Skip to content

chore(deps): update JS packages to latest and realign the smpy scaffolds - #324

Merged
antosubash merged 3 commits into
mainfrom
worktree-js-deps-update
Sep 10, 2026
Merged

chore(deps): update JS packages to latest and realign the smpy scaffolds#324
antosubash merged 3 commits into
mainfrom
worktree-js-deps-update

Conversation

@antosubash

@antosubash antosubash commented Sep 10, 2026

Copy link
Copy Markdown
Owner

Summary

  • Bump 21 npm packages to latest across the root workspace, host/client_app, packages/{i18n,ui} and every module package — including vitest 4 → 5 (major), lucide-react 1.28 → 1.43, zod 4.4.3 → 4.5.4, and vite 8.2.2. Also biome.json's $schema pin and docs' vue.
  • Realign the smpy new / smpy create-module scaffolds with the toolchain they scaffold against: flat mode paired @vitejs/plugin-react ^5 with vite ^8 (incompatible), and the scaffolded CI/Dockerfiles trailed this repo's own pins by several majors (checkout v4→v7, setup-uv v3→v9, setup-node v4→v7, node 22→24).
  • Fix three pre-existing bugs, each with a regression test. All are version-independent — missing packages, not incompatible ones.

@inertiajs/react is deliberately held at 2.3.27. The v3 client migration is tractable, but fastapi-inertia 1.1.0 is the newest release and still implements the v2 protocol, so moving the client alone would mean forking the adapter. test_sm_new_flat_pins_inertia_react_to_v2 already enforces the pin.

Bugs fixed

  1. smpy new --flat produced an app that could not build. vite build failed with Could not resolve '@tailwindcss/vite'. Flat mode emits no npm workspaces, so client_app/package.json is never installed and the root manifest is the only one npm reads — but it carried just the framework pins, omitting tailwind and the @types packages.
  2. smpy create-module --standalone failed its own CI on the first run. npm run typecheck hit TS2688 for node and vite/client: the shared base.json declares those types, but the scaffold depended on neither vite nor @types/node.
  3. docs/package-lock.json was left stale after the vue bump. docs/ carries its own lockfile outside the root workspaces array, so the workspace-wide install never touched it — npm ci there failed with lock file's vue@3.5.40 does not satisfy vue@3.5.42. No workflow builds docs/, so repo CI stayed green and never caught it.

Verification

  • Local CI: lint (ruff + ty + biome + 12 tsconfigs + file-size + i18n gates), 2975 Python tests, 463 JS tests (vitest 5), client build — all green
  • 44/44 e2e passing
  • All three scaffold shapes built end to end: flat app installs + builds, workspace app passes tsc && vite build under TypeScript 7, standalone module typechecks clean
  • Browser-verified: 7 routes render, base-ui radio, react-hook-form tracking, zod blocking an invalid submit, full create-user flow, lucide icons rendering, no raw i18n keys, no console errors
  • Verification report: https://claude.ai/code/artifact/2afcb804-c23b-4b06-99c0-6b9164bb1652

QA Report

  • Full QA cycle completed (1 iteration)
  • 0 bugs found, 0 outstanding
  • Categories tested: Happy Path, Form Validation, Component Interaction, Icon/i18n Rendering, Console Health

The report link is a Claude Artifact and starts private — I can share it from claude.ai/code/artifacts if reviewers need access. It also documents four false alarms this run produced (a cross-project Vite port collision, PID-vs-port process kills, a .env-sensitive unit test, and an e2e password mismatch that tripped the login rate limiter) — worth a skim before anyone re-runs this pipeline.

Test plan

  • Reviewer confirms CI is green
  • Reviewer runs npm ci in docs/ and confirms it succeeds
  • Reviewer scaffolds smpy new --flat and confirms vite build succeeds

@antosubash
chore(deps): update JS packages to latest
7d5963a 
Bump every npm dependency to its latest compatible release across the
root workspace, host/client_app, packages/{i18n,ui} and all module
packages:

- @base-ui/react 1.7.0 -> 1.8.0
- @biomejs/biome 2.5.7 -> 2.5.12 (and biome.json $schema to match)
- @hookform/resolvers 5.7.1 -> 5.9.1
- @testing-library/jest-dom 7.0.0 -> 7.0.1
- @testing-library/react 16.3.2 -> 16.3.3
- @types/node 26.1.2 -> 26.5.0
- @types/react-dom 19.2.4 -> 19.2.7
- @vitejs/plugin-react 6.0.5 -> 6.1.1
- autoprefixer 10.5.4 -> 10.5.5
- i18next 26.3.6 -> 26.4.2
- input-otp 1.4.2 -> 1.5.0
- lucide-react 1.28.0 -> 1.43.0
- postcss 8.5.25 -> 8.5.28
- react-hook-form 7.84.0 -> 7.87.0
- react-i18next 17.0.11 -> 17.0.13
- react-resizable-panels 4.12.2 -> 4.12.4
- rollup-plugin-visualizer 7.0.1 -> 7.1.1
- sonner 2.0.7 -> 2.0.8
- vite 8.2.0 -> 8.2.2
- vitest 4.1.10 -> 5.0.0 (major; full suite passes unchanged)
- zod 4.4.3 -> 4.5.4
- docs: vue 3.5.40 -> 3.5.42

Also refresh the `smpy new` scaffold templates, which had drifted well
behind the framework they scaffold against: @types/node ^22 -> ^26.5.0,
@vitejs/plugin-react ^5 -> ^6.1.1, typescript ^5.7.0 -> ^7.0.2 and
vite ^6.0.0 -> ^8.2.2, so a freshly scaffolded app builds on the same
toolchain as the packages it consumes.

@inertiajs/react is deliberately held at 2.3.27. Inertia v3 needs client
changes we could make (array-form layout assignments in ~21 pages, the
`invalid` -> `httpException` event rename, `<title inertia>` ->
`data-inertia`), but the server side has no path: fastapi-inertia 1.1.0
is the latest release and still implements the v2 protocol, so moving
the client alone would mean forking the adapter. Tracked separately.

Verified: make lint, make doctor, 2973 Python tests, 463 JS tests, and
a production client build all pass.

Claude-Session: https://claude.ai/code/session_01CwgTb8hULSfHoW2DrFrQAW
@antosubash
fix(cli): bring the app/module scaffolds up to the current toolchain
5d0a136 
The `smpy new` / `smpy create-module` scaffolds had drifted behind the
framework they scaffold against, and two of them emitted projects that
could not build at all.

Version drift:

- flat-mode npm pins in app_project.py: @vitejs/plugin-react ^5 -> ^6.1.1
  (^5 does not support the vite ^8 pinned alongside it), typescript
  ^5.6.0 -> ^7.0.2, vite ^8.0.0 -> ^8.2.2
- standalone module template: typescript ^5.7.0 -> ^7.0.2
- scaffolded module CI/publish workflows: actions/checkout v4 -> v7,
  astral-sh/setup-uv v3 -> v9.0.0, actions/setup-node v4 -> v7, and
  node 22 -> 24, matching this repo's own pr.yml / release.yml
- scaffolded Dockerfiles: nodesource setup_22.x -> setup_24.x, matching
  the repo's own Dockerfile

Two scaffolds were broken before this change:

- `smpy new --flat` produced an app that failed `vite build` with
  "Could not resolve '@tailwindcss/vite'". Flat mode emits no npm
  workspaces, so client_app/package.json is never installed and the root
  manifest is the only one npm reads — but it carried just the framework
  pins, omitting @tailwindcss/vite, tailwindcss and the @types packages
  client_app needs. The root dict now covers them.
- `smpy create-module --standalone` produced a module that failed its own
  CI `npm run typecheck` with TS2688 for 'node' and 'vite/client'. The
  shared base.json declares types ["vite/client", "node"] but the
  scaffold depended on neither vite nor @types/node. Both added.

Both bugs predate this change and are version-independent — they are
missing packages, not incompatible ones.

Regression tests cover each: the flat root manifest must be a superset
of client_app's deps, and the standalone module must ship a provider for
every entry in base.json's `types`.

Verified by scaffolding all three shapes end to end: flat app installs +
builds, workspace app passes `tsc && vite build` under TypeScript 7, and
a standalone module typechecks clean. Plus make lint, make doctor, 2975
Python tests and 463 JS tests.

Claude-Session: https://claude.ai/code/session_01CwgTb8hULSfHoW2DrFrQAW
@antosubash
fix: address code review findings (round 1, pass 1)
4e62fa2 
- Regenerate docs/package-lock.json after the vue ^3.5.40 -> ^3.5.42 bump.
  docs/ carries its own lockfile and is not in the root npm workspaces
  array, so the workspace-wide npm install never touched it and
  `npm ci` in docs/ failed with "lock file's vue@3.5.40 does not
  satisfy vue@3.5.42". No workflow builds docs/ today, so repo CI
  stayed green and never caught it. Verified: npm ci --dry-run in docs/
  fails before this change and succeeds after.
- Fix the now-stale "Node 22" comment above the nodesource setup_24.x
  line in both scaffold Dockerfile templates.

Claude-Session: https://claude.ai/code/session_01CwgTb8hULSfHoW2DrFrQAW
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
🔒 Security Review ✅ Completed 2026-09-10T15:22:09.673050Z 4e62fa2 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@cloudflare-workers-and-pages

cloudflare-workers-and-pages Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown

Deploying simple-module-python with  Cloudflare Pages  Cloudflare Pages

Latest commit: 4e62fa2
Status: ✅  Deploy successful!
Preview URL: https://ffd5fb99.simple-module-python.pages.dev
Branch Preview URL: https://worktree-js-deps-update.simple-module-python.pages.dev

View logs

@antosubash
antosubash merged commit 12b6f38 into main Sep 10, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@antosubash