chore(deps): weekly CLI dependency update (2026-07-17) [RED-709] [ship]#1414
Merged
Conversation
Bump the direct dependencies whose latest version is both compatible with our Node 20.19.0 floor and past pnpm's 2-day release-age embargo: mqtt 5.15.1 -> 5.15.2 string-width 8.2.1 -> 8.2.2 @typescript-eslint/typescript-estree 8.62.1 -> 8.64.0 oclif 4.23.24 -> 4.23.27 tar 7.5.19 -> 7.5.20 eslint 10.6.0 -> 10.7.0 typescript-eslint 8.62.1 -> 8.64.0 vitest 3.2.6 -> 3.2.7 Held back — newest major raises the minimum Node above our floor, and each is already at its latest installable version, so no manifest change: @commitlint/cli, @commitlint/config-conventional 21.x needs >=22.12.0 lint-staged 17.x needs >=22.22.1 nanoid 6.x needs ^22 || ^24 || >=26 Deferred: typescript stays at 6.0.3. 7.0.2 clears both gates, but TypeScript 7 is the native port and typescript-eslint 8.64.0 declares peer typescript ">=4.8.4 <6.1.0", so it would break the lint toolchain. Tracked separately. Excluded: @types/node, deliberately held near our minimum supported Node major so code cannot reach for APIs missing on the oldest Node we support. Nothing was blocked by the release-age embargo this week. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…D-709] Phase 1 of the dependency-update command sent the operator straight to `pnpm outdated -r`. That command compares the installed tree against the registry, so in a tree without node_modules it reports every direct dependency as `missing (wanted ...)` — including ones already up to date — instead of only what is outdated, making the survey useless. A fresh git worktree never has node_modules, since gitignored artifacts are not shared between worktrees, so the survey fails there by default. Add the install step and a tripwire describing the all-`missing` output, so the next operator recognises the failure instead of re-deriving it. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
sorccu
force-pushed
the
simo/red-709-weekly-cli-dependency-update
branch
from
July 17, 2026 17:55
91c1468 to
48c4154
Compare
sorccu
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Linear: RED-709
Weekly dependency update. Each package goes to the newest version that is both compatible with our Node 20.19.0 floor (
engines.nodeis^20.19.0 || >=22.12.0) and past pnpm's 2-dayminimumReleaseAgeembargo.mqttstring-width@typescript-eslint/typescript-estreeocliftareslinttypescript-eslintvitestHeld back
Newest major raises the minimum Node above our floor. Each is already at its latest installable version, so no manifest change:
@commitlint/cli,@commitlint/config-conventional— 21.x requires>=22.12.0lint-staged— 17.x requires>=22.22.1nanoid— 6.x requires^22 || ^24 || >=26Deferred
typescriptstays at 6.0.3. 7.0.2 clears both gates, but TypeScript 7 is the native port andtypescript-eslint@8.64.0declares peertypescript: ">=4.8.4 <6.1.0", so adopting it today would break the lint toolchain. Split out to RED-737.Excluded
@types/node— deliberately held near our minimum supported Node major, so code cannot reach for APIs missing on the oldest Node we support.Nothing was blocked by the release-age embargo this week.
Verification
Both packages build,
skills/in sync, lint clean, 1621 + 19 unit tests pass on vitest 3.2.7, commitlint accepts and rejects correctly,pnpm install --frozen-lockfilereports the lockfile up to date, and every changed package'sengines.nodeadmits Node 20.19.0 with no engine warnings.The lockfile was regenerated from the committed one (
git checkout HEAD -- pnpm-lock.yaml && pnpm install) so the diff carries only what the new ranges require, without unrelated in-range transitive churn.Other changes
Second commit fixes the dependency-update command doc: its survey step ran
pnpm outdated -rwith no install first.pnpm outdatedcompares the installed tree against the registry, so in a fresh worktree (which never hasnode_modules) it reports every direct dependency asmissing (wanted ...)and the survey is useless. Hit for real during this update.🤖 Generated with Claude Code