Skip to content

chore(deps): upgrade Composer + pnpm packages, repo cleanup#107

Merged
llbbl merged 4 commits into
masterfrom
chore/upkeep-deps
Jun 1, 2026
Merged

chore(deps): upgrade Composer + pnpm packages, repo cleanup#107
llbbl merged 4 commits into
masterfrom
chore/upkeep-deps

Conversation

@llbbl

@llbbl llbbl commented Jun 1, 2026

Copy link
Copy Markdown
Owner

Summary

  • Repo cleanup: remove stale/duplicate files, gitignore CLAUDE.md, relocate DOCKER.md
  • Composer upgrades including PHPUnit 12 → 13 (major) and Symfony CVE pins
  • pnpm upgrades including Vite 6 → 8 and two other major-version bumps
  • All migration fixes applied; suite passing at 135 tests

Changes

Repo Cleanup

  • CLAUDE.md: Removed from version control and added to .gitignore
  • docs/docker.md: DOCKER.md relocated here
  • license.txt: Deleted (duplicate of LICENSE)
  • create.sql: Deleted (superseded by CI4 migrations)
  • README_MIGRATION.md: Deleted (CI3→CI4 migration is complete)
  • docs/contributing.md: Deleted (generic boilerplate; root CONTRIBUTING kept)
  • package-lock.json: Deleted (project uses pnpm)

Composer Upgrades

  • codeigniter4/framework: 4.7.0 → 4.7.3
  • phpstan/phpstan: 2.1 → 2.2
  • friendsofphp/php-cs-fixer: 3.93 → 3.95
  • phpunit/phpunit: 12 → 13 (major)
  • symfony/http-foundation + symfony/routing: Pinned to ^6.4.41 (resolves 3 CVEs; Symfony 7 blocked by cboden/ratchet)

pnpm Upgrades

  • vite: 6 → 8 (two majors)
  • @vitejs/plugin-vue: 5 → 6
  • @sveltejs/vite-plugin-svelte: 5 → 7 (two majors)
  • svelte / vue / sass: Minor bumps
  • pnpm-workspace.yaml: Added picomatch ^4.0.4 override to clear last 2 transitive advisories

Migration Fixes

  • app/Config/Format.php: Added $jsonEncodeDepth property (CI 4.7 requirement)
  • app/Controllers/Chat.php: Added missing CodeIgniter\HTTP\RedirectResponse import
  • app/Database/Migrations/: Replaced $this->db->DBDriver with $this->db->getPlatform() in 2 migration files
  • app/Helpers/FileHelper.php: Cast float → int in formatSize()
  • src/svelte/App.svelte: Migrated Sass darken()color.adjust() via @use "sass:color"
  • src/vue/App.vue: Migrated Sass darken()color.adjust() via @use "sass:color"
  • vite.config.js: Removed invalid server.root key
  • phpstan.neon: Removed deprecated treatPhpDocTypesAsCertain key

Verification

  • composer audit: clean
  • composer analyse: no errors
  • composer test: 135 passing (46 PHPUnit 13 deprecation notices — deferred, see below)
  • pnpm audit: clean
  • pnpm build: clean

Deferred Follow-ups

Recorded in docs/tasks.md (items 48–54):

  • PHPUnit createMockcreateStub migration (the 46 deprecation notices)
  • phpunit.xml.dist schema URL bump
  • composer cs-fix reformatting pass
  • Vite explicit build.target
  • Node engine bump to 20.19+
  • Empty src/vue/ subdirectory cleanup
  • pnpm dev verification

Test Plan

  • composer install completes without errors
  • composer audit reports clean
  • composer analyse reports no errors
  • composer test passes all 135 tests
  • pnpm install completes without errors
  • pnpm audit reports clean
  • pnpm build produces clean output in public/dist/
  • php spark serve starts the development server
  • Chat app loads and messages can be sent/received in the browser
  • WebSocket server (php spark websocket:start) connects and broadcasts messages
  • XML, JSON, HTML, Vue, and Svelte chat interfaces all render correctly

llbbl added 4 commits June 1, 2026 08:45
- Add CLAUDE.md to .gitignore
- Remove CLAUDE.md, README_MIGRATION.md, create.sql, docs/contributing.md, license.txt, package-lock.json
- Rename DOCKER.md -> docs/docker.md
### Composer
- codeigniter4/framework 4.7.0 -> 4.7.3
- phpstan/phpstan 2.1 -> 2.2
- friendsofphp/php-cs-fixer 3.93 -> 3.95
- phpunit/phpunit 12 -> 13
- symfony/* pinned to ^6.4.41 for CVE patches

### pnpm
- vite 6 -> 8
- @vitejs/plugin-vue 5 -> 6
- @sveltejs/vite-plugin-svelte 5 -> 7
- svelte, vue, sass minor version bumps
- Added picomatch override
- Added pnpm-workspace.yaml

### Migration fixes applied
- Format::$jsonEncodeDepth property added (app/Config/Format.php)
- RedirectResponse import added to Chat controller
- BaseConnection->getPlatform() calls updated in both migration files
- FileHelper int casts added for strict type compatibility
- Sass darken() replaced with color.adjust() in App.svelte/App.vue
- Removed invalid vite server.root option from vite.config.js
- Removed deprecated phpstan key from phpstan.neon

### Follow-ups
- Deferred follow-ups recorded in docs/tasks.md (items 48-54)
Renamed LICENSE to LICENSE.md and removed outdated docs (docs/api.md,
docs/backlog.md, docs/plan.md). This cleanup aligns the repository with
the current documentation strategy and reduces confusion from deprecated
files. No runtime or test changes were made; this is purely project
housekeeping.
# Conflicts:
#	composer.lock
#	package-lock.json
#	package.json
#	pnpm-lock.yaml
@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Updatednpm/​svelte@​5.55.10 ⏵ 5.56.088 +110088 +198 +1100
Updatedcomposer/​symfony/​http-foundation@​6.4.33.0 ⏵ 6.4.41.010010090100100
Updatedcomposer/​friendsofphp/​php-cs-fixer@​3.95.2.0 ⏵ 3.95.3.010010090100100
Updatedcomposer/​phpunit/​phpunit@​12.5.22.0 ⏵ 13.1.13.010010090100100

View full report

@llbbl
llbbl merged commit 88580a7 into master Jun 1, 2026
5 checks passed
@llbbl
llbbl deleted the chore/upkeep-deps branch June 1, 2026 13:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant