chore(deps): upgrade TypeScript 5.9.3 → 6.0.3 - #416
Conversation
pnpm 11 stops reading pnpm-specific config from two places, both silently: 1. package.json's "pnpm" field. That held 22 security overrides pinning tmp, qs, uuid, js-yaml and others — the very packages .github/dependabot.yml ignores *because* they are pinned there. Losing them would have been a silent supply-chain regression. Moved to pnpm-workspace.yaml. 2. .npmrc's pnpm settings. `pnpm config get shamefully-hoist` returns undefined under 11, so hoisting stopped and every module apps/web imports without declaring failed to resolve. Moved to pnpm-workspace.yaml. Two latent defects surfaced and are fixed at the root: - allowBuilds held b/d/e/i/l/s/u — the sorted letters of "esbuild", a string that had been spread character-by-character. It never approved anything; esbuild, sharp and msw silently ran without their postinstall scripts. Rewritten with the real policy from onlyBuiltDependencies. - apps/web imported onnxruntime-web (owned by packages/ai-core), @tauri-apps/api (owned by apps/desktop) and @sentry/browser (transitive of @sentry/react) without declaring any of them. They resolved only through shamefully-hoist. Now declared explicitly. Verified: pnpm install clean, check:lockfile OK, tsc --noEmit 0 errors, all 22 overrides present in the regenerated lockfile. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ored The document claimed the .npmrc pnpm settings remain valid under pnpm 11. They do not: pnpm config get shamefully-hoist returns undefined, hoisting stops, and the phantom imports in apps/web break. Replaced the claim with what the migration actually found. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ound - Section 1 is the pre-migration baseline, not the current state (pnpm 11 is now pinned). - The pnpm bump spans four files, not two. - Rollback must restore package.json's pnpm block and .npmrc, not just packageManager — a half rollback leaves the 22 overrides pointing nowhere. - Three phantom deps, not four; strictPeerDependencies now lives in pnpm-workspace.yaml; frozen install cannot regenerate a lockfile. All raised by CodeRabbit on #413. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…orepack pins Two findings from CodeRabbit on this PR, both real: 1. auditConfig.ignoreCves does not exist in pnpm 11 (it is ignoreGhsas, and it takes GHSA IDs). Carried over unchanged, the suppression would have stopped working with no error. Investigating it showed the suppression is obsolete — and was dangerous. The entry suppressed CVE-2026-41242 = GHSA-xq3m-2v4x-88gg, "Arbitrary code execution in protobufjs", severity CRITICAL — while AUDIT_BACKLOG S-07 recorded it as a low-severity false positive. The overrides pin protobufjs >=8.2.0, which resolves to 8.7.0 (patched), so the advisory no longer applies: both CI audits (--audit-level=critical --prod and --audit-level=high) pass with no auditConfig at all. Removed rather than migrated. Keeping it would have silently swallowed the next genuine protobufjs advisory. S-07 updated to Resolved with the correction. 2. scripts/setup-windows.ps1, scripts/windows-doctor.mjs and scripts/cursor-cloud-update.sh still pinned corepack to pnpm@10.33.0. Synced to 11.13.0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Peer is eslint >=7.0.0, so it is compatible with the current ESLint 9 and does not depend on the blocked ESLint 10 upgrade. eslint.config.js only consumes the default export (prettierConfig, appended last), which v10 keeps — the v10 breaking changes concern individual removed/renamed rule entries that this config never references. Verified: eslint loads and lints clean; lint:scopes (the blocking CI gate) passes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Not 7.0.2: typescript-eslint@8.64 declares typescript ">=4.8.4 <6.1.0" and no v9 exists, so TS 7 would leave the whole lint stack — including the blocking lint:changed / lint:scopes gates — on an unsupported peer. TS 6 is the transitional release and sits inside that range. @typescript-eslint/* bumped to 8.64.0 alongside. Two source changes, both real fixes rather than workarounds: - apps/web/tsconfig.json: removed "baseUrl". TS 6 deprecates it (TS5101, gone in 7.0) and offers "ignoreDeprecations": "6.0" to silence it. Silencing just defers the problem; paths have resolved relative to tsconfig.json since TS 4.1 and "@/*": ["./*"] is already relative, so baseUrl was redundant. Removing it clears a TS 7 blocker instead of deferring it. - webGpuService.ts: dropped an eslint-disable for no-unsafe-type-assertion that TS 6's narrowing made unnecessary — the directive is now reported as unused. One suppression fewer, not one more. Verified: turbo run typecheck 5/5 packages green, root typecheck green, lint:scopes green, zero-any gate = 0. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe pull request updates the TypeScript development dependency, reformats workspace configuration, enables Snyk builds, and removes an inline WebGPU ESLint suppression. ChangesToolchain and configuration
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| Docker |  |
Jul 14, 2026 1:26p.m. | Review ↗ |
| JavaScript | |
Jul 14, 2026 1:26p.m. | Review ↗ |
| Python | |
Jul 14, 2026 1:26p.m. | Review ↗ |
| Rust | |
Jul 14, 2026 1:26p.m. | Review ↗ |
| Shell | |
Jul 14, 2026 1:26p.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 19-26: Update the pnpm build-approval configuration to enable
builds for snyk by changing its entry to true, while leaving `@google/genai` and
the other package settings unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 6bf488cc-238d-42dc-af4d-11dc8c9aa8f0
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (4)
apps/web/services/local-ai/device/webGpuService.tsapps/web/tsconfig.jsonpackage.jsonpnpm-workspace.yaml
💤 Files with no reviewable changes (2)
- apps/web/tsconfig.json
- apps/web/services/local-ai/device/webGpuService.ts
This branch was cut from chore/pnpm-11 before #413 merged, so it carried a duplicate of the entire pnpm 11 migration -- the Windows scripts, pnpm-workspace.yaml, docs/toolchain-update.md, .npmrc. All of that is on main now, so every conflicted file takes main's version. What is left is the branch's actual contribution: eslint-config-prettier 9.1.2 -> 10.1.8, one line in the root package.json plus its lockfile entry. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The base branch now carries main (post-#413), which brought its own minimumReleaseAgeExclude. Git merged both copies in, producing a duplicate `minimumReleaseAgeExclude` key -- a YAML error, and one that silently resolved to the *second* block, dropping the turbo and postcss exemptions and putting CI straight back into the release quarantine. Kept main's list: its `@typescript-eslint/*` glob is a superset of the ten pinned 8.64.0 entries this branch had added, so nothing is lost. snyk: false -> true, per review. snyk's postinstall (`node wrapper_dist/bootstrap.js exec`) is what fetches the actual CLI binary. Denying it leaves `snyk` on PATH but non-functional, silently breaking `pnpm run security:snyk` and therefore `security:scan`. Verified against the installed package's manifest. @google/genai stays denied: its only install script is `preinstall: echo 'preinstall: no-op'`, so allowing it would buy nothing and grant a pure-JS SDK the right to execute code at install time. This does not disable the Gemini integration -- allowBuilds governs install-time scripts, not runtime features. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 36-40: Update the minimumReleaseAgeExclude configuration to
replace the broad package and wildcard selectors with exact package@version
entries sourced from the lockfile. Preserve exclusions only for the specifically
trusted versions of turbo, `@turbo/`*, `@typescript-eslint/`*, and postcss, without
exempting future releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 89f675eb-540b-4838-af99-59c7cf307ba3
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
package.jsonpnpm-workspace.yaml
There was a problem hiding this comment.
Caution
Inline review comments failed to post. This is likely due to GitHub's internal server error or limits when posting large numbers of comments. If you are seeing this consistently it is likely a permissions issue. Please check "Moderation" -> "Code review limits" under your organization settings.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 36-40: Update the minimumReleaseAgeExclude configuration to
replace the broad package and wildcard selectors with exact package@version
entries sourced from the lockfile. Preserve exclusions only for the specifically
trusted versions of turbo, `@turbo/`*, `@typescript-eslint/`*, and postcss, without
exempting future releases.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 89f675eb-540b-4838-af99-59c7cf307ba3
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (2)
package.jsonpnpm-workspace.yaml
🛑 Comments failed to post (1)
pnpm-workspace.yaml (1)
36-40: 🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash set -euo pipefail printf '--- pnpm-workspace.yaml (relevant section) ---\n' nl -ba pnpm-workspace.yaml | sed -n '28,48p' printf '\n--- search for minimumReleaseAge settings usage ---\n' rg -n "minimumReleaseAge|minimumReleaseAgeExclude" -S . printf '\n--- pnpm version / help if available ---\n' ( pnpm --version || true ) ( pnpm config get minimum-release-age || true ) ( pnpm help install | sed -n '1,220p' || true )Repository: qnbs/CannaGuide-2025
Length of output: 249
🌐 Web query:
pnpm minimumReleaseAgeExclude wildcard package families exact package@version selectors documentation💡 Result:
In pnpm, the minimumReleaseAge setting defines a delay (in minutes) for installing new packages to protect against malicious releases [1][2]. The minimumReleaseAgeExclude configuration allows you to opt specific packages out of this maturity requirement [2][3]. You can use several formats within the minimumReleaseAgeExclude list to specify which packages or versions are exempt: 1. Package Names: You can exclude entire packages by name (e.g., webpack) [2][3]. 2. Wildcard Patterns: You can use glob patterns to exclude package families, such as scoped packages (e.g.,
@myorg/* or is-) [4][3]. 3. Exact Versions: You can exclude specific versions of a package using the package@version syntax. You may also specify multiple versions using the || operator (e.g., nx@21.6.5 or webpack@4.47.0 || 5.102.1) [5][3]. Example configuration in pnpm-workspace.yaml: minimumReleaseAge: 1440 minimumReleaseAgeExclude: - webpack - '@myorg/' - nx@21.6.5 - webpack@4.47.0 || 5.102.1 Note that while exact versions are supported, general semver ranges are typically not supported in this exclusion list [5][6]. Patterns and specific versions allow you to maintain security for most dependencies while ensuring that trusted internal tools or critical fixes can be installed immediately [3].Citations:
- 1: https://pnpm.io/settings
- 2: https://github.com/pnpm/pnpm.io/blob/main/blog/releases/10.16.md
- 3: https://charpeni.com/blog/protecting-against-compromised-packages-with-minimum-release-age
- 4: pnpm/pnpm#9984
- 5: https://github.com/pnpm/pnpm.io/blob/main/blog/releases/10.19.md
- 6: https://github.com/pnpm/pnpm/blob/2b14c742/pkg-manager/core/test/install/minimumReleaseAge.ts
🌐 Web query:
site:pnpm.io minimumReleaseAgeExclude package families wildcard exact version selector💡 Result:
In pnpm, the minimumReleaseAgeExclude setting allows you to bypass the minimumReleaseAge maturity requirement for specific dependencies [1][2]. This setting supports three primary ways to define exemptions: 1. Package Names: Listing a package name will exempt all versions of that package from the release age restriction [1]. 2. Wildcard Patterns: You can use wildcards (e.g.,
@myorg/*) to exempt all packages matching a specific pattern [1][3]. 3. Exact Versions: You can specify exact versions to exempt, such as package@version [4]. You can also combine multiple versions for a single package using a disjunction operator (||), for example, package@1.0.0 || 1.1.0 [1][5][6]. These configuration options are defined within your pnpm-workspace.yaml file [1]. If multiple entries for the same package are provided, pnpm handles them by treating them as a combined disjunction [6].Citations:
- 1: https://pnpm.io/settings
- 2: https://pnpm.io/blog/releases/10.16
- 3: https://pnpm.io/blog/releases/10.17
- 4: https://pnpm.io/blog/releases/10.19
- 5: https://pnpm.io/10.x/settings
- 6: https://pnpm.io/blog/releases/11.9
🏁 Script executed:
#!/bin/bash set -euo pipefail echo '--- pnpm-workspace.yaml (lines 1-80) ---' nl -ba pnpm-workspace.yaml | sed -n '1,80p' echo echo '--- minimumReleaseAge references in repo ---' rg -n "minimumReleaseAge|minimumReleaseAgeExclude" -S pnpm-workspace.yaml .github . || trueRepository: qnbs/CannaGuide-2025
Length of output: 239
🏁 Script executed:
#!/bin/bash set -euo pipefail python3 - <<'PY' from pathlib import Path p = Path("pnpm-workspace.yaml") for i, line in enumerate(p.read_text().splitlines(), 1): if 30 <= i <= 45: print(f"{i:>4}: {line}") PYRepository: qnbs/CannaGuide-2025
Length of output: 1048
Security Misconfiguration (CWE-16)
Reachability: External
Replace the broad exclusions with version-pinned entries
These name and wildcard selectors exempt every future matching release from the 24-hour quarantine window. If only specific releases are trusted, switch to exactpackage@versionentries from the lockfile.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pnpm-workspace.yaml` around lines 36 - 40, Update the minimumReleaseAgeExclude configuration to replace the broad package and wildcard selectors with exact package@version entries sourced from the lockfile. Preserve exclusions only for the specifically trusted versions of turbo, `@turbo/`*, `@typescript-eslint/`*, and postcss, without exempting future releases.
1 participant
Stacked on #415 → #413. Retargets automatically as those merge.
Why 6.0.3 and not 7.0.2
typescript-eslint@8.64— the newest there is, no v9 exists — declares:TS 7 is outside that range. Because
.npmrcsetsstrict-peer-dependencies=false,pnpm installwould not stop it: it would install cleanly and the parser would fail at runtime, taking the blockinglint:changedandlint:scopesgates with it. TS 6.0.3 is the transitional release and sits inside the supported range.The only two source changes
1.
apps/web/tsconfig.json— removedbaseUrlTS 6 reports it as deprecated (
TS5101, removed in 7.0) and offers"ignoreDeprecations": "6.0"to silence the error. Silencing only defers the problem to the TS 7 upgrade.pathshave resolved relative totsconfig.jsonsince TS 4.1, and the mapping is already relative:So
baseUrl: "."was redundant. Removing it clears a TS 7 blocker rather than postponing it.2.
webGpuService.ts— removed aneslint-disableTS 6's narrowing made the
no-unsafe-type-assertionsuppression unnecessary; ESLint now reports the directive itself as unused. One suppression fewer, not one more — the repo's suppression ratchet stays honest.Verification
The unit suite, coverage thresholds and bundle budget run in CI — a TS major can change emit, so the bundle-budget gate is the one to watch.
🤖 Generated with Claude Code
Summary by CodeRabbit