build(deps): update dependencies and fix security advisories

.changeset/update-dependencies.md

@@ -0,0 +1,9 @@
+---
+"@labdigital/graphql-codegen-bruno": minor
+"@labdigital/graphql-codegen-k6": minor
+"@labdigital/graphql-codegen-typedefs": minor
+---
+
+Update dependencies to resolve security advisories: `@graphql-codegen/plugin-helpers` 7, `@graphql-codegen/visitor-plugin-common` 7 and `@graphql-tools/utils` 12. The `graphql` peer dependency now accepts both v16 and v17.
+
+The packages now only publish `dist`, declare `types` in their `exports` map and are marked side-effect free.

.github/workflows/release.yml

@@ -1,5 +1,10 @@
 name: Release
-on: [push]
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
 
 env:
   CI: true
@@ -13,58 +18,45 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - name: Set up Node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          node-version: 22
+          persist-credentials: false
 
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-        name: Install pnpm
-        id: pnpm-install
-        with:
-          run_install: true
+      - name: Set up Node.js
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
 
-      - name: Check
+      - name: Check formatting, linting and typing
         run: pnpm check
 
   build:
-    name: Build, and test on Node ${{ matrix.node }} and ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
+    name: Build, and test on Node ${{ matrix.node }}
+    runs-on: ubuntu-latest
     needs: validate
     strategy:
       matrix:
         node: ["22.x", "24.x", "26.x"]
-        os: [ubuntu-latest]
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-        name: Install pnpm
-        id: pnpm-install
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          run_install: true
+          persist-credentials: false
 
-      - name: Use Node ${{ matrix.node }}
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - name: Set up Node.js
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
           node-version: ${{ matrix.node }}
-          cache: "pnpm"
 
       - name: Build
         run: pnpm build
 
       - name: Test
         run: pnpm test:ci
 
-
   release:
     timeout-minutes: 15
     runs-on: ubuntu-latest
-    if: github.ref == 'refs/heads/main'
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     needs: build
     environment: release
     permissions:
@@ -73,29 +65,22 @@ jobs:
       pull-requests: write # create/update the release PR
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
-        name: Install pnpm
-        id: pnpm-install
-        with:
-          run_install: true
-
       # No dependency cache in the release job (cache poisoning)
-      - name: Install node.js
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - name: Set up Node.js
+        uses: labd/gh-actions-typescript/pnpm-install@ada4548df9a365c62c8b396b583953c6d4bc113f # v1.1.0
         with:
-          node-version: 22
+          cache: "false"
 
       - name: Upgrade npm for trusted publishing
         run: npm i -g npm@^11.6.4
 
       - name: Create and publish versions
         uses: changesets/action@ae32849d5ba541f9ae29e40e22a623bc13562f51 # v2.1.2
         with:
-          # changesets/action v2 renamed every one of these inputs.
           pr-title: "Release new version"
           commit-message: "update version"
           publish-script: pnpm publish:ci

.vscode/settings.json

@@ -4,9 +4,7 @@
 	"editor.defaultFormatter": "biomejs.biome",
 	"editor.formatOnSave": true,
 	"editor.codeActionsOnSave": {
-		"quickfix.biome": "explicit",
-		"source.organizeImports": "never",
-		"source.organizeImports.biome": "explicit"
+		"source.fixAll.biome": "explicit"
 	},
 	"files.watcherExclude": {
 		"**/.git/objects/**": true,

biome.json

@@ -1,12 +1,13 @@
 {
-	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json",
+	"$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
 	"vcs": {
 		"enabled": true,
 		"clientKind": "git",
-		"defaultBranch": "main"
+		"defaultBranch": "main",
+		"useIgnoreFile": true
 	},
 	"files": {
-		"ignore": ["**/dist/*"]
+		"includes": ["**", "!**/dist/**/*"]
 	},
 	"json": {
 		"parser": {
@@ -20,7 +21,7 @@
 	"linter": {
 		"enabled": true,
 		"rules": {
-			"recommended": true,
+			"preset": "recommended",
 			"complexity": {
 				"noUselessTernary": "error",
 				"useDateNow": "error",
@@ -32,9 +33,14 @@
 				"noUnusedVariables": "off"
 			},
 			"suspicious": {
-				"noConsoleLog": "error",
 				"noEvolvingTypes": "error",
-				"useErrorMessage": "error"
+				"useErrorMessage": "error",
+				"noConsole": {
+					"level": "error",
+					"options": {
+						"allow": ["assert", "debug", "error", "info", "trace", "warn"]
+					}
+				}
 			},
 			"style": {
 				"noParameterAssign": "off",
@@ -48,9 +54,7 @@
 					}
 				},
 				"useTemplate": "off",
-				"useThrowOnlyError": "error"
-			},
-			"nursery": {
+				"useThrowOnlyError": "error",
 				"noNestedTernary": "warn"
 			}
 		}

package.json

@@ -8,27 +8,27 @@
 	"engines": {
 		"node": ">=22"
 	},
-	"main": "index.js",
 	"scripts": {
 		"build": "pnpm turbo build",
-		"deps:fix": "syncpack fix-mismatches && pnpm dedupe && pnpm install",
-		"format": "biome format --fix",
-		"changeset-version": "changeset version && pnpm format",
-		"check": "biome check",
+		"check": "biome ci && pnpm typecheck",
+		"deps:fix": "syncpack fix --dependency-types prod,dev && pnpm dedupe && pnpm install",
+		"format": "biome check --write",
+		"lint": "biome check",
 		"publish:ci": "pnpm build && pnpm changeset publish",
 		"publish:version": "pnpm changeset version && pnpm format",
 		"test": "vitest run",
-		"test:ci": "vitest run --coverage --passWithNoTests"
+		"test:ci": "vitest run --coverage --passWithNoTests",
+		"typecheck": "pnpm turbo typecheck"
 	},
-	"workspaces": ["packages/*"],
 	"packageManager": "pnpm@12.12.0",
 	"private": true,
 	"devDependencies": {
-		"@biomejs/biome": "^1.9.4",
-		"@changesets/cli": "^2.27.10",
-		"@vitest/coverage-v8": "3.2.7",
-		"syncpack": "^13.0.0",
-		"turbo": "^2.2.3",
-		"vitest": "3.2.7"
+		"@biomejs/biome": "^2.5.15",
+		"@changesets/cli": "^3.0.3",
+		"@vitest/coverage-v8": "5.0.3",
+		"publint": "^0.3.25",
+		"syncpack": "^15.3.3",
+		"turbo": "^2.11.7",
+		"vitest": "5.0.3"
 	}
 }

packages/bruno/README.md

@@ -1,4 +1,7 @@
 ## GraphQL Codegen Bruno Plugin
+
+[![npm](https://img.shields.io/npm/v/@labdigital/graphql-codegen-bruno)](https://www.npmjs.com/package/@labdigital/graphql-codegen-bruno)
+
 This plugin generates a directory with
 [Bruno](https://github.com/usebruno/bruno) files with all GraphQL queries in
 your codebase

packages/bruno/package.json

@@ -16,36 +16,40 @@
 		"directory": "packages/bruno"
 	},
 	"exports": {
-		".": "./dist/index.js"
-	},
+		".": {
+			"types": "./dist/index.d.ts",
+			"default": "./dist/index.js"
+		},
+		"./package.json": "./package.json"
+	},
+	"sideEffects": false,
+	"files": [
+		"dist"
+	],
 	"scripts": {
 		"build": "tsdown",
-		"lint": "biome ci && tsc --noEmit",
 		"clean": "rm -rf dist",
 		"publish:ci": "pnpm build && pnpm changeset publish",
 		"test": "vitest run",
-		"test:ci": "vitest run --coverage"
+		"test:ci": "vitest run --coverage",
+		"typecheck": "tsc --noEmit"
 	},
 	"dependencies": {
-		"@graphql-codegen/plugin-helpers": "^5.0.4"
+		"@graphql-codegen/plugin-helpers": "^7.4.2"
 	},
 	"devDependencies": {
-		"@graphql-tools/graphql-file-loader": "^8.0.4",
-		"@graphql-tools/load": "^8.0.5",
-		"@types/node": "^22.20.5",
-		"@vitest/coverage-v8": "3.2.7",
-		"prettier": "^3.3.3",
+		"@graphql-tools/graphql-file-loader": "^8.1.22",
+		"@graphql-tools/load": "^8.1.19",
+		"@types/node": "^26.6.5",
+		"@vitest/coverage-v8": "5.0.3",
+		"graphql": "^17.0.2",
+		"prettier": "^3.9.10",
+		"publint": "^0.3.25",
 		"tsdown": "^0.23.1",
-		"typescript": "^5.7.2",
-		"vite-tsconfig-paths": "^5.1.3",
-		"vitest": "3.2.7"
+		"typescript": "^7.0.2",
+		"vitest": "5.0.3"
 	},
 	"peerDependencies": {
-		"graphql": "16.x"
-	},
-	"pnpm": {
-		"overrides": {
-			"graphql": "^16.9.0"
-		}
+		"graphql": "^16.0.0 || ^17.0.0"
 	}
 }

packages/bruno/src/__mocks__/schema.graphqls

@@ -1,6 +1,6 @@
 type Query {
-  customer(info: CustomerInfo!): Customer
-  product(id: ID!): Product
+	customer(info: CustomerInfo!): Customer
+	product(id: ID!): Product
 }
 
 input CustomerInfo {
@@ -19,23 +19,22 @@ input Credentials {
 }
 
 type Customer {
-  id: ID!
-  firstName: String!
-  email: String!
-  addresses: [Address!]!
+	id: ID!
+	firstName: String!
+	email: String!
+	addresses: [Address!]!
 }
 
 type Product {
-  id: ID!
-  name: String!
-  price: Float!
+	id: ID!
+	name: String!
+	price: Float!
 }
 
 type Address {
-  id: ID!
-  email: String
-  firstName: String
-  lastName: String
-  city: String
+	id: ID!
+	email: String
+	firstName: String
+	lastName: String
+	city: String
 }
-

packages/bruno/src/index.test.ts

@@ -1,6 +1,5 @@
 import * as fs from "node:fs";
 import path from "node:path";
-import { afterEach } from "node:test";
 import type { Types } from "@graphql-codegen/plugin-helpers";
 import { GraphQLFileLoader } from "@graphql-tools/graphql-file-loader";
 import { loadDocumentsSync, loadSchemaSync } from "@graphql-tools/load";
@@ -13,10 +12,6 @@ const snapshotDir = path.join(__dirname, "__snapshots__");
 const mockSchemaPath = path.join(__dirname, "__mocks__", "schema.graphqls");
 const mockDocumentsPath = path.join(__dirname, "__mocks__", "query.graphql");
 
-afterEach(() => {
-	fs.rmSync(mockOutputDir, { recursive: true });
-});
-
 describe("Bruno Plugin", () => {
 	it("should generate the expected output", async () => {
 		// Load the mock schema
@@ -30,7 +25,7 @@ describe("Bruno Plugin", () => {
 		}) as Types.DocumentFile[];
 
 		// Clear the output directory before running the test
-		fs.rmSync(mockOutputDir, { recursive: true });
+		fs.rmSync(mockOutputDir, { recursive: true, force: true });
 
 		// Run the plugin
 		const outputFile = path.join(mockOutputDir, "output.json");

packages/bruno/src/index.ts

@@ -2,7 +2,7 @@ import nodeFs from "node:fs";
 import path from "node:path";
 import type { PluginFunction, Types } from "@graphql-codegen/plugin-helpers";
 import type { GraphQLSchema } from "graphql";
-import { type BrunoPluginConfig, asBruno } from "./bruno";
+import { asBruno, type BrunoPluginConfig } from "./bruno";
 import { extractOperations } from "./operations";
 
 export const plugin: PluginFunction<BrunoPluginConfig> = async (