Major dependency migrations: next 16, vitest 4, happy-dom 20, wrangler 4, better-sqlite3 12

[travisbreaks]

Tracking the four major-version dep bumps that dependabot opened on 2026-05-20 and we closed without merging. Closing the PRs keeps the open-PR list clean for visitors while preserving the work as a known follow-up here.

Each one needs its own review pass before re-attempting. CI green is necessary but not sufficient: some of these pass tests because the test suite doesn't exercise the breakage surface.

Pending migrations

next 15.5.18 → 16.2.6 (#40, closed)

• Scope: apps/playground only.
• CI status: red on 2026-05-20.
• Migration notes: Next 16 dropped Webpack-mode defaults and changed how the router caches segment data. Playground is a static export so most breakage points don't apply, but the build script needs to be re-validated.
• Path forward: re-open per dependabot, fix the build error, validate that pnpm --filter playground build still produces the static export the demo widget can serve.

vitest 2.1.9 → 4.1.7 (#41, closed)

• Scope: every package's test runner.
• CI status: red on 2026-05-20.
• Migration notes: Vitest 3 + 4 collapsed several config options, changed the inline-snapshot serializer, and tightened the vi.mocked typing. 207 tests across 5 workspaces depend on this. Migration is substantive.
• Path forward: dedicated branch, follow Vitest 3 + 4 migration guides, expect serializer fallout on snapshot tests, expect typing fallout on adapter mocks.

happy-dom 15.11.7 → 20.9.0 (#43, closed)

• Scope: widget tests (DOM-shadowing simulation).
• CI status: green on 2026-05-20.
• Why deferred anyway: jumped five major versions in one bump. The current test surface doesn't exercise the parts of happy-dom that changed between 15 and 20 (shadow root traversal semantics, custom element upgrade order, MutationObserver microtask timing). Merging would be safe today but a future test that hits one of those areas would break unpredictably.
• Path forward: review the happy-dom changelog between 15 and 20 against packages/widget/src/widget.test.ts + environment.test.ts for any tests that depend on shadow-DOM behavior; add explicit regression tests before merging.

wrangler 3.114.17 → 4.93.0 (#44, closed)

• Scope: apps/worker deploy + local dev tooling.
• CI status: green on 2026-05-20.
• Why deferred: CI does not deploy to Cloudflare. CI passing only validates that wrangler 4 installs and the wrangler types step (if it ran) doesn't error. Actual wrangler deploy behavior + wrangler.toml schema changes between v3 and v4 are unverified.
• Path forward: review wrangler 4 migration guide, audit apps/worker/wrangler.toml against v4 schema requirements, run wrangler deploy --dry-run locally before merging.

Cadence

Dependabot is configured for Mondays 09:00 CT. These PRs will re-open weekly. When ready to migrate, address them on a dedicated branch + close this tracking issue.

Reference: 2026-05-20 GitHub audit pass.

`better-sqlite3` 11.10.0 -> 12.10.0 (#42, closed 2026-05-20 after re-check)

• Scope: `packages/adapter-cloudflare` tests (D1 simulation).
• CI status: green on the original base, red on Node 20 after rebasing against the actions v6/v7 baseline (PRs chore(ci): Bump pnpm/action-setup from 4 to 6 #27 / chore(ci): Bump actions/setup-node from 4 to 6 #28 / chore(ci): Bump actions/checkout from 4 to 6 #29 / chore(ci): Bump actions/upload-artifact from 4 to 7 #30).
• Why deferred: the v12 prebuilt native binary appears to have a Node 20 regression that didn't surface on the older actions versions. Node 22 still passes.
• Path forward: either drop Node 20 from the CI matrix (engines.node already says >=20, but if v12 cleanly supports only 22+ we can pin) OR wait for a v12.x patch that restores Node 20 prebuilts.