Upgrade ng-packagr, vitest, and eslint where each was actually causing a problem

[vannt-dev]

Four dependency upgrades, each picked because something concrete was wrong rather than because a number was behind. Only one changes what any package publishes.

ng-packagr 17 → 19

The angular package built against Angular 19 with a tool that declared it wanted Angular 17:

peer @angular/compiler-cli: ^17.0.0     installed: 19.2.25
peer typescript:            >=5.2 <5.5  installed: 5.6.3

Both violated, which is why installing in packages/angular needed --legacy-peer-deps. It worked — the bundle carries ɵɵngDeclareComponent ... version: "19.2.25" — on a combination ng-packagr never claimed to support. 19.2.2 matches exactly, plain npm install succeeds, and 36 transitive packages go away for 4.

This is the one commit that changes a published artifact. The part consumers load is untouched — fesm2022, index.d.ts and public-api.d.ts are byte-identical — but ng-packagr stopped emitting the per-file esm2022/ output in 18, along with its esm2022/esm export conditions. The . export keeps types and default, which is what Angular 19+ libraries ship, and default points at the same file those conditions already resolved to.

	Before	After
Unpacked	317.1 KB	165.9 KB (−48%)
Tarball	75.8 KB	33.7 KB (−56%)
Files	33	19

In-range updates

npm update only — no package.json touched, nothing moved outside a range already declared. @angular/* 19.2.20→19.2.25, @analogjs/* 1.16→1.22, react/react-dom 19.2.4→19.2.8, vue 3.5.32→3.5.41, plus @vue/test-utils, lint-staged, @commitlint/, @types/.

Two rows in the lockfile diff look like majors and are not. rimraf 3.0.2→6.1.3 at the hoist root is core and angular's already-declared ^6.1.3 finally resolving there; the 3.0.2 was a transitive from flat-cache, which keeps its own nested copy. vite 6.4.3 at the root is a transitive of the newer @analogjs — the vite packages/react declares stays at 5.4.21 under its own node_modules, and vitest keeps its nested 5.4.21.

core onto the workspace's vitest

core was pinned to vitest 0.34 while everything else ran 1.6, and that single split caused both workarounds the repo carried: 0.34 has no --typecheck flag, so test:types needed the 0.34-only vitest typecheck --run subcommand; and the hoisted @vitest/coverage-v8@1.6.1 is incompatible with 0.34, so core alone used @vitest/coverage-istanbul. Both are gone — core now resolves the hoisted 1.6.1 with no nested copy.

Two config shapes changed with it, and both were proven live rather than assumed, because a silently-ignored gate is worse than no gate:

• test:types → vitest --run --typecheck.only, same scope as before. Appending const broken: number = 'nope' to types.test-d.ts exits 1 with TypeCheckError.
• The coverage floor moves from 0.34's flat keys to 1.x's thresholds wrapper. This is the dangerous half — 1.x silently ignores the flat keys, so the floor would have vanished without a word. Raising statements to 99 exits 1 with ERROR: Coverage for statements (95.12%) does not meet global threshold (99%).

v8 and istanbul count differently, so core's reported numbers move to 95.12 statements / 88.69 branches / 100 functions against the unchanged 85/75/85/85 floor.

eslint 8 → 9, flat config

eslint 8.57.1 is end of life; npm ci printed "This version is no longer supported" on every install. eslint 9 reads neither .eslintrc.cjs nor .eslintignore, so both become eslint.config.mjs, translated rule for rule with .eslintignore's reasoning carried into the ignores comment.

Three dependency decisions worth flagging:

• eslint-plugin-prettier is removed, not upgraded. v5 requires prettier >=3, which would have pulled the whole prettier 2→3 reformat into this PR. It is redundant regardless: format-check is already its own CI gate and lint-staged runs prettier --write before eslint, so linting formatting was a slower second copy of an existing check. eslint-config-prettier stays to keep turning off rules that fight the formatter.
• Stayed on eslint 9, not 10, because eslint-plugin-import 2.32 declares peers only up to ^9. This branch opens by removing a peer violation; adding one at the end would be incoherent.
• eslint-config-airbnb-base and eslint-plugin-node are dropped — neither appeared in the old config's extends or plugins. Installed, never used.

The upgrade surfaced six real things: typescript-eslint 8 flags unused catch bindings (three in scripts/build-changed.js, now optional catch bindings), and eslint 9 reports unused disable directives (three stale ones, including a no-empty-interface disable for a rule v8 renamed, guarding an interface that is not empty).

A clean lint run is also what a flat config with a wrong files glob produces, so the rules were checked against probe files rather than trusted. On a .ts file: curly, eqeqeq, semi, max-len, prefer-const and no-unused-vars all fire. On a second probe: import/order and import/no-unresolved fire. example/, smoke/ and *.d.ts remain ignored.

Release scope

Only @dynamic-field-kit/angular gets a changeset. core, react and vue changed only tooling that never ships — devDependencies, vitest.config.js, and two stale eslint-disable comments — and their built dist is byte-identical to develop, verified by building both revisions and diffing. They get an empty changeset rather than version bumps that would publish identical tarballs.

Verification

Every commit was verified after a clean npx npm@10 ci: build, lint, format-check, typecheck, core type tests, all four package suites (plain and --coverage), the published-package smoke suite, test:scripts, npm audit --omit=dev, the three verify scripts, and all three example app builds.

The lockfile was regenerated with npm@10 throughout, never the locally installed npm 11 which prunes other platforms' optional binaries. Linux entries went 100 → 115 — an increase from new transitive platform packages, not the pruning that bug causes.