Repository navigation
chore(deps): update web + api deps, pin the jinja2 starlette 1.x now needs - #41
Merged
Merged
Conversation
…needs Web: next/eslint-config-next 16.3.0, @sentry/nextjs 10.70.0, react(-dom) 19.2.8, shiki 4.4.3, tailwind 4.3.3, vitest 4.1.10, @types/* current. Held back three majors for their own pass: eslint 10 (crashes eslint-config-next), typescript 7, starlette 1.6 on the web side. API: fastapi 0.141.1, pydantic 2.13.4, pymongo 4.17.0, python-dotenv 1.2.2, sentry-sdk 2.68.0. fastapi 0.141 pulls starlette 1.6, which raises from starlette.templating at module scope when jinja2 is absent. fastapi-cache2 imports that module unconditionally and main.py imports fastapi_cache, so the container would have failed to boot. jinja2 had only ever been a transitive arrival; it is now pinned explicitly. pnpm-workspace.yaml: pnpm 11 does not honour name@version entries in minimumReleaseAgeExclude, so our own @viz-cx/* releases tripped the supply-chain cooldown on every publish. A glob covers them for good. @sentry/cli's build script is marked off — it only fetches the source-map upload binary, which needs SENTRY_AUTH_TOKEN, and nothing sets one. Verified: web 116 tests + tsc + production build; api 92 tests + ruff.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Routine dependency refresh across
web/andapi/, plus one latent boot failure it uncovered.Web — next + eslint-config-next 16.3.0, @sentry/nextjs 10.70.0, react/react-dom 19.2.8, shiki 4.4.3, tailwind + @tailwindcss/postcss 4.3.3, vitest 4.1.10, @types/* to current.
API — fastapi 0.141.1, pydantic 2.13.4, pymongo 4.17.0, python-dotenv 1.2.2, sentry-sdk 2.68.0.
The jinja2 pin is not cosmetic
fastapi 0.141 pulls starlette 1.6, which raises
ImportErrorfromstarlette.templatingat module scope when jinja2 is missing.fastapi_cache.coderimports that module unconditionally, andmain.pyimportsfastapi_cache— so the API container would have failed to boot on deploy. jinja2 had only ever reached us transitively and the new graph dropped it. Now pinned explicitly, with a comment saying why, since nothing in our own code references it.Caught by the test suite, not by the deploy.
pnpm-workspace.yaml
name@versionentries inminimumReleaseAgeExclude, which is why every@viz-cx/*publish has been tripping the supply-chain cooldown and needing a fresh pin. A glob covers them permanently — they're our own packages from the ts-core repo, so the cooldown was never the point.@sentry/clibuild script markedfalse. It only fetches the source-map upload binary, which requiresSENTRY_AUTH_TOKEN; nothing indeploy.web.ymlor the Dockerfile sets one. This also clears theERR_PNPM_IGNORED_BUILDSfailure that had been forcing anpm_config_verify_deps_before_run=falsebypass on everypnpm build/pnpm test.Held back
Three majors, each deserving its own pass rather than a drive-by before a deploy: eslint 10 (known to crash eslint-config-next), typescript 7, starlette 1.6 as a direct web-side dep.
Verification
tsc --noEmitclean, production build succeedsruff checkclean (CI gate is ruff + pytest)