Version Packages

[uptide-release]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to main, this PR will be updated.

Releases

uptide@0.13.0

Minor Changes

• #134 b795705 Thanks @lucasbraum! - Packs can name alternate leads: packages a repository declares instead of the pack's own (react-router-dom for react-router). check and fix asked for either name use the pack; where only the alternate is declared, the lead is analyzed at the version installed through it, pnpm stores included, and fix declares it beside the alternate at the target before upgrading both.

• #149 3303118 Thanks @lucasbraum! - Add a candidate express 4 to 5 migration pack. Route strings that path-to-regexp 8 rejects or reads differently are found on calls of an Express app or router (including lists registered in a loop); req.params values widened to string | string[], req.param, res.sendfile, express.static.mime and express.query are claimed from the compiler; res.redirect(url, status), app.param(fn), res.redirect('back') and res.send(<number>) are found in the source; runtime defaults (async errors, req.body, the query parser, urlencoded, dotfiles, Node 18) go to decisions. No rule rewrites. With the pack in use, check no longer adds its text-matched express 5 runtime findings.

• #148 5143c46 Thanks @lucasbraum! - Add a candidate joi 17 to 18 migration pack. new ValidationError(message, {}, original), which stops compiling for code written against joi 17.0–17.6, is rewritten to pass []; the Node.js 20 requirement and the top-level domains joi 18 no longer accepts in email(), domain() and uri() are reported as decisions. Scored against two public repositories, one of them a negative control.

• #131 413d3da Thanks @lucasbraum! - Add a verified lucide-react 0.x to 1.x migration pack. Brand icons removed in 1.x are found at their imports and every use, with a guide whose replacement choice goes to the owner; icon names dropped during 0.x are renamed at the import or member; deep dist/ imports, untyped icon lookups, the absoluteStrokeWidth and IconNode deprecations, and the aria-hidden default for repositories before 0.489.0 are reported. Lucide's lockstep packages move together and the consumer's build is required. Verified against three public repositories, one of them a negative control.

• #132 107c107 Thanks @lucasbraum! - Add a verified React Router 6 → 7 migration pack, which also runs for applications that declare only react-router-dom. It moves react-router-dom imports to react-router. It reports, with a guide for the agent, the rest of the upgrade: the removed future prop and router option, react-router-dom/server, lowercase formMethod comparisons and json/defer calls (found by syntax where the compiler is blind), the other removed exports, and generatePath calls that pass null for a required parameter. The six v6 future flags that become defaults are reported as decisions where the repository's router setup has not enabled them. React Router 7 → 8 is a separate upgrade.

• #142 9c57934 Thanks @lucasbraum! - check and fix plan what the target version requires: a package the target, or anything moving with it, declares as a peer or dependency at a range the installed copy rejects moves to the lowest release of its major that satisfies it (openai 7 moves zod 3.24.2 to 3.25.0), shown apart from release-group companions ("moved because openai 7.4.0 requires zod ^3.25 || ^4.0"). A move only a new major makes is never made: it is reported as a blocker with the exact range in check, the PR body and pack test. The npm install scope guard no longer lets a declared root dependency change because a moved package peers on it.

• #128 06f11ab Thanks @lucasbraum! - Add verified Sentry JavaScript SDK 10 to 11 migration packs for @sentry/nextjs and @sentry/browser, with the SDK's lockstep release group, a required build for Next.js, and inventory-scoped decisions for data collection, span streaming, sampling and platform minimums. Mechanical rules move withSentryConfig to @sentry/nextjs/config and the removed build options under webpack, remove enableLogs/enableMetrics: true, and rename exports, integration names and httpIntegration options; privacy, sampling, profiling and OpenTelemetry choices stay assisted and are reported for the owner. Fix uptide pack new dropping registry entries long enough to be wrapped.

• #155 922c5ab Thanks @lucasbraum! - uptide pack test applies a stricter verified gate: at least five expected breaking sites across the public ground-truth repositories, besides two repositories and no breaking false positive. Upgrades the compiler cannot see are gated on their behavior notes instead. Mechanical rules no real site exercises are recorded as unexercised, and check and fix run their sites as assisted. @sentry/browser and @sentry/react become candidates (fewer than five real breaking sites). A pack can lower the minimum only with a written reason in its RESEARCH.md. The README packs table shows each pack's breaking-site count. The output shows the gate's class, site counts and every reason a pack is a candidate.

• #147 0b88170 Thanks @lucasbraum! - check and fix remove a deprecated @types stub instead of upgrading to it. When the release the upgrade would move @types/<pkg> to is deprecated on npm, and <pkg>'s target declares its own types (types, typings or a types export), the plan removes it: "Removed: @types/ioredis, ioredis 5 ships its own types", in check and in the PR body. check now diffs such a package against its own target types instead of failing on a stub with no declarations, and fix removes the entry in the same install, with the install scope guard allowing exactly that removal.

• #150 4c3212b Thanks @lucasbraum! - check typescript judges a TypeScript 5 to 6 upgrade with both compilers: every project of the workspace is compiled with the installed TypeScript and with the target's, and what is new at the target is a finding; the bundled compiler never stands in, and a target without a JavaScript API (TypeScript 7) is reported as not compiled. A candidate typescript 5 to 6 pack reports the tsconfig options 6.0 deprecates where they are set, the rootDir default, module-keyword namespaces and import assertions. A peer that rejects the target (typescript-eslint on TypeScript 6) is now reported as a peer conflict even when it is not grouped with the package.

• #137 21894d7 Thanks @lucasbraum! - Add verify.build to uptide.yml: the package.json script a migration pack's required build runs. Unset, Uptide runs build:ci, then build-ci, then build. When a build fails before the framework's build starts because it needs an environment variable or a database (prisma db push without DATABASE_URL), the pull request and the report say so ("build needs DATABASE_URL; set verify.build") instead of a bare "build failed". uptide init writes the setting as a comment.

Patch Changes

• #141 9debb6d Thanks @lucasbraum! - check no longer reports a pre-existing type error as a breaking site when the upgrade only changes its wording, such as a type the message prints in full. An error at the same place with a different reason is still reported.

• #129 e796e4c Thanks @lucasbraum! - Add a candidate ioredis 5 to 6 migration pack: client constructions that inherit the RESP3, reconnect and keep-alive defaults ioredis 6 changed, compiler-blind sites (mode === 'subscriber', commands in a connect listener with the offline queue off, AUTH recognized by command name), dependents that bundle ioredis 5, instrumentation that stops patching ioredis 6, and Node 20. It is scored against five public upgrades and stays a candidate: none of them has a breaking site to verify it with.

• #139 9ba005a Thanks @lucasbraum! - Allow local check and fix smoke tests of registered candidate packs with --allow-candidate, with an explicit unverified banner. Reject candidate opt-in in the Action and with publication flags, and prevent stored candidate runs from being published. Label pack-claimed assisted sites by rule id even with --no-llm.

• #157 f3af6a1 Thanks @lucasbraum! - check no longer reports a blocker for a direct dependency whose plain dependency range rejects the target (@azure/ai-projects on openai ^6, verdaccio pinning express 4): the package manager gives it its own nested copy, so it is listed as staying, with the new major that would accept the target when there is one. pack test counts a with move that check leaves and explains (a blocker, a new-major stay or a peer conflict) as explained, and one of a package that does not depend on the lead as the repository's choice; neither fails the run.

• #130 5ced450 Thanks @lucasbraum! - Add a candidate openai 4 to 7 migration pack: named path parameters, del → delete, promoted beta chat helpers, renamed runner events, removed entry points and request-option overloads are rewritten where unambiguous; tool-call unions, httpAgent, fileFromPath and the other removals get agent guides; APIError.headers, Web Response bodies and double-encoded path ids are detected even in code typed any; Node 22, zod, fetch and client-subclass decisions carry repository evidence. It stays a candidate (the dependency is still checked and fixed as generic) until two engine gaps its ground truth exposed are closed.

• #136 578a042 Thanks @lucasbraum! - Fold implicit-any errors (TS7006, TS7031, TS7019) inside an option the target removed into the pack finding on that option, as downstream evidence: the callbacks lost the types the option gave them, and the same edit resolves them. They no longer stand as separate breaking sites.

• #143 883e587 Thanks @lucasbraum! - uptide pack test scores each expected site at the severity of the rule or behavior note it belongs to, so a missed note that only needs a look, or a decision, no longer counts as a missed break. Behavior-note sites get their own precision and recall in the output and in verification.json (behavior, with the counts behind each rate), false negatives show their severity, and a rate with nothing to measure prints n/a instead of 100%, in pack test and in the README's packs table.

• #154 7aa3d58 Thanks @lucasbraum! - uptide pack test fails a pack's verification.json only when it claims more than the run measures (recorded verified, measured candidate). A pack recorded as candidate on purpose passes, with recorded candidate by choice; measures verified, and a record whose numbers differ gets a note instead of a failure. A generic ground-truth site now counts as a true positive for the rule that claims it.

• #152 ca31aee Thanks @lucasbraum! - uptide pack test takes several packs: uptide pack test zod ai.

• #159 1e157fd Thanks @lucasbraum! - uptide pack test --json times each ground-truth repository: timing gives the fetch, install and check wall time and the process's peak memory.

• #144 0881185 Thanks @lucasbraum! - Ground truth can name a site for an upgrade that only adds lines inside an existing call, such as an option added to a constructor: the site is the call's start line, so a pack finding there scores as a true positive instead of a false positive. pnpm packs:truth drafts these anchors from insert-only hunks for review, and docs/packs.md and CONTRIBUTING describe the rule.

• #156 9039e3c Thanks @lucasbraum! - Public ground truth now exercises three rules that ran as assisted: zod error-params, stripe api-version-unpinned and next stable-cache-exports. Their rewrites run mechanically again. All three packs stay verified.

• #138 0db5640 Thanks @lucasbraum! - Respect repository tsconfig file selection, recursive project references, and workspace project options when checking dependency upgrades. Compiler diagnostics outside every TypeScript project no longer produce breaking findings; pack rules and build-configuration findings retain their own scope. Repositories without a tsconfig retain importer-based compilation, with that fallback stated in the report.

  Anchor missing members supplied by dependency augmentations at their setup import, retaining affected calls as evidence instead of counting each call as a separate breaking edit.

• #151 9ddaaff Thanks @lucasbraum! - Add a candidate redis (node-redis) 4 to 5 and 5 to 6 migration pack, one rule set per major: an upgrade gets the rules of the majors it crosses, so 4 to 6 gets both. 4 to 5 covers legacyMode, commandOptions and isolation, scan iterators that yield batches, string SCAN cursors, boolean replies that became numbers, enums that became constants, keepAlive, @redis/graph and internal dist imports; 5 to 6 covers the RESP3 client type, unstableResp3, and the client defaults 6 changes (RESP3, command timeout, keep-alive delay, maintenance notifications) with a decision per client. Scored against five public upgrades; it stays a candidate until the stricter verified gate lands, since the core 4 to 5 API changes have no real site yet.

• #135 42a3b54 Thanks @lucasbraum! - Move only packages released with the upgraded one. A pack's declared release group now bounds the lead's npm scope, and without one a same-scope package moves only when a pin, a peer or a release at the target relates it to the group. Packages of the scope that are versioned on their own (@sentry/vite-plugin 5.x, @sentry/cli, the old @sentry/utils 8.x) are reported as "stays at X" in check, the pull request and pack test instead of making fix refuse the whole upgrade. Registers the verified @sentry/react 10 to 11 pack.

• #146 09b8682 Thanks @lucasbraum! - Report Stripe clients pinned to different API versions at the top of check and of the PR body, as a decision for the owner: every new Stripe(...) in TypeScript and JavaScript sources, scripts included, with the version it speaks after the upgrade (an unpinned client speaks the SDK default). The PR's decisions list, for each client behind the target, the changelog entries it would cross for the resources it calls. No pin is rewritten.

• #140 bc428d1 Thanks @lucasbraum! - Keep migration PR bodies within their size budget while preserving summaries, representative diffs, decisions, review warnings and verification ahead of changelog and transitive detail. Keep every evidenced Stripe change visible and uncapped; group and cap only other changes to used resources, link the full changelog, and identify omitted text in the retained report.

• #145 3c8902d Thanks @lucasbraum! - The zod pack migrates ZodError#errors to .issues by rule: reads (error.errors[0].message, error?.errors) and destructuring (const { errors } = error becomes const { issues: errors } = error) where the type checker resolves the receiver to ZodError, and reads off an untyped catch binding of a zod parse. Writes are left to the agent.

• #127 c4ead4f Thanks @lucasbraum! - zod: check now reports ZodError#formErrors and #errors read off an untyped catch binding of a zod parse/parseAsync (catch (error: any) { return error.formErrors.fieldErrors }), which zod 4 removed and the compiler cannot see. Files that only import a schema from the repository's own module (@/lib/zod) are covered too. fix rewrites <err>.formErrors.fieldErrors and <err>.formErrors.formErrors to z.flattenError(<err>), importing z where it is missing; every other read goes to the agent.