chore: tooling migration and dependency updates by marsidev · Pull Request #123 · marsidev/react-turnstile

marsidev · 2026-03-20T21:28:20Z

Summary

Replaces ESLint/Prettier with Oxlint/Oxfmt for 50-100x faster linting/formatting, migrates to TypeScript v7 (Go), consolidates DX with unified check/fix scripts, updates all dependencies to fix security vulnerabilities, and migrates library build from tsup to tsdown.

Changes

🚀 Tooling Migration

Replaced ESLint + Prettier → Oxlint + Oxfmt
- Oxlint v1.57.0 (linter)
- Oxfmt v0.42.0 (formatter)
- 50-100x faster performance
Configs: Migrated to TypeScript configs
- .eslintrc.json → oxlint.config.ts
- .prettierrc.mjs → oxfmt.config.ts
Removed: packages/eslint-config-custom package entirely
Removed: lint-staged dependency (no longer needed)

⚡ TypeScript v7 (Go Implementation)

Added @typescript/native-preview (TS v7 dev preview)
Added oxlint-tsgolint for type-aware linting
Enabled options.typeAware: true in Oxlint config
Renamed all type-check scripts to typecheck for consistency

🔒 Security Fixes

jsdom: 28.0.0 → 29.0.1 (fixes undici vulnerabilities - 3 high, 3 moderate)
next: 16.1.6 → 16.2.1 (fixes 4 security advisories)
All vulnerabilities resolved - pnpm audit now shows 0 issues

📦 Dependency Updates
Updated 17+ packages across the monorepo:

@antfu/ni: 28.2.0 → 30.0.0
@playwright/test & playwright: 1.58.1 → 1.58.2
@types/react: 19.2.10 → 19.2.14
@types/node: 25.2.0 → 25.5.0
pnpm: 10.28.2 → 10.33.0
@typescript/native-preview: dev.20260320.1 → dev.20260325.1
vitest: 4.0.18 → 4.1.1
bumpp: 10.4.0 → 11.0.1
lucide-react: 0.563.0 → 1.6.0 (breaking: brand icons removed)
jotai: 2.17.0 → 2.19.0
tailwindcss: 4.1.18 → 4.2.2
autoprefixer: 10.4.24 → 10.4.27
postcss: 8.5.6 → 8.5.8

📚 Library Build Migration (tsup → tsdown)

Replaced tsup with tsdown (Rolldown-based library bundler)
Performance: Build time reduced from ~1.1s to ~458ms (2.3x faster)
Features gained:
- Built-in gzip size reporting
- Smarter defaults (treeshaking enabled)
- Future-proof (official Rolldown project)
Config: Added tsdown.config.ts with ESM output
Removed: tsup.config.ts and tsup dependency

📝 Script Improvements

pnpm check   # NEW: runs lint:check + format:check + typecheck
pnpm fix     # NEW: runs lint + format (auto-fix everything)

🔧 CI Optimization

Merged 3 jobs → 1 job: lint + format + type-check now run as single check job
Reduces redundant builds and job startup overhead
Total CI jobs: 5 → 3 (40% reduction)

🎯 DX Enhancements

Created CONTRIBUTING.md with full development guide
Updated VS Code settings with unwanted recommendations for old extensions
Updated pre-commit hook: pnpm check (validates all files)

Performance Impact

Tool	Before	After	Improvement
Linting	~5-10s	79ms	~100x faster
Formatting	~8-10s	278ms	~30x faster
Type checking	tsc	tsgo	Native Go
Library build	~1.1s	458ms	~2.3x faster

Files Changed

.github/workflows/ci.yml - Optimized CI workflow
package.json - New scripts, updated deps
oxlint.config.ts - New linter config
oxfmt.config.ts - New formatter config
CONTRIBUTING.md - New contributor guide
.vscode/extensions.json - Updated recommendations
packages/lib/package.json - Updated scripts & dependencies
packages/lib/tsdown.config.ts - NEW: tsdown configuration
packages/lib/tsup.config.ts - REMOVED: tsup configuration
demos/nextjs/package.json - Updated scripts & dependencies
demos/nextjs/src/components/header.tsx - Fixed lucide-react breaking change
pnpm-lock.yaml - Updated lockfile

Breaking Changes

Library: None - No runtime changes, no API changes.

Demo App: lucide-react v1.6.0 removed brand icons (including GithubIcon). Replaced with inline SVG in header component.

Testing

pnpm check passes
pnpm fix works correctly
Library builds successfully (pnpm lib:build)
All tests pass (pnpm test)
CI workflow validated
Pre-commit hooks tested
pnpm audit shows 0 vulnerabilities
tsdown build verified (faster, gzip reporting)

Migration for Contributors

Existing contributors need to:

Install the Oxc VS Code extension
Run pnpm install to get new dependencies
Use pnpm check instead of individual commands

Add structured AI agent skills to help coding assistants use react-turnstile correctly: - 5 comprehensive skills: basic-setup, widget-customization, nextjs-ssr, multiple-widgets, token-lifecycle - Domain map with 8 failure modes extracted from GitHub issues and maintainer interviews - CI workflows for skill validation and stale checking - Version bumping now includes skill files via bumpp config

codesandbox · 2026-03-20T21:28:23Z

Review or Edit in CodeSandbox

Open the branch in Web Editor • VS Code • Insiders

Open Preview

docs-page · 2026-03-20T21:28:25Z

To view this pull requests documentation preview, visit the following URL:

docs.page/marsidev/react-turnstile~123

Documentation is deployed and generated using docs.page.

vercel · 2026-03-20T21:28:25Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
react-turnstile	Ready	Preview, Comment	Mar 28, 2026 3:20am

- Add pnpm check (runs lint:check + format:check + typecheck) - Add pnpm fix (runs lint + format) - Rename type-check scripts to typecheck for consistency - Update CI to use single check job instead of 3 separate jobs - Remove lint-staged (no longer needed with fast oxlint/oxfmt) - Update pre-commit hook to run full pnpm check - Add unwantedRecommendations to VS Code config

Security fixes: - jsdom: 28.0.0 → 29.0.1 (fixes undici vulnerabilities) - next: 16.1.6 → 16.2.1 (fixes Next.js security advisories) Package updates: - @antfu/ni: 28.2.0 → 30.0.0 - @playwright/test: 1.58.1 → 1.58.2 - playwright: 1.58.1 → 1.58.2 - @types/react: 19.2.10 → 19.2.14 - @types/node: 25.2.0 → 25.5.0 - oxlint: 1.56.0 → 1.57.0 - oxfmt: 0.41.0 → 0.42.0 - oxlint-tsgolint: 0.17.1 → 0.17.4 - pnpm: 10.28.2 → 10.33.0 - @typescript/native-preview: dev.20260320.1 → dev.20260325.1 - vitest: 4.0.18 → 4.1.1 - bumpp: 10.4.0 → 11.0.1 - lucide-react: 0.563.0 → 1.6.0 - jotai: 2.17.0 → 2.19.0 - tailwindcss/postcss: 4.1.18 → 4.2.2 - autoprefixer: 10.4.24 → 10.4.27 - postcss: 8.5.6 → 8.5.8 Breaking changes handled: - Replaced lucide-react GithubIcon with inline SVG

Replaced tsup with tsdown for faster builds: - Build time: ~1.1s → ~458ms (2.3x faster) - Uses Rolldown (Rust-based bundler) - Built-in gzip size reporting - Maintains same output format (.js/.d.ts) Changes: - Removed tsup dependency and config - Added tsdown dependency and config - Updated build scripts - Preserved backward compatible output

Changes: - CONTRIBUTING.md: Changed 'tsup' to 'tsdown' in dev server description - Root package.json: Removed obsolete tsup>rollup override - packages/lib/package.json: Added typescript devDependency The typescript package is required by tsdown/rolldown-plugin-dts for generating .d.ts declaration files.

see: https://pnpm.io/supply-chain-security

Changes: - Remove duplicate JSX/JS code examples - Keep only TypeScript examples with proper types - Apply consistent formatting (double quotes, semicolons) - Remove unnecessary <CodeGroup> wrappers - Update 12 documentation files

marsidev added 2 commits March 19, 2026 23:44

docs: update readme

f6be832

chore: update lockfile

969bf7b

vercel bot deployed to Preview March 20, 2026 21:33 View deployment

marsidev added 7 commits March 20, 2026 19:07

chore: add oxc tolling, remove eslint and prettier, add tsgo(preview)

02368af

refactor: remove markdown lint

713a140

refactor: format code

e868c8a

refactor: lint code

27d3cec

chore(scripts): standardize lint and format commands

16ec3a1

chore: add CONTRIBUTING.md

f365b9b

vercel bot deployed to Preview March 21, 2026 02:46 View deployment

marsidev added 2 commits March 25, 2026 13:54

vercel bot had a problem deploying to Preview March 25, 2026 18:35 Failure

chore: update lockfile

59032b1

vercel bot deployed to Preview March 25, 2026 18:41 View deployment

vercel bot deployed to Preview March 25, 2026 19:12 View deployment

marsidev marked this pull request as ready for review March 25, 2026 19:19

marsidev added 2 commits March 26, 2026 12:35

chore: add supply chain security settings

4bcdfbd

see: https://pnpm.io/supply-chain-security

chore: upgrade ts

5c09937

vercel bot had a problem deploying to Preview March 26, 2026 16:41 Failure

Merge branch 'main' into feat/docs

657f243

vercel bot had a problem deploying to Preview March 28, 2026 00:02 Failure

chore(demo): resolve TypeScript 7 moduleResolution deprecation error

5fb7fcf

vercel bot deployed to Preview March 28, 2026 00:09 View deployment

docs: simplify code examples to TypeScript only

9fb6d8b

Changes: - Remove duplicate JSX/JS code examples - Keep only TypeScript examples with proper types - Apply consistent formatting (double quotes, semicolons) - Remove unnecessary <CodeGroup> wrappers - Update 12 documentation files

vercel bot deployed to Preview March 28, 2026 03:20 View deployment

marsidev changed the title ~~Docs, skills and more~~ chore: tooling migration and dependency updates Mar 28, 2026

marsidev merged commit f623195 into main Mar 28, 2026
6 checks passed

marsidev deleted the feat/docs branch March 28, 2026 03:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: tooling migration and dependency updates#123

chore: tooling migration and dependency updates#123
marsidev merged 19 commits intomainfrom
feat/docs

marsidev commented Mar 20, 2026 •

edited

Loading

Uh oh!

codesandbox bot commented Mar 20, 2026

Uh oh!

docs-page bot commented Mar 20, 2026

Uh oh!

vercel bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

marsidev commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Performance Impact

Files Changed

Breaking Changes

Testing

Migration for Contributors

Uh oh!

codesandbox bot commented Mar 20, 2026

Review or Edit in CodeSandbox

Uh oh!

docs-page bot commented Mar 20, 2026

Uh oh!

vercel bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

marsidev commented Mar 20, 2026 •

edited

Loading

vercel bot commented Mar 20, 2026 •

edited

Loading