chore: Update dependencies to latest - #45
Merged
Merged
Conversation
Update 38 packages to the latest version within their current major line. No major upgrades are included here. Four packages are deliberately held at their current major because a peer dependency blocks the upgrade: - typescript 5.9.3: ts-jest@29 requires <7 and @typescript-eslint@8 (including canary) requires <6.1.0. No TS 7 compatible release exists. - graphql 16: every @apollo/server 5.x release peers on ^16.11.0 and no v6 has shipped. Bumped to 16.14.2 instead. - graphql-upload 17: v18 requires graphql ^17, blocked by the above. Bumped to 17.1.0 instead. - @types/node 24: kept aligned with the Node 24 runtime. Two follow-on fixes were required: - jest 30.4 turns the --testPathPattern to --testPathPatterns rename into a hard error, so the test:unit and test:integration scripts would no longer run. Renamed the flag in both. - prettier 3.9 changes how union types are laid out, reformatting src/common/graphql/utils/types.ts. Formatting only, no behavior change.
Upgrade five packages across a major boundary. Each was checked against its actual usage in this repo and needs no code change. - uuid 13 -> 14: drops Node 18, requires a global crypto and TS 5.4.3+. All three are already satisfied. Only v4 is imported. - class-validator 0.14 -> 0.15: the sole breaking change makes the IsIBAN options argument mandatory, and IsIBAN is not used here. - globals 16 -> 17: consumed only by the ESLint config. - @types/supertest 6 -> 7: realigns the types with supertest 7, which ships no types of its own. - @swc/cli 0.7 -> 0.8: never invoked by any script; builds go through the Nest swc builder, which uses @swc/core. Build, lint, unit and integration tests all pass unchanged.
Bump eslint 9.39.1 to 10.8.1. @typescript-eslint 8.67 already peers on eslint ^10, and eslint-plugin-prettier and eslint-config-prettier both accept it, so no plugin changes were needed. Rewrite eslint.config.mjs to use the flat presets directly instead of wrapping the old eslintrc-style configs in FlatCompat: - plugin:@typescript-eslint/recommended becomes the plugin's own configs['flat/recommended'] - plugin:prettier/recommended becomes eslint-plugin-prettier/recommended, which already merges eslint-config-prettier - ecmaVersion 5, which was wrong for this codebase, becomes latest Verified equivalent by diffing `eslint --print-config` before and after: all 410 resolved rules are byte-identical, with the same 24 active. This drops the last uses of @eslint/eslintrc and @eslint/js, so both are removed. @eslint/js was only ever passed to the FlatCompat constructor and never contributed a rule to the resolved config.
Remove three dependencies that are not used: - apollo-server-core and apollo-server-express, both Apollo Server v3, which is end of life. Nothing imports them; the GraphQL layer runs on @apollo/server v5 with @as-integrations/express5. Also correct the stale package list in README.md that still named apollo-server-express. - @types/uuid, a stub that is now wrong anyway. It only publishes up to v11 while uuid is at 14, and uuid has shipped its own types since v13. Declare dotenv explicitly. src/common/config/ormconfig.ts imports it but package.json never listed it, so it resolved to whatever another package happened to hoist, which was 16.6.1 from an unrelated ^16.4.5 range rather than the 17.4.1 that @nestjs/config depends on. Pinning it to ^17.4.1 promotes dotenv 17 to the top level, and dotenv 17 logs a banner to stdout on every config() call, so pass quiet: true to keep the CLI and app startup output clean.
Bump typeorm 0.3.27 to 1.1.0. @nestjs/typeorm was already moved to 11.0.3 earlier on this branch, which peers on typeorm ^1.0.0-dev. Raise the TypeScript target from es2017 to es2023, the minimum TypeORM 1.0 requires. tsconfig.json is the only place a target is pinned, so this also drives the swc builder and ts-jest. Register a quote_ident stub for pg-mem in the integration test setup and in the generator template that mirrors it. TypeORM 1.x builds the table comment lookup in loadTables() as obj_description((quote_ident(schema) || '.' || quote_ident(table))::regclass) rather than passing a pre-quoted literal, and pg-mem implements no quote_ident, so synchronize() failed for every test in the suite. No application code needed changing. The removed 0.3 APIs are unused here, the entity has no relations so the LEFT to INNER JOIN change does not apply, and the find options already use the object form. Build, lint, unit and integration tests pass. Two nullish-where issues found while verifying this upgrade are left for a follow-up branch: a pre-existing crash in processWhere, which is not caused by the upgrade, and undefined id claims reaching the repository from the JWT strategies.
Re-resolve the transitive tree within the existing semver ranges. package.json is unchanged. - @ungap/structured-clone 1.3.0 -> 1.3.3, clearing the CWE-502 advisory on 1.3.0. jest-worker already allowed ^1.3.0; the lockfile was simply pinned to the old version. - Deduplicates the tree from 1146 to 1090 resolved packages. Deprecated transitive packages drop from 7 to 6. The rest come from jest, @nestjs/cli, @nestjs/graphql and @nestjs/apollo, all of which are already at their latest versions, so they need an upstream fix. @types/node stays hoisted at 24.13.3 as intended; the 26.2.0 copies are nested under jest internals and graphql-upload and do not affect this project's compilation.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes
eslint.config.mjson the flat presets, droppingFlatCompat,@eslint/eslintrcand@eslint/jsapollo-server-core,apollo-server-expressand@types/uuid, all deprecated and unuseddotenv, whichormconfig.tsimported without it being inpackage.json, and passquiet: trueto silence the dotenv 17 bannertargetto es2023quote_identstub for pg-mem, which TypeORM 1.1 needs forloadTables()--testPathPatternto--testPathPatternsin the test scripts, which jest 30.4 requiresyarn.lockNot upgraded
typescript7 — ts-jest peers<7, @typescript-eslint peers<6.1.0graphql17 — every@apollo/server5.x peers on^16.11.0graphql-upload18 — requires graphql^17@types/node26 — kept on the Node 24 runtime