Files
apf_portal/package.json
T
Julien Gautier a0ee9fb3ca
CI / commits (pull_request) Successful in 2m6s
CI / check (pull_request) Successful in 2m33s
CI / a11y (pull_request) Successful in 1m32s
CI / perf (pull_request) Successful in 2m32s
CI / scan (pull_request) Failing after 5m58s
fix(deps): revert TS6/ESLint10/webpack-cli7 majors and gate future majors
Three Renovate-driven major bumps that landed via `nx affected`
passing trivially (deps-only change → no project flagged as
affected) have been silently breaking the build since they merged:

- **TypeScript 5→6** (#33) — TS6 deprecates `baseUrl`; every lib's
  `tsconfig.lib.json` now fails with `TS5101: Option 'baseUrl' is
  deprecated and will stop functioning in TypeScript 7.0`. Revert
  to TypeScript 5.9.x; we'll revisit when the broader Angular/Nx
  ecosystem aligns on TS6.
- **ESLint 9→10** (#36) — `@nx/eslint@22.7.1` was built against
  ESLint 9 and fails project-graph extraction with `Unable to find
  eslint`. Revert to ESLint 9.x; bring `@eslint/js`,
  `eslint-plugin-playwright`, and `jsonc-eslint-parser` back to
  their ESLint-9-compatible versions in the same revert.
- **webpack-cli 5→7** (#34) — webpack-cli 7 removed the
  `--node-env=production` flag that Nx's webpack target generates,
  breaking `portal-bff:build`. Revert to webpack-cli 5.x; revisit
  when Nx's webpack executor is updated.

The `ajv@<8.18.0` override added in #42 was over-broad: it forced
ESLint's transitively-bundled ajv to v8, which doesn't accept the
legacy options ESLint 9 passes. Narrow the override to
`@angular-devkit/core>ajv@<8.18.0` so only the targeted chain
(nestjs-prisma > @angular-devkit/core > ajv) is bumped, leaving
ESLint's ajv alone.

Verified locally: `pnpm exec nx run-many -t lint test build` is
green on all 8 projects; `pnpm audit --audit-level=moderate`
reports zero vulnerabilities.

To prevent future silent breakages, add a Renovate package rule
that gates **all major updates** behind the dependency dashboard
(`dependencyDashboardApproval: true`). Renovate stops creating PRs
for majors automatically — they appear as checkboxes in the
dashboard, and only get a PR when a human ticks the box. Patch
and minor bumps still flow on the daily cron.

`docs/development.md` "Reviewing Renovate PRs" is updated to
explain the gate and why it exists, citing the three offenders we
caught the hard way.
2026-05-06 22:01:44 +02:00

131 lines
3.8 KiB
JSON

{
"name": "apf-portal",
"version": "0.0.0",
"license": "MIT",
"packageManager": "pnpm@10.33.4",
"scripts": {
"prepare": "husky",
"ci:check": "pnpm exec nx affected -t format:check lint test build",
"ci:audit": "pnpm audit --audit-level=moderate",
"ci:commits": "pnpm exec commitlint --from ${COMMIT_LINT_FROM:-origin/main} --to HEAD --verbose",
"ci:perf": "pnpm exec nx build portal-shell --configuration=production && pnpm exec lhci autorun --config=./lighthouserc.js"
},
"private": true,
"lint-staged": {
"!(pnpm-lock).{ts,tsx,js,jsx,html,scss,css,md,json,yml,yaml}": [
"prettier --write"
]
},
"pnpm": {
"onlyBuiltDependencies": [
"@nestjs/core",
"@parcel/watcher",
"@prisma/client",
"@prisma/engines",
"@swc/core",
"esbuild",
"less",
"lmdb",
"msgpackr-extract",
"nx",
"prisma",
"unrs-resolver"
],
"overrides": {
"axios@<1.15.2": ">=1.15.2",
"@angular-devkit/core>ajv@<8.18.0": ">=8.18.0",
"brace-expansion@<5.0.5": ">=5.0.5",
"follow-redirects@<1.16.0": ">=1.16.0",
"ip-address@<10.1.1": ">=10.1.1",
"tmp@<0.2.4": ">=0.2.4",
"yaml@<2.8.3": ">=2.8.3"
}
},
"prisma": {
"schema": "apps/portal-bff/prisma/schema.prisma"
},
"devDependencies": {
"@analogjs/vite-plugin-angular": "~2.5.0",
"@analogjs/vitest-angular": "~2.5.0",
"@angular-devkit/core": "~21.2.0",
"@angular-devkit/schematics": "~21.2.0",
"@angular/build": "~21.2.0",
"@angular/cli": "~21.2.0",
"@angular/compiler-cli": "~21.2.0",
"@angular/language-service": "~21.2.0",
"@commitlint/cli": "^20.5.3",
"@commitlint/config-conventional": "^20.5.3",
"@eslint/js": "^9.8.0",
"@lhci/cli": "^0.15.1",
"@nestjs/schematics": "^11.0.0",
"@nestjs/testing": "^11.0.0",
"@nx/angular": "^22.7.1",
"@nx/devkit": "22.7.1",
"@nx/eslint": "^22.7.1",
"@nx/eslint-plugin": "22.7.1",
"@nx/jest": "22.7.1",
"@nx/js": "22.7.1",
"@nx/nest": "^22.7.1",
"@nx/node": "22.7.1",
"@nx/playwright": "22.7.1",
"@nx/vite": "^22.7.1",
"@nx/vitest": "22.7.1",
"@nx/web": "22.7.1",
"@nx/webpack": "22.7.1",
"@oxc-project/runtime": "^0.129.0",
"@playwright/test": "^1.36.0",
"@schematics/angular": "~21.2.0",
"@swc-node/register": "1.11.1",
"@swc/core": "1.15.33",
"@swc/helpers": "0.5.21",
"@tailwindcss/postcss": "^4.2.4",
"@types/jest": "^30.0.0",
"@types/node": "24.12.2",
"@typescript-eslint/utils": "^8.40.0",
"@vitest/coverage-v8": "~4.1.0",
"@vitest/ui": "~4.1.0",
"angular-eslint": "^21.2.0",
"eslint": "^9.8.0",
"eslint-config-prettier": "^10.0.0",
"eslint-plugin-playwright": "^1.6.2",
"husky": "^9.1.7",
"jest": "^30.0.2",
"jest-environment-node": "^30.0.2",
"jest-util": "^30.0.2",
"jsdom": "^29.0.0",
"jsonc-eslint-parser": "^2.1.0",
"lint-staged": "^17.0.0",
"nx": "22.7.1",
"postcss": "^8.5.12",
"prettier": "^3.8.1",
"prisma": "^6.19.3",
"tailwindcss": "^4.2.4",
"ts-jest": "^29.4.0",
"ts-node": "10.9.2",
"tslib": "^2.3.0",
"typescript": "~5.9.2",
"typescript-eslint": "^8.40.0",
"vite": "^8.0.0",
"vitest": "^4.0.8",
"webpack-cli": "^5.1.4"
},
"dependencies": {
"@angular/common": "~21.2.0",
"@angular/compiler": "~21.2.0",
"@angular/core": "~21.2.0",
"@angular/forms": "~21.2.0",
"@angular/platform-browser": "~21.2.0",
"@angular/router": "~21.2.0",
"@nestjs/common": "^11.0.0",
"@nestjs/core": "^11.0.0",
"@nestjs/platform-express": "^11.0.0",
"@prisma/client": "^6.19.3",
"axios": "^1.6.0",
"class-transformer": "^0.5.1",
"class-validator": "^0.15.1",
"nestjs-prisma": "^0.27.0",
"reflect-metadata": "^0.2.0",
"rxjs": "~7.8.0"
}
}