Repository navigation
chore(deps): batch Next, React, R3F and Bun upgrades - #1021
Conversation
…t-dependencies/xml-parser-20261008
pascal
Bot
changed the title
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit c1572c2. Configure here.
| "node": ">=20.9.0" | ||
| }, | ||
| "packageManager": "bun@1.3.14", | ||
| "packageManager": "bun@1.4.2", |
There was a problem hiding this comment.
Bun version pins left mismatched
Medium Severity
packageManager now declares bun@1.4.2, but Dockerfile and .github/workflows/release.yml still install 1.3.14. Those files already document that this skew makes bun install --frozen-lockfile fail, so Docker builds and release publishes can break while main CI, which reads package.json, still passes.
Reviewed by Cursor Bugbot for commit c1572c2. Configure here.
Changes
Reuse the existing XML-parser upgrade branch for the daily dependency batch:
The branch also aligns the vendored pointer-event provenance and installed-version regression with R3F 9.8.1. Root overrides pin the React/R3F versions; independent review must verify compatibility and the vendored implementation, not assume the label change proves parity. The diff spans 14 files, including manifests, bun.lock and the pointer-event implementation/test.
Validation
Current head: c1572c2.
GitHub checks on this exact head passed: quality, cli-smoke, Changed paths and ci (run 38090816790 and run 38090816781). GitHub reports the draft mergeable.
Earlier local validation in this PR covered an older XML-only head and does not validate this expanded batch. Independent repository-native validation and guarded review are still required. No merge, publication or deployed acceptance is claimed.
Note
Medium Risk
Upgrades the full React/Next/R3F runtime and re-baselines vendored 3D pointer-event logic; regressions could affect rendering, routing, and editor interaction unless differential tests and CI cover the new stack.
Overview
Batches a monorepo dependency upgrade: Next.js 16.4.0, React / React DOM 19.3.0 (with matching
@types), and @react-three/fiber 9.8.1 across apps and packages. Rootpackage.jsonoverrides now also pinreact,react-dom, and@react-three/fiberso the workspace resolves a single stack.Bun is bumped to 1.4.2 (
packageManagerand@types/bun). fast-xml-parser moves to 5.11.2 at the root and in editor-related dev deps.@next/eslint-plugin-nextfollows Next at 16.4.0.bun.lockreflects transitive updates (e.g. sharp, scheduler) from those bumps.In
@pascal-app/viewer, the vendoredpointer-events.tsprovenance and the differential test’s version pin are updated from R3F 9.6.1 → 9.8.1 so custom pointer/camera-drag behavior stays aligned with the installed fiber version.Reviewed by Cursor Bugbot for commit c1572c2. Bugbot is set up for automated code reviews on this repo. Configure here.