Skip to content

Chore: Refresh All Deps to Bleeding Edge#162

Merged
jlukic merged 5 commits intomainfrom
chore/bump-npm-deps
Apr 28, 2026
Merged

Chore: Refresh All Deps to Bleeding Edge#162
jlukic merged 5 commits intomainfrom
chore/bump-npm-deps

Conversation

@jlukic
Copy link
Copy Markdown
Member

@jlukic jlukic commented Apr 28, 2026

Bumps all packages to latest versions.

Changes

  • Runs ncu -u across all workspace package.json
  • Adds minor changes to handle changes in API (TS6 made types default to []

Upgrade every npm dep to current latest across all 8 manifests, including 4 majors that needed targeted edits.

Majors:
- glob 10 → 13 (tools/lsp) — programmatic API unchanged
- zod 3 → 4 (tools/mcp) — our usage is the simple-schema subset
- typescript 5 → 6 (tools/mcp) — adds types: [node] to tsconfig (new TS6 default)
- lucide-static 0.563 → 1.12 (packages/specs) — drops github brand icon

Drops the standalone docs/package-lock.json since workspaces consolidate to root.

Resolves all 7 npm dependabot alerts; one remaining brace-expansion advisory is via wireit (developer-controlled brace input, no exploit path).
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 28, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
semantic-next Ready Ready Preview, Comment Apr 28, 2026 8:02pm
1 Skipped Deployment
Project Deployment Actions Updated (UTC)
mcp Ignored Ignored Preview Apr 28, 2026 8:02pm

Request Review

Vercel build runs `cd docs && npm install` as part of build:docs, which needs the standalone lockfile. Workspaces consolidation was an incorrect assumption — the docs lockfile is load-bearing for the deploy cycle.
jlukic added 2 commits April 28, 2026 15:54
The lucide-static 0.563 → 1.12 bump touched 480 SVGs but only 10 had real path changes; the rest differed solely in the license comment header. Reverting the regenerated set keeps the PR diff reviewable. Next `npm run build:icons` will reapply the 10 substantive updates on its own.
Material-symbols, tabler, and other icon set bumps regenerated SVGs that mostly differ in license headers. Reverting all src/ to keep the PR focused on the dep refresh; next build:icons run reapplies any substantive path changes on its own.
@jlukic jlukic merged commit 74c6bd0 into main Apr 28, 2026
7 of 10 checks passed
@jlukic jlukic deleted the chore/bump-npm-deps branch April 28, 2026 19:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant