chore(ci): SHA-pin third-party actions, group the vite toolchain - #56
Merged
Merged
Conversation
Two changes, both bringing this repo in line with the posture the three frontend apps and the two client repos landed today. Pins anthropics/claude-code-action and softprops/action-gh-release by commit SHA, using the SHAs already running across the frontends. GitHub-owned actions (actions/checkout, actions/setup-node) stay on tags, matching the apps' convention rather than the backend's pin-everything approach. Adds a vite-toolchain group, listed first so it wins over npm-development. This repo carries vitest, @vitest/coverage-v8 and @vitejs/plugin-react, which are peer-locked to each other and to vite — and it is still on plugin-react ^4 while the apps have moved to ^6 + vite ^8. When that move happens here it has to arrive as one PR: plugin-react 6 requires vite ^8, and the two offered separately deadlock each other. The apps spent a PR untangling exactly that. Also adds an @types/node major ignore, anchored to engines >=22.0.0. As a library consumed by all three frontends this has to keep compiling for the oldest Node it claims to support; newer types would let code referencing Node 24+ APIs typecheck clean here and still break a consumer on Node 22. Drops the stale "(setup-uv v9)" example from the github-actions comment — no workflow in this repo uses setup-uv, so the example described nothing real.
jfrench9
added a commit
that referenced
this pull request
Sep 1, 2026
…ependency Completes the vite-toolchain alignment: all three apps and both client repos moved to @vitejs/plugin-react ^6 with vite ^8 today, and core was the last repo still on plugin-react ^4. Dependabot offered this as #54 (plugin-react 4.7.0 -> 6.1.1) hours before the vite-toolchain group landed in #56, so it arrived ungrouped — a one-line package.json change whose real content was a bundler swap, since plugin-react 6 peers vite ^8. #54 was closed in favour of doing it deliberately. vite is added as a direct devDependency rather than left transitive. That matters more here than in the apps: package-lock.json is gitignored in this repo, so without a direct entry the vite version would be recorded nowhere at all — no lockfile, no package.json line, nothing to review or pin. Now a future bundler major arrives titled what it is. One mismatch worth knowing about, deliberately not "fixed": core declares engines >=22.0.0, while plugin-react 6 and vite 8 want ^20.19.0 || >=22.12.0. That gap only affects contributors on Node 22.0-22.11, who will see an EBADENGINE warning (npm does not enforce engines unless engine-strict is set). It does not affect consumers, because devDependencies are not installed by them — so raising the published engines range to satisfy a dev tool would narrow a consumer-facing promise for no consumer-facing reason. CI is unaffected: node-version '22' resolves to the latest 22.x, well past 22.12. Verified with the full gate on vite 8: format:check, lint, typecheck, test (43 files, 492 passed / 16 skipped) and build all pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Brings this repo in line with the CI dependency posture the three frontend apps and the two client repos landed today. This repo was already in the better shape of the group — its
dependabot.ymlcovers npm — so this is the narrower half of the change.Changes
Two third-party actions pinned by commit SHA —
anthropics/claude-code-actionandsoftprops/action-gh-release, using the SHAs already running across the frontends. GitHub-owned actions stay on tags, matching the apps' convention rather than the backend's pin-everything approach.New
vite-toolchaingroup, listed first so it wins overnpm-development. This is the substantive part. This repo carriesvitest,@vitest/coverage-v8and@vitejs/plugin-react, which are peer-locked to each other and tovite— and it's still on@vitejs/plugin-react ^4while all three apps have moved to^6+vite ^8. When that move happens here it has to arrive as one PR: plugin-react 6 requires vite ^8, and the two offered separately deadlock each other. The apps spent a PR untangling exactly that after it arrived disguised as "bump a dev plugin from 4.7.0 to 6.1.1".New
@types/nodemajor ignore, anchored toengines >=22.0.0. As the library all three frontends consume, this has to keep compiling for the oldest Node it claims to support — newer types would let code referencing Node 24+ APIs typecheck clean here and still break a consumer on Node 22.Removed a stale comment. The
github-actionssection cited "(setup-uv v9)" as its example of an unwanted major, but no workflow in this repo uses setup-uv — the example described nothing real.Not changed
@vitejs/plugin-reactstays on^4and vite stays transitive. Moving this repo to vite 8 is a dependency decision, not a posture one; the group is what makes that decision takeable as a single reviewable PR when you want it.Verification
Changes are YAML-only.
prettier --checkpasses on the edited files, which matters here because CI runsnpm run format:checkover.yml.