[kalverra]

We have a lot of ancient packages and dependencies in this repo that were causing lots of security alerts. Figured we'd do a full sweep.

Overview

Comprehensive modernization of runtime engines, build tooling, testing framework, GitHub Actions SDKs, and application dependencies across the monorepo. This upgrade targets Node 26 and pnpm 12, migrates Nx to 23.3, transitions ESLint to Flat Config (eslint.config.mjs), upgrades Vitest to 5.0, and updates all @actions/* SDKs to their latest major releases.

Package Upgrades

Runtimes & Engines

Tool / Engine	From	To	Scope / Files
nodejs	24.14.1	26.10.0	.tool-versions
pnpm	10.6.5 / ^10.0.0	12.9.1 / ^12.0.0	.tool-versions, package.json, CI workflows, composite actions

Monorepo Tooling & Transpilation

Package	From	To	Scope / Notes
nx	22.7.12	23.3.0	Root monorepo orchestration
@nx/devkit	22.7.12	23.3.0	Root devDependencies
@nx/esbuild	22.7.12	23.3.0	Root devDependencies
@nx/eslint	22.7.12	23.3.0	Root devDependencies
@nx/eslint-plugin	22.7.12	23.3.0	Root devDependencies
@nx/js	22.7.12	23.3.0	Root devDependencies
@nx/plugin	22.7.12	23.3.0	Root devDependencies
esbuild	^0.23.1	^0.28.2	Root & apps/update-action-versions
@swc-node/register	1.11.1	1.12.1	Root devDependencies
@swc/cli	0.7.10	0.8.1	Root devDependencies
@swc/core	1.15.8	1.16.13	Root devDependencies
@swc/helpers	0.5.19	0.5.23	Root devDependencies

Linting & Formatting (Flat Config Migration)

Package	From	To	Scope / Notes
eslint	^8.57.1	9.39.5	Migrated .eslintrc.json to eslint.config.mjs
@typescript-eslint/eslint-plugin	^7.18.0	8.71.1	ESLint 9 Flat Config
@typescript-eslint/parser	^7.18.0	8.71.1	ESLint 9 Flat Config
@eslint/eslintrc	(new)	^3.0.0	ESLint flat compatibility
@eslint/js	(new)	^9.8.0	ESLint recommended configs
jsonc-eslint-parser	(new)	^3.3.0	JSONC linting parser in flat config
typescript-eslint	(new)	^8.58.0	Flat config helper library
prettier	^2.8.8	^3.9.9	actions/signed-commits

Testing & Types

Package	From	To	Scope / Notes
vitest	^4.1.11	^5.0.3	Root & 19 workspace packages
typescript	5.9.3	^6.0.3	Root & 7 workspace packages
@types/node	24.12.2 / ^24.13.6	^26.6.4	Root & 19 workspace packages

GitHub Actions SDKs & Octokit

Package	From	To	Scope / Notes
@actions/core	^2.0.3	^3.0.1	17 action/app packages
@actions/github	^8.0.1	^9.1.1	17 action/app packages
@actions/artifact	^5.0.3 / ^6.2.1	^6.3.1	2 action/app packages
@actions/cache	^5.2.0	^6.3.0	apps/go-conditional-tests
@actions/exec	^1.1.1	^3.0.0	actions/signed-commits
@actions/glob	^0.5.1	^0.7.0	6 action/app packages
@octokit/types	^16.0.0	^18.0.0	14 action/app packages
octokit	^3.2.2	^5.0.5	apps/actions-dependencies-updater

Application Dependencies

Package	From	To	Scope / Notes
p-limit	^6.2.0	^7.3.3	apps/go-conditional-tests
jira.js	^4.1.3	^6.3.0	libs/jira-tracing
diff	^8.0.4	^9.0.0	actions/apidiff-go
replace-in-file	^7.2.0	^9.0.0	apps/update-action-versions
dotenv	^16.6.1	^18.0.6	apps/actions-dependencies-updater

Key Highlights & Architectural Changes

1. Node 26 & pnpm 12 Engines:

   • Upgraded monorepo runtime to Node 26.10.0 and pnpm 12.9.1.
   • Updated workflow files (pull-request-main.yml, push-main.yml, solidity-review-artifacts.yml, reusable-docusaurus.yml) and composite actions (setup-nodejs, cicd-build-publish-artifacts-ts, ci-lint-ts, ci-test-sol, ci-test-ts, cicd-changesets) to pnpm-version: "^12.0.0".
   • Moved overrides and allowBuilds into pnpm-workspace.yaml conforming to pnpm 12 standards.

2. ESLint 9 Flat Config Migration:

   • Converted deprecated .eslintrc.json configurations into modular eslint.config.mjs files in root and configured subprojects.
   • Maintained clean lint scope via nx.json matching baseline.

3. ESM Compatibility for Actions SDKs:

   • Adapted Vitest test mocks (vi.mock("@actions/core"), vi.mock("@actions/github")) to accommodate non-configurable exports in native ESM @actions/* v3/v9 modules.

4. Git Attributes & Diff Optimization:

   • Marked **/dist/** and **/out/** with -diff merge=binary in .gitattributes to prevent massive 30,000+ line text diffs from stalling git CLI and editor status watchers.
   • Added .zed/settings.json file scan exclusions.

Merge Danger

	Rating	Why
Revert	🟡 minor	Clean revert restores lockfile and dist, but touches 116 files across every package; no schema or data changes.
Blast radius	🟠 large	Minor bumps move floating @v1 tags for all composite actions, silently switching every consumer to pnpm 12 defaults

[github-actions]

👋 kalverra, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[github-actions]

🦋 Changeset is good to go

Latest commit: 477b04f

We got this.

Not sure what this means? Click here to learn what changesets are.

[tvc-robsondebraga]

we may want to remove / check for double quotes here. in the porcelain with all untracked files, we can have something like:

git status --porcelain --untracked-files=all
?? "new dir/file.txt"

which means file have a double quote. in the readFileSync that can fail, because there is no file named '"new dir/file.txt"'

[tvc-robsondebraga]

as this is a reusable workflow, can we make this similar to reusable-docusaurus?