From 5642e1b490c7cf2bb6fbb9c9dd7862c26fc12f3e Mon Sep 17 00:00:00 2001 From: Juha Kangas <42040080+valuecodes@users.noreply.github.com> Date: Sat, 31 Oct 2026 21:37:50 +0200 Subject: [PATCH 1/5] chore: add the maintain-kit updates workflow Co-Authored-By: Claude Opus 5.5 --- .github/workflows/maintain-kit-updates.yml | 24 ++++++++++++++++++++++ AGENTS.md | 14 ++++++++++--- README.md | 4 ++++ 3 files changed, 39 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/maintain-kit-updates.yml diff --git a/.github/workflows/maintain-kit-updates.yml b/.github/workflows/maintain-kit-updates.yml new file mode 100644 index 0000000..e923a5d --- /dev/null +++ b/.github/workflows/maintain-kit-updates.yml @@ -0,0 +1,24 @@ +name: Maintain-kit updates + +on: + schedule: + # Weekly on Monday, after the daily dashboard run. An off-peak minute avoids + # the top-of-the-hour queue. + - cron: "17 6 * * 1" + workflow_dispatch: + +permissions: {} + +jobs: + # Keeps one PR per update kind (Node.js, pnpm, catalog) open for updates on + # the current major. Nothing auto-merges. The PRs are opened with + # GITHUB_TOKEN, so their `pull_request` checks wait for someone with write + # access to approve them in the PR. A called workflow cannot raise the + # caller's token, so the job grants it here. + maintain-kit-updates: + permissions: + contents: write # push the update branches + pull-requests: write # open, edit and close the PRs + actions: write # required by the called job even without ci-workflow + issues: read # link the dashboard issue + uses: valuecodes/maintain-kit/.github/workflows/updates.yml@e5bf1d24a413d9312cd2051c39ef44ddd9358be5 # v1.0.0 diff --git a/AGENTS.md b/AGENTS.md index 401ec05..cfff343 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -96,9 +96,17 @@ It keeps one issue, **Maintenance dashboard** (label `maintain-kit-dashboard`), what is due: `catalog:` updates, pnpm (`packageManager`), Node.js (`.nvmrc`) and `pnpm audit` findings. Like `minimumReleaseAge`, a release shows up only once it is 14 days old; a Node.js security -release shows up right away and is flagged. It never opens PRs or commits; doing the -updates stays manual. For a Node.js bump, change only `.nvmrc` (the one place that -holds the exact version). The dashboard, secret-scan and workflow-lint callers pin the +release shows up right away and is flagged. It never opens PRs or commits. For a +Node.js bump, change only `.nvmrc` (the one place that holds the exact version). + +`maintain-kit-updates.yml` calls the updates workflow from +`valuecodes/maintain-kit` weekly. It keeps one PR per kind open (Node.js, pnpm, +`catalog:`) on a `maintain-kit/` branch, for updates on the +current major only; majors stay manual. Those PRs are opened with `GITHUB_TOKEN`, so +their `pull_request` checks wait until someone with write access clicks **Approve +workflows to run** in the PR. It needs **Allow GitHub Actions to create and approve +pull requests** turned on under Settings → Actions → General. Nothing auto-merges. +The dashboard, updates, secret-scan and workflow-lint callers pin the same `valuecodes/maintain-kit` commit, so bump them together. --- diff --git a/README.md b/README.md index e99fb65..e41e5cd 100644 --- a/README.md +++ b/README.md @@ -106,3 +106,7 @@ PATH such as `~/.local/bin`). GitHub settings this relies on: `.github/dependabot.yml` only bumps the SHA-pinned GitHub Actions monthly. 5. **Issues**: run the `Maintain-kit dashboard` workflow once, then pin the **Maintenance dashboard** issue it creates. +6. **Actions → General**: turn on **Allow GitHub Actions to create and approve pull + requests**. `maintain-kit-updates.yml` needs it for its weekly update PRs (one + per kind: Node.js, pnpm, `catalog:`). Nothing auto-merges, and each PR's checks + wait until someone approves the workflows to run in the PR. From 684403bb31bb984fc2a33a4a586622af332f77f8 Mon Sep 17 00:00:00 2001 From: Juha Kangas <42040080+valuecodes@users.noreply.github.com> Date: Sat, 31 Oct 2026 21:38:39 +0200 Subject: [PATCH 2/5] chore: move pnpm settings to pnpm-workspace.yaml and enforce engines pnpm 12 reads only auth settings from .npmrc, so save-exact there had no effect; saveExact in pnpm-workspace.yaml replaces it. engineStrict makes a dependency whose engines exclude the running Node.js fail the install, and the pnpm engines entry goes, since packageManager pins pnpm already. Co-Authored-By: Claude Opus 5.5 --- .npmrc | 5 ----- AGENTS.md | 6 +++--- package.json | 3 +-- pnpm-workspace.yaml | 9 +++++++++ 4 files changed, 13 insertions(+), 10 deletions(-) delete mode 100644 .npmrc diff --git a/.npmrc b/.npmrc deleted file mode 100644 index bed67e8..0000000 --- a/.npmrc +++ /dev/null @@ -1,5 +0,0 @@ -# Don't use caret (^) or tilde (~) in package versions -save-prefix= - -# Always save exact versions -save-exact=true \ No newline at end of file diff --git a/AGENTS.md b/AGENTS.md index cfff343..9ba9a7e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -121,8 +121,8 @@ same `valuecodes/maintain-kit` commit, so bump them together. Update with `pnpm up --latest -r`; `updateConfig.ignoreDependencies` holds `@types/node` to the `.nvmrc` major, so bump it by hand. - Every install enforces the supply-chain settings in `pnpm-workspace.yaml` - (`minimumReleaseAge`, `trustPolicy: no-downgrade`) plus pnpm 12's default - `blockExoticSubdeps`. When one fails, investigate: never disable it, and never - exclude a whole package to get past it. + (`minimumReleaseAge`, `trustPolicy: no-downgrade`, `engineStrict`) plus pnpm + 12's default `blockExoticSubdeps`. When one fails, investigate: never disable + it, and never exclude a whole package to get past it. - Run `pnpm typecheck`, `pnpm lint`, `pnpm knip`, `pnpm format:check` and `pnpm test` before committing. Update docs when architecture or behavior changes. diff --git a/package.json b/package.json index c02736f..364a5f0 100644 --- a/package.json +++ b/package.json @@ -5,8 +5,7 @@ "license": "MIT", "type": "module", "engines": { - "node": "^24.22.1 || >=26.12.1", - "pnpm": ">=12.0.0" + "node": "^24.22.1 || >=26.12.1" }, "packageManager": "pnpm@12.12.0+sha512.2ee06ac86db554cf384421461220f0e336a487bfd41b2acd04e17a86b1487832fe45e8d1743f7fc52acc77de12d2356b536fedf8229fc483239e40b13d474449", "scripts": { diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 3fdf397..893d7c2 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -43,6 +43,10 @@ updateConfig: # guardrail, not a CI check. catalogMode: strict +# Writes exact versions (no `^` or `~`) on `pnpm add`. pnpm 12 reads only +# auth settings from `.npmrc`, so this has to live here. +saveExact: true + # Security floors for transitive deps whose parents still resolve a vulnerable # version. Drop an entry once `pnpm audit` stays clean without it. overrides: @@ -65,6 +69,11 @@ allowBuilds: # install fails with ERR_PNPM_IGNORED_BUILDS. workerd: false +# pnpm already fails the install when the root `engines.node` doesn't match. +# This also refuses any non-optional dependency whose own `engines` excludes +# the running Node.js, instead of only warning. +engineStrict: true + # 14 days, in minutes: a new release is not resolvable until it is this old. # So `pnpm up --latest` deliberately skips fresh releases; use # `minimumReleaseAgeExclude` if one package must move faster. From 33b14bbc83c57ed953c2ad6513372260a2578c1d Mon Sep 17 00:00:00 2001 From: Juha Kangas <42040080+valuecodes@users.noreply.github.com> Date: Sat, 31 Oct 2026 21:39:16 +0200 Subject: [PATCH 3/5] chore: add pre-commit and pre-push git hooks Copied from agentic-monorepo-starter: pre-commit runs format:check, lint and a staged gitleaks scan that fails closed, pre-push runs typecheck, test and knip. The prepare script enables them on install, and the Claude settings deny --no-verify. Co-Authored-By: Claude Opus 5.5 --- .claude/settings.json | 3 +++ .githooks/pre-commit | 20 ++++++++++++++++++++ .githooks/pre-push | 9 +++++++++ AGENTS.md | 22 +++++++++++++++++----- README.md | 13 ++++++++----- package.json | 3 ++- 6 files changed, 59 insertions(+), 11 deletions(-) create mode 100755 .githooks/pre-commit create mode 100755 .githooks/pre-push diff --git a/.claude/settings.json b/.claude/settings.json index 0b46e81..808ed60 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -17,6 +17,9 @@ "Bash(wget:*)", "Bash(nc:*)", "Bash(ssh:*)", + "Bash(git commit --no-verify:*)", + "Bash(git commit -n:*)", + "Bash(git push --no-verify:*)", "Read(**/.env*)", "Read(**/.dev.vars)", "Read(**/.prod.vars)", diff --git a/.githooks/pre-commit b/.githooks/pre-commit new file mode 100755 index 0000000..e557485 --- /dev/null +++ b/.githooks/pre-commit @@ -0,0 +1,20 @@ +#!/bin/sh +# Fast checks before every commit; the heavier ones run in pre-push, and CI runs +# all of them again. Enabled by `pnpm install` (the root `prepare` script) or +# `git config core.hooksPath .githooks`. Never bypass with --no-verify: fix the +# failure instead. +# +# format:check and lint read the working tree, not the staged snapshot, so +# unstaged edits can make them pass or fail. Stage everything you mean to commit. +set -eu + +pnpm format:check +pnpm lint + +# Scan only what is staged, with a local gitleaks (8.19+ for `git --staged`). +# This fails closed: without gitleaks the commit is refused, since the point of +# this hook is to stop a secret before it reaches the remote. CI scans the full +# history through secret-scan.yml from valuecodes/maintain-kit, which pins the +# gitleaks version. +gitleaks git --help >/dev/null 2>&1 || { echo "install gitleaks 8.19+: https://github.com/gitleaks/gitleaks#installing" >&2; exit 2; } +gitleaks git --staged --redact "$(git rev-parse --show-toplevel)" diff --git a/.githooks/pre-push b/.githooks/pre-push new file mode 100755 index 0000000..c02000e --- /dev/null +++ b/.githooks/pre-push @@ -0,0 +1,9 @@ +#!/bin/sh +# Slower checks before every push; pre-commit already ran format, lint and the +# staged secrets scan. Turbo's cache replays unchanged packages. Build is left +# to CI. Never bypass with --no-verify: fix the failure instead. +set -eu + +pnpm typecheck +pnpm test +pnpm knip diff --git a/AGENTS.md b/AGENTS.md index 9ba9a7e..dbefd80 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -63,12 +63,23 @@ configured by the root `knip.jsonc` and exits 0 when clean. Formatting is oxfmt (Prettier-compatible), configured by the root `.oxfmtrc.jsonc`, which also sorts imports. -There is no post-edit formatting hook: run `pnpm format` yourself before committing. - -There are no git hooks. CI scans the full git history for secrets with the gitleaks +Nothing formats on edit, and the pre-commit hook only checks formatting: run +`pnpm format` yourself before committing. + +Git hooks live in `.githooks/` and are plain shell scripts, with no hook manager. +`pnpm install` enables them through the root `prepare` script. The setting goes in +the clone's shared git config, so it covers every worktree, and a branch without +`.githooks/` simply runs no hooks. If you cloned before the hooks existed and have +not run `pnpm install` since, run `git config core.hooksPath .githooks` once. +`pre-commit` runs `format:check`, `lint` and `gitleaks git --staged` with the local +gitleaks (v8.19+). The secrets scan fails closed, so the commit is refused when +gitleaks is not installed. `pre-push` runs `typecheck`, `test` and `knip`. CI still +runs every check. `format:check` and `lint` read the working tree, not the staged +snapshot, so stage everything you mean to commit. + +The hook runs whatever gitleaks is installed; CI scans the full git history with the version pinned in `secret-scan.yml` from `valuecodes/maintain-kit`, so this repo holds -no gitleaks pin; a local `gitleaks git --staged` (gitleaks v8.19+) does the same for -staged changes before a commit. +no gitleaks pin. CI checks are defined once, in the reusable `.github/workflows/checks.yml`: typecheck, lint, knip, format:check, test, CodeQL code scanning (`javascript-typescript`), @@ -115,6 +126,7 @@ same `valuecodes/maintain-kit` commit, so bump them together. - Keep diffs tight and focused; no drive-by refactors or new tooling without discussion. - Never commit secrets, credentials, `.env`, `.dev.vars` or `.prod.vars` files. +- Never bypass the git hooks with `--no-verify`; fix the failure instead. - Add dependencies to the correct workspace with `pnpm --filter add `. Every external version lives in the `catalog:` block of `pnpm-workspace.yaml` and manifests reference it as `catalog:`; `@repo/*` deps stay `workspace:*`. diff --git a/README.md b/README.md index e41e5cd..564057a 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,13 @@ flowchart TD Requires Node 24 (exact version in `.nvmrc`) and pnpm 12 (see `packageManager`). +`pnpm install` also turns on the git hooks in `.githooks/`: format, lint and a staged +secrets scan before each commit; typecheck, test and Knip before each push. Committing +needs `gitleaks` v8.19+ on PATH for the staged secrets scan: `brew install gitleaks` +(macOS, Linux and WSL), or unpack the `linux_x64` tarball from the +[releases page](https://github.com/gitleaks/gitleaks/releases) into a directory on +PATH such as `~/.local/bin`. + ```sh pnpm install # install dependencies pnpm dev # start local dev server @@ -90,11 +97,7 @@ test, CodeQL, a gitleaks secret scan over the full git history and actionlint + over the workflow files; the last two run through the reusable `secret-scan.yml` and `workflow-lint.yml` from `valuecodes/maintain-kit`. `feature.yml` runs them on PRs and fans them into `all-passed`; `main.yml` runs them on push to `main`, then the `deploy` -job deploys the workers. There are no git hooks: to scan staged changes before a -commit, run `gitleaks git --staged` with gitleaks v8.19+ (`brew install gitleaks` on -macOS, Linux and WSL, or unpack the `linux_x64` tarball from the -[releases page](https://github.com/gitleaks/gitleaks/releases) into a directory on -PATH such as `~/.local/bin`). GitHub settings this relies on: +job deploys the workers. GitHub settings this relies on: 1. **Rules → Rulesets**: the `main` ruleset requires a pull request and the `all-passed` status check, the only one to list. diff --git a/package.json b/package.json index 364a5f0..4950c15 100644 --- a/package.json +++ b/package.json @@ -17,7 +17,8 @@ "format": "oxfmt", "format:check": "oxfmt --check", "knip": "knip", - "clean": "turbo run clean" + "clean": "turbo run clean", + "prepare": "git rev-parse --git-dir >/dev/null 2>&1 && git config --local core.hooksPath .githooks || true" }, "devDependencies": { "@types/node": "catalog:", From 9e0f614d82a55223aa6b3c8e71b55f5cca3f9226 Mon Sep 17 00:00:00 2001 From: Juha Kangas <42040080+valuecodes@users.noreply.github.com> Date: Sat, 31 Oct 2026 21:40:46 +0200 Subject: [PATCH 4/5] chore: update Node.js to 26 .nvmrc moves to 26.12.1 and @types/node to 26.6.5, matching agentic-monorepo-starter. engines.node still accepts 24.22.1. The Workers' runtime is set by compatibility_date and nodejs_compat in wrangler.jsonc, not by .nvmrc, so those stay as they are. Co-Authored-By: Claude Opus 5.5 --- .nvmrc | 2 +- AGENTS.md | 2 +- README.md | 2 +- pnpm-lock.yaml | 76 ++++++++++++++++++++++----------------------- pnpm-workspace.yaml | 4 +-- 5 files changed, 43 insertions(+), 43 deletions(-) diff --git a/.nvmrc b/.nvmrc index ce62013..63f87c2 100644 --- a/.nvmrc +++ b/.nvmrc @@ -1 +1 @@ -24.22.1 +26.12.1 diff --git a/AGENTS.md b/AGENTS.md index dbefd80..ffcc83c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -38,7 +38,7 @@ and inside an app use the `~/` alias (`src/*`) to go up the tree. ## Commands -**Prerequisites:** Node.js 24 (exact version in `.nvmrc`), pnpm 12.12.0 (`packageManager` in root `package.json`). +**Prerequisites:** Node.js 26 (exact version in `.nvmrc`), pnpm 12.12.0 (`packageManager` in root `package.json`). ```bash pnpm install # Install all dependencies diff --git a/README.md b/README.md index 564057a..d8010fb 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ flowchart TD ## Development -Requires Node 24 (exact version in `.nvmrc`) and pnpm 12 (see `packageManager`). +Requires Node 26 (exact version in `.nvmrc`) and pnpm 12 (see `packageManager`). `pnpm install` also turns on the git hooks in `.githooks/`: format, lint and a staged secrets scan before each commit; typecheck, test and Knip before each push. Committing diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 66a6db3..dd58c63 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -174,8 +174,8 @@ catalogs: specifier: 0.9.1 version: 0.9.1 '@types/node': - specifier: 24.19.2 - version: 24.19.2 + specifier: 26.6.5 + version: 26.6.5 drizzle-kit: specifier: 0.31.11 version: 0.31.11 @@ -233,7 +233,7 @@ importers: devDependencies: '@types/node': specifier: 'catalog:' - version: 24.19.2 + version: 26.6.5 knip: specifier: 'catalog:' version: 6.41.0 @@ -276,16 +276,16 @@ importers: version: link:../../packages/typescript '@types/node': specifier: 'catalog:' - version: 24.19.2 + version: 26.6.5 typescript: specifier: 'catalog:' version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) wrangler: specifier: 'catalog:' - version: 4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@24.19.2) + version: 4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@26.6.5) apps/browser-scraper: dependencies: @@ -310,16 +310,16 @@ importers: version: link:../../packages/typescript '@types/node': specifier: 'catalog:' - version: 24.19.2 + version: 26.6.5 typescript: specifier: 'catalog:' version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) wrangler: specifier: 'catalog:' - version: 4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@24.19.2) + version: 4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@26.6.5) apps/operator: dependencies: @@ -362,7 +362,7 @@ importers: version: link:../../packages/typescript '@types/node': specifier: 'catalog:' - version: 24.19.2 + version: 26.6.5 drizzle-kit: specifier: 'catalog:' version: 0.31.11 @@ -374,10 +374,10 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) wrangler: specifier: 'catalog:' - version: 4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@24.19.2) + version: 4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@26.6.5) packages/alpha-vantage: dependencies: @@ -399,7 +399,7 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) packages/http-client: dependencies: @@ -418,7 +418,7 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) packages/logger: devDependencies: @@ -430,7 +430,7 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) packages/telegram: dependencies: @@ -452,7 +452,7 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) packages/typescript: {} @@ -466,7 +466,7 @@ importers: version: 7.0.2 vitest: specifier: 'catalog:' - version: 5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + version: 5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) packages: @@ -1554,8 +1554,8 @@ packages: '@types/estree@1.0.9': resolution: {integrity: sha512-GhdPgy1el4/ImP05X05Uw4cw2/M93BCUmnEvWZNStlCzEKME4Fkk+YpoA5OiHNQmoS7Cafb8Xa3Pya8m1Qrzeg==} - '@types/node@24.19.2': - resolution: {integrity: sha512-93d49wCWJkCyN87MxLpNN6KXPCwFw7bVUg79mGUV1OS40JGWwVCr8n61DXCSqz7CV6/VfPkb7xec7uP2M+QHWQ==} + '@types/node@26.6.5': + resolution: {integrity: sha512-uMzsv9stDdofIZBx4UGh4Z9ZgXnGC9seRDscilBcTHAeOFk67MZg/k9bWVfO+bk4qZmG+l52hRnLwUiH2LnJTg==} '@typescript/typescript-aix-ppc64@7.0.2': resolution: {integrity: sha512-MTKKkWB7p/0E9xi1d1tHtZ5PiLkGEMIq88pK2CubZjOsLtYTLqhgIgi6zepFa+9GHZ6h05NMCkQxGKiPXMxXtQ==} @@ -2169,8 +2169,8 @@ packages: resolution: {integrity: sha512-RYNm/ISFtflWpIcXTPHHLJZ0mqzInav+L9ke9PcL+hHsSf9+Fd/syPb614Mlqs/O3AYgjnvxDOFl0a+zVqi1/w==} engines: {node: '>=14'} - undici-types@7.24.6: - resolution: {integrity: sha512-WRNW+sJgj5OBN4/0JpHFqtqzhpbnV0GuB+OozA9gCL7a993SmU+1JBZCzLNxYsbMfIeDL+lTsphD5jN5N+n0zg==} + undici-types@8.9.0: + resolution: {integrity: sha512-KTDyRTYX8sWmKXAikPHHSyc63CRPETMctyjKFupcC6OBLXT3xsN0e9aF7m+mIXutFWpUXuedtowG7iLOzp0kQg==} undici@7.30.0: resolution: {integrity: sha512-dkrQXeHSaoamnItlYbmzG0wFYrM0ZwDxCIg0A7aKjTyyhh9svRzCNFEzV+Vm05/yehjCzjDZ31KXfGEjYSztDQ==} @@ -2936,9 +2936,9 @@ snapshots: '@types/estree@1.0.9': {} - '@types/node@24.19.2': + '@types/node@26.6.5': dependencies: - undici-types: 7.24.6 + undici-types: 8.9.0 '@typescript/typescript-aix-ppc64@7.0.2': optional: true @@ -3000,14 +3000,14 @@ snapshots: '@typescript/typescript-win32-x64@7.0.2': optional: true - '@vitest/mocker@5.0.3(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': + '@vitest/mocker@5.0.3(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1))': dependencies: '@jridgewell/trace-mapping': 0.3.31 '@vitest/spy': 5.0.3 estree-walker: 3.0.3 magic-string: 1.4.2 optionalDependencies: - vite: 8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) + vite: 8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) '@vitest/spy@5.0.3': {} @@ -3201,10 +3201,10 @@ snapshots: dependencies: '@jridgewell/sourcemap-codec': 1.6.0 - miniflare@5.20261006.1-alpha(@types/node@24.19.2): + miniflare@5.20261006.1-alpha(@types/node@26.6.5): dependencies: '@cspotcode/source-map-support': 0.8.1 - sharp: 0.35.5(@types/node@24.19.2) + sharp: 0.35.5(@types/node@26.6.5) undici: 7.30.0 workerd: 1.20261006.1 ws: 8.21.0 @@ -3380,7 +3380,7 @@ snapshots: semver@7.8.5: {} - sharp@0.35.5(@types/node@24.19.2): + sharp@0.35.5(@types/node@26.6.5): dependencies: '@img/colour': 1.1.0 detect-libc: 2.1.2 @@ -3411,7 +3411,7 @@ snapshots: '@img/sharp-win32-arm64': 0.35.5 '@img/sharp-win32-ia32': 0.35.5 '@img/sharp-win32-x64': 0.35.5 - '@types/node': 24.19.2 + '@types/node': 26.6.5 smol-toml@1.9.0: {} @@ -3484,7 +3484,7 @@ snapshots: unbash@5.0.0: {} - undici-types@7.24.6: {} + undici-types@8.9.0: {} undici@7.30.0: {} @@ -3492,7 +3492,7 @@ snapshots: dependencies: pathe: 2.0.3 - vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1): + vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1): dependencies: lightningcss: 1.33.0 picomatch: 4.0.7 @@ -3500,17 +3500,17 @@ snapshots: rolldown: 1.2.13 tinyglobby: 0.2.17 optionalDependencies: - '@types/node': 24.19.2 + '@types/node': 26.6.5 esbuild: 0.28.2 fsevents: 2.3.3 jiti: 2.7.0 tsx: 4.23.15 yaml: 2.9.1 - vitest@5.0.3(@types/node@24.19.2)(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)): + vitest@5.0.3(@types/node@26.6.5)(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)): dependencies: '@types/chai': 5.2.3 - '@vitest/mocker': 5.0.3(vite@8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) + '@vitest/mocker': 5.0.3(vite@8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1)) chai: 6.2.2 es-module-lexer: 2.3.2 expect-type: 1.4.0 @@ -3521,10 +3521,10 @@ snapshots: tinybench: 6.1.4 tinyexec: 1.3.0 tinyglobby: 0.2.17 - vite: 8.3.4(@types/node@24.19.2)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) + vite: 8.3.4(@types/node@26.6.5)(esbuild@0.28.2)(jiti@2.7.0)(tsx@4.23.15)(yaml@2.9.1) why-is-node-running: 3.2.1 optionalDependencies: - '@types/node': 24.19.2 + '@types/node': 26.6.5 transitivePeerDependencies: - msw @@ -3540,13 +3540,13 @@ snapshots: '@cloudflare/workerd-linux-arm64': 1.20261006.1 '@cloudflare/workerd-windows-64': 1.20261006.1 - wrangler@4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@24.19.2): + wrangler@4.149.0(@cloudflare/workers-types@5.20261011.1)(@types/node@26.6.5): dependencies: '@cloudflare/kv-asset-handler': 0.5.0 '@cloudflare/unenv-preset': 2.16.2(unenv@2.0.0-rc.24)(workerd@1.20261006.1) blake3-wasm: 2.1.5 esbuild: 0.28.2 - miniflare: 5.20261006.1-alpha(@types/node@24.19.2) + miniflare: 5.20261006.1-alpha(@types/node@26.6.5) path-to-regexp: 6.3.0 unenv: 2.0.0-rc.24 workerd: 1.20261006.1 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 893d7c2..29187b8 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -13,8 +13,8 @@ catalog: # At least the version `wrangler` declares as its peer. "@cloudflare/workers-types": 5.20261011.1 "@hono/zod-validator": 0.9.1 - # Held on the Node 24 line to match `.nvmrc` (see `updateConfig` below). - "@types/node": 24.19.2 + # Held on the Node 26 line to match `.nvmrc` (see `updateConfig` below). + "@types/node": 26.6.5 drizzle-kit: 0.31.11 drizzle-orm: 0.45.4 hono: 4.13.13 From f294ba594b77c5560c14a300f9557b70f6d3b2fa Mon Sep 17 00:00:00 2001 From: Juha Kangas <42040080+valuecodes@users.noreply.github.com> Date: Sat, 31 Oct 2026 21:52:11 +0200 Subject: [PATCH 5/5] docs: name the Node.js and pnpm majors, not exact versions The exact versions live in .nvmrc and packageManager, which the update PRs bump without touching the docs. Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AGENTS.md b/AGENTS.md index ffcc83c..16643bd 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -38,7 +38,7 @@ and inside an app use the `~/` alias (`src/*`) to go up the tree. ## Commands -**Prerequisites:** Node.js 26 (exact version in `.nvmrc`), pnpm 12.12.0 (`packageManager` in root `package.json`). +**Prerequisites:** Node.js 26 (exact version in `.nvmrc`), pnpm 12 (exact version in `packageManager` in root `package.json`). ```bash pnpm install # Install all dependencies