chore(deps): consolidate the root dependency bumps and raise @types/node to 22 by clay-good · Pull Request #2194 · Fission-AI/OpenSpec

clay-good · 2026-11-02T13:42:07Z

Supersedes #2148, #2188, #2182 and #2181. Each of those touches the root pnpm-lock.yaml, so they cannot merge independently without four separate flake.nix hash refreshes; two of them are also unsound on their own.

Status: green except the Nix pnpmDeps hash, which is refreshed in a follow-up commit on this branch (see below).

What was wrong

PR	Bump	Problem alone
#2182	vitest 4.1.12 → 5.0.3	Leaves `@vitest/ui` at 4.1.12
#2181	@vitest/ui 4.1.12 → 5.0.3	Leaves `vitest` at 4.1.12
#2188	typescript-eslint 8.72.0 → 8.72.1	Stale flake hash only
#2148	@inquirer/core 12.0.5 → 12.0.6	Stale flake hash only

@vitest/ui's peer range pins vitest exactly, so #2181 and #2182 each resolve a mismatched pair. Neither fails the install, because pnpm only warns on an unmet peer — so each PR would have merged a broken pairing silently.

Separately, @types/node was still ^20.19.43 while engines.node has been >=22.12.0 since #2159. vitest 5 declares a peer of ^22.0.0 || >=24.0.0, so a bare vitest-5 bump installs with an unmet peer and the project keeps type-checking against a runtime it no longer supports.

What this does

Moves vitest and @vitest/ui to 5.0.5 together (a matched pair, no peer warnings).
Picks up the two patch bumps lockfile-only, leaving the package.json ranges alone as Dependabot does.
Raises @types/node to ^22.12.0 to match the Node floor and satisfy vitest 5's peer.
Refreshes the flake pnpmDeps hash once.

Proof

Run locally on this branch and on clean main at 27c0515:

Gate	Result
`pnpm install`	No peer-dependency warnings (vitest 5.0.5 / @vitest/ui 5.0.5 / @types/node 22.20.5)
`pnpm run build`	Pass
`pnpm lint`	Pass
`npx tsc --noEmit`	Pass — exit 0 against the Node 22 types
`pnpm test`	231 files / 6797 tests pass; 3 files / 10 tests fail

Those 10 failures (artifact-workflow, config-edit, config-profile) reproduce identically on clean main — same 3 files, same 10 tests, same 6797 passing — so vitest 5 introduces no regressions. They are the known local-sandbox baseline and are green in CI.

Notes

Not bundled: chore(deps): bump the website-dependencies group in /website with 3 updates #2189 (website lockfile, already green and outside the flake fileset) and fix(deps): force minimatch >=11.0.1 for GHSA-g3hv-75wg-m249 #2192 (the minimatch security pin, already green). Both can merge independently of this.
Whichever of this PR and fix(deps): force minimatch >=11.0.1 for GHSA-g3hv-75wg-m249 #2192 lands second needs a one-line flake.nix hash refresh — unavoidable, since both regenerate the root lockfile.
No changeset: dev-dependency bumps follow the normal release cadence.

🤖 Generated with Claude Code

Summary by CodeRabbit

Chores
- Updated development tooling, including Node.js type definitions and the test tools used during development. These changes do not add or alter app functionality.
- Updated build dependency metadata to reflect the refreshed packages. No user-facing changes are included in this update.

…ther Consolidates four Dependabot PRs that each touch the root lockfile, so the flake's pnpmDeps hash is refreshed once instead of four times: - @inquirer/core 12.0.5 -> 12.0.6 (#2148) - typescript-eslint 8.72.0 -> 8.72.1 (#2188) - vitest 4.1.12 -> 5.0.5 (#2182) - @vitest/ui 4.1.12 -> 5.0.5 (#2181) vitest and @vitest/ui have to move in the same commit. @vitest/ui's peer range pins vitest exactly, so #2181 and #2182 each resolved a mismatched pair (@vitest/ui 4.1.12 against vitest 5.0.3, and the reverse) that only holds together because pnpm does not fail the install on an unmet peer. Raising @types/node from ^20.19.43 to ^22.12.0 is what makes vitest 5 installable: it declares a peer of ^22.0.0 || >=24.0.0, and the old range left an unmet peer warning. The 20.x types were already stale -- #2159 raised engines.node to >=22.12.0, so the project was type-checking against a runtime it no longer supports. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

coderabbitai · 2026-11-02T13:42:20Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: Fission-AI/OpenSpec
Branch: chore/deps-root-bumps-2026-11-02
File: .coderabbit.yaml
Commit: 96815fb
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 6531430a-5f60-4490-9445-da8d040e4477

Commits

Reviewing files that changed from the base of the PR and between 9e7db3c and 96815fb.

Files selected for processing: 1

flake.nix

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The development dependencies change: @types/node updates to ^22.12.0, and vitest and @vitest/ui update to ^5.0.3. The pnpmDeps hash in flake.nix also changes.

Changes: Development dependency updates

Layer / File(s)	Summary
Dependency version updates `package.json`, `flake.nix`	`@types/node` changes to `^22.12.0`. `vitest` and `@vitest/ui` change to `^5.0.3`. The `pnpmDeps` hash changes.

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related PRs

Fission-AI/OpenSpec#2141: Updates the same root Vitest dependencies.
Fission-AI/OpenSpec#2159: Raises the package Node.js minimum to 22.12.0.

Suggested reviewers: tabishb

Merge Risk: Minimal · up to 96815

The dependency updates are ready to merge based on the supplied evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately describes the dependency updates, including the Vitest-related root dependency bumps and the `@types/node` upgrade.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

Finishing Touches

Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

openspec-cloud · 2026-11-02T13:42:45Z

No PR-relevant drift confirmed.

AI-generated · A citation proves the line exists, not that it makes the case — verify before acting.
Checked the 0 requirements selected for this PR at c0c8ed4 (322 total).
This is not a full-repository clean result; see the check for coverage and any broader findings.
View results · Click Refresh, then Scan again in the check. Or comment /openspec-cloud.

The root lockfile changed, which invalidates the fixed-output derivation hash in flake.nix. Read from the Nix Flake Validation annotation on this PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

alfred-openspec

The consolidation is the right move. The vitest/@vitest/ui peer-pin means neither #2182 nor #2181 could merge soundly alone, and four separate flake hash refreshes is unnecessary churn.

@types/node bump to ^22 is overdue given engines.node >= 22.12.0 since #2159 -- good to align the type surface with the runtime floor, especially now that vitest 5 declares a ^22 peer.

The 10 test failures matching clean main confirms no vitest-5 regression. All CI green including Nix. Approve.

Resolves the flake.nix pnpmDeps hash and pnpm-lock.yaml conflicts introduced by #2192 (minimatch >=11.0.1 override). Took main's side for both, then regenerated the lockfile so it carries the minimatch override alongside this branch's @inquirer/core, typescript-eslint, vitest 5 and @types/node 22 bumps. The pnpmDeps hash is still main's and will be refreshed from the Nix Flake Validation annotation. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

alfred-openspec

The delta since my earlier approval (9934192) is the main merge that brought in #2192 (minimatch override) and a nix hash refresh — no new logic. All CI green including Nix Flake Validation. Re-approving at 96815fb.

clay-good requested a review from a team as a code owner November 2, 2026 13:42

clay-good requested review from alfred-openspec and removed request for a team November 2, 2026 13:42

build(nix): refresh the pnpmDeps hash for the dependency bumps

9934192

The root lockfile changed, which invalidates the fixed-output derivation hash in flake.nix. Read from the Nix Flake Validation annotation on this PR. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

clay-good added the dependencies Pull requests that update a dependency file label Nov 2, 2026

alfred-openspec previously approved these changes Nov 2, 2026

View reviewed changes

clay-good added this pull request to the merge queue Nov 2, 2026

github-merge-queue Bot removed this pull request from the merge queue due to a conflict with the base branch Nov 2, 2026

clay-good dismissed alfred-openspec’s stale review via 9e7db3c November 2, 2026 21:33

clay-good requested a review from alfred-openspec November 2, 2026 21:34

build(nix): refresh the pnpmDeps hash after the main merge

96815fb

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

alfred-openspec approved these changes Nov 4, 2026

View reviewed changes

clay-good added this pull request to the merge queue Nov 4, 2026

Merged via the queue into main with commit 3e4d5f0 Nov 4, 2026
29 checks passed

clay-good deleted the chore/deps-root-bumps-2026-11-02 branch November 4, 2026 17:15

Navigation Menu

Repository navigation

chore(deps): consolidate the root dependency bumps and raise @types/node to 22 - #2194

chore(deps): consolidate the root dependency bumps and raise @types/node to 22#2194
clay-good merged 4 commits into
mainfrom
chore/deps-root-bumps-2026-11-02

clay-good commented Nov 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading

Uh oh!

openspec-cloud Bot commented Nov 2, 2026

Uh oh!

alfred-openspec left a comment

Uh oh!

alfred-openspec left a comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

clay-good commented Nov 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was wrong

What this does

Proof

Notes

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openspec-cloud Bot commented Nov 2, 2026

No PR-relevant drift confirmed.

Uh oh!

alfred-openspec left a comment

Choose a reason for hiding this comment

Uh oh!

alfred-openspec left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

clay-good commented Nov 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading