fix(deps): revert TS6/ESLint10/webpack-cli7 majors and gate future majors #43

2026-05-06T22:07:46+02:00

julien commented

2026-05-06 22:07:46 +02:00

Summary

Three Renovate major bumps merged silently because nx affected doesn't see deps-only PRs as affecting any project — CI passed trivially, the breakage only surfaced when nx run-many was run locally:

TypeScript 5→6 (#33) — tsconfig.lib.json fails with TS5101: Option 'baseUrl' is deprecated. Revert to 5.9.x.
ESLint 9→10 (#36) — @nx/eslint@22.7.1 not compatible: project graph fails with "Unable to find eslint". Revert eslint, @eslint/js, jsonc-eslint-parser, eslint-plugin-playwright to ESLint-9-compatible versions.
webpack-cli 5→7 (#34) — webpack-cli 7 removed the --node-env=production flag Nx generates. Revert to 5.x.

Bonus side-fix: the ajv@<8.18.0 override added in #42 was over-broad and was forcing ESLint's bundled ajv to v8 (incompatible with ESLint 9's option contract). Narrow the override to @angular-devkit/core>ajv@<8.18.0 so only the targeted nestjs-prisma chain is bumped.

Prevention — gate majors behind the dependency dashboard

Add a Renovate packageRule with dependencyDashboardApproval: true for matchUpdateTypes: ["major"]. Renovate stops auto-creating PRs for majors; they appear as checkboxes in the dashboard issue, and only get a PR after a human ticks the box (presumably after reading the changelog and confirming Nx-plugin / Angular / NestJS readiness).

This is the surgical fix for the gap. The deeper fix (making nx affected correctly mark all projects as affected on package.json changes) is a separate investigation worth doing later — but the dashboard gate prevents the same trap regardless.

Verification

Locally on this branch:

pnpm exec nx run-many -t lint test build --parallel=2 → ✓ 8 projects pass.
pnpm audit --audit-level=moderate → 0 vulnerabilities.

Test plan

check job goes green on this PR (would have caught the regressions if nx affected were broader).
After merge, the next Renovate run does not create new PRs for any major (TS, eslint, webpack-cli, etc.).
Any pending major in the dashboard issue still appears, but only as a checkbox awaiting approval.

Out of scope (follow-up)

Investigate why nx affected misses package.json-only changes. Likely a missing entry in nx.json namedInputs (default) or targetDefaults. Worth its own focused PR; the dashboard gate is the conservative fix in the meantime.

## Summary Three Renovate major bumps merged silently because `nx affected` doesn't see deps-only PRs as affecting any project — CI passed trivially, the breakage only surfaced when `nx run-many` was run locally: - **TypeScript 5→6** (#33) — `tsconfig.lib.json` fails with `TS5101: Option 'baseUrl' is deprecated`. Revert to 5.9.x. - **ESLint 9→10** (#36) — `@nx/eslint@22.7.1` not compatible: project graph fails with "Unable to find eslint". Revert eslint, `@eslint/js`, `jsonc-eslint-parser`, `eslint-plugin-playwright` to ESLint-9-compatible versions. - **webpack-cli 5→7** (#34) — webpack-cli 7 removed the `--node-env=production` flag Nx generates. Revert to 5.x. Bonus side-fix: the `ajv@<8.18.0` override added in #42 was over-broad and was forcing ESLint's bundled ajv to v8 (incompatible with ESLint 9's option contract). Narrow the override to `@angular-devkit/core>ajv@<8.18.0` so only the targeted nestjs-prisma chain is bumped. ## Prevention — gate majors behind the dependency dashboard Add a Renovate `packageRule` with `dependencyDashboardApproval: true` for `matchUpdateTypes: ["major"]`. Renovate stops auto-creating PRs for majors; they appear as checkboxes in the dashboard issue, and only get a PR after a human ticks the box (presumably after reading the changelog and confirming Nx-plugin / Angular / NestJS readiness). This is the surgical fix for the gap. The deeper fix (making `nx affected` correctly mark all projects as affected on package.json changes) is a separate investigation worth doing later — but the dashboard gate prevents the same trap regardless. ## Verification Locally on this branch: - `pnpm exec nx run-many -t lint test build --parallel=2` → ✓ 8 projects pass. - `pnpm audit --audit-level=moderate` → 0 vulnerabilities. ## Test plan - [ ] `check` job goes green on this PR (would have caught the regressions if `nx affected` were broader). - [ ] After merge, the next Renovate run does not create new PRs for any major (TS, eslint, webpack-cli, etc.). - [ ] Any pending major in the dashboard issue still appears, but only as a checkbox awaiting approval. ## Out of scope (follow-up) Investigate why `nx affected` misses package.json-only changes. Likely a missing entry in `nx.json` `namedInputs` (`default`) or `targetDefaults`. Worth its own focused PR; the dashboard gate is the conservative fix in the meantime.

julien added 1 commit 2026-05-06 22:07:46 +02:00

fix(deps): revert TS6/ESLint10/webpack-cli7 majors and gate future majors

CI / commits (pull_request) Successful in 2m6s

Details

CI / check (pull_request) Successful in 2m33s

Details

CI / a11y (pull_request) Successful in 1m32s

Details

CI / perf (pull_request) Successful in 2m32s

Details

CI / scan (pull_request) Failing after 5m58s

Details

a0ee9fb3ca

Three Renovate-driven major bumps that landed via `nx affected`
passing trivially (deps-only change → no project flagged as
affected) have been silently breaking the build since they merged:

- **TypeScript 5→6** (#33) — TS6 deprecates `baseUrl`; every lib's
  `tsconfig.lib.json` now fails with `TS5101: Option 'baseUrl' is
  deprecated and will stop functioning in TypeScript 7.0`. Revert
  to TypeScript 5.9.x; we'll revisit when the broader Angular/Nx
  ecosystem aligns on TS6.
- **ESLint 9→10** (#36) — `@nx/eslint@22.7.1` was built against
  ESLint 9 and fails project-graph extraction with `Unable to find
  eslint`. Revert to ESLint 9.x; bring `@eslint/js`,
  `eslint-plugin-playwright`, and `jsonc-eslint-parser` back to
  their ESLint-9-compatible versions in the same revert.
- **webpack-cli 5→7** (#34) — webpack-cli 7 removed the
  `--node-env=production` flag that Nx's webpack target generates,
  breaking `portal-bff:build`. Revert to webpack-cli 5.x; revisit
  when Nx's webpack executor is updated.

The `ajv@<8.18.0` override added in #42 was over-broad: it forced
ESLint's transitively-bundled ajv to v8, which doesn't accept the
legacy options ESLint 9 passes. Narrow the override to
`@angular-devkit/core>ajv@<8.18.0` so only the targeted chain
(nestjs-prisma > @angular-devkit/core > ajv) is bumped, leaving
ESLint's ajv alone.

Verified locally: `pnpm exec nx run-many -t lint test build` is
green on all 8 projects; `pnpm audit --audit-level=moderate`
reports zero vulnerabilities.

To prevent future silent breakages, add a Renovate package rule
that gates **all major updates** behind the dependency dashboard
(`dependencyDashboardApproval: true`). Renovate stops creating PRs
for majors automatically — they appear as checkboxes in the
dashboard, and only get a PR when a human ticks the box. Patch
and minor bumps still flow on the daily cron.

`docs/development.md` "Reviewing Renovate PRs" is updated to
explain the gate and why it exists, citing the three offenders we
caught the hard way.