📦 deps(nx): upgrade Nx to 22.6.0, deduplicate workspace deps, and restore Docker hardening

.github/workflows/docker.yml

@@ -73,7 +73,7 @@ jobs:
   build-scan-push:
     runs-on: ${{ vars.ACTION_RUNNER_TAG || 'self-hosted' }}
     timeout-minutes: 30
-    # Build+scan on all branches; push steps have their own ref guards
+    # Build+scan+push only on main and release branches
     if: |
       github.ref == 'refs/heads/main' ||
       startsWith(github.ref, 'refs/tags/release/')

.gitignore

@@ -42,3 +42,6 @@ apps/mcp-server/key.pem
 
 # Git worktrees
 .worktrees/
+
+.claude/worktrees
+.claude/settings.local.json

apps/api/jest.config.ts

@@ -1,14 +1,14 @@
-// eslint-disable-next-line @nx/enforce-module-boundaries
-import { compilerOptions } from '../../tsconfig.base.effective.json';
-// eslint-disable-next-line @nx/enforce-module-boundaries
-import {
+ 
+const { compilerOptions } = require('../../tsconfig.base.effective.json');
+ 
+const {
   pathsToModuleNameMapper,
   swcTransformWithDecorators,
   standardTransformIgnorePatterns,
   standardModuleFileExtensions,
-} from '../../jest-utils';
+} = require('../../jest-utils.ts');
 
-export default {
+module.exports = {
   displayName: 'api',
   preset: '../../jest.preset.ts',
   testEnvironment: 'node',

apps/cli-e2e-tests/jest.config.ts

@@ -1,10 +1,10 @@
-// eslint-disable-next-line @nx/enforce-module-boundaries
-import {
+ 
+const {
   swcTransformWithDefineFields,
   standardModuleFileExtensions,
-} from '../../jest-utils';
+} = require('../../jest-utils.ts');
 
-export default {
+module.exports = {
   displayName: 'cli-e2e-tests',
   preset: '../../jest.preset.js',
   testEnvironment: 'node',

apps/cli/jest.config.ts

@@ -1,10 +1,10 @@
-// eslint-disable-next-line @nx/enforce-module-boundaries
-import {
+ 
+const {
   swcTransformWithDefineFields,
   standardModuleFileExtensions,
-} from '../../jest-utils';
+} = require('../../jest-utils.ts');
 
-export default {
+module.exports = {
   displayName: 'packmind-cli',
   preset: '../../jest.preset.js',
   testEnvironment: 'node',

apps/cli/package.json

@@ -36,7 +36,6 @@
   },
   "dependencies": {
     "@types/inquirer": "^9.0.9",
-    "diff": "^8.0.3",
     "inquirer": "^13.0.2",
     "zod": "^4.3.5",
     "semver": "^6.3.1"

apps/frontend/jest.config.ts

@@ -1,10 +1,10 @@
-import { pathsToModuleNameMapper } from 'ts-jest';
+const { pathsToModuleNameMapper } = require('ts-jest');
 
 // Use require instead of import to avoid TypeScript compilation issues
-// eslint-disable-next-line @typescript-eslint/no-require-imports
+ 
 const { compilerOptions } = require('../../tsconfig.base.effective.json');
 
-export default {
+module.exports = {
   preset: '../../jest.preset.ts',
   displayName: 'frontend',
   rootDir: '.',

apps/frontend/package.json

@@ -3,14 +3,8 @@
   "version": "0.0.0",
   "private": true,
   "dependencies": {
-    "@react-router/dev": "^7.12.0",
-    "@react-router/fs-routes": "^7.12.0",
-    "@react-router/node": "^7.12.0",
-    "@react-router/serve": "^7.12.0",
     "@types/nprogress": "0.2.3",
     "nprogress": "0.2.0",
-    "react-router": "^7.12.0",
-    "react-router-dom": "^7.12.0",
-    "validator": "^13.15.15"
+    "react-router-dom": "^7.12.0"
   }
 }

apps/mcp-server/jest.config.ts

@@ -1,14 +1,14 @@
-// eslint-disable-next-line @typescript-eslint/no-require-imports
+ 
 const { compilerOptions } = require('../../tsconfig.base.effective.json');
-// eslint-disable-next-line @nx/enforce-module-boundaries
-import {
+ 
+const {
   pathsToModuleNameMapper,
   swcTransformWithDecorators,
   standardTransformIgnorePatterns,
   standardModuleFileExtensions,
-} from '../../jest-utils';
+} = require('../../jest-utils.ts');
 
-export default {
+module.exports = {
   displayName: 'mcp-server',
   preset: '../../jest.preset.ts',
   testEnvironment: 'node',

dockerfile/Dockerfile.api

@@ -10,7 +10,8 @@ RUN apk update && \
     apk add --no-cache \
         openssl=3.5.5-r0 \
         bash=5.3.3-r1 \
-        ca-certificates=20251003-r0
+        ca-certificates=20251003-r0 && \
+    rm -rf /sbin/apk /etc/apk /lib/apk /usr/share/apk /var/cache/apk
 
 # Use the existing node user from the base image
 USER node

dockerfile/Dockerfile.mcp

@@ -7,7 +7,8 @@ RUN apk update && \
     apk add --no-cache \
         openssl=3.5.5-r0 \
         bash=5.3.3-r1 \
-        ca-certificates=20251003-r0
+        ca-certificates=20251003-r0 && \
+    rm -rf /sbin/apk /etc/apk /lib/apk /usr/share/apk /var/cache/apk
 
 # Use the existing node user from the base image
 USER node

eslint.config.mjs

@@ -97,4 +97,10 @@ export default [
     // Override or add rules here
     rules: {},
   },
+  {
+    files: ['**/jest.config.ts'],
+    rules: {
+      '@typescript-eslint/no-require-imports': 'off',
+    },
+  },
 ];

nx.json

@@ -41,7 +41,6 @@
       "plugin": "@nx/vite/plugin",
       "options": {
         "buildTargetName": "build",
-        "testTargetName": "test",
         "serveTargetName": "serve",
         "devTargetName": "dev",
         "previewTargetName": "preview",
@@ -71,6 +70,12 @@
         "testStorybookTargetName": "test-storybook",
         "staticStorybookTargetName": "static-storybook"
       }
+    },
+    {
+      "plugin": "@nx/vitest",
+      "options": {
+        "testTargetName": "test"
+      }
     }
   ],
   "generators": {