chore(deps): weekly dependency update (2026-09-19)

[robertying]

Summary

Weekly automated dependency update. Ran corepack use pnpm@latest && corepack install, then pnpm update --latest -r.

• pnpm: 12.4.1 -> 12.4.2 (packageManager field updated)
• @graphql-codegen/client-preset: 6.1.3 -> 6.2.0
• @types/node: 26.4.1 -> 26.6.2
• daisyui: 5.7.37 -> 5.7.42
• dotenv: 17.4.2 -> 18.0.1 (major) — no breakage observed; only used in codegen.ts for dotenv.config(), API unchanged.
• prettier: 3.9.6 -> 3.9.8
• eslint: bumped to 10.11.0 (major) by pnpm update --latest, then capped back down to 9.39.5 (see below).

All other dependencies were already at their latest resolvable versions (no change).

Capped package: eslint -> 9.39.5

pnpm update --latest bumped eslint to 10.11.0. This broke pnpm lint with a hard crash:

TypeError: Error while loading rule 'react/display-name': contextOrFilename.getFilename is not a function
    at .../eslint-plugin-react@7.37.5.../lib/util/version.js:31

Root cause: eslint-config-next (already at its latest release, 16.3.5) pulls in eslint-plugin-react@7.37.5 (also its latest release), which still calls the pre-flat-config context.getFilename() API removed by ESLint 10. eslint-plugin-react's own published peerDependencies cap at ^9.7, confirming ESLint 10 isn't supported yet. This is an unsupported-version incompatibility in the toolchain, not a real code issue, so eslint was capped back to 9.39.5 (latest 9.x) to keep lint green. pnpm lint passes cleanly at this pin. This should be revisited once eslint-plugin-react/eslint-config-next publish ESLint 10 support.

Local check results (this sandbox)

• pnpm lint: pass (clean, no warnings)
• pnpm codegen: could not run — requires GRAPHQL_API_URL/GRAPHQL_ADMIN_SECRET (normally from .env.local, which does not exist in this checkout) to hit the live schema at api.tsinghua.app. This sandbox's network egress policy also blocks that host outright. This is an environment limitation, not a dependency-update regression — .env.local was never touched per policy. CI has the required secrets and network access and should be used to verify codegen/build for this PR.
• pnpm build: failed, but only as a downstream consequence of the above — gql/ (gitignored, generated by codegen) was never produced, so webpack fails with Module not found: Can't resolve 'gql' in the two pages that import generated types (app/(main)/courses/page.tsx, app/(main)/courses/[id]/page.tsx). No other build errors were observed.
• Smoke test (pnpm dev): pass. Server started, GET / returned HTTP 200 with the expected page title (星期四 Thursday) and no errors in the startup log. (Routes under /courses depend on the ungenerated gql/ module and were not exercised, consistent with the codegen limitation above.)

next.config.ts workaround assessment

Existing comment/workaround:

// typescript is aliased to @typescript/typescript6, which only ships
// bin/tsc6 (no bin/tsc), so Next's TypeScript-CLI type-check can't find it.
useTypeScriptCli: false,

Checked after this week's bumps: @typescript/typescript6 is still at 6.0.2 (unchanged; already latest on the registry) and its published package still only ships bin/tsc6, no bin/tsc. The workaround is still necessary — not safe to remove yet. (Did not touch this file.) No other unusual workaround/pin comments were found elsewhere in the repo besides this one.

GitHub Actions

Checked all uses: pins in .github/workflows/CI.yml (actions/checkout@v7, actions/setup-node@v7, pnpm/action-setup@v6, actions/cache@v6) against upstream tags. All four are already floating major-version tags pointing at the latest available major (checkout v7.0.1, setup-node v7.0.0, action-setup v6.1.0, cache v6.1.0 are the newest releases in their respective majors — no v8/v7 exists beyond what's already referenced). No workflow changes needed.

Dockerfile

FROM node:lts-alpine is a floating tag — left alone per policy. No other hardcoded/pinned versions found worth flagging.

Needs review

• pnpm codegen/pnpm build could not be verified locally in this sandbox (no .env.local, no network access to api.tsinghua.app). Please confirm CI's check job (which runs pnpm codegen then pnpm build with real secrets) passes on this branch before merging.
• Pre-existing, unrelated to this week's bump: pnpm peers check reports an unmet peer — graphql-request@7.4.0 wants graphql@"14 - 16" but graphql@17.0.2 is installed. Both versions were already present before this week's update (introduced in a prior week's update) and neither pnpm update --latest changed them (each is already at its own latest release). Not capped/touched this run since it's outside this week's diff and its real-world impact couldn't be verified without the live schema. Worth a follow-up.
• eslint capped at 9.39.5 (see above) — re-check for an ESLint-10-compatible eslint-config-next/eslint-plugin-react release in a future run and un-cap when available.

🤖 Generated with Claude Code

https://claude.ai/code/session_01C454fCeZafg1A5YR4UU7Un

---

Generated by Claude Code