Skip to content

Housekeeping: Dependency updates - #316

Merged
devmount merged 13 commits into
mainfrom
chores/node-dependency-updates
Aug 25, 2026
Merged

Housekeeping: Dependency updates#316
devmount merged 13 commits into
mainfrom
chores/node-dependency-updates

Conversation

@devmount

@devmount devmount commented Aug 25, 2026

Copy link
Copy Markdown
Collaborator

What changed?

This PR contains lots of dependency updates, housekeeping and clean-up. This is a second try after #274 failed.

Before After
image image
  • All dependencies were updated to their latest version, except vue-tsc and typescript. Those are not (yet) compatible with us using the standard Storybook pattern of spying on array-style defineEmits(['click']) with onClick/onChanged args
  • I found that there wasn't any linting step in our CI validation workflow, so I added it
  • I fixed a bug in one of our Vue defineModel defaults
  • I explicitly excluded unplugin-dts from the Storybook config. This was an issue already existing before the update. vite-plugin-dts had leaked its dts() plugin into the Storybook build, because @storybook/vue3-vite auto-merges the project's root vite.config.ts — we never scoped this to the library build only.

Why?

Fixing security issues. Housekeeping.

Limitations and Notes

See the comments above.

Applicable Issues

Closes #273

Screenshots

No UI changes.

@davinotdavid davinotdavid left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we also double check that every package that got bumped to a major version didn't have any breaking changes?

Comment thread package.json Outdated
"@eslint/js": "9.39.4",
"@playwright/test": "1.61.1",
"@eslint/js": "10.0.1",
"@microsoft/api-extractor": "^7.59.0",

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't seem to be used anywhere and is a net new dependency added. Why has this been added?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

api-extractor is needed by vite-plugin-dts v5 now (in v4 it was bundled internally) as optional peer dependency. Without installing it explicitly, bundling silently failed and fell back to unbundled per-file declarations (breaking our dist/index.d.ts).

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm I see, interesting. Perhaps we should remove the caret here / pin the version!

Also, noting here that this package seems to bundle its own version of typescript (which is 5.93 according to their package.json) that gives us a warning when building our project since our typescript version is now 6.x.

We don't usually use the latest features of typescript anyways but perhaps we should watch out and update this again when api-extractor updates their bundled typescript version.

@devmount devmount Aug 25, 2026

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I saw that too. But I saw this more like a note for api-extractor to update TS at their end - or am I getting that wrong? Since we already have TS v7 available, I thought going at least to v6 would be sufficient for now. All builds worked on my end locally, but please test this too 🙏🏻 Otherwise, I can happily revert to TS v5, this was only the baseUrl change.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh and good point on the caret! Will remove it!

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes that's what I meant as well. Whenever api-extractor updates their TS version and release a new version with it, we should update it here as well (note for the future).

Comment thread .storybook/main.ts
Comment on lines +15 to +22
// The root vite config's dts plugin only makes sense for the library build, not for storybook-static.
// It fails there since api-extractor can't resolve an entry file under storybook's own outDir.
viteFinal: async (config) => {
config.plugins = config.plugins?.filter(
(plugin) => !(plugin && 'name' in plugin && plugin.name === 'unplugin-dts'),
);
return config;
},

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you elaborate on this? What is and where are we using an api-extractor?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, this one is tricky because we're doing separate things in the same repository here. We have builds for the main component library (the published npm package), we have the web components build and we have the static storybook site. All these sharing the same config more or less implicitly.

@storybook/vue3-vite auto-merges our root vite.config.ts, so the dts() plugin meant only for the main library build was always leaking into the Storybook build too. Under v4 it just silently wrote an additional unused file to that build, but v5's bundleTypes computes the entry path from Storybook's actual outDir and hard-fails when it doesn't exist. So this filter makes sure the plugin is excluded for storybook.

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We could maybe also just use a dedicated vite config für storybook? 🤔 Maybe that would be cleaner, I'll take a look at that. That would duplicate some config we have, but we don't have to do filter magic.

@davinotdavid davinotdavid Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IMHO we can leave it for now. Thanks for the explanations! We can trace it back to this discussion if we want a bit more clarity on why that is and even though we have separate things in the same repository, we still (thankfully) don't have an overly complicated setup (yet).

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're welcome, thanks for asking. Alright, let's keep it as is.

@devmount

Copy link
Copy Markdown
Collaborator Author

@davinotdavid Of course. Here are the breaking changes of the major upgrades I did:

Package Change Breaking change Fix applied
vite-plugin-dts 4.5.4 → 5.0.3 rollupTypes renamed to bundleTypes / now requires @microsoft/api-extractor explicitly / its dts() plugin leaks into the Storybook build (via config auto-merge), now hard-failing there instead of silently no-oping like v4 did Renamed option in vite.config.ts/vite.ce.config.ts; added @microsoft/api-extractor devDependency; added viteFinal in .storybook/main.ts to filter the plugin out of Storybook's build
typescript 5.9.3 → 6.0.3 baseUrl deprecated Removed baseUrl from tsconfig.jsonpaths already used relative form, so behavior is unchanged
eslint + @eslint/js 9.39.4 → 10.9.0 / 10.0.1 Legacy .eslintrc* support removed; Node 18/19/21/23 dropped None needed
@vue/tsconfig 0.8.1 → 0.9.1 tsconfig.dom.json's default lib moved ES2016 → ES2022 None needed

@davinotdavid davinotdavid left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@devmount
devmount merged commit d8ac03c into main Aug 25, 2026
5 checks passed
@devmount
devmount deleted the chores/node-dependency-updates branch August 25, 2026 15:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Update Vite and TypeScript

2 participants