Skip to content

Monorepo migration - #78

Merged
lucasdoell merged 108 commits into
mainfrom
staging
Jun 26, 2026
Merged

Monorepo migration#78
lucasdoell merged 108 commits into
mainfrom
staging

Conversation

@lucasdoell

Copy link
Copy Markdown
Member

No description provided.

…or and info output with detailed event information.
…clarity and consistency in interaction responses
…r code and integrating a new startServer function for improved organization
…h checks, guild retrieval, channel listing, and notification sending
…ng of guild details and text channels for a given guild
- New packages/lint-config holds the core app's oxlint base + oxfmt config
- web/docs/bot all consume it via extends (oxlint) and --config (oxfmt)
- docs disables react/no-unknown-property (react-three-fiber)
- bot relaxes type-aware unsafe rules + no-console (discord.js/Bun/logger)
- turbo lint/format:check inputs track the shared config for cache correctness
- oxfmt ignores markdown so docs prose isn't reflowed
Pull in the four commits landed on main since the migration diverged:
botid package removal (config, routes, instrumentation-client) and the
atomic map-ingestion / parser row changes. Git rename detection mapped
main's edits onto the relocated apps/web/ paths; the botid dependency
removal was applied to apps/web/package.json (the monorepo root keeps
its turbo scripts), and instrumentation-client.ts was deleted per main.
Run the TS7 (Go) compiler for `tsc --noEmit` across every workspace while
keeping TS6 for tools that need the JS compiler API. Each package now aliases
`typescript` -> `@typescript/typescript6` (the API slot Next.js and fumadocs
import, shipping `tsc6`) and adds `typescript-7` -> `typescript@7.0.1-rc` (the
real TS7, shipping `tsc`), so the existing typecheck scripts pick up TS7 with
no command changes. Web cold typecheck drops from ~96s to ~5s.

Fixes surfaced by the move off TS5:
- web: widen ColumnData.value to number | string and drop a stale
  @ts-expect-error in stats-table.tsx.
- bot: add bun-types and "types": ["bun"] so the Bun global resolves under
  TS6/7 (tsc6 failed identically, so this is not TS7-specific).

Remove the @effect/language-service patch prepare step from web: TS7's native
compiler can't be patched and the patch no longer applies to the TS6 shim, so
build-time Effect diagnostics in tsc are unavailable. Editor diagnostics still
work via the tsconfig plugin. Document the dual-compiler setup in AGENTS.md.
Resolve every open Dependabot/audit advisory (132 npm advisories across 36
packages) ahead of going live, preferring real dependency updates over
transitive overrides.

Direct + parent updates (the bulk of the fixes):
- web: @auth/prisma-adapter 1.0.5 -> 2.11.2 (aligns with next-auth v5),
  next-auth beta.30, next-intl 4.9, @vercel/blob 2.4, @vercel/toolbar 0.2,
  validator 13.15.22, vitest 3.2.6, postcss 8.5.15, @aws-sdk/* 3.1075,
  @opentelemetry/* 0.219/2.8, @axiomhq/* 1.7/0.2, @tiptap/* 3.27,
  @sendgrid/mail 8.1.6, react-scan 0.5.
- bot: discord.js 14.26.4, @opentelemetry/* 0.219/2.8.
- transactional: react-email / @react-email/ui 6.6.5.

Overrides kept only for irreducible transitives whose parents are already at
their latest release (or are framework internals) and still pin a vulnerable
version: undici (discord.js/cheerio), @opentelemetry/core (@effect),
@hono/node-server (prisma), postcss (next), esbuild (build tooling).

Unify @types/react on 19.2.17 / @types/react-dom on 19.2.3 so React Three
Fiber's JSX augmentation resolves consistently in the docs app.

pnpm audit: no known vulnerabilities. typecheck, web tests (1149), and web +
docs builds all pass.
Replace next-auth v5-beta and @auth/prisma-adapter with Better Auth across
apps/web, preserving every behavior (OAuth, email magic link, sign-in gating,
rate limiting, Stripe customer creation, onboarding email, new-user webhooks,
ranked-data claim, admin impersonation).

- Add src/lib/auth-server.ts: the betterAuth() instance with GitHub/Google/
  Discord social providers, the magic-link plugin (existing SES template), and
  the admin plugin. Lifecycle moved to databaseHooks; gating and rate-limit
  helpers live in src/lib/auth-gating.ts.
- Keep src/lib/auth.ts as a compatibility layer: auth() returns the historical
  next-auth session shape, so the ~145 call sites and authorization helpers are
  untouched. Add src/lib/auth-client.ts and move the route handler to [...all].
- Migrate the Prisma auth tables to the Better Auth core schema and add a
  data-preserving migration for populated environments.
- Handle impersonation with the admin plugin's impersonateUser (in-place,
  revertible) and a Stop Impersonating control in the user nav.
- Drop the unused FACEIT OAuth provider.
- Update account-table consumers, Session/User type imports, bot Discord lookup,
  and the impersonation i18n strings.
Remove unused AbilityImpactData local import and the dead env-parse
statement from the ambient app.d.ts (TS1036), and convert string
concatenations to template literals in the Discord bot commands.
The shared lint-config enables typeAware oxlint rules, which require the
tsgolint executable, but only apps/web declared oxlint-tsgolint. The bot,
docs, and transactional workspaces relied on pnpm hoisting it locally and
failed in CI's isolated install (Failed to find tsgolint executable).
@vercel

vercel Bot commented Jun 26, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
parsertime Ready Ready Preview, ✅ 2 resolved Jun 26, 2026 3:24am

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​types/​bun@​1.3.141001004989100
Addednpm/​@​typescript/​typescript6@​6.0.1621005592100
Addednpm/​@​radix-ui/​react-label@​2.1.101001006698100
Addednpm/​@​radix-ui/​react-separator@​1.1.101001006798100
Addednpm/​@​radix-ui/​react-aspect-ratio@​1.1.101001006798100
Addednpm/​@​radix-ui/​react-toggle@​1.1.121001006798100
Addednpm/​@​radix-ui/​react-progress@​1.1.101001006998100
Addednpm/​@​rive-app/​react-webgl2@​4.29.3991006999100
Addednpm/​@​radix-ui/​react-slot@​1.3.01001006998100
Addednpm/​@​radix-ui/​react-use-controllable-state@​1.2.31001006995100
Addednpm/​@​radix-ui/​react-avatar@​1.2.0991007098100
Addednpm/​@​radix-ui/​react-collapsible@​1.1.14991007098100
Addednpm/​@​radix-ui/​react-toggle-group@​1.1.13991007098100
Addednpm/​@​radix-ui/​react-tabs@​1.1.15991007098100
Addednpm/​bun-types@​1.3.14100100859570
Addednpm/​@​tanstack/​react-query-devtools@​5.101.11001007195100
Addednpm/​@​radix-ui/​react-switch@​1.3.1991007198100
Addednpm/​@​radix-ui/​react-hover-card@​1.1.17991007198100
Addednpm/​@​opentelemetry/​sdk-trace-node@​2.8.07110010094100
Addednpm/​@​radix-ui/​react-checkbox@​1.3.5991007198100
Addednpm/​@​radix-ui/​react-alert-dialog@​1.1.171001007198100
Addednpm/​@​types/​color@​4.2.11001007182100
Addednpm/​@​radix-ui/​react-dialog@​1.1.17991007198100
Addednpm/​@​radix-ui/​react-dropdown-menu@​2.1.18991007198100
Addednpm/​@​radix-ui/​react-popover@​1.1.17991007198100
Addednpm/​@​radix-ui/​react-accordion@​1.2.14991007198100
Addednpm/​@​radix-ui/​react-context-menu@​2.3.11001007198100
Addednpm/​@​radix-ui/​react-radio-group@​1.4.1991007298100
Addednpm/​@​radix-ui/​react-menubar@​1.1.18991007298100
Addednpm/​@​opentelemetry/​exporter-trace-otlp-http@​0.219.07210010096100
Addednpm/​@​radix-ui/​react-tooltip@​1.2.10991007298100
Addednpm/​fumadocs-mdx@​15.0.9981007296100
Addednpm/​@​types/​mdx@​2.0.141001007285100
See 101 more rows in the dashboard

View full report

@socket-security

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/fumadocs-mdx@15.0.9npm/react-scan@0.5.7npm/sharp@0.34.5npm/@emnapi/runtime@1.11.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm @react-email/ui is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: packages/transactional/package.jsonnpm/@react-email/ui@6.6.5

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@react-email/ui@6.6.5. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm css-tree is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/react-email@6.6.5npm/css-tree@3.2.1

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/css-tree@3.2.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm date-fns is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/web/package.jsonnpm/date-fns@4.4.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/date-fns@4.4.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm effect is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/web/package.jsonnpm/effect@3.21.4

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/effect@3.21.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm immer is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@react-three/fiber@9.6.1npm/@xyflow/react@12.11.1npm/@react-three/drei@10.7.7npm/immer@11.1.8

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/immer@11.1.8. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm js-yaml is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/fumadocs-core@16.9.1npm/fumadocs-mdx@15.0.9npm/js-yaml@4.2.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm mermaid is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@streamdown/mermaid@1.0.2npm/streamdown@2.5.0npm/mermaid@11.16.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.16.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm next is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/@react-email/ui@6.6.5npm/next@16.2.6

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/next@16.2.6. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm preact is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: pnpm-lock.yamlnpm/react-scan@0.5.7npm/preact@10.29.2

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/preact@10.29.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm three is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/three@0.184.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/three@0.184.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm three is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/docs/package.jsonnpm/three@0.184.0

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/three@0.184.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Obfuscated code: npm validator is 90.0% likely obfuscated

Confidence: 0.90

Location: Package overview

From: apps/web/package.jsonnpm/validator@13.15.35

ℹ Read more on: This package | This alert | What is obfuscated code?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/validator@13.15.35. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@lucasdoell
lucasdoell merged commit fde879f into main Jun 26, 2026
16 checks passed
@lucasdoell
lucasdoell deleted the staging branch June 26, 2026 03:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant