refactor(devtools): replace semver with verkit

[sxzz]

Summary

• replace direct semver and @types/semver usage in the Nuxt DevTools client, timeline integration, and package update checks with verkit
• migrate gte and lt to verkit's functional isGreaterOrEqual and isLess APIs while keeping satisfies behavior
• update the pnpm catalog, package metadata, minimum-release-age allowlist, lockfile, and focused compatibility tests

Motivation

verkit is a pure ESM, zero-dependency SemVer implementation with first-class TypeScript declarations and functional, tree-shakeable named exports. This matches @nuxt/devtools' ESM-only published module output, avoids CommonJS interop for its direct version operations, and removes the need for @types/semver.

Compatibility

• preserve default prerelease range behavior, comparison boundaries, and invalid-input handling with focused tests
• keep verkit as a runtime dependency because the published ESM chunks externalize it; the browser client bundles its usage
• retain the existing semver workspace override for transitive consumers while removing every direct first-party semver dependency and import
• keep the effective Node.js floor unchanged: verkit requires Node.js 18.12+, matching the affected package's existing @nuxt/kit runtime floor
• verify the built module imports successfully on Node.js 18.20.8

Related

• Replace semver with verkit e18e/ecosystem-issues#277
• refactor(kit,nuxt): replace semver with verkit nuxt#35713

Validation

• pnpm install --frozen-lockfile --ignore-scripts --offline
• pnpm lint
• pnpm build
• pnpm typecheck
• pnpm test
• pnpm test:e2e:dev
• pnpm test:e2e:built
• pnpm --dir packages/devtools pack --dry-run --json
• Node.js 18.20.8 built-module import smoke test
• git diff --check

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	verkit@​0.1.2

View full report

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes replace semver with verkit across DevTools version checks. Dependencies and workspace catalogs now use verkit 0.1.2, while semver type entries are removed. Nuxt range checks, the timeline’s minimum-version gate, and package update detection call verkit helpers. A new test suite covers stable, prerelease, range, boundary, and invalid-input behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: replacing semver with verkit in devtools.
Description check	✅ Passed	The description is directly related to the changeset and accurately describes the semver-to-verkit migration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ESLint

If the error stems from missing dependencies, add them to the package.json file. For unrecoverable errors (e.g., due to private dependencies), disable the tool in the CodeRabbit configuration.

ESLint install failed. For unrecoverable errors, disable the tool in CodeRabbit configuration.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

packages/devtools/test/version-comparison.test.ts (1)

4-24: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add coverage for the migrated production call sites.

This suite validates verkit primitives but not satisfyNuxtVersion, the timeline minimum-version gate, or checkForUpdateOf. Add focused boundary, prerelease, equality, and invalid-input cases at those integration points so helper-level tests cannot mask wiring or fallback regressions.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/devtools/test/version-comparison.test.ts` around lines 4 - 24, Add
integration-focused tests in the version comparison suite for
satisfyNuxtVersion, the timeline minimum-version gate, and checkForUpdateOf,
covering boundary values, prerelease handling, equality, and invalid inputs.
Exercise the actual production call paths and assert their fallback/error
behavior so tests verify wiring beyond the underlying verkit helpers.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@packages/devtools/test/version-comparison.test.ts`:
- Around line 4-24: Add integration-focused tests in the version comparison
suite for satisfyNuxtVersion, the timeline minimum-version gate, and
checkForUpdateOf, covering boundary values, prerelease handling, equality, and
invalid inputs. Exercise the actual production call paths and assert their
fallback/error behavior so tests verify wiring beyond the underlying verkit
helpers.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: df36e361-e812-45c3-abd5-26acc2a90a80

📥 Commits

Reviewing files that changed from the base of the PR and between 0c94730 and 961aac7.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (7)

• package.json
• packages/devtools/client/composables/npm.ts
• packages/devtools/package.json
• packages/devtools/src/integrations/timeline.ts
• packages/devtools/src/npm/index.ts
• packages/devtools/test/version-comparison.test.ts
• pnpm-workspace.yaml

💤 Files with no reviewable changes (1)

• package.json