mirror of
https://github.com/Donkie/Spoolman.git
synced 2026-10-21 09:39:46 -05:00
Donkie
3c414503d6
Dependabot #982 opened the door: an esbuild advisory that can only be closed by going forward, since the fix is upstream of us in vite-plugin-svelte and vitest. It could not merge on its own, though -- Vitest 4 no longer augments Vite's defineConfig, so the `test` block in vite.config.ts became a type error and the style job went red on a file Dependabot is not allowed to touch. The config now takes defineConfig from vitest/config, which is where that overload lives. With the chain forced open anyway, everything else that had drifted goes with it: SvelteKit, Svelte, paraglide, Playwright, prettier-plugin-svelte 4, globals 17 and ESLint 10. TypeScript stays on 5.9 -- 7.0.2 is out, but typescript-eslint pins <6.1.0 and svelte-check ^5 || ^6, so it is peer-blocked on both sides rather than merely untested. Vite 8 replaces Rollup and esbuild with Rolldown, so the toolchain is now one Rust binary plus lightningcss. Measured against a clean checkout of the old tree: the production build drops from 7.7s to 4.6s, shipped JavaScript from 383 KB gzipped across 42 chunks to 360 KB across 36. Dev cold start is unchanged at ~2s, as expected -- dev serves unbundled ESM either way. The armv7 image is not exposed to Rolldown's native binaries: build-client runs on amd64 and the arch jobs only download its artifact. ESLint 10 turns on no-useless-assignment, which caught three initialisers that every branch overwrites; they become bare declarations. The allowScripts block pinning esbuild@0.21.5 goes too, as esbuild is no longer in the tree at all and nothing in the repo reads that field. The lockfile is regenerated rather than patched: the old one pinned vite-plugin-svelte 4 firmly enough that npm could not resolve a path to 7 without it. Verified on Node 24: lefthook ci green, 50 unit tests, a11y audit, and the full tests_frontend_v2 Playwright suite (21/21) against a real backend serving the new build.