[CatOfJupit3r]

Requested by Roman · project thread

What changed

This lands the Renovate backlog from #17 and moves every dependency to the latest version that is compatible with the toolchain and past the 24-hour quarantine. Known advisories are resolved in the workspace and in every example.

• Toolchain: packageManager is pnpm 12.11.2 and the workflows read it from there. The workspace engines floor moves to pnpm >=12.0.0; CONTRIBUTING.md and the bug report template now say pnpm 12. CI Node is 22.23.3 and Bun is 1.4.2. The published packages' node >=18 floor is unchanged.
• Workspace, docs and packages: Vitest 5, tsdown 0.23, changesets 3.0.3, oxlint 1.88, prettier 3.9.10, @tanstack/intent 0.5, fumadocs 16.17, Next 16.4, React 19.3, typescript-eslint 8.71, ESLint 10.12, Zod 4.6, Valibot 1.5 and @types/*.
• Examples: every exact pin moved to the latest compatible release, including Vitest 5 and tsdown 0.23. The allowBuilds pins match the new workerd (hono) and @swc/core (nestjs) versions.
• Advisories: root overrides pin source-map-js to 1.2.2 and undici to 8.10.2. The effect, elysia, hono, nestjs, nextjs and orpc examples carry the same source-map-js override. pnpm audit reports no known vulnerabilities in the workspace or any example.
• Actions: every uses: is pinned to a commit SHA with a version comment. pnpm/action-setup moves to v6.1.0, deploy-pages to v5.0.1 and changesets/action to v2.1.2. The Extended validation job merged from main gets the same pins, Node 22.23.3 and Bun 1.4.2.

The only published change is eslint-plugin-enumwaii's @typescript-eslint/utils range, which moves from ^8.69.0 to ^8.71.2. It ships with a patch changeset.

Held back

• TypeScript stays on 6.0.3. TypeScript 7 does not expose the compiler API that typescript-eslint needs, and @typescript-eslint/utils 8.71 requires typescript <6.1.
• fumadocs-twoslash stays on 3.3.1. Version 4 imports typescript/unstable/sync, which only TypeScript 7 provides.
• effect stays on 3.x in the effect example. Effect 4 is a breaking rewrite and needs its own example update.
• Node 24 and Ubuntu 26 runners are left for separate PRs.

Validation

• pnpm check passes: format, pins, lint, tests, type tests, skills, builds, docs, publint/attw and all eight examples.
• pnpm audit is clean for the workspace and each example.
• pnpm test:runtimes (Bun, Deno, Workers) passes locally. Vitest 5 enables fsModuleCache by default and the Workers pool cannot read it, so the hono Workers config turns it off. The Node 18 check runs in Extended validation.

Checklist

• The change is focused and linked to an issue when applicable.
• Runtime and type tests cover behavior or inference changes. (n/a, no behavior change)
• Public API changes include useful JSDoc and authored documentation. (n/a)
• Lint rule changes include valid and invalid parser-service cases. (n/a)
• A Changeset is included for each user-visible published-package change, or this pull request explains why none is needed.
• pnpm check passes.

[CatOfJupit3r]

@copilot update all package versions to latest possible. if available, ensure that security issues are resolved by making sure new versions are above specified ranged