- next 16.2.7 -> 16.2.6 in both apps. 16.2.7 regresses Turbopack dev route
matching for API routes nested below a dynamic segment (probed in the
private repo: /api/items/[id]/fork, /api/scenes/[id]/events 404 with the
router's HTML not-found; production builds unaffected; bisected
16.2.6 good / 16.2.7 bad). 16.2.6 carries all the 16.2.5/16.2.6
security fixes — only the bugfix backports are forgone.
- Remove @react-three/uikit-lucide from @pascal-app/editor dependencies:
zero imports in this repo or private-editor; dead weight in every npm
consumer's install.
- Pin @visual-json/react "latest" -> "^0.4.0" (current resolution;
"latest" in a published package's deps is unreproducible and was
inconsistent with private-editor's ^0.4.0).
- Add root override three: 0.184.0, mirroring private-editor's dedupe —
drops the nested stats-gl three@0.170.0 so the lockfile resolves a
single three (the stated single-instance invariant now holds here too).
Verified: build, check-types, biome check, 931 package tests green;
lockfile resolves one next (16.2.6) and one three (0.184.0);
oxide/lightningcss optionalDependency pins still match resolutions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Range edits:
- next 16.2.1 -> 16.2.7 in apps/editor + apps/ifc-converter. 16.2.5/16.2.6
fixed six high-severity advisories (middleware bypass, DoS, SSRF, XSS,
RSC cache poisoning); 16.2.7 is bugfix backports. No API/config changes.
- typescript 6.0.2 -> 6.0.3 everywhere, including aligning the 5.9.3
stragglers (@pascal-app/mcp, @repo/ui, @repo/eslint-config) that date
from the original scaffold and were never intentionally held back.
- @types/node in @pascal-app/mcp: ^25.5.0 -> ^22.19.20 — mcp was the only
workspace typed against non-LTS node 25; 22 matches the release
workflow's node and every other workspace.
- @number-flow/react ^0.5.14 -> ^0.6.0 (packages/editor, apps/editor);
the only breaking change (removed --number-flow-char-height CSS var)
is unused here.
- agentation ^2.3.2 -> ^3.0.2 (apps/editor devtool; v3 is a drop-in for
the props-less <Agentation /> usage, additions are opt-in).
- Root overrides: @types/react 19.2.14 -> 19.2.17,
@types/three 0.184.0 -> 0.184.1 (types-only fixes).
Lockfile refresh within existing ranges picks up react 19.2.7 (pairs with
next 16.2.7 — 19.2.6 had a server-action FormData regression), motion
12.40.0, three-mesh-bvh 0.9.10, @react-three/uikit-lucide 1.0.73, the
June radix wave, lucide-react 1.17.0, zustand 5.0.14, tailwind-merge
3.6.0, geist 1.7.2 (fixes Geist Mono ligature regression), react-grab
0.1.44, biome 2.4.16 + ultracite 7.8.2, turbo 2.9.17.
Held: three stays 0.184.0 (npm latest; single-instance constraint),
tailwindcss 4.3.0 + lightningcss 1.32.0 already match the pinned
optionalDependencies native binaries, eslint 10 major not taken
(@repo/ui is unconsumed legacy scaffold).
Verified: turbo build, check-types, biome check, and 931 package tests
green; bun.lock stays lockfileVersion 1 (CI bun 1.3.0 compatible);
single next/three resolution confirmed.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two bugs in one fix:
1. The 0.8.0 release commit only bumped .version, not the inter-package
peerDependencies / devDependencies. So the published packages still
declared peer constraints like "@pascal-app/viewer": "^0.7.0". Caret
in semver 0.x doesn't allow 0.8.0 to satisfy ^0.7.0, so bun resolves
workspace consumers (and apps/editor's deep import paths) to the
stale npm-published 0.7.0 instead of the workspace 0.8.0 — meaning
local edits never show up in apps/editor or any linked consumer.
2. The release.yml sync step was using $GITHUB_ENV to read back the new
versions in the same step, which doesn't work — env-file writes only
surface in subsequent steps. Switched to a bash associative array
(NEW_VERSIONS) for in-step lookup, kept the $GITHUB_ENV write for the
downstream publish/commit/tag steps. Also added a final "refs after
sync" debug print so this is visible in the workflow log.
After this lands and you bun install, packages/editor/node_modules/@pascal-app/viewer
should symlink to the workspace packages/viewer/, not to .bun/@pascal-app+viewer@0.7.0.
Future releases will sync peerDeps correctly on their own.
Wholesale swap of packages/{core,viewer,editor,mcp} and apps/editor with the
versions from the private editor repo, which is the production source of truth.
Setup changes:
- packages/{core,viewer,editor} versions held at 0.7.0 baseline (matching
the most recent published release) so a bump=minor publishes 0.8.0
- packages/mcp held at 0.1.1 (never published; first publish will go through
the new release.yml flow)
- peerDependencies and devDependencies for inter-package @pascal-app/*
references pinned to ^0.7.0 instead of '*' / 'workspace:*' so they are
valid for npm consumers
- Root package.json: TypeScript bumped to 6.0.2, added overrides for
@types/react, @types/react-dom, @types/three to prevent JSX namespace
fragmentation across the workspace
- release.yml extended to also publish editor and mcp; 'both' option renamed
to 'all'; added a sync step that updates inter-package peerDeps/devDeps to
match the new versions on every bump (so viewer/editor/mcp tarballs always
reference the version of core they were built against)
- Root scripts gained release:editor and release:mcp shortcuts
Verification:
- bun install --frozen-lockfile is consistent
- packages/{core,viewer,mcp} build cleanly, dist/index.d.ts emitted
- packages/editor check-types reports 21 pre-existing errors, identical to
what private-editor currently reports
Open PRs against editor-v2 will need rebasing/conflict resolution.
