2026 Uplift #3093

Living tracking issue. It supersedes the infra parts of #2863 (2024 Roadmap). We'll keep editing this as we experiment, and record what changed in the Decision log at the bottom.

Status (2026-11-04): Phase 1 is done and on main. 37.4.0 and 37.4.1 shipped from the new OIDC pipeline (plus a hand-published legacy victory-native@37.3.7). Phase 2 is done on chore/2026-uplift-02: Turborepo has replaced wireit + nps (#3102), pnpm pack:check checks published output (#3103), the UMD bundles are gone (#3107), tsdown builds the victory-* packages into dist/ with exports maps (#3108), and Vitest has replaced Jest (dadb6af) with coverage reported in CI (#3109), and oxlint + oxfmt have replaced ESLint + Prettier (#3110, #3111, #3112). Unused root dependencies are gone (#3113), and root dev dependencies are current, with a pnpm dep:check routine (#3114). Website dependencies are current, Tailwind 4 included (#3116, #3119), and Vercel previews land on the docs (#3117). A headless browser probe of the docs and the ESM browser page drove a bugfix pass (#3120, #3123, #3124). victory-vendor's build tools are current and it stays on Babel 7 (#3127; a single-tool build is #3126, after the uplift). The CI rewrite is done: hardening (#3130) and an ESM bundle-size report (#3131), which also showed that { VictoryPie } now tree-shakes through the victory barrel. TypeScript is underway: #3077's namespace fix landed (#3132), the repo moved to bundler resolution on TS 6 (#3133), and types:check runs on TS 7 with published declarations type-checked in pack:check (#3134). cpx2 and rimraf are gone (#3136), and the docs site is on react-live 5 (#3137). The React peer range is now >=18, with a CI job on React 18.0.0 (#3138). Development and CI are on Node 26, and pnpm installs only versions at least 7 days old (#3139). Changelogs come from the official @changesets/changelog-github (#3140). The 38.0.0 canary checked out against 37.4.1. 38.0.0 is out (2026-11-03): the integration branch merged to main with a merge commit (#3141), then Version Packages #3143 published all 29 packages. Browser docs are at @38 (#3144). Phase 3 is underway: the stories are a workspace package with local story types (#3145) and have a Vite gallery, type-checked in CI (#3146); Every story has an SVG snapshot test in CI (#3147); next, fixing the stories that log errors and warnings and failing tests on console output, then removing Storybook and Chromatic. 38.x work lands as PRs straight to main (decision log, 2026-11-03). Phases 3–5 follow as 38.x releases.

Why

• Nothing has been released since 37.3.6 (Jan 2025). The release pipeline is stuck (Release pending: changesets would publish 37.4.0 for bug fixes (victory-candlestick changeset is "minor"); Version Packages PR #3047 is stale #3091, Version Packages #3047): every release.yml run since Dec 2025 fails at checkout because CHANGESETS_TOKEN no longer works, and the shared setup action's wireit GitHub Actions cache step fails too (the legacy cache API is gone).
• React 19 users hit broken typings and broken container events (Victory typing breaks on upgrade to React 19 #3076, Container component mouse events / tooltip stopped working after upgrading react 18 -> 19 #3048). Both were closed by the stale bot, not fixed.
• The build is hard to maintain:
  • wireit config is generated into each of 30 packages.
  • Each package builds four ways: Babel ESM, Babel CJS, a webpack UMD bundle, and tsc types.
  • Type errors don't fail the build (types:pkg:compile || types:warning).
  • No exports maps except in victory-vendor.
  • CI runs Node 18. The React peer range is >=16.6.0.
• The legacy victory-native (37.x, npm tag legacy) is still built here, though victory-native latest (43.x) is published from victory-native-xl.

By the numbers (Oct 2026)

• victory-vendor: about 215M downloads a month, about 99% via recharts, which depends on victory-vendor@^37.0.2 and uses d3-scale and d3-shape. It's our highest-stakes package.
• victory: about 1.7M a month. Each sub-package gets roughly the same downloads (within about 7%), so very few people install them on their own.
• React downloads by major (last week): 19 is 75%, 18 is 22%, and 16 and 17 together are under 3%.

Principles

1. Infra first, source last. Hold off on substantive edits to packages/*/src. Some tooling changes will inevitably touch source mechanically: the oxfmt reformat, oxlint autofixes and suppressions, and fixes for type errors from the TS upgrade and from making type errors fail the build. Each of those lands as its own PR, separate from the config change, with no behavior changes mixed in, and its commit goes into .git-blame-ignore-revs.
2. Keep tasks as plain package.json scripts. A task runner orchestrates and caches them; it doesn't own them.
3. Every phase is releasable. Small PRs, and main stays green.
4. Follow react-live's lead (Chore: full project upgrade (mostly infra, little code) react-live#418) where it fits a 29-package monorepo.

Branching and merge strategy

• Integration branch: chore/2026-uplift-02, cut from main after 37.4.1, pushed to origin. It replaces chore/2026-uplift (Phase 1), which is retired; see the decision log.
• All uplift work lands as small PRs into the integration branch, not main. Each PR gets a changeset if it changes what users of a published package get (code, types, exports, published files, dependencies/peerDependencies). Changes to only scripts or devDependencies don't need one. Squash-merging these PRs into the integration branch is fine.
• main keeps getting fixes. Merge main into the integration branch regularly (merge, not rebase, since it's shared) so the final merge stays small.
• CI: ci.yml runs on main and chore/2026-uplift* (push and pull_request). The release workflow publishes only from main, except a deliberate canary (see Phase 1).
• Final merge: one PR from the integration branch into main, merged with a merge commit, not a squash. That keeps per-PR history and keeps the SHAs in .git-blame-ignore-revs valid. The accumulated changesets then produce a Version Packages PR for 38.0.0.
  • The repo allows squash merges and the merge button can default to squash (that's how 2026 Uplift: phase 1 (CI, pnpm 12, OIDC release pipeline) #3098 ended up squashed). For the final merge, temporarily allow only merge commits.
  • "Automatically delete head branches" deletes the integration branch on merge. Keep it off, or protect chore/2026-uplift* with a ruleset.
  • Release gate before merging: the Road to 38.0.0 checklist below (Phase 2 plus the breaking items; decision log, 2026-11-01). Also required: main merged in, green CI, and a successful canary publish from the integration branch.
  • After 38.0.0 is published, update the browser docs examples: esm.sh victory@37 → @38; jsDelivr's pinned version, plus its React version and remap if jsDelivr baked in a different React. Check both with Test the "Using Victory in the browser" docs examples #3106 (or its prototypes, by hand).

Releases and in-flight work

• Interim 37.x releases, from the new pipeline (done 2026-10-26).
  • Canary 37.4.0-canary-20261026180958 from chore/2026-uplift: all 29 tarballs diffed against 37.3.6. Same file lists; victory-vendor unchanged (all 299 files, exports); only the expected changes (fix: handle empty labelStyle values #3043, FIX: Handle error bar empty theme object #3046, engines removal, version pins).
  • Phase 1 merged to main in 2026 Uplift: phase 1 (CI, pnpm 12, OIDC release pipeline) #3098 (squash by accident; the tree is identical to the integration branch).
  • 37.4.0 (Version Packages Version Packages #3047): all 29 packages via OIDC with provenance, one v37.4.0 tag and GitHub release.
  • 37.4.1 (victory-vendor: License notification improvements #3092 → Version Packages Version Packages #3099): victory-vendor licenses, shipped on its own so the change to our highest-stakes package is isolated. Diffed before merge: only LICENSE.txt (all packages) plus vendor's README and license field; exports and code unchanged.
• 38.0.0 (2026-11-03): final merge [uplift] 38.0.0: 2026 infra uplift (Phase 2 and breaking changes) #3141 → Version Packages Version Packages #3143 (see Road to 38.0.0, step 6).
• Infra work doesn't wait on open PRs. Unmerged work (Phase 0 and community PRs) comes in during or after the uplift, whichever is easier for each PR:
  • During: change the PR's base to chore/2026-uplift-02 on GitHub, so it runs against the new CI. Preferred once Phase 2's CI is up.
  • After: leave it targeting main, then merge main into the integration branch.
  • After the oxlint + oxfmt churn PR: run pnpm format:fix and the lint fix on the PR branch first, then merge. That clears most of the mechanical conflicts.

Road to 38.0.0

The integration branch already has breaking changes (UMD removal, dist/ + exports, ES2022 output, src/ no longer published), so its next release is a major. Ship it as soon as Phase 2 and the breaking items are done, instead of after every phase (decision log, 2026-11-01). Anything breaking that misses 38.0.0 waits for 39 or ships behind an opt-in.

1. Finish Phase 2: TS 7 (tsgo) for types:check ([uplift] chore: TypeScript 7 for types:check, check published declara… #3134), react-live v5 ([uplift] chore: website react-live 5 #3137), the last cruft (cpx2, rimraf) ([uplift] chore: replace cpx2 and rimraf with Node scripts #3136). tsdown's dts.generator: "tsgo" can follow in 38.x (needs TS 7.1 stable).
2. Breaking items from Phase 4:
   • React peer range >=16.6.0 → >=18, with a CI job pinned to React 18.0.0 ([uplift] chore: require React 18 (peer >=18) with a React 18.0.0 CI job #3138). React 19 type work (Victory typing breaks on upgrade to React 19 #3076, Container component mouse events / tooltip stopped working after upgrading react 18 -> 19 #3048) can follow in 38.x.
   • victory-vendor: ESM import of d3-color, d3-format, d3-path, d3-time-format, d3-voronoi fails without hoisting #3104: decided (2026-11-02): keep victory-vendor's ./d3-* subpaths.
   • victory-vendor: es/*.js is ESM in a package without "type" (relies on Node syntax detection) #3105: decided (2026-11-02): es/package.json ("type": "module") is not in 38.0.0.
3. victory-vendor's version: decided (2026-11-02): it stays in the fixed group and ships as 38.0.0. recharts (victory-vendor@^37) stays on 37.4.x until it opts in.
4. End-of-uplift review (Housekeeping), pnpm dep:check, merge main in, green CI. Done in [uplift] chore: Node 26, pnpm minimumReleaseAge 7 days, dev deps #3139 (Node 26, minimumReleaseAge, dev-dependency updates; CI green on the integration branch); main had nothing new (2026-11-03). Changelog generator swapped in [uplift] chore: use the official @changesets/changelog-github #3140.
   • Changelog generator ([uplift] chore: use the official @changesets/changelog-github #3140): the deprecated @svitejs/changesets-changelog-github-compact is replaced by the official @changesets/changelog-github (disableThanks, like react-live). scripts/changelog.js now only drops "Updated dependencies" lines (with the fixed group, every release would list sibling bumps in all 29 changelogs). Rendered the pending changesets with both: same entries; each now leads with PR + commit links, and bare #123 references are linked.
5. Canary to next from the integration branch: 38.0.0-canary-20261103184440 (all 29, from bce12bb4b, SLSA v1 provenance), checked against 37.4.1 (2026-11-03). The recharts smoke test waits until recharts opts in to victory-vendor@38 (see step 3).
   • Every file in the 29 tarballs is identical to a local pnpm pack of the same commit (except the canary's CHANGELOG.md), so the local pack:check results (publint, attw, isolated require()/import(), vendor snapshot, declaration check) hold for the published tarballs.
   • victory-vendor: same 300 files; exports, dependencies and the other manifest fields unchanged (only version, devDependencies, scripts). 105 lib-vendor/ files differ only by Babel 7.29's interop helpers and redundant parentheses, as expected from [uplift] chore: update victory-vendor build tools #3127.
   • Registry install of victory (React 19, Node 26): all 28 victory-* packages export the same 234 names as 37.4.1, via require() and import() alike (37.4.1's import() loaded CJS and added __esModule/default/module.exports). renderToString works for bar, line + voronoi, pie, stack + zoom and polar charts, via ESM and CJS. Markup changes vs 37.4.1: no stray index attribute on bars ([uplift] fix: keep Victory props off primitives' DOM elements (#3118) #3123), and the path precision note under fix: normalize SVG path precision to prevent hydration errors #3087.
   • The changelog generator from [uplift] chore: use the official @changesets/changelog-github #3140 ran in the release workflow (canary CHANGELOG.md: PR + commit links, no "Updated dependencies" lines).
6. Final merge (merge commit) → Version Packages PR → 38.0.0, then update the browser docs examples to @38.
   • Final merge [uplift] 38.0.0: 2026 infra uplift (Phase 2 and breaking changes) #3141 (merge commit 23ab5056e). Its review added a turbo.json fix: the shared test helpers now import d3-voronoi directly instead of victory-voronoi's source, and test/** and scripts/pack-check.mjs moved to globalDependencies (decision log, 2026-11-03).
   • Version Packages Version Packages #3143 → 38.0.0 (all 29 on latest, SLSA v1 provenance, v38.0.0 release). Its CI runs were held for approval ("Approve and run"), not skipped (see Releases and in-flight work).
   • Published tarballs diffed against the canary: only version, CHANGELOG.md, the canary's rewrite of the victory-chart: "*" devDependency, and a union member order in four declaration files (number[] | string[], same type). Every sibling dependencies/peerDependencies pin is 38.0.0.
   • Browser docs at @38 ([uplift] docs: browser examples at 38, Approve and run for Version Packages #3144) (esm.sh victory@38, jsDelivr victory@38.0.0, which bakes in React 19.3.1 like the canary). Both examples checked in headless Chromium: 4 bars, Randomize works, one React, no errors. Same PR: AGENTS.md, CONTRIBUTING and release.yml describe "Approve and run" for the Version Packages PR.

After 38.0.0: Phase 3, the rest of Phase 4 (React 19 support, runtime dependency updates, SSR smoke tests, types issues) and Phase 5 ship as 38.x minors and patches. Decided (2026-11-03): they land as PRs straight to main, no new integration branch.

Phase 0: Intake (doesn't block the uplift)

• victory-vendor: License notification improvements #3092: victory-vendor licenses (fixes victory-vendor: published package ships no license file, and the license field misses BSD-3-Clause #3089, victory-vendor declares "license": "MIT AND ISC" but repo ships only the MIT text — no ISC license text anywhere #3090). Shipped in 37.4.1.
• Stop using typescript module syntax #3077: export module → export namespace, needed to typecheck under TS 7. Landed on the integration branch as [uplift] fix: use namespace instead of module in immutable types (#3077) #3132 (author credited as co-author).
• fix: normalize SVG path precision to prevent hydration errors #3087: SVG path precision (Hydration error using VictoryLine on NextJS 15. #2941 SSR hydration)
  • Canary check (2026-11-03): victory-vendor's CJS lib-vendor/ is a snapshot of the lockfile's d3-shape 3.1.0 / d3-path 3.0.1 (no rounding), while its ESM es/ re-exports the user's installed d3 (3.2.x / 3.1.x round paths to 3 decimals). So CJS and ESM render different path strings (e.g. 183.33333333333334 vs 183.333), as in 37.4.1 for bundlers. New in 38: Node import() now takes the ESM path, so Node ESM SSR matches bundled clients; CJS SSR still differs. Updating vendor's d3 (Phase 4 runtime deps) would align them.
• Stale Version Packages PR Version Packages #3047: the new pipeline reused its branch and it became the 37.4.0 Version Packages PR.

Phase 1: Scope and release pipeline (OIDC)

Remove victory-native

• Delete packages/victory-native and demo/rn, plus the metro Babel preset and related deps, the ignore entry in the changesets config, and the native special case in the wireit sync script. Update the README, CONTRIBUTING and website docs to point at victory-native-xl (2026 Uplift: remove legacy victory-native package and RN demo #3094).
  • The "Overridden in victory-native" comments and victory-core's isNativeTouchEvent path stay until a source PR.
• No npm deprecation. latest (43.x) is where users are.
• Legacy patch victory-native@37.3.7 on legacy with the unreleased fix(native): fix container prop forwarding #3065 fix (Updating version to 37.1.1 - viewBox issue #2895, VictoryCursorContainer broken #3063). Published once, by hand, from a branch off v37.3.6 (npm publish --tag legacy), outside this repo's release pipeline. Verified tarball vs 37.3.6 (only the four containers + version differ); latest stays 43.x (XL).

Tooling for releases

• packageManager → pnpm@12.14.0 (chore: upgrade pnpm 9.13 -> 12.14 #3095). pnpm settings moved from .npmrc / package.json "pnpm" to pnpm-workspace.yaml (pnpm 11+ reads them only there), plus an allowBuilds allowlist. pnpm/action-setup v6. Lockfile resolution and packed output unchanged.
• @changesets/cli v3 ([uplift] ci: changesets v3 + OIDC release pipeline with canary #3096). Dropped the @changesets/cli@2.24.1 patch (it only made changeset publish honor publishConfig.tag for victory-native). The existing changelog wrapper (scripts/changelog.js over @svitejs/changesets-changelog-github-compact) works with v3 unchanged.
• Keep the fixed: [["victory*"]] group. All packages, including victory-vendor, version together.

Release workflow (.github/workflows/release.yml)

• Rebuilt on changesets/action v2 split jobs ([uplift] ci: changesets v3 + OIDC release pipeline with canary #3096), modelled on react-live's:
  • select-mode (read-only) → version (opens the Version Packages PR) or pack (build, then changeset pack) → publish (changeset publish --from-pack-dir).
  • permissions: {} at the top; each job gets only what it needs. Only publish and canary get id-token: write.
  • package-manager-cache: false in all release jobs (avoids cache poisoning).
  • publish and canary run in the npm-publish environment (branch rules: main + the integration branch; required reviewers optional, currently none). Not production: Vercel's docs deployments use it, and environment names are case-insensitive ([uplift] ci(release): use npm-publish environment instead of Production #3097).
  • Provenance is automatic under trusted publishing (SLSA v1 on 37.4.x).
• Tags and release notes: per-package tags and releases are off (create-github-releases: false, push-git-tags: false). A follow-up step runs gh release create v{version} --generate-notes, which creates the one tag and the aggregate release. scripts/release.ts, its deps, and nps git:tag were removed (see the decision log).
• Canary: workflow_dispatch in the same file (npm trust is bound to one workflow file). gh workflow run release.yml --ref <branch> publishes X.Y.Z-canary-<datetime> to next (snapshot.useCalculatedVersion).
• Version PR token: CI runs on PRs opened or updated with GITHUB_TOKEN are held for approval (seen on Version Packages #3143; earlier they didn't run at all). Current practice: after the PR's last update, a maintainer clicks "Approve and run". Better: a fine-grained token (this repo, contents + pull-requests) or a GitHub App token in the version job.

npm and GitHub setup (needs a maintainer)

• GitHub: npm-publish environment, deployment branches main + chore/2026-uplift-02 (was chore/2026-uplift).
• npm: scripts/npm-trust.sh (29 packages, --file release.yml --env npm-publish --allow-publish, npm ≥11.15.0, --dry-run). Run once. Kept for adding packages or re-creating trust: renaming release.yml or the environment breaks publishing until trust is re-created (npm allows one trust config per package).
• Now that OIDC publishing has worked (37.4.0, 37.4.1): set each package's npm publishing access to "require 2FA and disallow tokens", then delete the NPM_TOKEN and CHANGESETS_TOKEN secrets.

Validate

• Canary from the integration branch (see Releases and in-flight work). Repeat before the final merge, and smoke-test recharts against the canary victory-vendor.
• Interim 37.4.0 (and 37.4.1).

Phase 2: Build tooling (mechanical source churn only)

Config-only work goes first (turbo, tsdown, vitest, CI). The changes that churn source go last, each in its own PR:

1. Type-error fixes once TS errors fail the build
2. The TS upgrade and tsconfig changes
3. The oxlint + oxfmt switch: the oxfmt reformat plus oxlint autofixes and suppressions (done as one format PR and one lint PR, [uplift] chore: format with oxfmt #3111 and [uplift] chore: fix oxlint errors #3112)

Open PRs don't block these. They catch up afterwards using the format-then-merge approach above.

• Task runner: Turborepo in place of wireit + nps + scripts/sync-pkgs-wireit.js ([uplift] chore: replace wireit + nps with Turborepo #3102).
  • Root turbo.json plus package-level ones for victory-vendor and website. Task names kept (build, types:check, jest, lint, ...); ordering comes from ^task workspace deps, so no generator.
  • CI cache via actions/cache (no Vercel account needed); test restores the build job's cache, lint runs in parallel. --affected on PRs. Telemetry off in all workflows.
  • ESLint and Prettier run with --cache; lint no longer waits on any build.
  • Fixed: wireit inputs pointed at missing files (test/jest-config.js, config/webpack.config*.js), so config edits didn't invalidate tasks.
  • Timings (local): warm check 4.3s → 0.6s; cold check ~40s → ~45s (Jest worker pools per package; the Vitest PR should fix it).
  • Fixed in [uplift] chore: add pack:check #3103: the root package.json depended on victory-vendor/victory-voronoi (for test/ helpers), which put them and their dependencies into Turborepo's global hash. Any edit to victory-core, victory-voronoi or victory-vendor invalidated every task.
• tsdown per package: ESM + CJS + .d.ts, with publint and @arethetypeswrong/core on every build ([uplift] chore: switch to tsdown. #3108). Remove the Babel configs.
  • Also did Phase 4's dist/ + exports move (see the decision log, 2026-10-27): ESM .mjs + .d.mts, CJS .cjs + .d.cts, one output file per source file, es2022 (tsconfig target now matches), no sourcemaps or declaration maps, src/ no longer published. One shared tsdown.config.mts; one turbo build task.
  • publint and attw run in pnpm pack:check (CI), not in every build.
  • .babelrc.build.js and cross-env removed. .babelrc.js stays for babel-jest until Vitest; @babel/cli stays for victory-vendor's build.
  • Only source change: ComponentEvent type exported from victory-core, so dependents' declarations reference victory-core instead of inlining its internal types.
  • Timings (local): cold pnpm build 12.1s (85 tasks) → 8.6s (29); cold check ~45s → ~30s; warm check 0.6s → 68ms. Exported names match 37.4.1 for all 28 packages (require() and import()).
• Type errors fail the build. Fix whatever surfaces.
  • TS 5.7.2 had 0 errors in all 27 victory-* packages (build and types:check configs, 2026-10-27). Since [uplift] chore: switch to tsdown. #3108, declaration errors fail the build (the || echo warning is gone).
• victory-vendor: port scripts/build.js (d3 ESM → CJS vendoring) to tsdown/Rolldown, or keep it as-is behind a turbo task. Must still emit LICENSE.txt.
  • Kept as-is behind a turbo task, with its tools updated ([uplift] chore: update victory-vendor build tools #3127; see the decision log, 2026-10-29). A single-tool build is victory-vendor: explore a single-tool build (drop Babel) #3126, after the uplift.
  • Published-output check: pnpm pack:check ([uplift] chore: add pack:check #3103), in CI. For every package: publint, attw, and require() + import() of every entrypoint from an isolated install (declared deps only). victory-vendor must also match pack-snapshot.json: manifest fields, per-entrypoint resolution under node10/node16/bundler, known attw and load failures, file list.
  • Found by it: victory-vendor: ESM import of d3-color, d3-format, d3-path, d3-time-format, d3-voronoi fails without hoisting #3104 (ESM import of five undocumented d3-* subpaths fails without hoisting) and victory-vendor: es/*.js is ESM in a package without "type" (relies on Node syntax detection) #3105 (es/*.js relies on Node's ESM syntax detection). Neither affects recharts' d3-scale/d3-shape.
• Vitest replaces Jest (jsdom). Pushed directly as dadb6af (no PR; description in this comment).
  • Vitest 5, run per package through turbo with one shared test/vitest.config.mts (globals: true). Task renamed jest → test (pnpm test).
  • Tests: jest.* → vi.*, one xit → it.skip. No snapshot changes; 619 passed, 2 skipped (same as Jest).
  • jsdom pinned to 20.x (what Jest used); see the dev-deps item below. @vitest/eslint-plugin replaces eslint-plugin-jest. The root .babelrc.js and its presets are gone.
  • Timings (local): tests only ~10.5s → ~4.3s; cold check ~30s → ~18s; warm check 66ms.
  • victory-vendor's tests/*.test.ts were never run by Jest. Since [uplift] chore: report Vitest coverage in CI #3109 their runtime checks (subpath exports are functions) run in pnpm test. Their type checks (type re-exports, @ts-expect-error on a bad name) still aren't type-checked: tsc can't resolve the victory-vendor/d3-* self-imports under moduleResolution: node (TS 7 item). pack:check covers most of this more strictly. Type-checked since [uplift] chore: TypeScript 6 with bundler module resolution #3133 (bundler resolution).
  • Coverage, reported but not gated (Infra: Add coverage reporting to CI #2348), [uplift] chore: report Vitest coverage in CI #3109: pnpm test:coverage runs all tests in one Vitest run with v8 (packages/*/src/** only); CI writes the summary to the job summary and doesn't fail on it. Baseline: 52% statements, 39% branches.
  • pool: "vmThreads" ([uplift] chore: report Vitest coverage in CI #3109): jsdom set up once per worker. Coverage run ~4.1s → ~1.5s; pnpm test ~5.0s → ~4.6s. isolate: false was as fast but fails 5–57 tests when file order is shuffled (state leaks between files), so it's not used.
• oxlint + oxfmt replace ESLint + Prettier: config [uplift] chore: replace ESLint + Prettier with oxlint + oxfmt #3110, format churn [uplift] chore: format with oxfmt #3111, lint churn [uplift] chore: fix oxlint errors #3112. Both churn commits are in .git-blame-ignore-revs.
  • oxfmt evaluation (0.75.0): it handles every file type we have (TS/TSX/JS, JSON, MD, MDX, YAML, CSS). On JS/TS it differs from Prettier 3.9 only in how long union types wrap (13 files); most of its diff from our Prettier 3.3 is what Prettier 3.9 changes too. The oxc VS Code extension covers both tools. Pinned to exact versions because oxfmt is still 0.x.
  • oxfmt formats everything now, including docs (part of Infra: Lint docs in CI #2217), at printWidth: 80. The unused printWidth: 40 override for *.mdx is gone. Linting code blocks inside MDX is still not covered.
  • Lint does no formatting: eslint-plugin-prettier and eslint-config-prettier are gone. CI's lint job now also runs pnpm format, so formatting is checked in CI for the first time.
  • format and lint are root-only scripts run outside turbo: each checks the whole repo in under a second, so caching saves nothing. Per-package lint scripts and the turbo lint/format tasks are removed.
  • Rule parity: .oxlintrc.json comes from @oxlint/migrate. Three rules are oxlint nursery (experimental) rules, enabled by name: no-undef (JS files only; tsc covers TS), react/require-render-return, promise/no-return-in-finally. The rules not migrated are obsolete under strict mode, React 17+ or TS. The correctness category is off so the rule set matches ESLint's (see Phase 5).
  • oxlint can't set rule options in comments, so the 8 inline /* eslint no-magic-numbers: [...] */ comments became line-level eslint-disable comments. lint fails on unused disable directives.
  • Format churn left build output byte-identical (all 864 dist/ and vendor files), as did the lint churn.
  • @types/eslint override kept in pnpm-workspace.yaml: webpack (via Storybook) still pulls it in. Remove it with Storybook (Phase 3).
  • Timings (local, cold): format 2.3s (JS/TS/JSON only) → 0.9s (all 725 files); lint 8.7s (38s CPU, 30 turbo tasks) → 0.24s; check ~18s → ~15.6s. Warm check 66ms → 1.2s, because format and lint aren't cached.
  • Type-aware linting (oxlint --type-aware, needs tsgo) waits for the TS 7 item.
• TypeScript 7 + tsgo (deferred until after tsdown; when we get here, decide whether to give it its own issue). Move tsconfig off baseUrl / moduleResolution: node (target is already ES2022, [uplift] chore: switch to tsdown. #3108), fix Stop using typescript module syntax #3077, switch types:check to tsgo, and set tsdown's dts.generator: "tsgo" (needs typescript@7.1; experimental in rolldown-plugin-dts). Optionally use project references.
  • Measured 2026-10-27 on TS 7.0.2 (tsconfig adjusted): 0 source errors, 6 in victory-candlestick.test.tsx, about 9x faster than tsc on victory-core. Stop using typescript module syntax #3077's export module blocks pass only because skipLibCheck skips them.
  • Kept in this issue, as four small PRs (decision log, 2026-10-31): Stop using typescript module syntax #3077 → TS 6 + tsconfig → TS 7 types:check → tsgo declarations.
  • Stop using typescript module syntax #3077 ([uplift] fix: use namespace instead of module in immutable types (#3077) #3132): export module → export namespace in victory-core's vendored immutable-types.d.ts. TS 7.0.2 reported 18 TS1540 errors on the published .d.mts with skipLibCheck: false; now 0. Only those lines change in dist/. Ride-along: the website's types:check had no task dependencies (website/turbo.json overrode the root entry), so on cold runs it raced the package builds; it now waits for ^build.
  • TS 6.0.3 + tsconfig ([uplift] chore: TypeScript 6 with bundler module resolution #3133): moduleResolution: "bundler", module: "esnext", no baseUrl (TS 6 deprecates node10 and baseUrl; TS 7 removes them). Website: Docusaurus's baseUrl unset, @site/* declared locally, strict: false (TS 6's new default is true). Build output byte-identical; pack:check and bundle sizes unchanged; no changeset. SSR smoke via packed tarballs (ESM + CJS, React 18 and 19) found two pre-existing problems, now under Phase 4's SSR item. types:check --force 12.4s → 13.0s (+1 task).
    • getTicks's inferred return union (number[] | string[] vs string[] | number[]) flips between identical builds, on TS 5.9 and 6 alike. Declaration diffs have to ignore it, or a source PR annotates the return type.
  • Type-check victory-vendor's tests/ ([uplift] chore: TypeScript 6 with bundler module resolution #3133): types:check added; under bundler the victory-vendor/d3-* self-imports resolve through exports.
  • TS 7.0 for types:check (tsgo), [uplift] chore: TypeScript 7 for types:check, check published declara… #3134. TS 7.0 has no stable JS API (only unstable/* exports), so declarations stay on TS 6 via rolldown-plugin-dts. Root typescript@7.0.2; a .pnpmfile.cjs hook pins the tools that import the JS API (rolldown-plugin-dts, cosmiconfig, react-docgen-typescript, @storybook/react-docgen-typescript-plugin, fork-ts-checker-webpack-plugin) to 6.0.3. A pnpm override can't do it: a peer still resolves to the root's copy (decision log, 2026-11-01). pack:check now type-checks each package's published declarations with skipLibCheck: false on TS 7, so module blocks can't come back; 18 pre-existing errors are allowlisted (Phase 4 types item). 0 source errors; the 6 in victory-candlestick.test.tsx were a moved @ts-expect-error (TS 7 reports per prop); declarations unchanged; tsc-only types:check 4.6s → 2.4s.
  • Later (38.x is fine): dts.generator: "tsgo" once TS 7.1 is stable; compare declarations byte-for-byte. Remove .pnpmfile.cjs and the 6.0.3 pin with it (check the website and Storybook tools then, or after Phase 3 removes Storybook). Then type-aware oxlint.
• Node: add .nvmrc (lts/*), used by CI (node-version-file) and documented in CONTRIBUTING. Remove the engines fields from every package.json and from the wireit sync generator. (Done early, with dropping the broken wireit GHA cache step so CI passes again.)
• CI rewrite:
  • Hardening ([uplift] chore: harden GitHub Actions workflows #3130): permissions: {} defaults with per-job grants, persist-credentials: false, current action majors, hybrid pinning, zizmor in CI (pnpm lint:gha locally), issue workflows on GITHUB_TOKEN/ubuntu-latest.
  • Bundle-size report on ESM imports instead of the UMD file (reported, not gated), [uplift] chore: add ESM bundle-size report to CI #3131: pnpm bundle-size (rolldown, minified + gzip, React external). The CI bundle-size job writes the table to the job summary; on PRs it builds the base (HEAD^1 of the merge commit) in a worktree and shows the gzip change, with a warning annotation above +1%. Baseline (dist/ from [uplift] chore: switch to tsdown. #3108): { VictoryPie } from victory-pie or victory 54.7 kB gz, all of victory-core 67.5 kB, all of victory 120.7 kB. Job ~30s, in parallel with test.
• Chromatic has failed on every run since Dec 2025 (now: Storybook 8's SWC addon preset fails to load under Node 24). Leave it until Phase 3 replaces it; ignore its status.
• Remove cruft: the start script (points at the missing demo/ts), config/webpack/demo, react-hot-loader ([uplift] chore: remove UMD bundles and webpack; add browser ESM docs #3107), nps ([uplift] chore: replace wireit + nps with Turborepo #3102), cross-env ([uplift] chore: switch to tsdown. #3108), cpx2 and rimraf ([uplift] chore: replace cpx2 and rimraf with Node scripts #3136; sync and clean:* are now small async Node scripts; victory-vendor's build dropped rimraf in [uplift] chore: update victory-vendor build tools #3127), and unused root devDeps ([uplift] chore: remove unused root dependencies #3113).
  • [uplift] chore: remove unused root dependencies #3113 removed clsx, fs-extra + @types/fs-extra, @babel/plugin-transform-export-namespace-from, prop-types + @types/prop-types, react-icons (the website declares its own), react-test-renderer and ts-node from the root, and moved victory-vendor's four Babel build deps into its own devDependencies (it relied on hoisting). Vendor output byte-identical. Swept with knip. concurrently stays until Phase 3 (see there).
  • Remove the unused lodash from dependencies in victory-canvas, victory-histogram and victory-scatter (none of their source imports it; found by knip). It changes what users install, so it's its own small PR with a patch changeset, kept out of the infra cruft PR ([uplift] fix: VictoryLabel default font and unused lodash deps #3115).
  • Same PR (small published fixes, [uplift] fix: VictoryLabel default font and unused lodash deps #3115): VictoryLabel's default fontFamily (victory-core/src/victory-label/victory-label.tsx) has an invisible soft hyphen (U+00AD) inside 'Seravek', so that font never matches. Found by the jsdom 30 update; the label test's inline snapshot has it too.
• Update all dev dependencies to latest, including the website's. Do this after the tool swaps above, so we don't upgrade things we're about to delete. Add a dep:check script ([uplift] chore: add dep:check and update root dev dependencies #3114: npm-check-updates as a pinned root devDependency, root + workspaces, 7-day cooldown; parked majors in .ncurc.cjs).
  • B1, root ([uplift] chore: add dep:check and update root dev dependencies #3114): jsdom 30 (toCssColor test helper for its rgb() normalization; pie fixture's invalid #fffff fixed), immutable 5 (Victory's duck-typed support still passes), rimraf 6 (--glob), cpx2 9, jest-dom 7, changelog wrapper 1.2 (wrapper keeps the blank line between entries), and latest in-major React 18.3, @types/react 18.3 (one type-only cast in add-events.tsx), TypeScript 5.9, @types/node 24 (.nvmrc pinned to 24). Coverage-run tests ~1.5s → ~1.9s (jsdom 30 environment setup); builds unchanged.
  • B2, website (pnpm build:docs): Docusaurus 3.10, TS 5.9, React 18.3, tailwindcss 4 (config migration), d3-array/d3-scale/d3-time (docs examples), date-fns 4, typedoc 0.28, docusaurus-search-local, find-cache-dir 6. react-live 5 stays its own item below (parked in .ncurc.cjs).
    • Everything but Tailwind ([uplift] chore: update website dependencies #3116). Docusaurus 3.10 needed blog: false (it now writes an empty /blog page) and onBrokenMarkdownLinks under markdown.hooks. Same 87 pages, build ~30s → ~27s.
    • tailwindcss 4: CSS-first config (@theme), @tailwindcss/postcss, drop autoprefixer. Modern-browser floor accepted (Safari 16.4+, Chrome 111+, Firefox 128+). Done in [uplift] chore: update website to Tailwind 4 #3119: keeps v3 behavior (no preflight, unlayered utilities, same content sources), class renames from @tailwindcss/upgrade. Visible changes: theme builder headings now use Inter (the nested rule v3 dropped), and the landing page LinkButton shows its green border. Docs build ~27s → ~15s.
    • vercel.json redirects / → /open-source/victory (307) so Vercel preview links land on the docs ([uplift] chore: redirect Vercel root to /open-source/victory #3117).
  • B3, victory-vendor build tools ([uplift] chore: update victory-vendor build tools #3127): Babel 7.29, babel-plugin-module-resolver 5.0.3; execa and rimraf dropped (Node built-ins; Babel's CLI now runs without a shell, so the build works on Windows). The nested-modules check never ran (typo, and pnpm never nests), so it now checks that every d3 dependency of a vendored package is vendored too. lib-vendor/ diff: newer Babel interop helpers and redundant parentheses in 3 d3-array files; pack-snapshot.json unchanged.
  • Website leads from knip, resolved in [uplift] chore: update website dependencies #3116:
    • postcss-import removed. It was a no-op (CSS output identical) and only resolved because Docusaurus loads the config from inside node_modules/.pnpm, where Tailwind 3's copy is reachable.
    • @docusaurus/plugin-google-gtag and plugin-google-tag-manager removed; preset-classic depends on both (tags still in the built HTML).
    • @algolia/client-search and search-insights removed after all: they're required peers of @algolia/autocomplete-core under theme-search-algolia (pulled in by preset-classic, unused: the site uses local search), and pnpm fills them via autoInstallPeers: true.
    • @docusaurus/plugin-content-docs stays declared: sidebars.ts imports its types.
  • Website follow-ups found in B2:
    • Delete the unused src/plugins/victory-typedoc/ (unregistered since Next Generation Documentation #2938/Upgrades ESLint to Version 9 #2958; no doc uses auto_generated). Drops typedoc, find-cache-dir and mdast-util-from-markdown, plus its undeclared js-yaml and unist-util-visit imports ([uplift] fix: docs example warnings and website cleanups #3124).
    • Declare lodash in website (3 files in src import it; it resolves only by hoisting) ([uplift] fix: docs example warnings and website cleanups #3124).
    • Make the website tsc check src (its tsconfig only includes vendors.d.ts) ([uplift] fix: docs example warnings and website cleanups #3124). 33 errors once src was included, mostly missing Docusaurus module types; all type-only fixes. The script was named typecheck, which nothing ran; it's now types:check, so pnpm check and CI run it (victory-docs#types:check waits only for the packages' builds, not the docs build). The landing page casts its Date accessors until DataGetterPropType doesn't accept Date (x/y accessors returning a Date) #3125 is fixed.
    • Nested h1–h6 rule under .theme-builder * in custom.css is dropped from the built CSS (Css Minimizer warnings; also in production). Fixed by Tailwind 4's built-in nesting ([uplift] chore: update website to Tailwind 4 #3119).
• Browser probe + bugfix pass. Drive headless Chromium over the docs (dev server and production build), Storybook and the ESM browser page, with interactions (hover, drag, wheel, clicks). Collect console errors and warnings, uncaught exceptions and failed requests, then fix them in small PRs split by concern: library fixes (patch changeset), one docs-examples PR, upstream issues noted. The probe script is not committed; Phase 3's browser tests are its long-term home.
  • Probe results (2026-10-28): docs dev server and production build (86 pages, 447 charts each), plus a local-dist/ ESM page via an import map (19 charts, one per chart and container type). No uncaught exceptions or failed requests. Storybook skipped: its static build fails with the same SWC preset error (Phase 3).
  • delaunay-find ESM interop (regression from [uplift] chore: switch to tsdown. #3108, unreleased): victory-voronoi-container default-imports Babel-compiled CJS, so strict ESM (Node, webpack for .mjs) gets module.exports and Delaunay.from is not a function on mouse move. Fixed, and pack:check now fails on default imports of CJS with exports.default ([uplift] fix: delaunay-find default import in strict ESM #3120).
  • Chart props leak to the DOM from primitives inside VictoryChart (standalone warning) #3118 (pulled forward from Phase 5): primitives strip chart-context props before spreading onto SVG elements ([uplift] fix: keep Victory props off primitives' DOM elements (#3118) #3123).
  • Docs examples: missing key in error-bar.mdx and bar-horizontal-stacked; d3fc "multiple ticks fall within a discontinuity" warning from the skip-weekends examples (line, area, victory-common-theme-props); theme builder <select value={null}> ([uplift] fix: docs example warnings and website cleanups #3124). d3fc's own scale.ticks() emits the same warning, so the examples tick on the data dates instead. Re-probe of the touched pages: 0 findings.
  • Found while fixing Chart props leak to the DOM from primitives inside VictoryChart (standalone warning) #3118, filed for later: VictoryChart overrides width/height set on its children #3121 (VictoryChart overrides width/height set on its children; Phase 5 prop passing) and Primitive prop types don't include SVG attributes (x1, d, cx, ...) #3122 (primitive prop types don't include SVG attributes; Phase 4 types). Found in [uplift] fix: docs example warnings and website cleanups #3124: DataGetterPropType doesn't accept Date (x/y accessors returning a Date) #3125 (DataGetterPropType doesn't accept Date; Phase 4 types).
• Dependency updates without bots (decision log 2026-10-28): no Renovate or Dependabot version-update PRs.
  • Dependabot security alerts: turned on after the final merge (see Housekeeping).
  • Document the routine in AGENTS.md and CONTRIBUTING ([uplift] chore: add dep:check and update root dev dependencies #3114): run pnpm dep:check before each release (and when an alert comes in), and update in one PR.
• Docs site (Docusaurus): build through turbo (pnpm build:docs, used by Vercel; [uplift] chore: replace wireit + nps with Turborepo #3102).
• Docs site: bump react-live to v5 ([uplift] chore: website react-live 5 #3137). Docusaurus's live-codeblock still installs its own 4.1.8, unused: our swizzled Playground and ReactLiveScope replace its components.

Phase 3: Stories and visual testing (replacing Storybook + Chromatic)

After 38.0.0 (no published changes; see Road to 38.0.0). Victory renders SVG, so visual regressions matter more here than in react-live. We shouldn't drop Chromatic without a replacement in place.

• Keep the 197 existing story files as-is (Storybook's file format, with seeded deterministic data). Replace import type { Meta } from "@storybook/react" with a local type.
  • [uplift] chore: stories workspace package, local story types, package imports #3145: stories/ is a private workspace package, victory-stories (changesets ignore). Local Meta/StoryObj/Decorator in stories/utils/types.ts; stories import victory and victory-vendor/d3-* instead of the @/ source alias. Mechanical, so it's in .git-blame-ignore-revs.
• A small Vite app that loads stories/**/*.stories.tsx and gives a browsable gallery (as in react-live's stories/).
  • [uplift] chore: Vite stories gallery, type-check stories #3146: stories/utils/load-stories.ts (UI-free, for the snapshot tests too) renders each story as Storybook did: global, meta, then story args; meta decorators; Storybook's story ids; each story as its own component, since some call hooks in render. Gallery in stories/app/ (sidebar by title, filter, #<story-id> URLs, error boundary). pnpm stories:dev runs turbo watch (package rebuilds reload Vite). Stories are type-checked in pnpm check and CI (one error fixed).
  • All 197 render in headless Chromium. Known story problems, left as-is: VictoryBar "Focus With Refs" throws (it reads the DOM index attribute, which [uplift] fix: keep Victory props off primitives' DOM elements (#3118) #3123 stopped writing in 38.0.0); VictoryScatter "Data Accessors" renders NaN in two charts (story data has no x); two VictoryLine stories warn about missing keys.
• SVG snapshot tests for every story (Vitest browser mode, serialized <svg> markup). They're cheap and deterministic, with no font or pixel noise.
  • [uplift] test: SVG snapshot tests for every story (Vitest browser mode) #3147: stories/tests/ renders each story (via load-stories.ts) in headless Chromium (Vitest browser mode, Playwright) and compares its serialized markup with one file per story in stories/tests/__snapshots__/<title>/<name>.html. Runs in pnpm test/check and in CI's test and react-18 jobs (pnpm stories:install installs Chromium, about 17s in CI; the tests take about 5s locally, 30s for CI's Test step).
  • Deterministic across machines: text is sized with Victory's TextSize approximation instead of the installed fonts, the browser runs in UTC with en-US, lodash uniqueId ids are renumbered, and attribute numbers are rounded to 2 decimals. Waits until the markup stops changing (portals, mount effects). A test fails on snapshot files whose story is gone. Verified on macOS and Linux, React 18.0.0 included.
  • Story ids now match Storybook's (--bar-ratio, not --barratio from [uplift] chore: Vite stories gallery, type-check stories #3146). VictoryBar "Focus With Refs" is checked for its known error instead of a snapshot.
  • 196 files, 11 MB on disk (about 0.5 MB compressed).
• Screenshot tests (toMatchScreenshot) for a curated subset, run in a pinned Playwright container so baselines are stable.
• Interaction tests for tooltips, containers and events (covers the area of Container component mouse events / tooltip stopped working after upgrading react 18 -> 19 #3048).
• Test the "Using Victory in the browser" docs examples #3106: test the browser docs examples (esm.sh and jsDelivr) headless in CI, on this phase's browser-testing setup.
• Remove Storybook, Chromatic, chromatic.config.json and the workflow.
  • Also concurrently (only storybook:dev uses it). Storybook's dev server doesn't start under Node 24 (same SWC preset error as Chromatic), so it wasn't swapped for turbo watch in Phase 2. The stories app's dev script should use turbo watch from the start.

Phase 4: Packaging and React (v38)

The breaking items here ship in 38.0.0 (see Road to 38.0.0). The rest (React 19 support, runtime dependency updates, SSR smoke tests, types issues) can ship in 38.x.

• exports maps on every victory-* package (Infra: Add types field to package.json #2400), generated by tsdown: "." (import/require, types resolved from the sibling .d.mts/.d.cts) plus "./package.json". Output moves to dist/. Keep the legacy main/module/types fields for older tooling. attw + publint must pass. Done in [uplift] chore: switch to tsdown. #3108 (decision log, 2026-10-27).
  • Deep imports into lib/ and es/ stop resolving. GitHub code search finds only about 15 such imports; the v38 changelog gets a migration note.
  • victory-vendor's existing map stays byte-for-byte compatible. Every victory-vendor/d3-* subpath, plus types/import/default, must resolve exactly as today (recharts depends on it). pnpm pack:check and vendor's pack-snapshot.json guard this ([uplift] chore: add pack:check #3103).
  • victory-vendor: ESM import of d3-color, d3-format, d3-path, d3-time-format, d3-voronoi fails without hoisting #3104: decided to keep ./d3-* as is (decision log, 2026-11-02). Fallback if someone reports it: point the five ESM shims at the bundled CJS copies (option B).
  • victory-vendor: es/*.js is ESM in a package without "type" (relies on Node syntax detection) #3105: es/package.json with {"type": "module"} so es/ is real ESM without changing exports (needs a recharts canary smoke test). Not in 38.0.0 (decision log, 2026-11-02); later, as its own change with a canary.
  • Dropped pack:check's allowance for publint FILE_INVALID_FORMAT in the victory-* packages; it now applies only to victory-vendor ([uplift] chore: switch to tsdown. #3108).
  • The changeset's migration note covers deep imports, the ES2022 output and src/ no longer being published.
• Ship both ESM and CJS. CJS demand is still real.
• Remove the UMD bundles (dist/*.js) and the webpack config. Add a docs page on using Victory as ESM in the browser ([uplift] chore: remove UMD bundles and webpack; add browser ESM docs #3107, done early to make the tsdown PR smaller).
  • The page has esm.sh and jsDelivr examples; Test the "Using Victory in the browser" docs examples #3106 tracks testing them.
• React peer range >=16.6.0 → >=18 (unblocks useId for SSR, Hydration error using VictoryLine on NextJS 15. #2941). Develop on React 19 with @types/react 19, and add a CI job pinned to React 18.0.0 (as react-live does).
  • Peer >=18 and the react-18 CI job (React 18.0.0) landed in [uplift] chore: require React 18 (peer >=18) with a React 18.0.0 CI job #3138; library code can now use React 18 APIs (useId, useSyncExternalStore, ...), not 19-only ones (AGENTS.md). Developing on React 19 (@types/react 19, parked in .ncurc.cjs) goes with React 19 support below, in 38.x.
  • React 19 support: fix the types (Victory typing breaks on upgrade to React 19 #3076) and container events (Container component mouse events / tooltip stopped working after upgrading react 18 -> 19 #3048). A grep finds no findDOMNode, ReactDOM.render, element.ref reads, global JSX or propTypes in the source. The expected work is typing cloneElement/child.props (118 cloneElement calls) under @types/react 19.
• Update runtime dependencies (lodash, react-fast-compare, delaunay-find, and the vendored d3 modules) to latest within their current majors. Major bumps get evaluated one at a time, and anything in victory-vendor is checked against recharts.
• SSR / Node smoke tests: CJS require, ESM import, and renderToString (Tests: Add Node.js / SSR tests. #1965).
  • Prototype (2026-11-01, TS 6 PR): packed tarballs in an isolated install, renderToString of 20 chart setups (every chart type and container) via ESM and CJS, on React 18.3.1 and 19.3.1. 19/20 render on both.
  • victory-canvas can't render on the server: CanvasBar/CanvasPoint call new Path2D() in useMemo during render (browser-only API). Move it into the draw effect, or document canvas as client-only.
  • VictorySharedEvents with neither events nor container crashes (render() clones props.container, which is undefined). Not SSR-specific; fall back to groupComponent.
• Revisit types issues after the TS upgrade: Type Error in Victory Container 36.9.1 #2815, Typescript 5.2.2 issue in VictoryLineBase #2639.
  • Primitive prop types don't include SVG attributes (x1, d, cx, ...) #3122: primitive prop types (Line, Rect, ...) don't include SVG attributes, so <Line x1={25} /> fails to type-check. Widen with the element's React.SVGProps (published type change; maybe with Victory typing breaks on upgrade to React 19 #3076).
  • DataGetterPropType doesn't accept Date (x/y accessors returning a Date) #3125: DataGetterPropType (x/y/y0) doesn't accept Date, so Date accessors fail to type-check (they work at runtime). Add Date to the union (published type change); then drop the website's dateX cast.
  • Published declarations have type errors that users with skipLibCheck: false see (TS 6 and 7 alike; found by the TS 7 PR's pack:check step, allowlisted in ALLOWED_DECLARATION_ERRORS). victory-create-container: createContainer's inferred return type indexes the container map with an unnarrowed type parameter (TS2344, 16). victory-errorbar: ErrorBar's props use typeof ErrorBar.default, which doesn't exist (any in source; TS2339, 2). Fix (explicit return type; a real props type that stays loose enough for current callers), empty the allowlist, patch changeset.
  • getTicks (victory-core axis.ts): annotate the return type, so its inferred union stops flipping order between identical builds (see the TS 6 item).

Phase 5: Source modernization (later; continues #2863)

Tracked here for visibility; each item gets its own issue.

• Finish function components (Convert class components to function components #2778): add-events, clip-container, transition, and the chart components.
• Remove lodash (Remove dependency on lodash #2711)
• Hooks/context-based events and prop passing (VictoryGroup fails to pass shared events to children #2232, sharedEvents in victoryChart disappears after initial interaction #1900, 'active' variable in style for VictoryBar no longer works as expected #2861, React state change doesn't always trigger a chart redraw #2221, Use forward refs instead of containerRef for references to the rendered chart #2678, Unable to wrap victory components into customizable components #2342)
  • Chart props leak to the DOM from primitives inside VictoryChart (standalone warning) #3118: chart props (standalone, polar, theme, ...) leak to the DOM from primitives and plain elements inside VictoryChart (React dev warning; seen on the docs intro page). Follow-up to Warning: Received false for a non-boolean attribute standalone. #2609. Fixed in Phase 2's bugfix pass ([uplift] fix: keep Victory props off primitives' DOM elements (#3118) #3123; in the primitives, so custom children of VictoryChart still receive the props).
  • VictoryChart overrides width/height set on its children #3121: VictoryChart (and VictoryGroup/VictoryStack) override width/height set on children; a <Rect width={10}> inside a chart loses its width (or gets the chart's). Behavior change for Victory children too, so decide with the prop-passing work.
• Animation (Refactor VictoryTransition and animations #2104, Components flashing and re-rendering when animate is set to true #1997)
  • VictoryBar onExit transition renders invalid path (y0 undefined) in the Animations guide #3142: VictoryBar exit transitions render invalid paths (d="M x, undefined ...", console errors on the Animations guide's onExit example). Exiting data has _y0/_y1 null, and getBarPosition only defaults undefined. Pre-existing (37.4.1); likely also Expected number in path attribute error #2780.
• Turn on oxlint's correctness category (off for ESLint parity in [uplift] chore: replace ESLint + Prettier with oxlint + oxfmt #3110) and triage its 52 warnings: 35 Vitest test-hygiene (vi.fn() without type parameters, tests without expect, ...) and 12 React (react/refs, react/set-state-in-effect, react/no-did-mount-set-state), which may point to real bugs.
• New chart types are out of scope for the uplift. Wishlist carried over from 2024 Roadmap #2863: violin plot (Violin plots #1611), spider graph (Spider Graph #1610), Gantt (gantt chart #2769), heat map (Component request: Heat map #262), and (no issues yet) Mercator projection, hexbin, bubble map, tree map, cash/funds flow.

Housekeeping

• Triage the about 50 Issue: Accepted issues untouched since early 2024. Decide whether Issue: Accepted should keep exempting issues from the stale bot.
• Docs landing page's version chart uses a stale hard-coded list (Docs: landing page version chart uses a stale hard-coded version list #3100, low priority).
• Delete retired branches (chore/2026-uplift, changeset-release/main when idle) and the ~30 stale staging-17xx environments.
• End-of-uplift review (discuss before the final merge), [uplift] chore: Node 26, pnpm minimumReleaseAge 7 days, dev deps #3139:
  • Node 26: .nvmrc is pinned to 24 (and @types/node@24). Move to 26 if it's the active LTS by then; update .nvmrc, @types/node and the .ncurc.cjs entry together.
    • Decided (2026-11-02): yes, Node 26 (LTS). In [uplift] chore: Node 26, pnpm minimumReleaseAge 7 days, dev deps #3139: .nvmrc 26, @types/node ^26, .ncurc.cjs entry dropped. Vercel doesn't read .nvmrc: a maintainer sets the project's Node.js Version to 26.x.
  • pnpm minimumReleaseAge: not set. pnpm 12 also checks the existing lockfile against it, and 7 days rejected 47 recent entries (e.g. oxfmt 0.75.0, which we pin). Options: leave unset (dep:check has a 7-day cooldown), 1 day, or 7 days plus minimumReleaseAgeExclude for deliberate pins.
    • Decided (2026-11-02): 7 days (10080), in [uplift] chore: Node 26, pnpm minimumReleaseAge 7 days, dev deps #3139. By then only 3 transitive lockfile entries were too new; pnpm update re-resolved them to older versions, so no exclusions. minimumReleaseAgeExclude is for urgent security fixes only (CONTRIBUTING "Updating dependencies").
• After the final merge to main:
  • Close/redirect onPress event not firing on Android devices (victory-native) #3018 (victory-native) (closed 2026-11-03). Re-check VictoryTooltip overlap in VictoryGroup #2201 on web.
    • Checked on 38.0.0 (2026-11-03, headless Chromium): a VictoryGroup of three VictoryBars with VictoryTooltip; hovering the first (bottom-layer) series draws its tooltip above the later series, because web tooltips render in VictoryPortal's overlay SVG. VictoryTooltip overlap in VictoryGroup #2201 is victory-native (iOS) only.
  • Delete chore/2026-uplift-02 (remote and local) once 38.0.0 is stable in real projects. Its history is in main through the [uplift] 38.0.0: 2026 infra uplift (Phase 2 and breaking changes) #3141 merge commit.
  • Close 2024 Roadmap #2863 (2024 Roadmap): closed 2026-11-03; its open items are tracked here (Phase 5, chart wishlist above).
  • Maintainer: turn on GitHub's Dependabot security alerts (Settings → Code security). Alerts only; no security-update PRs. Waits until every dependency change in the uplift has landed on main (Storybook/Chromatic removal, runtime dependency updates, react-live 5, ...), so it starts from a clean baseline instead of a backlog of stale alerts. Some of these now land after 38.0.0, so this may come after the final merge.
• Vitest's shared cache (node_modules/.vitest-cache, used by every package's run) can race on the first pnpm check after a lockfile change: one run clears it while another reads it (ENOTEMPTY, seen once 2026-11-01; a rerun passes). CI starts from a fresh install, so it's local only so far. Give each package its own cache dir if it recurs.
• Bring in the open community PRs (fix(tooltip): pass lineHeight from style to label component (#2908) #3088, fix(victory-bar): support object return from cornerRadius callback #3086, Fixes clipping/loss of interactivity bug in VictoryCursorContainer (#3063) #3064, fillData sorted data assumption fixed #3062, fix: fixed the logic for scroll event on zoom-voronoi container #3060, Victory 2298 Tooltip Bug Fix #3027) during or after the uplift, as described above. Retarget them to main (the integration branch is merged).

Out of scope (separate tracks)

• Tree-shaking through the victory barrel. In early measurements, { VictoryPie } from "victory" comes out at about 131k gz vs 62k from victory-pie (esbuild, 37.3.6). This gets its own investigation and issue. Resolved by the tsdown build ([uplift] chore: switch to tsdown. #3108): since then both imports bundle to the same 54.7 kB gz ([uplift] chore: add ESM bundle-size report to CI #3131; decision log, 2026-10-31).
• Package consolidation (one victory package with subpath exports): revisit after v38.

Decision log