Upgrade toolchain: pnpm 11, TypeScript 7 (native, TS6 side-by-side), Biome 2, + security

[xinaesthete]

Upgrades the build toolchain and clears the actionable security alerts. All work is on the shared workspace catalog / configs; no shipped-library source changes.

What changed

pnpm 10.33 → 11.12

• packageManager / engines / volta pins.
• pnpm 11 hard-fails on undeclared build scripts, so the four previously-ignored builds (@biomejs/biome, @vaadin/vaadin-usage-statistics, core-js, core-js-pure) are declared false in pnpm-workspace.yaml allowBuilds — preserves prior behavior (no new postinstall scripts run).

TypeScript 5.7 → 7.0 (the native port), with TS 6 side-by-side

TS 7 is the native (Go) compiler and ships no classic JS API, which breaks vite-plugin-dts and @typescript-eslint. Handled per the TS 7 announcement's side-by-side guidance:

• vite-plugin-dts removed everywhere (shared base config + layers + zarrextra); every package now emits .d.ts via tsc --emitDeclarationOnly, matching core's existing pattern. This also drops the slow vite:dts step (~65% of build time) and the @microsoft/api-extractor/rollup subtree.
• Side-by-side: catalog typescript resolves to @typescript/typescript6 (the TS 6 API) so typescript-eslint/lint:react work; @typescript/native → typescript@7 provides the build-script tsc (native). Builds run on TS 7; eslint runs on TS 6.
• tsconfig migrations: dropped deprecated baseUrl (TS 7 error TS5101); cross-package types now resolve via node_modules → built dist/*.d.ts (rootDir-safe emit); zarrextra uses types: ["node"] (its worker path is delegated to @fideus-labs/fizarrita, so no DOM/WebWorker lib — keeps the package Node-safe by construction).

Security

• vite ^8.0.8 → ^8.0.16 (resolves 8.1.4): clears the high-severity server.fs.deny bypass alert.
• pnpm-workspace.yaml overrides force patched versions of vulnerable deps pinned deep in the Docusaurus docs-site build stack (dev-only, not shipped), range-scoped so other majors are untouched: shell-quote 1.8.3→1.10.0 (critical), ws@7→7.5.11, fast-uri→3.1.3, node-forge→1.4.0, svgo@3→3.3.4, minimatch@3→3.1.5, path-to-regexp@0.1→0.1.13, preact→10.29.7, lodash→4.18.1, @babel/plugin-transform-modules-systemjs→7.29.7, rollup→≥4.59.0.
• caniuse-lite → ^1.0.30001805 (silences the stale-browserslist warning; update-browserslist-db doesn't persist under pnpm).

Biome 1.9.4 → 2.5.3

Version bump + biome migrate to the 2.x config schema. The stricter 2.x recommended preset surfaces a lint/format backlog on existing code — deferred to a separate pass (biome is not a CI gate here).

Verification

• Shipped build green (all 6 packages, TS 7 native tsc)
• 397 tests pass
• Docs webpack build succeeds (overrides don't break it; no stale-browserslist warning)
• lint:react runs on the TS 6 API
• pnpm install --frozen-lockfile clean (CI parity)

Notes for reviewers

• Editor: with the side-by-side setup, node_modules/typescript resolves to the TS 6 compat package (no tsserver), so the TS 7 editor experience needs the dedicated "TypeScript native-preview" extension rather than "Use Workspace Version".
• Cross-package DX: tsconfig paths to sibling src were dropped in favor of node_modules→dist resolution (matches core), so deps must be built to get fresh types — project references would be the longer-term fix.
• Out of scope: Biome lint/format cleanup (tracked separately), remaining Docusaurus-internal mediums/lows (dev-only), and the 126 python/ fixture-tooling Dependabot alerts.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Build & Tooling

  • Updated the TypeScript and Biome toolchains.
  • Builds now generate TypeScript declaration files directly in package output folders.
  • Improved workspace dependency controls and package build restrictions.
  • Updated the minimum supported pnpm version to 11.

• Maintenance

  • Removed the previous declaration-generation plugin integration.
  • Refined TypeScript project boundaries and import organization settings.
  • Added safeguards for selected transitive dependencies.

[coderabbitai]

Warning

Review limit reached

@xinaesthete, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 33 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b2683456-8109-40ef-ac15-ccdab7fb432b

📥 Commits

Reviewing files that changed from the base of the PR and between cc88b82 and d05dce2.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• .github/workflows/docs.yml
• .github/workflows/release.yml
• .github/workflows/test.yml
• package.json
• pnpm-workspace.yaml

📝 Walkthrough

Walkthrough

The workspace updates Biome and pnpm tooling, removes vite-plugin-dts, and moves declaration generation into package-level TypeScript build commands that emit .d.ts files to dist.

Changes

Declaration Build Migration

Layer / File(s)	Summary
Workspace tooling foundation biome.json, package.json, pnpm-workspace.yaml	Biome and pnpm versions/configuration are updated, TypeScript catalog entries are revised, build permissions are restricted, and dependency overrides are added.
Vite declaration wiring removal vite.config.base.ts, packages/layers/vite.config.ts, packages/zarrextra/vite.config.ts	Vite-based vite-plugin-dts configuration is removed from shared and package-specific configurations.
Package declaration emission packages/*/package.json, packages/*/tsconfig.json	Package builds now emit declarations to dist; compiler inputs and path mappings are narrowed, and @typescript/native replaces vite-plugin-dts in package tooling. zarrextra adds Node typings and excludes codec-worker entries.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• Taylor-CCB-Group/SpatialData.js#42: Modifies TypeScript/Vite workspace resolution and package path mappings.
• Taylor-CCB-Group/SpatialData.js#73: Modifies shared vite.config.base.ts plugin configuration.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main toolchain upgrades and security-related dependency updates in the PR.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/typescript-pnpm-upgrade-e6edf6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

packages/react/tsconfig.json (1)

21-21: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Consider adding an exclude field for consistency with layers and vis.

This tsconfig has no exclude entry, while packages/layers/tsconfig.json and packages/vis/tsconfig.json both specify "exclude": ["dist", "node_modules"]. Since include is already ["src"], the omission is functionally safe, but adding it keeps the package configs uniform.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@packages/react/tsconfig.json` at line 21, Add an "exclude" entry to the
packages/react tsconfig configuration matching the layers and vis package
configs: exclude "dist" and "node_modules" while preserving the existing
"include": ["src"] setting.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pnpm-workspace.yaml`:
- Around line 15-27: Update the unbounded overrides in the overrides section so
each targets only the vulnerable package major by adding an appropriate lower
bound matching its patched major, including shell-quote, fast-uri,
`@babel/plugin-transform-modules-systemjs`, lodash, minimatch, node-forge, and
rollup. Preserve the existing bounded ranges for ws, preact, and svgo, and leave
path-to-regexp and caniuse-lite unchanged.

---

Nitpick comments:
In `@packages/react/tsconfig.json`:
- Line 21: Add an "exclude" entry to the packages/react tsconfig configuration
matching the layers and vis package configs: exclude "dist" and "node_modules"
while preserving the existing "include": ["src"] setting.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 0fef9ef9-10c2-4460-aa8d-97f46cb54ac2

📥 Commits

Reviewing files that changed from the base of the PR and between b2d9358 and cc88b82.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (18)

• biome.json
• package.json
• packages/avivatorish/package.json
• packages/avivatorish/tsconfig.json
• packages/core/package.json
• packages/core/tsconfig.json
• packages/layers/package.json
• packages/layers/tsconfig.json
• packages/layers/vite.config.ts
• packages/react/package.json
• packages/react/tsconfig.json
• packages/vis/package.json
• packages/vis/tsconfig.json
• packages/zarrextra/package.json
• packages/zarrextra/tsconfig.json
• packages/zarrextra/vite.config.ts
• pnpm-workspace.yaml
• vite.config.base.ts

💤 Files with no reviewable changes (1)

• packages/core/tsconfig.json