fix(journal): drop the retired @simplewebauthn/types package #15

Merged

ullrich merged 1 commit from fix/simplewebauthn-types-deprecation into main 2026-07-26 17:41:49 +00:00

Conversation 0 Commits 1 Files changed 3 +1 -11

ullrich commented 2026-07-26 14:22:14 +00:00

Owner

Copy link

Flagged by Renovate's dependency dashboard (#12) as deprecated with no automatic replacement available, so it needed doing by hand.

The migration

SimpleWebAuthn retired the standalone types package in v13.0.0. The release notes say to "refactor existing imports from /types [and] simply import them from /browser or /server instead".

There was exactly one usage, and it is server-side, so apps/journal/app/lib/auth.server.ts now takes RegistrationResponseJSON, AuthenticationResponseJSON and AuthenticatorTransportFuture from @simplewebauthn/server. That package owns those types now and no longer depends on @simplewebauthn/types at all, so the dependency is removed outright rather than replaced.

A latent mismatch this also clears

The versions had already drifted a major: browser and server were on 13.x while the types package sat at 12.0.0. So the types being compiled against were a major behind the runtime implementing them.

Harmless in this specific case — I diffed all three definitions between 12.0.0 and 13.3.2 before touching anything and they are byte-identical — but it is precisely the mismatch that the @types/* major-ignore rule in the dependency config exists to prevent ("a mismatched type package breaks typecheck without buying anything"), and it would not have stayed harmless indefinitely.

Verification

• pnpm --filter @trails-cool/journal typecheck — clean (this is the meaningful check: if @simplewebauthn/server did not re-export these, it would fail here)
• pnpm --filter @trails-cool/journal lint — clean
• pnpm --filter @trails-cool/journal test — 367 passed, 79 skipped
• no remaining references to @simplewebauthn/types anywhere in the repo or lockfile

Flagged by Renovate's dependency dashboard (#12) as deprecated with **no automatic replacement available**, so it needed doing by hand. ## The migration SimpleWebAuthn retired the standalone types package in [v13.0.0](https://github.com/MasterKale/SimpleWebAuthn/releases/tag/v13.0.0). The release notes say to *"refactor existing imports from /types [and] simply import them from /browser or /server instead"*. There was exactly one usage, and it is server-side, so `apps/journal/app/lib/auth.server.ts` now takes `RegistrationResponseJSON`, `AuthenticationResponseJSON` and `AuthenticatorTransportFuture` from `@simplewebauthn/server`. That package owns those types now and no longer depends on `@simplewebauthn/types` at all, so the dependency is removed outright rather than replaced. ## A latent mismatch this also clears The versions had already drifted a **major**: `browser` and `server` were on 13.x while the types package sat at `12.0.0`. So the types being compiled against were a major behind the runtime implementing them. Harmless in this specific case — I diffed all three definitions between 12.0.0 and 13.3.2 before touching anything and they are byte-identical — but it is precisely the mismatch that the `@types/*` major-ignore rule in the dependency config exists to prevent ("a mismatched type package breaks typecheck without buying anything"), and it would not have stayed harmless indefinitely. ## Verification - `pnpm --filter @trails-cool/journal typecheck` — clean (this is the meaningful check: if `@simplewebauthn/server` did not re-export these, it would fail here) - `pnpm --filter @trails-cool/journal lint` — clean - `pnpm --filter @trails-cool/journal test` — **367 passed**, 79 skipped - no remaining references to `@simplewebauthn/types` anywhere in the repo or lockfile

ullrich added 1 commit 2026-07-26 14:22:14 +00:00

fix(journal): drop the retired @simplewebauthn/types package ... c36f2fd491

SimpleWebAuthn retired the standalone types package in v13.0.0; the release
notes say to "refactor existing imports from /types [and] simply import them
from /browser or /server instead". The only usage here is server-side, so
auth.server.ts now takes RegistrationResponseJSON, AuthenticationResponseJSON
and AuthenticatorTransportFuture from @simplewebauthn/server, which owns them
and no longer depends on the types package at all.

Worth noting the versions had already drifted a major: browser and server were
on 13.x while the types package sat at 12.0.0, so the types being compiled
against were a major behind the runtime. Harmless in this instance — the three
definitions are byte-identical between 12.0.0 and 13.3.2, which I checked before
touching anything — but it is exactly the mismatch the \`@types/*\` major-ignore
rule in the dependency config exists to prevent, and it would not have stayed
harmless.

Surfaced by Renovate's dependency dashboard, which flagged the package as
deprecated with no automatic replacement available.

Verified: journal typecheck, lint, and 367 unit tests pass.

ullrich merged commit 9263e79fec into main 2026-07-26 17:41:49 +00:00

ullrich deleted branch fix/simplewebauthn-types-deprecation 2026-07-26 17:41:50 +00:00

ullrich referenced this pull request from a commit 2026-07-26 17:41:51 +00:00

Merge pull request 'fix(journal): drop the retired @simplewebauthn/types package' (#15) from fix/simplewebauthn-types-deprecation into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

dependencies

Dependency updates raised by Renovate (renovate.json5 labels)

  

major

Major version bump — always needs human review, never auto-merged

  

security-pin

Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels

dependencies

major

security-pin

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

trails-cool/trails!15

No description provided.