[claude]

Requested by Łukasz Komoszyński · Slack thread

A full dependency-maintenance pass across the workspace.

Before / After

Before: the repo lints with a legacy CommonJS flat-config (root eslint.base.config.cjs + per-package .cjs/.js files, eslint-plugin-prettier), lint is red on 4 pre-existing errors and excluded from the CI gate, @leancodepl/* tooling is pinned at 9.6.3, code imports zod/v4, and it runs on Nx 21 / Node 22.

After: the repo lints green with the shared @leancodepl/eslint-config flat config (single ESM eslint.config.mjs, matching js_corelibrary), runs on Node 24, imports plain zod (v4), and is on Nx 23 with current tooling. CI is green on Node 24: build (9 projects), test (31 tests / 23 snapshots), and lint (all 10 projects).

What changed

ESLint → flat config (js_corelibrary parity)

• Replaced eslint.base.config.cjs + all per-package eslint.config.cjs/.js with a single root ESM eslint.config.mjs; each package re-exports it via its own eslint.config.mjs (schema keeps its protocol/ ignore).
• Spreads the @nx/eslint-plugin flat presets plus base + imports from @leancodepl/eslint-config (no React presets — this repo generates TS contracts); enforces @nx/enforce-module-boundaries + @nx/dependency-checks; ignores **/dist + **/*.timestamp*.
• Pinned eslint ^9.39.4, unified typescript-eslint 8.62.1 (removed the separate @typescript-eslint/parser + eslint-plugin), eslint-config-prettier 10.1.8; removed eslint-plugin-prettier; prettier reduced to a one-line re-export of @leancodepl/prettier-config.
• Fixed the 4 pre-existing lint failures (perfectionist import ordering, several unicorn/* rules, prettier reformatting); nx.json lint inputs point at the flat config.

@leancodepl/* bumps

• @leancodepl/eslint-config / prettier-config / resolve-eslint-flat-config: 9.6.3 → 10.5.2.
• Runtime @leancodepl/utils (in -schema, -types, -generator): >=7.2.3 → >=10.5.2. 10.x is pure ESM, so a transformIgnorePatterns was added to the shared Jest preset to let ts-jest transpile @leancodepl/* (and tiny-invariant).

zod → 4

• Raised the zod floor to >=4.4.3 across root, generator, and the raw/zod/client/contracts plugins.
• Simplified the five source imports from zod/v4 to plain zod (on >=4.4.3 the root entry already is the v4 API); generated snapshots unchanged.

Other dependency bumps

• Nx: 21.6.4 → 23.0.1 (nx migrate, migrations applied, aligned @swc/*).
• @commitlint/cli + config-conventional → 21; lerna → 9; jsdom → 29.
• protobufjs 7.5.3 → 8.6.6 (+ protobufjs-cli 1.1.3 → 2.5.7; -schema range widened to ^8.0.0).
• @types/node ^24 → ^24.13.2 (latest 24.x, aligned with the Node 24 runtime); yaml 2.8.0 → 2.9.0; lodash floor → ^4.18.1; tslib floor → ^2.8.1; @swc/core → 1.15.43; plus safe minor/patch devDeps (@types/lodash, jest, jest-environment-jsdom, jest-util, jiti, ts-jest, verdaccio).

Node

• .nvmrc 22 → 24.18 (js_corelibrary parity). Both CI workflows resolve via node-version-file: .nvmrc; no engines.node pins to change.

Held / needs a maintainer decision

• typescript 5.9 → 6.0 — held on this PR; moved to a separate stacked PR (base chore/npm-dependencies-bump). TS 6 turns baseUrl (TS5101) and moduleResolution: node10 (TS5107) into hard errors, so it gets a real tsconfig migration there. TypeScript stays pinned at 5.9.3 here.
• Protobuf codegen regeneration — deferred to its own PR. protobufjs-cli 2 runs (verified via schema:proto-update), but regenerating the protocol files is ~12k lines of purely stylistic codegen churn; CI stays green on the existing generated files.

---

Second bump pass (2026-07) — new commits on top of the above

A follow-up dependency pass layered onto this branch, picking up new drift since the branch was opened and retrying the previously-held majors. Baseline for this pass was already green (lint 10 projects, build 9, test 31/23 snapshots) on Node 24.13.1; the bar was no new failures.

What changed (grouped)

• Nx 23.0.1 → 23.1.0 via nx migrate latest (migrations applied, migrations.json + tools/ai-migrations/ deleted; @swc/* already aligned, no change needed).
• TypeScript stays on 5.9.3. The TS 6 upgrade that was briefly bundled into the Nx 23.1 migration here has been moved to a separate stacked PR (base chore/npm-dependencies-bump), done properly with a real tsconfig migration (remove baseUrl, migrate moduleResolution off node10) rather than papering over it with ignoreDeprecations: "6.0". This branch keeps Nx 23.1.0 and all its non-TS changes; the TS-6-only tsconfig edits (ignoreDeprecations, and the noUncheckedSideEffectImports / types defaults) have been reverted so the workspace builds cleanly on 5.9.3.
• Safe minor/patch devDeps: @leancodepl/eslint-config / prettier-config / resolve-eslint-flat-config 10.5.2 → 10.6.0; typescript-eslint 8.62.1 → 8.64.0; eslint 9.39.4 → 9.39.5; prettier 3.9.4 → 3.9.5; @commitlint/cli 21.2.0 → 21.2.1; @types/node 24.13.2 → 24.13.3 (stays on 24.x); protobufjs 8.6.6 → 8.7.1; protobufjs-cli 2.5.7 → 2.6.1.
• Runtime (prod) deps: already at latest (zod, yargs, yaml, lodash, tslib, long, object-hash, lilconfig) — nothing to bump.

Held (with reasons)

• typescript 6.0.3 / 7.0.2 — held on this PR. TS 6 moved to its own stacked PR (see above). TS 7 is the native-compiler rewrite and remains out of scope: nx run-many -t build fails with Cannot read properties of undefined (reading 'readFile') (Nx's @nx/js TS integration is not TS7-compatible), ts-jest@29 peer caps <7, and @typescript-eslint/parser@8.64 peer caps <6.1.0. This branch stays at 5.9.3.
• eslint 10.7.0 — held. Clean strict npm install hard-fails with ERESOLVE: @leancodepl/eslint-config's plugin set (eslint-plugin-react@7.37.5, @types/eslint-plugin-jsx-a11y@6.10.1, eslint-plugin-import@2.32.0) still peer-caps ESLint at ^9, while eslint-plugin-unicorn@70 wants >=10.4 — unresolvable until the shared config publishes an ESLint-10 line. Kept at ^9.39.5.
• @types/node 26 — held (intentional). Pinned to the 24.x line to stay aligned with the Node 24 runtime (.nvmrc 24.18), matching the alignment decision earlier on this branch.
• verdaccio 6.8.0 — left as-is (nx-managed / excluded release-tooling dependency).

Audit: npm audit fix (no --force, lockfile-only) reduced 39 → 26 vulnerabilities. The remaining 26 (18 moderate / 5 high / 3 critical) are all in dev-only tooling chains (download / download-cli / decompress, verdaccio) and only clear under breaking --force bumps, so they are left for a maintainer decision.

Dependabot: repo has no dependabot.yml and no open Dependabot PRs to reconcile.

Verification: clean strict npm install and npm ci both resolve cleanly (exit 0); nx run-many -t lint build test green on Node 24.18.0 (lint 10 projects, build 9 projects, test 31 tests / 23 snapshots), on TypeScript 5.9.3 with no ignoreDeprecations anywhere. No typecheck target exists in this workspace.