pob 40.7.3 → 40.8.0

package/lib/generators/core/renovate/CoreRenovateGenerator.js

@@ -1,6 +1,8 @@
 import Generator from "yeoman-generator";
+import { hasExpoApp } from "../../../utils/expoApps.js";
 import inMonorepo from "../../../utils/inMonorepo.js";
 import { writeAndFormatJson } from "../../../utils/writeAndFormat.js";
+import { getRenovateExtends } from "./renovateExtends.js";
 
 export default class CoreRenovateGenerator extends Generator {
   constructor(args, opts) {
@@ -57,7 +59,7 @@ export default class CoreRenovateGenerator extends Generator {
     this.enableRenovate = this.enableRenovateConfig.enable;
   }
 
-  writing() {
+  async writing() {
     if (this.enableRenovate) {
       const pkg = this.fs.readJSON(this.destinationPath("package.json"), {});
       const renovateConfig = this.fs.readJSON(
@@ -68,18 +70,15 @@ export default class CoreRenovateGenerator extends Generator {
       if (this.options.app) {
         renovateConfig.$schema =
           "https://docs.renovatebot.com/renovate-schema.json";
-        renovateConfig.extends = [
-          "config:js-app",
-          "github>christophehurpeau/renovate-presets",
-        ];
-      } else {
-        renovateConfig.extends = [
-          "config:js-lib",
-          pkg.name === "pob-monorepo"
-            ? undefined
-            : "github>christophehurpeau/renovate-presets",
-        ].filter(Boolean);
       }
+      renovateConfig.extends = getRenovateExtends({
+        app: this.options.app,
+        pkgName: pkg.name,
+        withExpo: await hasExpoApp({
+          rootPath: this.destinationPath(),
+          pobConfig: this.config.getAll(),
+        }),
+      });
 
       return writeAndFormatJson(
         this.fs,

package/lib/generators/core/renovate/renovateExtends.js

@@ -0,0 +1,14 @@
+const presets = "github>christophehurpeau/renovate-presets";
+
+/**
+ * The expo preset comes last so that it overrides the rules of the default
+ * preset matching the same packages.
+ *
+ * @param {{ app: boolean, pkgName: string | undefined, withExpo: boolean }} options
+ */
+export const getRenovateExtends = ({ app, pkgName, withExpo }) =>
+  [
+    app ? "config:js-app" : "config:js-lib",
+    !app && pkgName === "pob-monorepo" ? undefined : presets,
+    withExpo ? `${presets}:expo` : undefined,
+  ].filter(Boolean);

package/lib/generators/core/renovate/renovateExtends.test.js

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { getRenovateExtends } from "./renovateExtends.js";
+
+const presets = "github>christophehurpeau/renovate-presets";
+
+describe("getRenovateExtends", () => {
+  it("extends the lib config and the presets for a library", () => {
+    expect(
+      getRenovateExtends({ app: false, pkgName: "lib", withExpo: false }),
+    ).toEqual(["config:js-lib", presets]);
+  });
+
+  it("extends the app config and the presets for an app", () => {
+    expect(
+      getRenovateExtends({ app: true, pkgName: "app", withExpo: false }),
+    ).toEqual(["config:js-app", presets]);
+  });
+
+  it("does not extend the presets for pob-monorepo", () => {
+    expect(
+      getRenovateExtends({
+        app: false,
+        pkgName: "pob-monorepo",
+        withExpo: false,
+      }),
+    ).toEqual(["config:js-lib"]);
+  });
+
+  it("extends the expo preset last with an expo app", () => {
+    expect(
+      getRenovateExtends({ app: true, pkgName: "mobile", withExpo: true }),
+    ).toEqual(["config:js-app", presets, `${presets}:expo`]);
+    expect(
+      getRenovateExtends({ app: false, pkgName: "alouette", withExpo: true }),
+    ).toEqual(["config:js-lib", presets, `${presets}:expo`]);
+  });
+});

package/lib/generators/monorepo/PobMonorepoGenerator.js

@@ -152,7 +152,8 @@ export default class PobMonorepoGenerator extends Generator {
     this.packageNames = this.packages.map((pkg) => pkg.name);
     this.packageConfigs = this.packageLocations.map((location) => {
       try {
-        return JSON.parse(fs.readFileSync(`${location}/.yo-rc.json`)).pob;
+        return JSON.parse(fs.readFileSync(`${location}/.yo-rc.json`, "utf8"))
+          .pob;
       } catch {
         console.warn(`warn: could not read pob config in ${location}`);
         return {};

package/lib/utils/appTsconfigTarget.js

@@ -1,6 +1,9 @@
-import fs from "node:fs";
 import path from "node:path";
-import { buildDependentsMaps, discoverWorkspaces } from "./workspaceUtils.js";
+import {
+  buildDependentsMaps,
+  discoverWorkspaces,
+  readPobConfig,
+} from "./workspaceUtils.js";
 
 export const appsWithBrowser = ["alp", "next.js", "vite", "vite-with-server"];
 
@@ -19,14 +22,6 @@ export const getAppTsconfigTarget = ({ appType, dom, withBun }) => {
   return undefined;
 };
 
-const readPobConfig = (location) => {
-  try {
-    return JSON.parse(fs.readFileSync(path.join(location, ".yo-rc.json"))).pob;
-  } catch {
-    return undefined;
-  }
-};
-
 /**
  * Target of the apps directly depending on the package, for packages compiled
  * by the bundler of these apps (untranspiled libraries). Expo wins as the

package/lib/utils/expoApps.js

@@ -0,0 +1,22 @@
+import path from "node:path";
+import { discoverWorkspaces, readPobConfig } from "./workspaceUtils.js";
+
+/** @param {Record<string, any> | undefined} pobConfig */
+export const isExpoApp = (pobConfig) =>
+  pobConfig?.project?.type === "app" && pobConfig.app?.type === "expo";
+
+/**
+ * Based on the pob config of the project and of its workspaces, like
+ * getAppTsconfigTarget, rather than on the package.json dependencies.
+ *
+ * @param {{ rootPath: string, pobConfig: Record<string, any> | undefined }} options
+ */
+export const hasExpoApp = async ({ rootPath, pobConfig }) => {
+  if (isExpoApp(pobConfig)) return true;
+  const workspaces = await discoverWorkspaces(rootPath);
+  return workspaces.some(
+    (workspace) =>
+      !workspace.isRoot &&
+      isExpoApp(readPobConfig(path.join(rootPath, workspace.location))),
+  );
+};

package/lib/utils/expoApps.test.js

@@ -0,0 +1,81 @@
+import * as fs from "node:fs/promises";
+import * as os from "node:os";
+import * as path from "node:path";
+import { describe, expect, it } from "vitest";
+import { hasExpoApp, isExpoApp } from "./expoApps.js";
+
+const app = (type) => ({ project: { type: "app" }, app: { type } });
+
+async function writeWorkspace(rootPath, location, pkg, pobConfig) {
+  const dir = path.join(rootPath, location);
+  await fs.mkdir(dir, { recursive: true });
+  await fs.writeFile(path.join(dir, "package.json"), JSON.stringify(pkg));
+  if (pobConfig) {
+    await fs.writeFile(
+      path.join(dir, ".yo-rc.json"),
+      JSON.stringify({ pob: pobConfig }),
+    );
+  }
+}
+
+/** Monorepo with a workspace for each [name, pobConfig] pair */
+async function prepareMonorepo(workspaces) {
+  const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), "pob-"));
+  await writeWorkspace(rootPath, ".", {
+    name: "root",
+    workspaces: ["packages/*"],
+  });
+  for (const [name, pobConfig] of workspaces) {
+    await writeWorkspace(rootPath, `packages/${name}`, { name }, pobConfig);
+  }
+  return rootPath;
+}
+
+const rootPobConfig = { project: { type: "lib" } };
+
+describe("isExpoApp", () => {
+  it("returns true for an expo app", () => {
+    expect(isExpoApp(app("expo"))).toBe(true);
+  });
+
+  it("returns false for other apps, libraries and missing configs", () => {
+    expect(isExpoApp(app("vite"))).toBe(false);
+    expect(isExpoApp({ project: { type: "lib" }, app: { type: "expo" } })).toBe(
+      false,
+    );
+    expect(isExpoApp(undefined)).toBe(false);
+  });
+});
+
+describe("hasExpoApp", () => {
+  it("returns true when the project is an expo app", async () => {
+    const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), "pob-"));
+    await writeWorkspace(rootPath, ".", { name: "mobile" });
+    expect(await hasExpoApp({ rootPath, pobConfig: app("expo") })).toBe(true);
+  });
+
+  it("returns false for a project without workspaces", async () => {
+    const rootPath = await fs.mkdtemp(path.join(os.tmpdir(), "pob-"));
+    await writeWorkspace(rootPath, ".", { name: "web" });
+    expect(await hasExpoApp({ rootPath, pobConfig: app("vite") })).toBe(false);
+  });
+
+  it("returns true when a workspace is an expo app", async () => {
+    const rootPath = await prepareMonorepo([
+      ["lib", rootPobConfig],
+      ["expo-demo-app", app("expo")],
+    ]);
+    expect(await hasExpoApp({ rootPath, pobConfig: rootPobConfig })).toBe(true);
+  });
+
+  it("returns false when no workspace is an expo app", async () => {
+    const rootPath = await prepareMonorepo([
+      ["lib", rootPobConfig],
+      ["web", app("vite")],
+      ["no-pob-config", undefined],
+    ]);
+    expect(await hasExpoApp({ rootPath, pobConfig: rootPobConfig })).toBe(
+      false,
+    );
+  });
+});

package/lib/utils/inMonorepo.js

@@ -12,11 +12,13 @@ const rootMonorepo =
 
 const rootMonorepoPkg =
   rootMonorepo &&
-  JSON.parse(fs.readFileSync(path.resolve(rootMonorepo, "package.json")));
+  JSON.parse(
+    fs.readFileSync(path.resolve(rootMonorepo, "package.json"), "utf8"),
+  );
 
 const getInMonorepoThings = () => {
   const rootYoConfig = JSON.parse(
-    fs.readFileSync(path.resolve(rootMonorepo, ".yo-rc.json")),
+    fs.readFileSync(path.resolve(rootMonorepo, ".yo-rc.json"), "utf8"),
   );
   const cwd = process.cwd();
 

package/lib/utils/minimumReleaseAgeExcludes.test.js

@@ -15,7 +15,9 @@ const readPublishedPackageNames = (directory) =>
     .filter((entry) => entry.isDirectory())
     .map((entry) => path.join(rootPath, directory, entry.name, "package.json"))
     .filter((packageJsonPath) => fs.existsSync(packageJsonPath))
-    .map((packageJsonPath) => JSON.parse(fs.readFileSync(packageJsonPath)))
+    .map((packageJsonPath) =>
+      JSON.parse(fs.readFileSync(packageJsonPath, "utf8")),
+    )
     .filter((pkg) => !pkg.private)
     .map((pkg) => pkg.name);
 

package/lib/utils/nodeEngines.js

@@ -3,12 +3,14 @@ import semver from "semver";
 import { latestLTS, maintenanceLTS } from "./nodeVersions.js";
 import * as packageUtils from "./package.js";
 
-// 22.18.0 is the version with strip typescript out of experimental status.
-// 22 skips node 23: features backported to 22 are experimental there.
+// Min versions are the October 2026 security releases (CVE-2026-105482,
+// CVE-2026-111497...), above 22.18.0 which has strip typescript stable.
+// 26.13.0 is the first 26 LTS, with the same code as security release 26.12.1.
+// Odd majors are skipped: features backported to 22 are experimental in 23.
 const enginesNodeForMajor = new Map([
-  ["22", "^22.18.0 || >=24.14.1"],
-  ["24", ">=24.14.1"],
-  ["26", ">=26.0.0"],
+  ["22", "^22.23.4 || ^24.22.1 || >=26.13.0"],
+  ["24", "^24.22.1 || >=26.13.0"],
+  ["26", ">=26.13.0"],
 ]);
 
 const minVersionForMajor = (major) => {

package/lib/utils/nodeEngines.test.js

@@ -6,12 +6,12 @@ import {
   updateTypesNodeFromEngines,
 } from "./nodeEngines.js";
 
-const NODE_22 = "^22.18.0 || >=24.14.1";
+const NODE_22 = "^22.23.4 || ^24.22.1 || >=26.13.0";
 
 describe("updateTypesNodeFromEngines", () => {
   it("keeps pinned devDependencies pinned when lower than engines min major", () => {
     const pkg = {
-      engines: { node: ">=24.14.1" },
+      engines: { node: "^24.22.1 || >=26.13.0" },
       devDependencies: { "@types/node": "22.5.0" },
     };
     updateTypesNodeFromEngines(pkg);
@@ -31,7 +31,7 @@ describe("updateTypesNodeFromEngines", () => {
 
   it("keeps devDependencies with the same major", () => {
     const pkg = {
-      engines: { node: ">=24.14.1" },
+      engines: { node: "^24.22.1 || >=26.13.0" },
       devDependencies: { "@types/node": "24.13.3" },
     };
     updateTypesNodeFromEngines(pkg);
@@ -49,7 +49,7 @@ describe("updateTypesNodeFromEngines", () => {
 
   it("updates a devDependencies range", () => {
     const pkg = {
-      engines: { node: ">=24.14.1" },
+      engines: { node: "^24.22.1 || >=26.13.0" },
       devDependencies: { "@types/node": ">=22.0.0" },
     };
     updateTypesNodeFromEngines(pkg);
@@ -66,7 +66,10 @@ describe("updateTypesNodeFromEngines", () => {
   });
 
   it("does not add @types/node", () => {
-    const pkg = { engines: { node: ">=24.14.1" }, devDependencies: {} };
+    const pkg = {
+      engines: { node: "^24.22.1 || >=26.13.0" },
+      devDependencies: {},
+    };
     updateTypesNodeFromEngines(pkg);
     expect(pkg.devDependencies["@types/node"]).toBeUndefined();
   });
@@ -88,7 +91,7 @@ describe("updateTypesNodeFromEngines", () => {
     "keeps unparseable version %s",
     (version) => {
       const pkg = {
-        engines: { node: ">=24.14.1" },
+        engines: { node: "^24.22.1 || >=26.13.0" },
         devDependencies: { "@types/node": version },
       };
       updateTypesNodeFromEngines(pkg);
@@ -101,8 +104,8 @@ describe("resolveEnginesNode", () => {
   it.each([
     ["18", NODE_22],
     ["22", NODE_22],
-    ["24", ">=24.14.1"],
-    ["26", ">=26.0.0"],
+    ["24", "^24.22.1 || >=26.13.0"],
+    ["26", ">=26.13.0"],
   ])("resolves min major %s from envs", (minMajor, expected) => {
     expect(resolveEnginesNode(">=22.18.0", minMajor, true)).toBe(expected);
   });
@@ -126,18 +129,22 @@ describe("resolveEnginesNode", () => {
   });
 
   it("lets envs lower engines.node", () => {
-    expect(resolveEnginesNode(">=24.14.1", "22", true)).toBe(NODE_22);
+    expect(resolveEnginesNode("^24.22.1 || >=26.13.0", "22", true)).toBe(
+      NODE_22,
+    );
   });
 
   it.each([true, false])(
     "keeps a higher min version of the same major (hasEnvs: %s)",
     (hasEnvs) => {
-      expect(resolveEnginesNode(">=24.15.3", "24", hasEnvs)).toBe(">=24.15.3");
+      expect(resolveEnginesNode(">=24.23.0", "24", hasEnvs)).toBe(">=24.23.0");
     },
   );
 
   it("raises a lower min version of the same major", () => {
-    expect(resolveEnginesNode(">=24.0.0", "24", true)).toBe(">=24.14.1");
+    expect(resolveEnginesNode(">=24.0.0", "24", true)).toBe(
+      "^24.22.1 || >=26.13.0",
+    );
   });
 });
 
@@ -148,7 +155,7 @@ describe("updateNodeEngines", () => {
       devDependencies: { "@types/node": "22.5.0" },
     };
     updateNodeEngines(pkg, {});
-    expect(pkg.engines.node).toBe(">=24.14.1");
+    expect(pkg.engines.node).toBe("^24.22.1 || >=26.13.0");
     expect(pkg.devDependencies["@types/node"]).toBe(
       pobDependencies["@types/node"],
     );
@@ -157,7 +164,7 @@ describe("updateNodeEngines", () => {
   it("supports babelEnvs", () => {
     const pkg = { pob: { babelEnvs: [{ target: "node", version: "24" }] } };
     updateNodeEngines(pkg, {});
-    expect(pkg.engines.node).toBe(">=24.14.1");
+    expect(pkg.engines.node).toBe("^24.22.1 || >=26.13.0");
   });
 
   it("uses the maintenance LTS without envs", () => {
@@ -169,7 +176,7 @@ describe("updateNodeEngines", () => {
   it("uses the latest LTS without envs when onlyLatestLTS", () => {
     const pkg = {};
     updateNodeEngines(pkg, { onlyLatestLTS: true });
-    expect(pkg.engines.node).toBe(">=24.14.1");
+    expect(pkg.engines.node).toBe("^24.22.1 || >=26.13.0");
   });
 
   it("removes @types/node when there is no node target", () => {
@@ -196,9 +203,9 @@ describe("updateNodeEngines", () => {
   it("keeps a higher engines.node when there is no node target", () => {
     const pkg = {
       pob: { envs: [{ target: "browser" }] },
-      engines: { node: ">=24.14.1" },
+      engines: { node: "^24.22.1 || >=26.13.0" },
     };
     updateNodeEngines(pkg, {});
-    expect(pkg.engines.node).toBe(">=24.14.1");
+    expect(pkg.engines.node).toBe("^24.22.1 || >=26.13.0");
   });
 });

package/lib/utils/package.js

@@ -86,6 +86,7 @@ const getVersionFromDependencyName = (dependency) => {
           // import.meta
           //   .resolve(`${dependency}/package.json`, import.meta.url)
         ),
+        "utf8",
       ),
     );
     return pkgJson.version;

package/lib/utils/packagejson.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
 
 export default JSON.parse(
-  fs.readFileSync(new URL("../../package.json", import.meta.url)),
+  fs.readFileSync(new URL("../../package.json", import.meta.url), "utf8"),
 );

package/lib/utils/workspaceUtils.js

@@ -3,6 +3,16 @@ import { glob } from "node:fs/promises";
 import path from "node:path";
 import { PackageDependencyDescriptorUtils } from "./packageDependencyDescriptorUtils.js";
 
+export const readPobConfig = (location) => {
+  try {
+    return JSON.parse(
+      fs.readFileSync(path.join(location, ".yo-rc.json"), "utf8"),
+    ).pob;
+  } catch {
+    return undefined;
+  }
+};
+
 export const getWorkspaceName = (workspace) => {
   if (workspace?.manifest?.raw?.name) return workspace.manifest.raw.name;
   return path.basename(workspace.location) || "unnamed-workspace";
@@ -20,7 +30,7 @@ export const discoverWorkspaces = async (rootPath) => {
   if (!fs.existsSync(rootPackageJSONPath)) {
     return [];
   }
-  const rootPkg = JSON.parse(fs.readFileSync(rootPackageJSONPath));
+  const rootPkg = JSON.parse(fs.readFileSync(rootPackageJSONPath, "utf8"));
 
   let workspaceGlobs = [];
   if (Array.isArray(rootPkg.workspaces)) {
@@ -48,7 +58,7 @@ export const discoverWorkspaces = async (rootPath) => {
       if (found.has(match)) continue;
       found.add(match);
       const filePath = path.join(rootPath, match);
-      const content = JSON.parse(fs.readFileSync(filePath));
+      const content = JSON.parse(fs.readFileSync(filePath, "utf8"));
       const dir = path.dirname(match);
       workspaces.push({
         name: content.name,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pob",
-  "version": "40.7.3",
+  "version": "40.8.0",
   "description": "Pile of bones, library generator with git/babel/typescript/typedoc/readme/vitest",
   "keywords": [
     "skeleton"
@@ -31,12 +31,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@pob/codemods": "0.18.2",
-    "@pob/eslint-config": "68.3.0",
-    "@pob/eslint-config-typescript-react": "68.4.0",
-    "@pob/sort-object": "11.3.0",
-    "@pob/sort-pkg": "13.3.0",
-    "@yeoman/adapter": "4.0.3",
+    "@pob/codemods": "0.18.3",
+    "@pob/eslint-config": "68.4.0",
+    "@pob/eslint-config-typescript-react": "68.5.0",
+    "@pob/sort-object": "11.3.1",
+    "@pob/sort-pkg": "13.3.1",
+    "@yeoman/adapter": "5.1.1",
     "eslint": "10.14.0",
     "findup-sync": "^5.0.0",
     "git-remote-url": "^1.0.1",
@@ -45,27 +45,27 @@
     "json5": "^2.2.3",
     "lodash.camelcase": "^4.3.0",
     "lodash.kebabcase": "^4.1.1",
-    "mem-fs": "4.1.5",
+    "mem-fs": "6.0.0",
     "mem-fs-editor": "12.1.0",
     "minimist": "1.2.8",
     "oxfmt": "0.75.0",
     "parse-author": "2.0.0",
-    "pob-dependencies": "28.6.0",
+    "pob-dependencies": "28.7.0",
     "semver": "7.8.5",
     "typescript": "npm:@typescript/typescript6@6.0.2",
     "validate-npm-package-name": "^8.0.0",
-    "yeoman-environment": "6.3.0",
+    "yeoman-environment": "8.5.1",
     "yeoman-generator": "10.3.0"
   },
   "devDependencies": {
-    "@pob/root": "28.6.1",
+    "@pob/root": "28.7.0",
     "@types/node": "24.19.1",
     "@typescript/native": "npm:typescript@7.0.2",
     "@yeoman/types": "1.13.1",
-    "tsrs": "0.18.0-ts7.1.0-dev.20260929"
+    "tsrs": "0.20.1-ts7.1.0-beta"
   },
   "engines": {
-    "node": ">=24.14.1"
+    "node": "^24.22.1 || >=26.13.0"
   },
   "pob": {
     "typescript": "check-only"