[obvious-autobuild-staging]

Why

Every dev-toolchain dependency is at least one major behind, and the gap compounds: Dependabot re-raises the vitest major migration every few weeks (most recently #238, which now drags vite 5→8 across two majors) and each closure buys time, not headroom. This PR is the approved deliberate migration (blueprint art_5caGrGsI) — all toolchain majors in one review, after which Dependabot bumps return to patch/minor size.

What

Versions — the version-locked toolchain block from the blueprint, moved together:

Package	From	To
vite	^5.4.11	^8.3.5
vitest	^2.1.8	^5.0.5
@vitejs/plugin-react	^4.3.4	^6.1.2
typescript	~5.6.3	~6.0.3
eslint / @eslint/js	^9.22.0	^10.14.0 / ^10.0.1
eslint-plugin-react-hooks	^5.1.0	^7.1.1
eslint-plugin-react-refresh	^0.4.14	^0.5.7
globals	^15.14.0	^17.14.0
jsdom	^29.1.1	^30.1.3
@testing-library/jest-dom	^6.9.1	^7.0.1
typescript-eslint	^8.18.0	^8.72.1 (peers TS <6.1.0 — hence TS 6, not 7)
@types/node	^20.19.43	^24

CI moves to Node 24 (actions/setup-node in the ci job) — vitest 5 requires ^22.12.0 \|\| ^24 \|\| >=26. React stays 18 (glide-data-grid peer cap; blueprint locked decision). Conversion deps stay pinned; postinstall patches re-verified idempotent on the fresh install. Runtime dependency minors stay with PR 2.

Deviations from the blueprint's PR split, both forced:

1. tailwindcss + @tailwindcss/vite → ^4.3.3 landed here instead of PR 2. @tailwindcss/vite@4.1.0 peers vite ^5.2 \|\| ^6 \|\| ^7 — npm cannot resolve the tree against vite 8 at all (no --legacy-peer-deps shortcuts). The pair is version-locked to this migration; PR 2 drops its tailwind line. This makes tailwind 4.1→4.3 the one CSS-affecting bump in PR 1 — layout was verified in the live preview (see evidence).
2. react-hooks v7's two new compiler-era rules (refs, set-state-in-effect) are off, with a documented comment in eslint.config.js. The codebase passes the rest of the compiler suite cleanly (purity, immutability, set-state-in-render, …). The two rules flag the deliberate "latest-value mirror" refs (CsvTable's latestRef/viewRef, App's converterStateRef — event handlers must see the last completed render's props) and derived-state-resync effects. The sanctioned replacement (useEffectEvent) is a React 19-era API and React is pinned to 18 here; adopting these rules is its own future refactor, not a side effect of a toolchain bump.

Migration fixes the majors required:

• eslint.config.js: reactHooks.configs["recommended-latest"] → reactHooks.configs.flat["recommended-latest"] — under ESM, v7's top-level configs are eslintrc-shaped (plugins: ["react-hooks"]), which eslint 10 rejects in flat config.
• useMediaQuery rewritten on useSyncExternalStore — the canonical fix for the new set-state-in-effect rule, behavior-preserving (matchMedia-less environments still get false, never re-render; the server snapshot keeps prerender on the false branch).
• tsconfig.app.json: dropped deprecated baseUrl (TS 6 flags it; paths is already tsconfig-relative) and added "types": ["node"] — the app project's Node ambient types previously rode in via baseUrl-based inclusion; now declared explicitly.
• convert.ts: rethrown conversion errors attach { cause: e } (new preserve-caught-error rule), and a dead records initializer removed (new no-useless-assignment rule).
• .obvious/obvious.md: corrected the stale "React 19" claim to React 18 with the glide-data-grid peer reason.

Rebuilt app/dist committed — vite 8 (rolldown core) changes asset hashes; verified byte-deterministic across consecutive builds before committing.

How to Review

• The one behavioral surface to sanity-check is the rebuilt bundle: same flow, same look, tailwind 4.3 is the only CSS-affecting change.
• app/scripts/prerender.mjs needed no changes — vite 8's middleware-mode ssrLoadModule path still works; the 40k-char prerender output is byte-identical across builds.
• Review eslint.config.js's rules block comment for the two deferred compiler rules — that's a judgment call worth a second opinion, not a mechanical migration step.
• Intentionally excluded: React 19 (glide-data-grid peer), TS 7 (typescript-eslint peer <6.1.0), all runtime dependency bumps (PR 2), changelog entry (dev-tooling only, no user-visible behavior change beyond the rebuilt bundle).

Test Evidence

Upvote confirms end-to-end — Changelog Vote event fires after Postgres write (row: entry 24, vote 1), vote state persists

Changelog popout opens with entries rendered — Changelog Open manual event fires

Paste a CSV and convert — data grid renders under the vite 8 bundle, layout unchanged

All gates run locally under Node 24.22.2 before push:

• npm run lint — clean (eslint 10.14.0)
• npx tsc -b --noEmit — clean (TS 6.0.3)
• npm test — 35 files, 612 tests passed, 0 failures (vitest 5.0.5 + jsdom 30.1.3)
• npm run build + dist hash-guard simulated locally: committed app/dist diffed byte-identical against a fresh build
• verify-seo.sh — green (45,480 bytes prerendered)
• Shim job is PHP-side only (no .php file touched): php -l over all six files + verify-shim.sh green locally (PHP 8.4.27)

Dogfood preview: paste CSV → convert → copy output, pane flip, and the four Plausible manual events (changelog_open, changelog_vote, Input, Export) verified firing in manual mode — evidence attached to the task.

---

Human author: David Boskovic (david@obvious.ai)

🔗 Obvious Project · 🧵 Obvious Thread · 🔀 Obvious PR Artifact