Weekly dependency update (2026-09-12)

[robertying]

Summary

• corepack use pnpm@latest && corepack install — bumped packageManager pin pnpm@12.3.4 → pnpm@12.4.1 (minor).
• pnpm update --latest -r — updated the rest of the workspace to latest: @graphql-codegen/cli 7.4.0→7.4.1, @primer/css 22.3.0→22.3.1, @types/react 19.2.18→19.3.0, @types/react-dom 19.2.7→19.3.0, daisyui 5.7.28→5.7.37, eslint-config-next 16.3.4→16.3.5, next 16.3.4→16.3.5, react 19.2.8→19.3.0, react-dom 19.2.8→19.3.0. Everything else was already at latest.
• Major bump attempted and capped back down: eslint 9.39.5 → 10.10.0 was tried, but capped back to 9.39.5 (latest 9.x, i.e. no net change to that line). eslint-plugin-react@7.37.5 (pulled in transitively via eslint-config-next) throws TypeError: contextOrFilename.getFilename is not a function while linting under ESLint 10's changed Linter API — an upstream compatibility gap in eslint-plugin-react, not a code issue in this repo. Same pattern as the last two weeks' PRs; will retry automatically once upstream catches up.

Checks

• pnpm codegen: could not run to completion in this sandbox. Network egress to https://api.tsinghua.app works here (unlike last week), but GRAPHQL_ADMIN_SECRET is not available in this sandbox, so schema introspection fails with Invalid value "undefined" for header "x-hasura-admin-secret". No .env* files exist or were touched. Real verification happens in CI, which has the secret.
• pnpm lint: passed (after the eslint cap; crashed hard before it, see above).
• pnpm build (next build --webpack): failed, but only as a downstream consequence of the codegen limitation above — Module not found: Can't resolve 'gql' in the two course pages that import generated GraphQL types (gql/ is gitignored and generated by codegen, not committed). Not a dependency regression; will build fine in CI once codegen runs first.
• Smoke test: ran next dev instead (codegen output unavailable). Server started in 509ms on port 3002 (3000 was occupied by an unrelated sandbox process), GET / — a route that doesn't touch generated GraphQL types — returned 200 with real rendered page HTML, no stack traces or warnings in the startup log beyond the expected useTypeScriptCli experimental-flag notice. (Cleaned up two AGENTS.md/CLAUDE.md files Next.js auto-generated during this smoke test — not committed.)

Workaround check (step 6)

• next.config.ts still disables experimental.useTypeScriptCli because the aliased typescript package (@typescript/typescript6) only ships a tsc6 binary, not tsc. This week's update did not change @typescript/typescript6 (still 6.0.2, latest; still only exposes bin: { "tsc6": "./bin/tsc6" }). Last week's PR (Weekly dependency update (2026-09-05) #8) noted next@16.3.4 appeared to have a fallback that could resolve tscN-style binaries, but that was left unverified/unflipped for a human to test deliberately — that status is unchanged this week (still not flipped, still worth a deliberate follow-up with gql/ generated).
• No other workaround-style comments found in the codebase (searched for workaround/hack/todo-remove/fixme/eslint-disable/ts-ignore/ts-expect-error).

GitHub Actions pins

• actions/checkout@v7, actions/setup-node@v7, pnpm/action-setup@v6, actions/cache@v6 — checked latest tags via git ls-remote --tags: all four floating major-version tags already point at the newest release in their current major (v7.0.1, v7.0.0, v6.1.0, v6.1.0 respectively). No workflow edits needed, no major bumps available.

Dockerfile

• Base image node:lts-alpine is a floating tag, left as-is. No other hardcoded versions found worth flagging.

Needs review

• eslint 9→10 cap (see above) — no action needed now; will retry automatically once eslint-plugin-react/eslint-config-next support ESLint 10.
• pnpm codegen / pnpm build were not verified end-to-end locally — this sandbox lacks GRAPHQL_ADMIN_SECRET. Please confirm CI's check job goes green on this PR.
• next.config.ts's experimental.useTypeScriptCli: false workaround — carried over from last week as possibly obsolete but still unverified; worth a deliberate follow-up rather than flipping it inside this automated PR.
• Pre-existing (not introduced this week): pnpm peers check reports graphql@17.0.2 doesn't satisfy graphql-request's peer range (14 - 16) and graphql-config's peer range (up to 16); graphql was already 17.0.2 before this update and is unchanged, so this isn't new — just flagging it's still there.

🤖 Generated with Claude Code

---

Generated by Claude Code