chore: bump template dependencies, recipes and Motoko compiler

[marc0olo]

Brings every template's dependencies up to their latest versions, along with the icp-cli recipe versions and the Motoko compiler.

Version bumps

npm — all pinned with ~ per CONTRIBUTING; remaining ^ ranges converted:

package	from	to
@icp-sdk/core	5.2 / 5.4 / 6.0	6.1
vite	7.1	8.2
react, react-dom	19.1	19.2
eslint	9.33	10.8
eslint-plugin-react-hooks	5.2	7.1
@vitejs/plugin-react	5.0	6.0
svelte	^5.0.0	5.56
@sveltejs/vite-plugin-svelte	6.2	7.3
vue / pinia	^3.0.0 / ^3.0.4	3.5 / 4.0
@types/node	25.9	26.2

Plus @eslint/js, globals, typescript-eslint, @types/react(-dom), @vitejs/plugin-vue, sass-embedded.

Recipes — motoko v5.0.0 → v5.1.0, rust v3.3.0 → v3.4.0, static-site v0.3.1 → v0.3.3. Schema URLs unified on icp-cli v1.3.0 (bitcoin-starter's canister.yaml files were still pinned at v0.2.0).

Motoko — moc 1.9.0 → 1.14.0, core 2.3.1 → 2.6.1.

Rust — ic-cdk 0.19 → 0.20. candid stays "0.10" (0.10.35 is latest).

Tests — now run against icp-dev-env-all:1.2.0 (icp CLI 1.2.0).

persistent actor → actor

Motoko backends now use bare actor, enabled by a new section in mops.toml:

[moc]
args = ["--default-persistent-actors"]

The recipe builds via mops build, which cannot take -- passthrough args, so the flag has to live in mops.toml. This is purely syntactic — the flag makes the optional persistent keyword default to true in the parser, so fields stay stable by default, explicit transient still works, and the Candid interface is unchanged.

Note

--default-persistent-actors is marked _UNDOCUMENTED_ in moc's source, so it is absent from moc --help and carries no documented stability promise. If it were renamed upstream, scaffolded projects would fail with unknown option. Reverting just this part is a small, self-contained change if that trade-off isn't wanted.

Changes beyond version numbers

These were required by the bumps, not optional cleanups:

• ic-cdk 0.20 moved ic_cdk::bitcoin_canister out into the separate ic-cdk-bitcoin-canister crate. bitcoin-starter now depends on it directly; GetBalanceRequest.network is a NetworkInRequest (.into()) and get_bitcoin_canister_id takes Network by value.
• eslint-plugin-react-hooks 7 restructured its config exports. The flat config moved to configs.flat['recommended-latest']; the old path is now eslintrc-shaped and hard-errors under flat config.
• rolldown-vite is deprecated upstream in favour of Vite 8 (npm prints a deprecation notice), so static-website moves to plain vite and drops the overrides block.
• vue-frontend was missing "type": "module", which Vite 8 warns about when loading an ESM vite.config.ts.
• proxy/icp.yaml pointed at a release that does not exist. The proxy-canister v1.0.0 URL 404s; v0.1.0 is the only release, and its proxy.wasm matches the sha256 already in the file, so the tag is corrected. Worth a second opinion in case a v1.0.0 release was pulled.

Verification

All 12 template combinations pass on icp CLI 1.2.0.

make test — 6/6:

PASS  rust                        PASS  hello-world:motoko:react
PASS  motoko                      PASS  hello-world:motoko:vue
                                  PASS  hello-world:rust:react
                                  PASS  hello-world:rust:vue

The 6 templates tests/matrix.yaml does not enumerate were additionally run through the same icp new → build → deploy → verify path — 6/6:

PASS  hello-world:motoko:svelte   PASS  bitcoin-starter:motoko
PASS  hello-world:rust:svelte     PASS  bitcoin-starter:rust
PASS  static-website              PASS  proxy

bitcoin-starter returns real state from get_config on both backends, which is the meaningful check for the ic-cdk 0.20 Bitcoin split and the actor Backend change:

record { network = "regtest"; bitcoin_canister_id = "g4xu7-jiaaa-aaaan-aaaaq-cai" }

Also verified locally: all four frontends install and build, tsc passes on react and svelte, react eslint . exits 0, all three Rust backends compile for wasm32-unknown-unknown, and both Motoko backends build with the Candid compatibility check passing against the committed .did files.

Not covered by any automated check

• The frontends never call the backend. http_check asserts HTTP 200 and a non-empty body on index.html; it never submits the greet form. The @icp-sdk/core 5→6 major bump sits on exactly that path (getCanisterEnv, IC_ROOT_KEY, agent construction).
• npm run dev is untested. Each vite.config.ts shells out to icp network status --json and icp canister status -i to mint the dev cookie; Vite 8 changed config loading and the CLI moved 0.3.2 → 1.2.0.

Both are being checked manually from this branch.

Follow-ups (not in this PR)

• tests/matrix.yaml has no svelte rows, and assert_hello_world_layout in tests/lib.sh omits svelte-frontend from its leftover-directory check. Adding the two svelte permutations would fold the ad-hoc run above into CI — worth doing, since svelte carries the largest dependency jump and currently has zero CI coverage.
• rust/Cargo.lock is tracked despite both .gitignore and CONTRIBUTING saying lock files must not be committed. It is updated here to stay consistent rather than left stale, but it arguably should be untracked.
• The react frontend is held at TypeScript 6.0.3 while svelte and static-website run 7.0.2: typescript-eslint@8.67.0 (its own latest) declares typescript: ">=4.8.4 <6.1.0", and no release supports TS 7 yet. React can move once that lands.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates the ICP CLI templates to current toolchain and dependency versions across frontend (Vite/React/Svelte/Vue), backend (Rust/Motoko), and icp-cli recipe/schema references, keeping templates compatible with the newer ecosystem.

Changes:

• Bump frontend dependencies (notably Vite 8, framework libs, ESLint/TypeScript toolchain) and remove deprecated rolldown-vite usage in static-website.
• Update icp-cli recipe versions and schema URLs across templates; adjust proxy template to a valid proxy-canister release URL.
• Bump Motoko compiler/toolchain and switch templates from persistent actor syntax to actor with --default-persistent-actors configured via mops.toml; bump Rust ic-cdk to 0.20 and update bitcoin-starter for the split bitcoin canister crate.

Reviewed changes

Copilot reviewed 29 out of 30 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
static-website/package.json	Replace rolldown-vite alias/overrides with Vite 8 and bump TypeScript.
static-website/icp.yaml	Update schema URL and static-site recipe version.
rust/icp.yaml	Update schema URL and rust recipe version.
rust/Cargo.toml	Bump ic-cdk to 0.20.
rust/Cargo.lock	Refresh lockfile to match updated Rust dependencies.
proxy/icp.yaml	Update schema URL and correct proxy-canister download URL tag.
motoko/src/main.mo	Switch persistent actor to actor.
motoko/mops.toml	Bump moc and add --default-persistent-actors args.
motoko/icp.yaml	Update schema URL and Motoko recipe version.
Makefile	Bump dev-env image tag used for template tests.
hello-world/vue-frontend/package.json	Add "type": "module" and bump Vue/Pinia/Vite and related tooling versions.
hello-world/vue-frontend/canister.yaml	Update schema URL and static-site recipe version.
hello-world/svelte-frontend/package.json	Bump Svelte/Vite/TypeScript and align pinned dependency ranges.
hello-world/svelte-frontend/canister.yaml	Update schema URL and static-site recipe version.
hello-world/rust-backend/Cargo.toml	Bump ic-cdk to 0.20.
hello-world/rust-backend/canister.yaml	Update schema URL and rust recipe version.
hello-world/react-frontend/package.json	Bump React/Vite/ESLint toolchain and align dependency range pinning.
hello-world/react-frontend/eslint.config.js	Update react-hooks flat-config import path for v7 plugin exports.
hello-world/react-frontend/canister.yaml	Update schema URL and static-site recipe version.
hello-world/motoko-backend/src/main.mo	Switch persistent actor to actor.
hello-world/motoko-backend/mops.toml	Bump moc and add --default-persistent-actors args.
hello-world/motoko-backend/canister.yaml	Update schema URL and Motoko recipe version.
hello-world/icp.yaml	Update schema URL.
bitcoin-starter/rust-backend/src/lib.rs	Switch to ic-cdk-bitcoin-canister crate and update API usage for ic-cdk 0.20 changes.
bitcoin-starter/rust-backend/Cargo.toml	Bump ic-cdk and add ic-cdk-bitcoin-canister dependency.
bitcoin-starter/rust-backend/canister.yaml	Update schema URL and rust recipe version.
bitcoin-starter/motoko-backend/src/main.mo	Switch persistent actor Backend to actor Backend.
bitcoin-starter/motoko-backend/mops.toml	Bump Motoko core, bump moc, and add --default-persistent-actors args.
bitcoin-starter/motoko-backend/canister.yaml	Update schema URL and Motoko recipe version.
bitcoin-starter/icp.yaml	Update schema URL.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.