Skip to content

Upgrade dependencies and Node 24; harden billing, Featherless, and pipeline behavior#1301

Open
rppavan wants to merge 5 commits intoagnaistic:devfrom
rppavan:dev
Open

Upgrade dependencies and Node 24; harden billing, Featherless, and pipeline behavior#1301
rppavan wants to merge 5 commits intoagnaistic:devfrom
rppavan:dev

Conversation

@rppavan
Copy link

@rppavan rppavan commented Mar 21, 2026

This PR updates the project to current package versions, moves the app to Node 24, and fixes several runtime and developer-experience issues uncovered during the upgrade work.

Changelog:

-### Changed

  • Upgraded a broad set of project dependencies to current compatible versions.
  • Updated the project runtime to Node.js 24.
  • Removed unused Vite configuration and dependencies, keeping Parcel as the active frontend bundler.
  • Added rimraf as a regular development dependency so cleanup commands no longer prompt for installation.
  • Ran pnpm run format:fix to normalize formatting across the codebase.

Fixed

  • Treated missing Stripe configuration as "billing disabled" instead of crashing the API at startup.
  • Deferred Stripe client initialization until billing is actually needed and returned graceful responses when billing is unavailable.
  • Fixed the pipeline proxy route for newer router and path-to-regexp behavior by removing the invalid /* catch-all usage.
  • Corrected pipeline proxy forwarding so the requested subpath is preserved upstream.
  • Hardened Featherless model-list fetching by validating status codes and response content before JSON parsing.
  • Added explicit request headers for Featherless API calls so requests work reliably behind Cloudflare.
  • Improved Featherless warning logs to include useful upstream status and body details instead of generic JSON parse failures.
  • Fixed TypeScript errors exposed by the dependency upgrades, including query param normalization, test imports, and Shepherd typings.

Verified

  • npm run deps
  • npm run build:all
  • pnpm run typecheck

@sceuick
Copy link
Member

sceuick commented Mar 22, 2026

Hi there, thanks for the PR.
I've read through this PR and have some comments:

  • The formatting changes create too much noise in this PR and distract from the actual changes behind made. I'm assuming it's due to prettier being updated. I'd be fine with this in other circumstances, but it's too distracting here.
  • Updating the project to Node 24 will cause issues with auth due to a breaking change in node:crypto which are only observed at run-time, so the current version needs to stay until I personally verify the upgrade.
  • The changes to encryptUserText uses crypto.scriptSync function which is very bad practice, especially in a hot path like this.
  • The changes in encryptUserText need to be tested for backwards compatibility - I'm assuming this was change at all due to upgrading to Node 24.
  • Mass upgrading dependencies like this is probably going to cause unexpected bugs and behaviour changes. This is simply far too risky for me and I'd never do it in a high-traffic production project like this. I don't have the time at the moment to accept this kind of risk in production even if I had the risk appetite for it (see my Discord announcements for why if needed)
  • I'm generally confused by the addition of + refactoring to use firstString in so many places + the creation of functions to retrieve values in components (e.g. const callback = () => firstString(query.callback)). I can see the argument why it could be necessary, but I don't agree that it is necessary. I'm assuming it's due to dependency upgrades.

There are some changes here that I'm interested in, but it's hard to pay attention to them because of the amount of change in this PR

  • The idea behind the Stripe 'billing disabled' changes are fine, but should be accomplished far more minimally.
  • The pipeline changes: the pipeline stuff can probably actually be deleted.
  • The encryption changes are interesting if that's the pathway to upgrading Node to 24, but I'd prefer to remove them and do it in a separate, isolated PR.
  • AFAIK the Featherless model fetching is working, but does cause an unnecessary warning log when it reaches the end of the models. What Cloudflare issues are you referring to?

It's certainly good to know what it would look like to update all of the dependencies and I appreciate that effort. Thank you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants