chore(deps): bump js-client npm dependencies

[claude]

Requested by Łukasz Komoszyński · Slack thread

Dependency refresh for js-client/ only. Nothing outside that directory is touched. TypeScript is deliberately kept on 5.x (^5.9.3) — the TypeScript upgrade is being handled separately in #93, and neither TS 6 nor TS 7 is pulled in here.

Runtime dependencies were not bumped; they are listed at the bottom for a maintainer decision.

What moved

Nx (via nx migrate latest)

Package	Before	After
nx	23.1.0	23.1.1
@nx/eslint, @nx/eslint-plugin, @nx/jest, @nx/js, @nx/rollup, @nx/workspace	23.1.0	23.1.1

nx migrate produced no migration steps and no out-of-scope packageJsonUpdates, so there was nothing to revert. Nx 23.1.1 still peer-requires @swc/core ^1.15.8 and @swc-node/register ^1.11.1, both already satisfied — no toolchain realignment needed.

Safe devDependencies (minor / patch)

Package	Before	After
@types/lodash	4.17.24	4.17.25
prettier	^3.9.5	^3.9.6
ts-jest	^29.4.11	^29.4.12
typescript-eslint	8.64.0	8.67.0
verdaccio	6.7.4	6.9.2

typescript-eslint 8.67.0 peer-requires typescript >=4.8.4 <6.1.0, so it is compatible with the TS 5.9 we are keeping.

Intentionally excluded from this pass as Nx-managed (rollup ^4.62.2 → ^4.62.4, @swc/core 1.15.43 → 1.16.0, @swc-node/register 1.11.1 → 1.12.1) — these should move when Nx's peer ranges move.

Majors

Package	Before	After
lerna	9.0.7	10.0.0

Lerna 10 is ESM-only, requires Node ^22.13 || ^24 || ^26 (the repo is on Node 24.18), and requires Nx 17+ (we are on 23.1.1). The options it removed (--includeFilteredDependencies, --includeFilteredDependents, --githubRelease, --skipGit, --npmTag) are not used anywhere in lerna.json or the release workflow, and the useNx / command.version config we do use is still in the 10.x schema. Verified with lerna list / lerna changed.

Side benefit: Lerna 10 depends on nx >=23.1.0 <24.0.0, so it now dedupes against the workspace's own Nx instead of nesting a second copy of nx@22.7.6 — 121 packages removed from the tree.

Two behavioural notes for whoever cuts the next release:

• Lerna 10 now throws EBEHIND in CI when the checkout is behind the remote during versioning/publishing (previously local-only); tunable via --ci-behind-behavior.
• It switched to the current conventional-changelog APIs, so generated CHANGELOG.md formatting may differ slightly. Version-bump behaviour and CLI options are unchanged.

What was HELD, and why

Package	Available	Why held
typescript	^5.9.3 → ^7.0.2	Explicitly out of scope. TypeScript stays on 5.x. The TS upgrade is tracked separately in #93.
eslint	^9.39.5 → ^10.8.1	Peers are not satisfied. eslint-plugin-import (2.32.0, latest) and eslint-plugin-jsx-a11y (6.10.2, latest) both cap at eslint ^9, and eslint-plugin-react caps at ^9.7 — all three are dependencies of @leancodepl/eslint-config@10.6.0, which is itself the latest release and has not declared ESLint 10 support. Installing ESLint 10 works and lint passes, but only by overriding three peer ranges, so the whole group should move together once the shared config ships ESLint 10 support.
@types/node	24.13.3 → 26.2.0	Node typings should track the runtime major. The repo runs Node 24.18 (.nvmrc) and @leancodepl/pipe declares engines.node >=22.0.0. Staying on 24.x is correct; 24.13.3 is the newest 24.x.
rollup, @swc/core, @swc-node/register	patch/minor available	Nx-managed — deferred to the next nx migrate so they stay inside Nx's peer ranges.

Dependabot

The repo has no .github/dependabot.yml and there are no open Dependabot PRs, so there is nothing to auto-close or reconcile against this lockfile.

npm audit

npm audit fix was run without --force; it changed the lockfile only, no manifest entries.

	Before	After
Total	28	11
Critical	1	0
High	14	10
Moderate	12	1
Low	1	0

Resolved transitively: ip-address, nanoid, postcss, undici, brace-expansion (partially), plus everything that disappeared with the nested nx@22.7.6 tree.

The remaining 11 are all dev-only and all three root causes are upstream:

• brace-expansion (high), reachable via nx — npm's only "fix" is downgrading Nx to 22.6.5.
• js-yaml (high) and tar (moderate), reachable via lerna — npm's only "fix" is downgrading Lerna to 6.6.2.

Both would be --force downgrades to older majors, i.e. a regression rather than a fix, so they were not applied. None of these reach the published package: CI's integrity gate is npm audit signatures --omit=dev, and @leancodepl/pipe's own runtime dependencies are clean.

Runtime dependencies — maintainer decision

Not bumped in this PR. Only one has an update available:

Package	Current	Available	Note	Recommendation
@microsoft/signalr	10.0.0	10.0.11	Patch-level servicing releases on the 10.0 line; no API changes, and @leancodepl/pipe declares the dependency as >=8.0.0 so the published contract is unaffected.	Bump. Low risk, and it is the transport the client actually runs on — worth doing in its own PR so the live-backend test in packages/pipe/__tests__/pipe.spec.ts is the gate.
deep-equal	2.2.3	—	Already latest.	No action.
lodash	4.18.1	—	Already latest.	No action.
rxjs	7.8.2	—	Already latest on the 7.x line.	No action.
tslib	^2.8.1	—	Already latest.	No action.

Verification

Run on Node 24.18.1 with its bundled npm 11.16.0 — the exact pair actions/setup-node resolves from js-client/.nvmrc. Clean rm -rf node_modules && npm install reproduces the lockfile with no drift, and npm ci (used by the release workflow) resolves cleanly.

Target	Result
npm install	pass, no lockfile drift
npm ci	pass (lockfile in sync with manifest)
nx run-many -t lint	pass
nx run-many -t build	pass
tsc -p packages/pipe/tsconfig.lib.json --noEmit	pass
nx run-many -t test	1 failed — pre-existing, environmental

The single failing test is pipe › assignments should work, which opens a live SignalR connection to api.exampleapp.test.lncd.pl. It fails with 403 Host not in allowlist because the verification sandbox blocks that host by egress policy. It fails identically on unmodified main — this is not a regression, and it is expected to pass in CI. It is also the repo's only test, so the effective local gate here was lint + build + typecheck.

npm audit signatures --omit=dev could not be exercised locally (the sandbox blocks the registry attestation endpoint); it is unaffected by this change and will run normally in CI.

The shared ESLint config was confirmed to be genuinely loading rather than silently falling back to defaults, by linting a deliberately non-conforming snippet and checking that import/*, unicorn/*, unused-imports/* and core rules all reported.

---

Generated by Claude Code