chore(deps): wave 1 low-risk dependency updates #39

Merged

rbrooks merged 2 commits from deps/wave-1-low-risk into main

2026-06-25 21:11:33 +00:00

rbrooks commented

2026-06-25 20:46:20 +00:00

Owner

Addresses the low-risk wave of the Renovate dependency dashboard (#30).

Changes

Package	From	To	Notes
`actions/checkout`	v4	v7	CI workflow only
`bcryptjs`	^2.4.3	^3.0.3	only `hash()`/`compare()` used — stable in v3
`@types/bcryptjs`	^2.4.6	removed	bcryptjs v3 ships its own types
`nodemailer`	^6.9.0	^9.0.1	`createTransport`/`sendMail` stable; v9 just raises the Node floor (we're on 24)
`@types/nodemailer`	^6.4.0	^8.0.1	follows runtime lib
`jsdom`	^26.0.0	^29.1.1	test-only
`@types/dompurify`	^3.0.5	removed	dompurify v3 ships its own types

Verification (dev server, Node 24 / npm 11)

API: tsc build clean ✅ · 148/148 vitest tests pass ✅
App: tsc + vite build clean ✅ · vitest pass (jsdom v29) ✅
Lockfiles regenerated; @types/bcryptjs and @types/dompurify fully removed from the trees; npm audit: API 0 vulns.

Remaining dashboard items (TypeScript v6, marked v18, diff v9, the redis-client cluster, react-router v8, tiptap v3) are deferred to later waves as they need per-package migration review.

🤖 Generated with Claude Code

Addresses the low-risk wave of the Renovate dependency dashboard (#30). ## Changes | Package | From | To | Notes | |---|---|---|---| | `actions/checkout` | v4 | v7 | CI workflow only | | `bcryptjs` | ^2.4.3 | ^3.0.3 | only `hash()`/`compare()` used — stable in v3 | | `@types/bcryptjs` | ^2.4.6 | **removed** | bcryptjs v3 ships its own types | | `nodemailer` | ^6.9.0 | ^9.0.1 | `createTransport`/`sendMail` stable; v9 just raises the Node floor (we're on 24) | | `@types/nodemailer` | ^6.4.0 | ^8.0.1 | follows runtime lib | | `jsdom` | ^26.0.0 | ^29.1.1 | test-only | | `@types/dompurify` | ^3.0.5 | **removed** | dompurify v3 ships its own types | ## Verification (dev server, Node 24 / npm 11) - **API:** `tsc` build clean ✅ · 148/148 vitest tests pass ✅ - **App:** `tsc` + `vite build` clean ✅ · vitest pass (jsdom v29) ✅ - Lockfiles regenerated; `@types/bcryptjs` and `@types/dompurify` fully removed from the trees; `npm audit`: API 0 vulns. Remaining dashboard items (TypeScript v6, marked v18, diff v9, the redis-client cluster, react-router v8, tiptap v3) are deferred to later waves as they need per-package migration review. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

rbrooks added 2 commits

2026-06-25 20:46:21 +00:00

chore(deps): wave 1 low-risk dependency updates

CI / App — typecheck, test & build (push) Failing after 19s

Details

CI / API — typecheck & tests (push) Failing after 26s

Details

951277f51e

- actions/checkout v4 → v7 (CI only)
- bcryptjs v2 → v3, drop now-bundled @types/bcryptjs
- nodemailer v6 → v9, @types/nodemailer v6 → v8
- jsdom v26 → v29 (test-only)
- remove @types/dompurify (dompurify v3 ships its own types)

Lockfiles refreshed on the dev server in a follow-up commit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

chore(deps): refresh lockfiles for wave 1 updates

CI / App — typecheck, test & build (push) Successful in 1m34s

Details

CI / App — typecheck, test & build (pull_request) Successful in 1m32s

Details

CI / API — typecheck & tests (push) Successful in 2m18s

Details

CI / API — typecheck & tests (pull_request) Successful in 2m15s

Details

11cc9d7e98

Regenerated on the dev server (Node 24 / npm 11). Verified green:
API tsc build + 148 tests, app tsc + vite build + tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

rbrooks merged commit cc172025a1 into main

2026-06-25 21:11:33 +00:00

rbrooks referenced this pull request from a commit

2026-06-25 21:11:35 +00:00

Merge pull request 'chore(deps): wave 1 low-risk dependency updates' (#39) from deps/wave-1-low-risk into main