chore(deps): migrate to TypeScript 6, Next 16, Zod 4, inngest 4, Vitest 4, ESLint 10#9
Merged
Merged
Conversation
…st 4, ESLint 10 Adopts the major dependency bumps dependabot proposed (and that I reverted on main because the grouped auto-merge landed them un-migrated and broke CI). Each breaking change fixed: - TypeScript 6 + @types/node 26: TS6 no longer auto-includes @types/node, so `node:*`, `process`, and `import.meta.url` stopped resolving. Added `"types": ["node"]` to the core/pipeline/db tsconfigs (web gets node types via the Next plugin, so it is untouched). - inngest 4: createFunction is now 2-arg — the trigger moved into the options object as `triggers`. Updated all three cron functions. - Next 16: removed the `eslint` NextConfig key (the built-in build-time ESLint integration was dropped; we already lint at the workspace root). Note: inngest 4 defaults to cloud mode, so /api/inngest now needs INNGEST_SIGNING_KEY (prod) or INNGEST_DEV=1 (local) — documented in .env.example. - ESLint 10: satisfied the new preserve-caught-error rule (attach `cause` to a rethrown fixture-read error). - Zod 4: no source changes needed — the existing schemas (incl. the M3 AlertChannelConfigSchema superRefine) are zod-4 compatible. Also bumps react/react-dom 19.2, @anthropic-ai/sdk, typescript-eslint. Verified on the new toolchain: typecheck, lint, 289 unit @ coverage gate, 53 integration tests (Postgres+pgvector), next 16 build, and a runtime smoke (auth flow + delivery log + the /api/inngest route under INNGEST_DEV).
Bumps the CI runner from Node 22 to Node 24 and the package `engines.node` floor to `>=24`, aligning the runtime with the bumped @types/node (Node-26 line) so the types no longer describe APIs ahead of the runtime. engine-strict is unset, so the floor stays advisory for local dev.
asmuelle
added a commit
that referenced
this pull request
Jun 20, 2026
The grouped npm update PRs batched every dependency-type together regardless of semver, so major bumps (Next 16, Zod 4, inngest 4, TS 6) landed un-migrated on main and broke CI. Restrict both npm groups to `minor` + `patch`; majors now arrive as individual PRs to be migrated on a branch (see PR #9). github-actions bumps stay grouped (low-risk, still gated by CI).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Dependabot grouped and auto-merged several major bumps onto
mainun-migrated, which broke CI (node:imports under TS6,createFunctionunder inngest 4, etc.). I reverted those two group PRs onmainto keep it green and land the M3 delivery feature; this PR does the migration deliberately so the bumps land green.What broke and how it's fixed
@types/node26@types/nodeinclusion →node:*,process,import.meta.urlunresolved"types": ["node"]in core/pipeline/db tsconfigs (web gets node types via the Next plugin)createFunctionis now 2-arg; trigger moved into options astriggerseslintkey removed fromNextConfig; cloud-mode default on/api/inngestINNGEST_DEV=1/INNGEST_SIGNING_KEYin.env.examplepreserve-caught-errorrulecauseto a rethrown errorAlso bumps react/react-dom 19.2,
@anthropic-ai/sdk, typescript-eslint.Verification
pnpm -r typecheck(TS 6)pnpm lint(ESLint 10)next build(Next 16) — 8 routes/api/inngest(underINNGEST_DEV)Note for the maintainer
The two dependabot group PRs this supersedes are still closeable (
#7production-deps,#8dev-deps). Consider configuring dependabot to not auto-merge grouped major bumps so future majors come through a migration PR like this one rather than landing onmainun-migrated.🤖 Generated with Claude Code