Modernize all dependencies#43
Merged
Merged
Conversation
Within-major bumps to rollup, typescript (5.9.3), tslib, postcss, autoprefixer, @tsconfig/svelte, @rollup/plugin-typescript, rollup-plugin-css-only, rollup-plugin-svelte, plus actions/checkout v4→v6. TypeScript 6 is latest stable but breaks svelte-preprocess 5; deferring the TS 6 bump until after the Svelte 5 migration in a later phase. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@rollup/plugin-commonjs 25 → 28 and @rollup/plugin-node-resolve 15 → 16. Default behavior changes (strictRequires=true, NODE_ENV export conditions) are fine for this codebase — only svelte is bundled through these plugins and it doesn't rely on CJS wrap semantics. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
electron 28 → 38 and electron-builder 24 → 26. No API surface used (ipcMain.handle, contextBridge, BrowserWindow, shell.openExternal, Menu) has breaking changes in this range. Dropped electron-is-dev entirely — the only reference was a commented-out devtools toggle. Swapped the comment to !app.isPackaged so re-enabling doesn't need the dep. Avoids the v3 ESM/CJS interop issue. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Ran the official @tailwindcss/upgrade tool: - tailwindcss 3.4 → 4.2 - @tailwind directives → @import 'tailwindcss' - theme colors, animations, and keyframes moved to @theme block in CSS - tailwind.config.js removed (config now CSS-first) - postcss plugin replaced with @tailwindcss/postcss - autoprefixer dropped (v4 handles vendor prefixing via Lightning CSS) - utility renames applied by the tool (shadow-sm → shadow-xs, outline-none → outline-hidden) Tailwind v4 split the CLI into @tailwindcss/cli; added it so the existing build:css script continues to resolve the tailwindcss binary. Dark mode config preserved via @custom-variant (class-based, as before). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
svelte 4 → 5, svelte-check 3 → 4, svelte-preprocess 5 → 6. The 4 component files build and run cleanly in Svelte 5's legacy mode, so the migration tool's runes conversion was not forced — per Svelte's guidance, legacy Svelte 4 code continues to work in v5. Fixed one svelte-check error surfaced by the newer type definitions: currentTarget.style access in ResourceCard.svelte needed an HTMLImageElement cast. The error predated this bump but was hidden because svelte-check wasn't in the build script. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- @rollup/plugin-terser 0.4 → 1.0 to drop vulnerable serialize-javascript - npm audit fix resolved transitive svgo and yaml advisories - electron 38 → 41 closes the last high-severity advisory (offscreen paint UAF and related). No impact on our API surface — verified with a build, launch, and full electron-builder dist pass (dmg + zip). - README Node minimum bumped v14 → v20 (electron-builder and Node 22 baseline in the ecosystem make v14 non-viable). npm audit now reports zero vulnerabilities. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Svelte 5 removed the new Component({ target }) instantiation API; the
compat shim doesn't cover bare new App() without going through
svelte/legacy's createClassComponent. Switching the entry to the
supported mount() from 'svelte' fixes an effect_orphan runtime error
that left the window blank.
Caught via devtools after the Phase 5 migration. The build, svelte-check,
and Electron launch all succeeded — only the renderer-initialization
path threw.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
DavidLiedle
added a commit
that referenced
this pull request
Apr 16, 2026
Reflects the Svelte 5 + Tailwind 4 + Electron 41 stack from PR #43. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Multi-phase dependency modernization across the whole stack. Each phase was validated with a build + Electron launch before committing, so any phase can be cherry-picked or reverted independently.
actions/checkout@v4 → v6@rollup/plugin-commonjs25 → 28,@rollup/plugin-node-resolve15 → 16electron-is-devdep@tailwindcss/upgradetool — CSS-first config,@tailwindcss/postcss,@tailwindcss/cliadded; autoprefixer droppedResourceCard.sveltesurfaced by svelte-check@rollup/plugin-terser0.4 → 1.0, Electron 38 → 41, transitive svgo/yaml bumps; README Node min 14 → 20Result:
npm auditreports 0 vulnerabilities (down from 24). Build, launch, andnpm run dist(DMG + ZIP) all pass.Notable non-upgrades
svelte-preprocess5 in Svelte 4's toolchain. Deferred — safe to try again now that Svelte 5 is in place, but out of scope here.!app.isPackaged, the zero-dep equivalent.Files of note
tailwind.config.jsdeleted — Tailwind 4 is CSS-first. Theme now lives insrc/global.cssandsrc/app.cssvia@theme.main.jslost itselectron-is-devrequire.buildconfig changes inpackage.json.Test plan
npm installcleannpm run buildsucceedsnpm run electronlaunches the appnpx svelte-checkhas 0 errorsnpm auditreports 0 vulnerabilitiesnpm run distproduces a working.dmgand.zip(arm64 mac)🤖 Generated with Claude Code