Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
669 changes: 329 additions & 340 deletions bun.lock

Large diffs are not rendered by default.

4 changes: 2 additions & 2 deletions bunfig.toml
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
[install]
minimumReleaseAge = 604800
# [install]
# minimumReleaseAge = 604800
Comment on lines +1 to +2

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Disabling minimumReleaseAge removes a supply chain safety net.

minimumReleaseAge = 604800 enforced a 7-day quarantine for newly published packages. Commenting it out means Bun will happily install packages published seconds ago — including potentially compromised or buggy ones. Given this PR bumps a massive swath of dependencies to bleeding-edge versions, disabling this guardrail right now is the worst possible timing.

If the intent was to install versions younger than 7 days, re-enable this setting after the update lands. Leaving it disabled permanently is reckless.

🔒️ Proposed fix: re-enable after updates are applied
-# [install]
-# minimumReleaseAge = 604800
+[install]
+minimumReleaseAge = 604800
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
# [install]
# minimumReleaseAge = 604800
[install]
minimumReleaseAge = 604800
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@bunfig.toml` around lines 1 - 2, Re-enable the Bun install configuration by
uncommenting the [install] section and minimumReleaseAge = 604800 in
bunfig.toml, preserving the seven-day package quarantine.

7 changes: 3 additions & 4 deletions function/redirects/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,12 @@
"private": true,
"scripts": {
"cf-typegen": "wrangler types",
"check": "vp check",
"deploy": "vp check && pnpm wrangler deploy",
"check": "vp run typecheck && vp check",
"deploy": "vp run check && wrangler deploy",
"dev": "wrangler dev",
"format": "vp fmt",
"lint": "vp lint",
"typecheck": "tsgo --noEmit"
"typecheck": "tsc --noEmit"
},
"dependencies": {
"hono": "catalog:backend"
Expand All @@ -18,7 +18,6 @@
"@cloudflare/workers-types": "catalog:cloudflare",
"@types/bun": "catalog:types",
"@types/node": "catalog:types",
"@typescript/native-preview": "catalog:build",
"typescript": "catalog:build",
"vite-plus": "catalog:build",
"wrangler": "catalog:build"
Expand Down
9 changes: 5 additions & 4 deletions function/router/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -6,19 +6,20 @@
"scripts": {
"build": "vp build",
"cf-typegen": "wrangler types",
"check": "vp check",
"deploy": "vp check && wrangler deploy",
"check": "vp run typecheck && vp check",
"deploy": "vp run check && wrangler deploy",
"dev": "wrangler dev",
"format": "vp fmt",
"lint": "vp lint",
"typecheck": "vp check"
"typecheck": "tsc --noEmit"
},
"dependencies": {
"hono": "catalog:backend"
},
"devDependencies": {
"@cloudflare/workers-types": "catalog:cloudflare",
"oxfmt": "catalog:build",
"@types/bun": "catalog:types",
"@types/node": "catalog:types",
"typescript": "catalog:build",
"vite-plus": "catalog:build",
"wrangler": "catalog:build"
Expand Down
47 changes: 23 additions & 24 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -8,48 +8,47 @@
],
"catalogs": {
"backend": {
"hono": "4.12.25"
"hono": "4.12.29"
},
"build": {
"@typescript/native-preview": "7.0.0-dev.20260610.1",
"@vitejs/plugin-react": "6.0.2",
"oxfmt": "0.54.0",
"@vitejs/plugin-react": "6.0.3",
"oxfmt": "0.56.0",
"oxlint": "1.57.0",
"oxlint-tsgolint": "0.18.1",
"typescript": "6.0.3",
"vite": "8.0.16",
"vite-plus": "0.1.24",
"typescript": "7.0.2",
"vite": "8.1.4",
"vite-plus": "0.2.4",
"vitest": "4.1.2",
"wrangler": "4.99.0"
"wrangler": "4.110.0"
},
Comment on lines 13 to 23

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

oxfmt version mismatch between catalog and root devDependencies.

The catalog pins oxfmt at 0.56.0 (line 15), but root devDependencies use 0.58.0 (line 72). Every other root devDependency matches its catalog counterpart exactly. This isn't intentional — it's a typo or a stale pin.

This means vp fmt will use different oxfmt versions depending on whether it runs from the root or a workspace context. You'll get inconsistent formatting across the monorepo and nobody will understand why.

🔧 Proposed fix: align root devDeps with catalog
-        "oxfmt": "0.56.0",
+        "oxfmt": "0.58.0",

Or alternatively, update the root devDependency to match the catalog:

-    "oxfmt": "0.58.0",
+    "oxfmt": "0.56.0",
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
"build": {
"@typescript/native-preview": "7.0.0-dev.20260610.1",
"@vitejs/plugin-react": "6.0.2",
"oxfmt": "0.54.0",
"@vitejs/plugin-react": "6.0.3",
"oxfmt": "0.56.0",
"oxlint": "1.57.0",
"oxlint-tsgolint": "0.18.1",
"typescript": "6.0.3",
"vite": "8.0.16",
"vite-plus": "0.1.24",
"typescript": "7.0.2",
"vite": "8.1.4",
"vite-plus": "0.2.4",
"vitest": "4.1.2",
"wrangler": "4.99.0"
"wrangler": "4.110.0"
},
"build": {
"`@vitejs/plugin-react`": "6.0.3",
"oxfmt": "0.58.0",
"oxlint": "1.57.0",
"oxlint-tsgolint": "0.18.1",
"typescript": "7.0.2",
"vite": "8.1.4",
"vite-plus": "0.2.4",
"vitest": "4.1.2",
"wrangler": "4.110.0"
},
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 13 - 23, Align the root devDependencies entry for
oxfmt with the catalog version 0.56.0. Update only the oxfmt version so root and
workspace formatting use the same pinned dependency.

"cloudflare": {
"@cloudflare/vite-plugin": "1.40.1",
"@cloudflare/workers-types": "4.20260610.1"
"@cloudflare/vite-plugin": "1.44.0",
"@cloudflare/workers-types": "5.20260712.1"
},
"react-ui": {
"@base-ui/react": "1.5.0",
"lucide-react": "1.17.0",
"@base-ui/react": "1.6.0",
"lucide-react": "1.24.0",
"react": "19.2.7",
"react-dom": "19.2.7",
"shadcn": "4.11.0"
"shadcn": "4.13.0"
},
"styling": {
"@tailwindcss/vite": "4.3.0",
"@tailwindcss/vite": "4.3.2",
"class-variance-authority": "0.7.1",
"clsx": "2.1.1",
"tailwind-merge": "3.6.0",
"tailwindcss": "4.3.0",
"tailwindcss": "4.3.2",
"tw-animate-css": "1.4.0"
},
"tanstack": {
"@tanstack/react-router": "1.170.15",
"@tanstack/react-router": "1.170.17",
"@tanstack/react-router-ssr-query": "1.167.1",
"@tanstack/react-start": "1.168.25",
"@tanstack/router-plugin": "1.168.18"
"@tanstack/react-start": "1.168.27",
"@tanstack/router-plugin": "1.168.19"
},
"types": {
"@types/bun": "1.3.14",
"@types/node": "25.9.2",
"@types/node": "26.1.1",
"@types/react": "19.2.17",
"@types/react-dom": "19.2.3"
}
Expand All @@ -69,10 +68,10 @@
"devDependencies": {
"@types/bun": "1.3.14",
"@types/jsdom": "28.0.3",
"@types/node": "25.9.1",
"@typescript/native-preview": "7.0.0-dev.20260603.1",
"oxfmt": "0.53.0",
"vite-plus": "0.1.24"
"@types/node": "26.1.1",
"oxfmt": "0.58.0",
"typescript": "7.0.2",
"vite-plus": "0.2.4"
},
"packageManager": "bun@1.3.13"
"packageManager": "bun@1.3.14"
}
7 changes: 3 additions & 4 deletions web/landing/package.json
Original file line number Diff line number Diff line change
@@ -1,20 +1,20 @@
{
"name": "@jfa.dev/landing",
"version": "0.3.4",
"version": "0.3.5",
"private": true,
"type": "module",
"scripts": {
"build": "vp build",
"cf-typegen": "wrangler types",
"check": "vp check",
"check": "vp run typecheck && vp check",
"deploy": "vp run typecheck && vp lint && vp build && wrangler deploy",
"dev": "vp dev --port 3000 --host",
"format": "vp fmt",
"lint": "vp lint",
"preview": "vp preview",
"serve": "vp preview",
"test": "vp test",
"typecheck": "tsgo --noEmit"
"typecheck": "tsc --noEmit"
},
"dependencies": {
"@base-ui/react": "catalog:react-ui",
Expand All @@ -38,7 +38,6 @@
"devDependencies": {
"@types/react": "catalog:types",
"@types/react-dom": "catalog:types",
"@typescript/native-preview": "catalog:build",
"@vitejs/plugin-react": "catalog:build",
"typescript": "catalog:build",
"vite": "catalog:build",
Expand Down
9 changes: 0 additions & 9 deletions web/landing/src/routes/__root.tsx
Original file line number Diff line number Diff line change
Expand Up @@ -59,15 +59,6 @@ function RootDocument({ children }: { children: React.ReactNode }) {
<a href="https://github.com/jfalava" className="sr-only" rel="me">
GitHub
</a>
<a href="https://twitter.com/jorgefalava" className="sr-only" rel="me">
Twitter
</a>
<a href="https://bsky.app/profile/jfa.dev" className="sr-only" rel="me">
Bluesky
</a>
<a href="https://todon.eu/@jfalava" className="sr-only" rel="me">
Mastodon
</a>
</body>
</html>
);
Expand Down
7 changes: 3 additions & 4 deletions web/og-img-gen/package.json
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@
"scripts": {
"build": "vp build",
"cf-typegen": "wrangler types",
"check": "vp check",
"check": "vp run typecheck && vp check",
"deploy": "vp run typecheck && vp lint && vp build && wrangler deploy",
"dev": "vp dev --port 3000 --host",
"format": "vp fmt",
"lint": "vp lint",
"preview": "vp preview",
"serve": "vp preview",
"typecheck": "tsgo --noEmit"
"typecheck": "tsc --noEmit"
Comment on lines +9 to +16

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Compare deploy chains across all packages
rg -n '"deploy"' --type=json -g '*package.json' -A1
# Investigate what vp check does vs vp lint + vp build
rg -n 'vp check' --type=json -g '*package.json' -B2 -A2

Repository: jfalava/jfa.dev

Length of output: 153


🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== package.json files =="
git ls-files '*package.json'

echo
echo "== deploy/check scripts across package.json files =="
python3 - <<'PY'
import json, pathlib
for p in sorted(pathlib.Path('.').rglob('package.json')):
    try:
        data = json.loads(p.read_text())
    except Exception:
        continue
    scripts = data.get('scripts', {})
    if any(k in scripts for k in ('deploy','check','lint','build','typecheck')):
        print(f'-- {p}')
        for k in ('check','deploy','lint','build','typecheck'):
            if k in scripts:
                print(f'  {k}: {scripts[k]}')
PY

echo
echo "== any direct vp check references =="
rg -n --glob 'package.json' 'vp check|vp run check|vp run typecheck|wrangler deploy|vp lint|vp build' .

echo
echo "== files mentioning vp check outside package.json =="
rg -n 'vp check|vp run check' .

Repository: jfalava/jfa.dev

Length of output: 2739


Use vp run check in deploy. web/og-img-gen skips vp check entirely here, so this path can drift from check and miss any validation added there. The function packages already gate deploys through check.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@web/og-img-gen/package.json` around lines 9 - 16, Update the deploy script in
web/og-img-gen/package.json to invoke the existing check script via vp run check
instead of separately running vp typecheck and vp lint, while preserving the
subsequent build and wrangler deploy steps.

},
"dependencies": {
"@base-ui/react": "catalog:react-ui",
Expand All @@ -26,7 +26,7 @@
"clsx": "catalog:styling",
"html-to-image": "1.11.13",
"lucide-react": "catalog:react-ui",
"nanoid": "5.1.11",
"nanoid": "5.1.16",
"react": "catalog:react-ui",
"react-dom": "catalog:react-ui",
"tailwind-merge": "catalog:styling",
Expand All @@ -40,7 +40,6 @@
"@types/node": "catalog:types",
"@types/react": "catalog:types",
"@types/react-dom": "catalog:types",
"@typescript/native-preview": "catalog:build",
"@vitejs/plugin-react": "catalog:build",
"jsdom": "29.1.1",
"shadcn": "catalog:react-ui",
Expand Down