chore(release): v2.1.6

[Wootehfook]

Release v2.1.6

Cuts release v2.1.6 from develop into main. Merging this PR triggers create-release.yml to tag v2.1.6 and publish the GitHub Release from the CHANGELOG notes below.

Changed

• Trim editor/devcontainer extension recommendations to project-relevant tools (chore: trim editor/devcontainer recommendations to project-relevant tools #313)
• Sync README with current version and app flow (docs: sync README with current version and app flow #314)
• Harden backend TypeScript typings across letterboxd, TMDB sync, cache, comparison, and test endpoints; reduce any usage (fix: harden common helper typings for sonar #273–fix: tighten tmdb sync typing and db contracts #279)
• Automate main-to-develop sync after releases and refine Dependabot auto-merge/grouping configuration (chore: automate main-to-develop sync after releases #297, Revise Dependabot auto-merge configuration #305, chore: group react/react-dom/@types updates in Dependabot #306)
• Numerous dependency updates, including vite, vitest, wrangler, prettier, eslint, typescript-eslint, the React group, jsdom, lint-staged, and @types/node

Release checklist

• Version bumped in package.json / package-lock.json → 2.1.6
• CHANGELOG [2.1.6] section added with compare links
• type-check, lint, and full test suite pass locally (117 tests)

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying boxdbud with    Cloudflare Pages

Latest commit:	2b893c8
Status:	✅  Deploy successful!
Preview URL:	https://6da45304.boxdbud.pages.dev
Branch Preview URL:	https://release-v2-1-6.boxdbud.pages.dev

View logs

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Release PR to cut v2.1.6 from develop into main, bundling documentation updates, dependency/tooling upgrades, tighter backend typings, and GitHub workflow automation/config tweaks.

Changes:

• Bump project version to 2.1.6, update CHANGELOG/release notes, and refresh README (flow + prerequisites).
• Upgrade dependencies/tooling (notably wrangler@4.110.0, TS target/lib to ES2022, React patch bumps) and tighten TS typings across Functions.
• Update editor/devcontainer recommendations and add new GitHub Actions automation (main→develop sync + Dependabot auto-merge + Dependabot grouping).

Reviewed changes

Copilot reviewed 22 out of 25 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
workers/tmdb-cron/package.json	Updates worker dev dependency wrangler (triggers related engine/peer constraints).
workers/tmdb-cron/package-lock.json	Lockfile refresh for worker dependency graph following wrangler bump.
tsconfig.json	Raises TS compile target/lib to ES2022.
README.md	Syncs badges, prerequisites, and user flow steps with current app behavior.
package.json	Bumps app version to 2.1.6, tightens Node engine requirement, updates dependencies/devDependencies.
functions/test/tmdb-check.ts	Hardens handler typing (replaces any with structured env type).
functions/test/movie-search.ts	Hardens handler typing (replaces any with structured env type).
functions/test/movie-lookup.ts	Replaces any casts with typed row interfaces and safer logging env typing.
functions/search/index.ts	Adds typed TMDB/D1 row shapes and removes any usage in query/result mapping.
functions/letterboxd/watchlist-count/index.ts	Introduces D1 “like” types and typed .first<…>() result shape.
functions/letterboxd/friends/index.ts	Improves typing around env/db/cache inputs; removes any logging/env casts.
functions/letterboxd/compare/index.ts	Replaces any with unknown/typed row shapes; tightens logging/error serialization.
functions/letterboxd/cache/index.ts	Defines D1-like interfaces and propagates stronger typing through cache helpers.
functions/letterboxd/avatar-proxy/index.ts	Avoids any in env typing for MOVIES_DB.
functions/compare/index.ts	Preserves scrape error cause and replaces any for TMDB row with a typed interface.
functions/api/watchlist-count-updates/index.ts	Tightens payload validation types (unknown + structured narrowing).
functions/api/watchlist-comparison/index.ts	Replaces any debug structures with explicit interfaces; improves D1 query typing.
functions/admin/tmdb-sync/index.ts	Tightens TMDB/D1 typings, improves fetch timeout/error wrapping, reduces any.
functions/_types/common-modules.d.ts	Improves ambient typings for shared helper module imports (reduces any).
functions/_types/ambient-common.d.ts	Improves ambient typings for common helpers (KV/TMDB/debug/jsonResponse).
functions/_lib/common.d.ts	Tightens helper type declarations (KV/TMDB/reduceMovie/debug/jsonResponse).
CHANGELOG.md	Adds 2.1.6 section and updates compare links.
.vscode/extensions.json	Trims extension recommendations to project-relevant tooling.
.gitignore	Tracks .vscode/extensions.json while ignoring other .vscode/*; adds Claude local settings ignore.
.github/workflows/version-bump.yml	Updates checkout pin; workflow still sets up Node 20.
.github/workflows/test-suite.yml	Updates checkout action to v7; workflow still sets up Node 20.
.github/workflows/sync-main-to-develop.yml	Adds new automation to cherry-pick release/hotfix merge into develop via PR.
.github/workflows/security.yml	Updates checkout action to v7.
.github/workflows/security-supported-versions-check.yml	Updates checkout action to v7; workflow still sets up Node 20.19.0.
.github/workflows/security-audit.yml	Updates checkout action to v7.
.github/workflows/deploy-worker.yml	Updates checkout action to v7; deploy workflow still sets up Node 20.
.github/workflows/dependabot-auto-merge.yml	Adds new Dependabot auto-approve/auto-merge workflow.
.github/workflows/debug-pages-build.yml	Updates checkout action to v7.
.github/workflows/create-release.yml	Updates checkout action to v7.
.github/workflows/changelog-update.yml	Skips changelog automation on sync PRs; updates checkout pin.
.github/workflows/build-application.yml	Updates checkout action to v7; workflow still sets up Node 20.
.github/workflows/backend-quality-checks-resolver.yml	Updates checkout action to v7; workflow still sets up Node 20.
.github/dependabot.yml	Adds grouping so React/react-dom/@types bump together.
.github/copilot-instructions.md	Documents auto-sync workflow + reinforces linear-history rules.
.devcontainer/devcontainer.json	Removes unrelated devcontainer features/extensions; keeps stack-aligned tooling.

Files not reviewed (1)

• workers/tmdb-cron/package-lock.json: Generated file

Comments suppressed due to low confidence (1)

.github/workflows/security-supported-versions-check.yml:20

• This job is still explicitly pinned to Node 20.19.0, but the repo now requires Node >=22.22.1 (package.json engines) and wrangler@4.110.0 requires Node >=22. If this workflow is meant to validate supported versions, it should be updated to a supported Node version so it doesn’t fail immediately on installs or misrepresent the project’s runtime constraints.

      - uses: actions/checkout@v7
      - name: Use Node.js 20.19.0
        uses: actions/setup-node@v6
        with:
          node-version: "20.19.0"

[Copilot]

Pull request overview

Copilot reviewed 22 out of 25 changed files in this pull request and generated 2 comments.

Files not reviewed (1)

• workers/tmdb-cron/package-lock.json: Generated file

Comments suppressed due to low confidence (10)

.github/workflows/test-suite.yml:21

• This workflow uses Node 20, but the repo now declares an engine requirement of Node >=22.22.1. Keeping Node 20 here risks failing installs/build/tests (and newer tooling like wrangler also requires Node 22+). Update the setup-node version to match the repo’s declared minimum.

      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6

.github/workflows/security-audit.yml:30

• This job runs npm ci under Node 20.19.0, but the repository declares Node >=22.22.1 in package.json engines. Update the CI Node version to the minimum supported version to avoid install/runtime issues.

      - uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:

.github/workflows/build-application.yml:20

• This build job uses Node 20, but the repo requires Node >=22.22.1 (package.json engines). Using an older Node risks failing installs/builds as dependencies update. Please bump the setup-node version accordingly.

      - name: Checkout repository
        uses: actions/checkout@v7

      - name: Setup Node.js
        uses: actions/setup-node@v6

.github/workflows/version-bump.yml:41

• This workflow runs npm commands with Node 20, but the repository’s engines require Node >=22.22.1. Updating the Node version here will prevent engine/tooling mismatches during version bumps and release automation.

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
        with:
          fetch-depth: 0
          token: ${{ env.RELEASE_PR_TOKEN }}

.github/workflows/deploy-worker.yml:21

• The worker deploy job uses Node 20, but the worker’s updated wrangler dependency requires Node >=22.0.0 (and the main repo engines require >=22.22.1). Update setup-node to avoid wrangler/tooling failures during deploy.

            - name: Checkout repository
              uses: actions/checkout@v7

            - name: Setup Node.js
              uses: actions/setup-node@v6

.github/workflows/backend-quality-checks-resolver.yml:31

• This workflow installs and runs the project under Node 20, but the repo declares Node >=22.22.1 in package.json engines. Update setup-node to the supported minimum to keep the required check stable.

      - name: Checkout
        uses: actions/checkout@v7

      - name: Use Node.js
        uses: actions/setup-node@v6

.github/workflows/sync-main-to-develop.yml:59

• This new sync workflow runs npm ci/lint/test/build under Node 20, but the repository requires Node >=22.22.1 (package.json engines). Using Node 20 here risks the sync PR failing verification and never being opened/auto-merged.

      - name: Setup Node.js
        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
        with:
          node-version: "20"
          cache: "npm"

.github/workflows/security-supported-versions-check.yml:20

• This workflow step name and configured Node version still reference 20.19.0, but the repository’s declared minimum is Node >=22.22.1. Updating this keeps the “supported versions” checks aligned with the project’s actual support policy.

      - uses: actions/checkout@v7
      - name: Use Node.js 20.19.0
        uses: actions/setup-node@v6
        with:
          node-version: "20.19.0"

.github/workflows/dependabot-auto-merge.yml:1

• Repo policy requires AI-generated files to start with an attribution header in the form “AI Generated: GitHub Copilot () - YYYY-MM-DD” (see .github/copilot-instructions.md). This file’s header doesn’t follow that required format.

# AI Generated: Claude (Cowork) - 2026-07-12

workers/tmdb-cron/package.json:15

• wrangler@4.110.0 declares a peer dependency on @cloudflare/workers-types ^5.20260708.1 (see workers/tmdb-cron/package-lock.json). The worker package.json still pins @cloudflare/workers-types to a v4 range, which can cause type/package resolution drift. Consider bumping workers-types to match wrangler’s peer dependency.

  "devDependencies": {
    "@cloudflare/workers-types": "^4.20250101.0",
    "typescript": "^5.9.3",
    "wrangler": "^4.110.0"