof X[Y]` in parentheses; auto-fixed. - examples/mdx/index.js: eslint-plugin-react 7.34+ flags ReactDOM.render as deprecated; switch to createRoot from react-dom/client, matching the other examples. - website/tsconfig.json: TS 5.x enforces module=Node16 whenever moduleResolution=Node16 (TS5110), and the upstream @tsconfig/docusaurus still references @docusaurus/theme-classic (not a direct dep). Override module/moduleResolution and trim types to the package-types alias. - website/src/components/index/more-oss.tsx: formidable-oss-badges 1.5+ removed the `featuredBadgeNames` export; build the allow-list locally and render <FeaturedBadge name=... /> for the known featured products. - pnpm-workspace.yaml: pin onlyBuiltDependencies for @parcel/watcher, core-js, and esbuild so pnpm >=10 stops complaining about ignored postinstall scripts. Verified locally with `pnpm run check:ci` and `pnpm run build`.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
🦋 Changeset detectedLatest commit: 345a7b9 The changes in this PR will be included in the next version bump. Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
ryan-roemer
reviewed
Sep 22, 2026
Add the missing changeset for the minor dependency upgrade. The wireit config for examples/one-page was missing the build inputs that affect the generated index.html (packages/spectacle/package.json, package-scripts.js, webpack.config.base.js). Without them, wireit restored a stale cached output built before the dep bump, which made the post-build `git diff` check fail on CI even though the local build matched HEAD.
The minor dep upgrade also moved the lockfile to lockfileVersion 9.0 (pnpm 9+ format). Pnpm 7 (used by all three workflows) prints "Ignoring not compatible lockfile" and re-resolves from scratch, which mutates the lockfile on disk and makes the post-build `git diff` check fail. Switch the pnpm action to v10 so CI installs the lockfile the project ships instead of regenerating one it can't parse.
Pnpm 10+ reads neverBuiltDependencies / onlyBuiltDependencies from pnpm-workspace.yaml only. The package.json entry now conflicts with the onlyBuiltDependencies whitelist (pnpm 10 errors with ERR_PNPM_CONFIG_CONFLICT_BUILT_DEPENDENCIES) and is also redundant: onlyBuiltDependencies effectively excludes puppeteer, since puppeteer isn't on the whitelist.
Pnpm 10 errors out with ERR_PNPM_LOCKFILE_CONFIG_MISMATCH when .auto-install-peers doesn't match settings.autoInstallPeers baked into pnpm-lock.yaml. The lockfile was rewritten to autoInstallPeers: true during the minor upgrade, so flip .npmrc to match.
pnpm 12's first install in this workspace injected an allowBuilds block with literal "set this to true or false" placeholders that aren't valid YAML booleans. The block is redundant alongside onlyBuiltDependencies (which already gates which postinstall scripts may run) and is silently ignored by pnpm 10 (the CI version), so just drop it.
ryan-roemer
approved these changes
Sep 24, 2026
ryan-roemer
left a comment
ryan-roemer
left a comment
Member
There was a problem hiding this comment.
I had to add some pnpm config stuff in a commit, but otherwise everything looks good! I tried out all the examples and one-page.
For the future, there's a lot of cruft we'll eventually want to tackle like:
- The whole frontend infra. Get off webpack? (but what does that mean for mdx plugin)
- Get off wireit?
... but for another day. For now, let's just 
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Run npm-check-updates across all workspaces with
--target minorto bump every package to its latest minor (and patch) release.Notable upgrades:
Changes
Code changes required to keep CI green after the bump:
use-full-screen.ts— TS 4.9 narrows the post-inoperand type more strictly, so type the webkit-prefixed element explicitly instead of relying on a non-null assertion.slide.tsx+print-mode/index.tsx— TS 4.9 blocks emitting.d.tsthat reference private@react-spring/webpaths (TS2742). AnnotateAnimatedDivwith a publicReact.ComponentType<AnimatedProps<any>>and cast the styled-components selector interpolation accordingly. Also drop the now-unused@ts-expect-erroron theonClickhandler.remark-rehype-directive.ts— prettier 2.8 wrapstypeof X[Y]in parentheses.examples/mdx/index.js—eslint-plugin-react7.34+ flagsReactDOM.renderas deprecated; switch tocreateRootfromreact-dom/client, matching the other examples.website/tsconfig.json— TS 5.x enforcesmodule=Node16whenevermoduleResolution=Node16(TS5110), and the upstream@tsconfig/docusaurusstill references@docusaurus/theme-classic(not a direct dep). Overridemodule/moduleResolutionand trimtypesto the package-types alias.website/src/components/index/more-oss.tsx—formidable-oss-badges1.5+ removed thefeaturedBadgeNamesexport; build the allow-list locally and render<FeaturedBadge name=... />for the known featured products.pnpm-workspace.yaml— pinonlyBuiltDependenciesfor@parcel/watcher,core-js, andesbuildso pnpm ≥10 stops complaining about ignored postinstall scripts.Why
Keep dependencies current for security patches, performance improvements, and compatibility. Several of the upgrades (eslint-plugin-react's deprecation rule, prettier 2.8's formatting change, TS 4.9's stricter
in-narrowing and declaration-portability rules) would otherwise surface as test/lint/type errors onmain.Test Plan
pnpm run check:ci— passes (lint, prettier, types:check, test across all workspaces).pnpm run build— passes;examples/one-page/index.htmlis regenerated and included.PUPPETEER_SKIP_DOWNLOAD=true pnpm install. CI uses pnpm 7 wherepnpm.neverBuiltDependenciesinpackage.jsonis still respected, so the newonlyBuiltDependenciesblock is additive and won't affect CI.Linked Issues
None.