chore: routine repo maintenance - #129
Merged
Merged
Conversation
pnpm 12 validates pnpm-workspace.yaml settings and errors on unrecognized keys when the version is pinned. A frozen-lockfile install under 12.0.0 succeeds, so every setting in the workspace file is still recognized. Dependency bumps are all patch or minor. @types/node stays at ^22 to match the Node 22 floor in engines. Lint, type check, 150 tests, and the build pass locally on Node 22.23.1.
The comment claimed vite and vitest require @types/node@^22. That is no longer true: vite 8.1.4 accepts >=22.12.0 and vitest 4 accepts >=24. The pin still has a purpose, so record the real one. Matching the types major to the Node 22 floor in engines stops type checking from accepting an API that does not exist on the oldest supported runtime. Node 22 is end-of-life 2027-04-30, which is when to revisit.
actions/checkout v7.0.1, pnpm/action-setup v6.0.10, jdx/mise-action v4.3.0. All patch or minor. zizmor-action is unchanged because its latest release is still inside the 7-day cool-down from renovate.json. actionlint and a zizmor audit both report no findings.
mise.local.toml is the conventional filename for a per-machine mise override. It was untracked but not ignored, so anyone creating one could commit machine-specific tool pins by accident.
Closes Dependabot alerts 16 and 19. postcss 8.5.16 auto-loads a source map from an attacker-controlled sourceMappingURL comment, disclosing arbitrary .map files (GHSA-r28c-9q8g-f849, CVSS 7.5). GHSA-fxqj-rqcc-2cmp is the incomplete-fix follow-up, where the traversal guard was skipped when the caller omitted the `from` option. Dev-only, reached via vitest -> vite. Not present in dist/. postcss 8.5.16 -> 8.5.26 and nanoid 3.3.15 -> 3.3.18. 8.5.27 and 8.5.28 exist but are inside the 7-day cool-down. `pnpm up -r --latest` did not catch these because it only re-resolves the packages named on the command line, and neither is a direct dependency.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Routine maintenance sweep across mise tools, the pnpm version, project dependencies, GitHub Actions pins, and the zizmor audit.
pnpm 11.13.1 → 12.0.0
A major bump, taken past the 7-day cool-down (released 2026-08-26). The breaking change that could touch this repo is workspace-settings validation: pnpm 12 errors on unrecognized keys in
pnpm-workspace.yamlwhen the version is pinned. A--frozen-lockfileinstall under 12.0.0 succeeds, so every setting in the file is still recognized.Dependencies
Ten packages, all patch or minor: biome 2.5.11, @types/react 19.2.18, npm-run-all2 9.0.3, prettier 3.9.6, react 19.2.8, tsdown 0.22.14, tsx 4.23.12, vitest 4.1.11, actions-up 1.18.0, zod 4.5.1.
@types/nodestays at^22. Its override comment was stale — it blamed a vite/vitest peer-dependency conflict that no longer exists (vite 8.1.4 accepts>=22.12.0, vitest 4 accepts>=24). The pin still earns its place by matching the Node 22 floor inengines, so the comment now says that, with Node 22's 2027-04-30 end-of-life as the revisit trigger.GitHub Actions
Seven pins repinned to exact SHAs:
actions/checkoutv7.0.1,pnpm/action-setupv6.0.10,jdx/mise-actionv4.3.0.zizmorcore/zizmor-actionwas held back — its latest release is still inside the 7-day cool-down.No change needed
actionlint,pnpm, andzizmorare pinned tolatestand already current.publish.ymlsuppressions still in force.Verification
Lint,
tsc --noEmit, 150 tests, build, prettier check, and actionlint all pass locally on Node 22.23.1. CI covers the 24.x and 26.x matrix legs.