[claude]

Requested by Łukasz Komoszyński · Slack thread

Routine dependency refresh of the workspace. Seven commits, each verified on its own; the whole branch was then verified end to end. TypeScript is deliberately kept on 5.x — see the held list below.

Only devDependencies were moved. Runtime dependencies were left alone on purpose and are collected at the bottom for a maintainer decision.

What moved

Nx

Package	Before	After
nx and all @nx/*	23.0.2	23.1.1

A patch-level migration. Nx's out-of-scope packageJsonUpdates were not applied — the commit touches nx and @nx/* only.

Safe devDependencies (minor and patch)

Package	Before	After
@commitlint/cli	^21.2.1	^21.2.2
@commitlint/config-conventional	^21.2.0	^21.2.2
@faker-js/faker	^10.5.0	^10.6.0
@openapitools/openapi-generator-cli	2.39.1	2.40.1
@playwright/test	1.61.1	1.62.1
@tanstack/react-query	5.101.2	5.101.4
@tanstack/react-query-devtools	5.101.2	5.101.4
@types/node	^26.1.1	^26.2.0
@types/react	^19.2.17	^19.2.18
@types/react-dom	^19.2.3	^19.2.4
core-js	^3.49.0	^3.50.0
eslint-plugin-playwright	2.10.5	2.11.0
jsonc-eslint-parser	^3.1.0	^3.3.0
lint-staged	17.0.8	17.3.0
prettier	>=3.9.5	>=3.9.6
react	^19.2.7	^19.2.8
react-dom	^19.2.7	^19.2.8
sinon	^22.0.0	^22.1.0
stylelint	^17.14.0	^17.14.1
testcontainers	^12.0.4	^12.1.0
typescript-eslint	8.63.0	8.67.0
verdaccio	6.2.5	6.9.2

react and react-dom are root devDependencies only; every workspace package declares them as *, so nothing downstream is constrained by this.

Majors

Package	Before	After	Why it is safe here
lerna	^9.0.7	^10.0.0	Requires nx >=23.1.0 <24.0.0, satisfied by the Nx bump above, so it now dedupes onto the workspace's Nx instead of bundling its own Nx 22.7.8 — that alone removes ~2000 lockfile lines. The release workflow never invokes lerna; it only reads the version out of lerna.json.

lerna is the only major taken. jsdom was attempted and reverted — see the held list.

One source change

packages/vite-plugin-favicon/src/lib/index.test.ts gains htmlTags: [] in two type-annotated fixtures. favicons 7.3.1 (pulled by npm audit fix, and already inside the declared ^7.2.0 range) adds a required htmlTags field to FaviconResponse. Keeping 7.3.1 buys a patched sharp and clears two high advisories; the plugin source only ever reads .html, never .htmlTags, so an empty array is a faithful stand-in. It is in its own commit.

What was HELD, and why

Package	Stayed at	Reason
typescript	5.9.3	Deliberate. 7.x is not in scope for this PR, and nothing here needs it.
jsdom	^29.1.1	Bumped to ^30.0.1, then reverted. jsdom 30 routes FileReader.readAsDataURL through @exodus/bytes, whose assertU8 guard is a realm-fragile instanceof Uint8Array check; vitest's jsdom environment swaps the global Uint8Array binding, so the check throws TypeError: Expected an Uint8Array and breaks @leancodepl/image-uploader:test. 30.0.1 is the latest release, so there is nothing to jump to.
eslint	^9.39.5	eslint-plugin-import@2.32.0, eslint-plugin-jsx-a11y@6.10.2 and eslint-plugin-react@7.37.5 all cap their eslint peer at ^9. ESLint 10 has to wait for that plugin set.
@babel/core, @babel/preset-react	^7.29.7	@nx/js@23.1.1 hard-depends on @babel/core@^7.23.2. Moving the root to 8 would fork the Babel tree into a 7 and an 8 copy.
@tanstack/react-router-devtools	1.167.0	1.167.1 peers @tanstack/react-router@^1.170.19, but that is a runtime dependency pinned at 1.170.17 and out of scope here.
@tanstack/router-plugin	1.168.19	Same cause: 1.168.32 peers @tanstack/react-router@^1.170.29. The whole router group has to move together.
vite, @vitejs/plugin-react, rollup, @swc/*, @swc-node/*	unchanged	Nx-managed. These are pulled forward by Nx migrations rather than by a manual sweep.

Holding jsdom costs nothing measurable: npm audit lands on the same 20 findings (0 critical, 19 high, 1 moderate) either way, and the vite-plugin-favicon test — the one jsdom 30 was credited with fixing, on a "Failed to resolve entry for package parse5" error — is green on jsdom 29 too, from a clean install.

Two notes worth a decision, neither introduced by this PR:

• vite is the largest remaining security item. It is pinned at 7.3.1 and five high advisories are fixed in 7.3.4+. Because it is Nx-managed it was left alone here, but a follow-up that moves it is worth scheduling.
• @types/node is on 26.x while .nvmrc pins Node 24.18. main already declared ^26.1.1 before this PR, so this only carries it to ^26.2.0 inside that major. Type definitions ahead of the runtime can typecheck code that will not run. Whoever picks this up should decide which side moves — types back to 24.x, or the runtime forward.

npm audit

	Total	Critical	High	Moderate
Before (main)	58	2	47	9
After bumps	31	0	27	4
After npm audit fix	20	0	19	1

npm audit fix was run without --force; it changed the lockfile only, package.json is untouched by it. What remains is vite (pinned, see above) plus brace-expansion, js-yaml, svgo and tar, all reachable only through Nx and lerna.

Dependabot

All ten open dependency PRs are subsumed by this branch and should close on merge:

PR	Wanted	This branch resolves
#323 nanoid	3.3.18	3.3.18
#322 dompurify	3.4.13	3.4.13
#321 fast-uri	3.1.5	3.1.5
#320 ip-address	10.4.0	10.5.0
#319 undici	6.28.0	6.28.0
#318 postcss	8.5.25	8.5.26
#317 brace-expansion	1.1.18	1.1.18
#314 sharp + favicons	—	0.35.3 / 7.3.1
#313 protobufjs	7.6.5	7.6.5
#312 axios	1.18.0	1.18.1

Verification

Full workspace run on the final tree, from a from-scratch npm install, nothing skipped:

Target	Result
lint	41 projects, pass
typecheck	38 projects + 1 dependency, pass
test	37 projects, pass
build	42 projects, pass

Every commit also installs cleanly with no lockfile drift, using the same npm install the CI workflow runs on the Node version in .nvmrc.

Runtime dependencies — maintainer decision

None of these were touched. They are listed so the call is yours.

Worth taking first

• @tanstack/react-router 1.170.17 → 1.170.29 (root). Patch-level only. This is the single change that unblocks @tanstack/react-router-devtools and @tanstack/router-plugin, both held above. Recommended.
• favicons ^7.2.0 → ^7.3.1 (vite-plugin-favicon). Already what the lockfile resolves; raising the declared floor passes the patched sharp on to consumers. Adds a required htmlTags field to FaviconResponse. Recommended.
• @nx/devkit ^23.0.0 → ^23.1.1 (nx-plugins). Aligns the plugin's floor with the Nx the workspace now runs. Recommended.

Low-risk floor raises on published packages — each only narrows what consumers may install, so each is a minor for the library:

• axios >=1.6.0 → >=1.19.0 (axios-cqrs-client), ^1.7.9 → ^1.19.0 (intl). Security and fetch-adapter fixes. Recommended together.
• rxjs >=7.0.0 → >=7.8.2 (antd-table-hooks, force-update, react-query-cqrs-client, rx-cqrs-client). Patch-level within 7. Low risk.
• @tanstack/react-query >=5.0.0 → >=5.101.4 (kratos, react-query-cqrs-client). Matches the version the workspace already develops against.
• @tanstack/react-form >=1.23.0 → >=1.33.5 and @radix-ui/react-slot >=1.0.0 → >=1.3.3 (kratos). Both additive.
• tslib ^2.3.0 → ^2.8.1 and @typescript-eslint/utils >=8.0.0 → >=8.67.0 (eslint-plugin, fetch-client). Helper and type-utility floors.
• Small patches: parse5 ^8.0.1, buffer >=6.0.3, tiny-invariant >=1.3.3, intl-messageformat ^11.2.13.
• Tooling floors in intl and mail-translation: @formatjs/cli ^6.16.18, @inquirer/checkbox ^5.2.1, @inquirer/confirm ^6.1.1, lodash ^4.18.1, yaml ^2.9.0, yargs ^18.1.0.
• react-easy-crop ^6.0.0 → ^6.2.3 and zod ^4.0.5 → ^4.4.3. Additive within the major.

Majors that need a real decision

• jsdom ^29.1.1 → ^30.0.1 (root devDependency). Blocked on the @exodus/bytes realm bug described in the held list, not on our code. Worth retrying once jsdom or @exodus/bytes ships a fix, or if vitest stops swapping the global Uint8Array.
• antd ^5.0.0 || ^6.0.0 → ^6.6.0 (antd-table-hooks). Dropping the ^5 arm cuts off consumers still on antd 5. Recommendation: hold until the consuming apps are on 6.
• react-dropzone ^15.0.0 → ^20.1.0 (image-uploader). Five majors of API drift; needs the component reviewed against the current hook signature. Recommendation: separate PR.
• chalk >=5.0.0 → >=6.0.0 (logger, folder-structure-cruiser). Tightens the ESM-only story and raises the Node floor. Recommendation: take it alongside a Node baseline decision.
• stylelint >=16 → >=17, stylelint-config-recommended-scss >=14 → >=17, stylelint-order >=5 → >=8 (stylelint-config). The devDependency side is already on 17, so these floors are lagging; moving them is a breaking change for consumers on 16. Recommendation: take as a set in its own release.

---

Generated by Claude Code