build(deps): React 19, Vite 8, Vitest 4, and the GitHub Actions majors

Closes the dependabot backlog in one sweep rather than 17 sequential
rebase-and-merge cycles: every one of those PRs touches package.json or
package-lock.json, so each merge conflicts the next and the queue can only
drain one CI round at a time.

── GitHub Actions (7 PRs) ────────────────────────────────────────────────────

checkout 4→7, setup-go 5→7, setup-node 4→7, setup-python 5→7, deploy-pages 4→5,
upload-pages-artifact 3→5, action-gh-release 2→3. Mechanical; the v4/v5 majors
were also emitting Node 20 deprecation warnings on every run.

── Web (7 of 10 PRs) ─────────────────────────────────────────────────────────

react + react-dom 18.3.1→19.2.8, @types/react 19, @dnd-kit/sortable 8→10
(with core →6.3.0 for its peer), vite 5→8, @vitejs/plugin-react 4→6,
vitest + @vitest/coverage-v8 2→4, globals 15→17, eslint-plugin-react-hooks 5→7,
typescript-eslint →8.68.0.

Three things had to change for these to work:

  • React 19 types. `useRef<T>(null)` now yields `RefObject<T | null>` rather
    than `RefObject<T>` — the honest type, since a ref genuinely is null until
    its element mounts. Fixed at the three declaration sites (useStickToBottom's
    return, Modal's initialFocusRef, HITLPopup's firstActionRef) rather than
    cast away at the ~10 use sites.

  • Vite 8 builds on rolldown, which accepts `manualChunks` only as a callback
    and fails the build outright on the object form. Same three vendor chunks
    (react / dnd / icons), matched on module id.

  • `__dirname` in the vite and vitest configs, which Vite 8's native config
    loader warns about. Now `import.meta.dirname`.

── The new React Compiler lint rules are OFF, deliberately ──────────────────

eslint-plugin-react-hooks v7 enables a family of rules derived from the React
Compiler. They flag 42 EXISTING patterns across Studio — not regressions, just
constructs the compiler cannot prove safe to memoize, setState-inside-an-effect
being most of them.

They are off rather than warnings because a warning nobody can act on 42 times
is noise that trains people to ignore the whole report. Adopting them is a real
refactor of state flow across the app and deserves its own review, not a
silent rewrite of every effect riding along in a version bump.

rules-of-hooks and exhaustive-deps — the two that caught real shipped bugs —
stay errors. The gate is not weakened by one rule: eslint still reports
0 errors and the same 50 pre-existing warnings it did before.

── Three PRs are NOT adoptable, and the blocker is upstream ─────────────────

  typescript 5.9.3 → 7.0.2 (#17)
    typescript-eslint caps TypeScript at <6.1.0 — including its own 8.68.1
    alphas. Taking TS 7 means deleting TypeScript linting from the project.

  eslint 9.39.5 → 10.8.1 (#19) and @eslint/js → 10.0.1 (#11)
    eslint-plugin-jsx-a11y's newest release (6.10.2) peers eslint ^3..^9 only.
    No ESLint 10 support has shipped.

Forcing either with --legacy-peer-deps produces a tree whose linting is
silently broken, which is worse than staying on the current major. They stay
open until the ecosystem catches up.

Verified: tsc clean, eslint 0 errors, 79/79 vitest, vite build green, Go build
+ lint at the zero baseline + full suite clean, and Studio exercised in a
browser under React 19 — SSE connected, all chunks and API calls 200, the
composition preview and phase rail rendering correctly.

Author: piotrlaczkowski

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Check for stale/broken repo slug references
         run: ./scripts/check-repo-refs.sh
@@ -34,16 +34,16 @@ jobs:
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -89,10 +89,10 @@ jobs:
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
@@ -109,10 +109,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -137,23 +137,23 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
           cache-dependency-path: web/package-lock.json
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
 

.github/workflows/docs.yml

@@ -34,10 +34,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v7
         with:
           python-version: "3.12"
           cache: pip
@@ -56,7 +56,7 @@ jobs:
 
       - name: Upload Pages artifact
         if: github.event_name != 'pull_request'
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@v5
         with:
           path: site
 
@@ -71,4 +71,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5

.github/workflows/govulncheck.yml

@@ -22,10 +22,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true

.github/workflows/release.yml

@@ -23,18 +23,18 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@v7
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v7
         with:
           node-version: "20"
           cache: npm
@@ -227,7 +227,7 @@ jobs:
           PY
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           tag_name: ${{ steps.ver.outputs.tag }}
           name: SLMCode ${{ steps.ver.outputs.tag }}

web/eslint.config.js

@@ -38,6 +38,29 @@ export default tseslint.config(
       'react-hooks/rules-of-hooks': 'error',
       'react-hooks/exhaustive-deps': 'error',
 
+      // ── React Compiler rules, deliberately off for now ──
+      //
+      // eslint-plugin-react-hooks v7 turns on a new family of rules derived
+      // from the React Compiler. They flag 42 EXISTING patterns across Studio —
+      // not regressions, not new defects, just constructs the compiler cannot
+      // prove safe to memoize (setState inside an effect being by far the most
+      // common).
+      //
+      // They are off rather than downgraded to warnings because a warning
+      // nobody can act on 42 times is noise that trains people to ignore the
+      // whole report. Adopting them is a real refactor of state flow across the
+      // app, and it is its own piece of work — doing it inside a dependency
+      // bump would put an unreviewed rewrite of every effect in the same commit
+      // as a version number.
+      //
+      // The two rules above — the ones that caught real shipped bugs — stay
+      // errors, so this upgrade does not weaken the gate by one rule.
+      'react-hooks/set-state-in-effect': 'off',
+      'react-hooks/refs': 'off',
+      'react-hooks/purity': 'off',
+      'react-hooks/immutability': 'off',
+      'react-hooks/preserve-manual-memoization': 'off',
+
       // A bare `catch {}` (or `catch (e) {}` with an empty body) is how 37 API
       // failures became invisible. Empty blocks must carry a comment saying
       // why swallowing is correct.