Repository navigation
Weekly dependency update (2026-08-29) - #5
Merged
Merged
Conversation
Ran corepack use pnpm@latest (11.21.0 -> 11.24.0) and pnpm update --latest -r. Notable version changes: - eslint 9.39.5 -> 10.9.1 (major) - @graphql-codegen/cli 7.2.0 -> 7.3.1, client-preset 6.1.2 -> 6.1.3 - next 16.3.0 -> 16.3.3, eslint-config-next 16.3.0 -> 16.3.3 - @types/node, @types/react-dom, daisyui, expo-server-sdk, sharp: minor/patch bumps lint currently fails after the eslint major bump: eslint-plugin-react 7.37.5 (pulled in via eslint-config-next) throws "contextOrFilename.getFilename is not a function" under eslint 10's flat-config rule context, so eslint-config-next does not yet support eslint 10. Left eslint at the new major per the update instructions rather than guessing a downgrade; see PR description for details. codegen/build could not be verified in this sandbox: pnpm codegen needs network access to the private GRAPHQL_API_URL endpoint plus GRAPHQL_ADMIN_SECRET, neither available here, so gql/ (gitignored) was never generated and next build fails on the resulting missing module. This is an environment/credentials limitation, not a regression from the dependency bump. GitHub Actions pins in .github/workflows/CI.yml were checked against upstream tags and are already on the latest major moving tag (checkout@v7, setup-node@v7, pnpm/action-setup@v6, actions/cache@v6) - no changes needed. Dockerfile's node:lts-alpine base is a floating tag and was left untouched. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016FM13cGCUnsrFfWxYaDYm5
Add a pull_request trigger so PRs (including the ones the weekly dependency-update routine opens) actually get CI-checked before merge. Gate the deploy job to push events only so PRs never trigger a container build/push.
eslint-plugin-react@7.37.5 (pulled in transitively via eslint-config-next) throws under ESLint 10's flat-config rule-context API: TypeError: contextOrFilename.getFilename is not a function Same fix already applied in the sibling blog/gpu-covid-visualization weekly-update PRs. Revisit once eslint-config-next ships ESLint 10 support.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ran the weekly autonomous dependency-update routine.
corepack use pnpm@latest && corepack install: pnpm 11.21.0 -> 11.24.0 (minor).pnpm update -r --latest(repo has apnpm-workspace.yaml, though it only carries build/install settings, not a multi-packagepackages:list):eslint9.39.5 -> 10.9.1 (MAJOR)@graphql-codegen/cli7.2.0 -> 7.3.1 (minor)@graphql-codegen/client-preset6.1.2 -> 6.1.3 (patch)@types/node26.2.0 -> 26.4.0 (minor)@types/react-dom19.2.4 -> 19.2.5 (patch)daisyui5.7.16 -> 5.7.22 (patch)eslint-config-next16.3.0 -> 16.3.3 (patch)expo-server-sdk7.1.0 -> 7.2.0 (minor)next16.3.0 -> 16.3.3 (patch)sharp0.35.3 -> 0.35.4 (patch)pnpm-lock.yamldeletion — updated in place by pnpm..github/workflows/CI.yml): checked everyuses:pin's upstream tags (actions/checkout@v7,actions/setup-node@v7,pnpm/action-setup@v6,actions/cache@v6). All four are already on the latest available major moving tag for that action — no changes needed/made.node:lts-alpine, a floating tag per the rules of this routine — left untouched. No other hardcoded tool versions worth flagging were found in the Dockerfile.Checks run locally
pnpm codegenGRAPHQL_API_URLendpoint (api.tsinghua.app) plusGRAPHQL_ADMIN_SECRET; neither is available in this sandboxed CI-less environment. Pre-existing environment/credentials limitation, not caused by this update —gql/is gitignored and always has to be generated locally/in CI with real secrets.pnpm lint(eslint)pnpm buildModule not found: Can't resolve 'gql', a direct downstream consequence of codegen not being able to run here (see above), not a regression from any bumped dependency.pnpm dev, port 3000)Smoke test detail
Started
pnpm devin the background and polledhttp://localhost:3000/. It responded200within ~3s with the expected homepage HTML (no error overlay, no new stack traces in stdout/stderr for that route)./coursesreturned500withModule not found: Can't resolve 'gql'— expected given codegen couldn't run in this sandbox (see above), not a new issue from the update. Process was killed after the check. Two files (AGENTS.md,CLAUDE.md) auto-generated by Next.js 16's dev server as a side effect were deleted before committing since they're unrelated to this update.What I fixed myself
Nothing needed a source-code fix this round — no lint autofixes were applicable (lint doesn't run at all, see below) and no mechanical renames were required by the version bumps that did apply cleanly.
Needs review
eslint9.39.5 -> 10.9.1 (major).pnpm lintnow crashes entirely (exit code 2, not just warnings):eslint-plugin-react7.37.5 (pulled in transitively viaeslint-config-next) throwsTypeError: contextOrFilename.getFilename is not a functionwhile evaluatingreact/display-name— a flat-configcontextAPI incompatibility. This meanseslint-config-nextdoes not yet support eslint 10. I did not guess a fix (e.g., pinning eslint back to^9) per the "don't guess on judgment calls" rule — this needs a maintainer decision: either pineslintback to 9.x untileslint-config-next/eslint-plugin-reactpublish eslint-10-compatible releases, or wait and re-run this update once upstream catches up. CI'sLintstep will fail on this branch as-is.pnpm codegen/pnpm buildcould not be verified at all in this sandbox due to lack of network access toapi.tsinghua.appand noGRAPHQL_ADMIN_SECRET. This is an environment limitation of the automation sandbox, not evidence of a real regression, but it also means no dependency's effect on the actual generated-GraphQL-types build path was validated — worth a real CI run (which does have the secret) before merging.node:lts-alpinebase image continues to float with each Alpine/Node LTS release; no hardcoded version was found to flag as a candidate bump this round.Generated by Claude Code