Update dependencies (Payload 3.80, Next.js 16.2, Lexical 0.42)

[holtschn]

Summary

• Update PayloadCMS from 3.70 to 3.80
• Update Lexical from 0.35 to 0.42
• Update Next.js from 16.1.1 to 16.2.1
• Update React from 19.2.3 to 19.2.4
• Update nodemailer from 7 to 8 (major version bump)
• Update @vercel/analytics from 1 to 2 and @vercel/speed-insights from 1 to 2
• Update various dev dependencies (Tailwind 4.2, Jest 30.3, ESLint 9.39, etc.)
• Move ajv to overrides (transitive dependency resolution, not used directly)
• Remove glob override (broke test-exclude/coverage collection in CI)

Test plan

• Verify npm run build succeeds
• Verify npm run dev starts correctly
• Verify npm test passes all tests
• Smoke test NDB pages (scores list, score detail, setlists)
• Verify Payload admin panel loads at /admin
• Send a test email (nodemailer v8 has breaking API changes)
• Check browser console for analytics/speed-insights errors on page load

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blechcontakt-web	Ready	Preview, Comment	Mar 31, 2026 9:33pm
rheinblech-web	Ready	Preview, Comment	Mar 31, 2026 9:33pm

[claude]

PR Review: Dependency Updates (Payload 3.80, Next.js 16.2, Lexical 0.42)

Good dependency hygiene PR. Only package.json and package-lock.json are changed, which is exactly what's expected. A few points worth reviewing before merging:

---

🔴 Breaking Changes (Major Version Bumps)

Three dependencies crossed a major version boundary — these warrant extra smoke-testing beyond the checklist:

nodemailer 7 → 8
The v8 release has breaking changes in its transport API and TypeScript types. Since this project uses Nodemailer for email (SMTP via NODEMAILER_* env vars), verify that email sending still works in dev or staging. The @types/nodemailer was also updated (7.0.4 → 7.0.11), so type errors at compile time would surface most regressions, but runtime behavior should be tested too.

@vercel/analytics 1 → 2 and @vercel/speed-insights 1 → 2
Both Vercel packages jumped a major version. The public API surface in Next.js projects is typically just <Analytics /> and <SpeedInsights /> component imports — if those still render without errors, these are likely fine. Still worth verifying there are no console errors on page load.

---

🟡 Notable Changes

ajv added as a direct production dependency
ajv is a JSON Schema validator that normally lives as a transitive dependency. Adding it explicitly to dependencies (not devDependencies) typically indicates a version conflict being forced. This is a valid pattern, but it's worth noting:

• It should probably be in overrides rather than dependencies if it's purely a version-conflict fix (similar to how @vercel/blob and glob were added to overrides)
• If it's actually used directly in application code, the placement is fine — but a quick grep -r "from 'ajv'" src/ would confirm

@vercel/blob and glob added to overrides
The old overrides (nodemailer ^7, esbuild >=0.27.2) were removed and replaced with @vercel/blob ^2.3.2 and glob ^13.0.6. The nodemailer override removal makes sense since it's now upgraded directly. The new overrides suggest transitive dependency conflicts in the new package versions — this is expected with major Payload/Next.js updates.

esbuild range changed from >=0.27.2 to ^0.27.4
Switching from a lower-bound floor (>=) to a caret range (^) is more restrictive. This shouldn't cause issues at 0.27.x, but it's a minor behavioral change worth being aware of.

Node.js minimum bumped in AWS SDK internals
The @aws-sdk/client-s3 now requires node >= 20.0.0 (was >= 18.0.0). If your deployment environment (Vercel, CI, local) uses Node 18, this could cause runtime issues. Verify node --version in your deployment target is ≥ 20.

---

🟢 Looks Good

• All Lexical packages consistently bumped from 0.35 → 0.42 (no mixed versions)
• All Payload packages consistently bumped from 3.70 → 3.80 (no mixed versions)
• eslint-config-next version matches next version (both 16.2.x) ✅
• jest and jest-environment-jsdom updated together ✅
• React patch (19.2.3 → 19.2.4) is minimal risk

---

Test Plan Suggestion

Beyond the checklist in the PR description, I'd add:

• Send a test email (verify nodemailer v8 API compatibility)
• Check browser console on /intern/ndb — no analytics/speed-insights errors
• Confirm Node.js version in CI/deployment is ≥ 20

---

Overall this is a straightforward dependency bump PR. The main thing to verify before merging is nodemailer v8 compatibility since that's the most likely source of a runtime regression.

[github-actions]

Test Coverage Report

Metric	Coverage
Statements	7.5%
Branches	6.24%
Functions	8.81%
Lines	7.34%

📊 [Full coverage report available in artifacts]

[github-actions]

Test Coverage Report

Metric	Coverage
Statements	7.5%
Branches	6.24%
Functions	8.81%
Lines	7.34%

📊 [Full coverage report available in artifacts]