chore(deps): lock vite 8.3.5 and pin next 16.3.8, with no manifest range moved (takes over #13288, #11845) by objectstack-fleet[bot] · Pull Request #13399 · objectstack-ai/objectui

objectstack-fleet · 2026-10-23T16:16:50Z

Requested by Tesla · project thread

Adds no product-specific widget, dialog, hook or string (see AGENTS.md › Product-neutral renderer)

Takes over two Dependabot PRs that have been red since 2026-10-20 with nobody on them: #13288 (vite 8.2.2 → 8.3.4) and #11845 (next 16.3.6 → 16.3.8). #11844 is the older copy of #11845's bump. Dependabot closes all three by itself once main carries these versions.

What changes

apps/site/package.json: next 16.3.6 → 16.3.8, as chore(deps): Bump next from 16.3.8 to 16.4.1 #11845 did.
pnpm-lock.yaml: vite 8.2.2 → 8.3.5 everywhere, next 16.3.8. No manifest's vite range moves: all 31 keep "vite": "^8.2.1", which already admits 8.3.x.

Why the vite range stays

#13288 raised every "vite": "^8.2.1" to "^8.3.4". Measured on that shape, re-applied on current main 3a73c07b3:

scripts/__tests__/doc-version-claims.test.ts › "pins the skeleton toolchain to the range the in-repo plugin packages declare" goes red: content/docs/guide/plugins.md:425 and skills/objectui/guides/project-setup.md:48 both teach ^8.2.1.
packages/create-plugin/src/__tests__/templates.test.ts › "sources every devDependency range from this repo instead of inventing them" goes red: templates.ts:109 (and packages/cli/src/utils/scaffold-dependencies.ts:146) hard-code ^8.2.1.
Fixing those pages means editing skills/**, which check-governed-queue-guard.mjs --test reads as GOVERNED, so the whole PR would wait on an authorized approver.

So the floor stays where the repo states it, and the upgrade happens in the lockfile. Raising the published floor (@object-ui/cli and @object-ui/create-plugin hand ^8.2.1 to scaffolded apps) is a separate change with its own governed page edit, if anyone wants it.

Lockfile

pnpm update -r vite@8.3.4 --no-save, then pnpm dedupe. Dedupe lands the tree on vite 8.3.5 (the newest in range) with one postcss, autoprefixer and nanoid.
node scripts/check-lockfile-integrity.mjs --base-ref origin/main: VERDICT clean — no package gained a copy (1774 resolutions, base and head). chore(deps): bump vite from 8.2.2 to 8.3.4 #13288's lock added a second autoprefixer and nanoid, which is the red it carried.
node scripts/check-lockfile-dedupe.mjs --report-only: VERDICT deduped.

Local verification (head `097db08c0`, pin `830a63a6` built by `pnpm run setup`)

pnpm turbo run type-check --concurrency=2: 81 of 81 tasks successful.
vitest run --project unit --maxWorkers=2: Test Files 1656 passed, 3 skipped (1659); Tests 31722 passed, 65 skipped. The dom and dom-heavy projects were not run here; CI's 16 shards run them.
doc-version-claims.test.ts: 29 of 29 passed.

No changeset: only apps/site (private) and the lockfile change, and check-changeset-presence does not read dependency fields.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UBfoEFdVTZ9yyEX5HxsHe4

…nge moved Takes over Dependabot's objectui#13288 (vite 8.2.2 -> 8.3.4) and objectui#11845 (next 16.3.6 -> 16.3.8), both red since 2026-10-20. - `apps/site` pins `next` 16.3.8, as #11845 did. - vite moves in the lockfile only. Every manifest keeps `"vite": "^8.2.1"`, which already admits 8.3.x. Raising the range, as #13288 did, makes the docs and skill pages that teach the plugin skeleton stale (`doc-version-claims`, `create-plugin` templates), and one of them, `skills/objectui/guides/project-setup.md`, is a governed surface, which is why #13288 could never go green on its own. - `pnpm update -r vite@8.3.4 --no-save`, then `pnpm dedupe`, which lands the whole tree on vite 8.3.5 with postcss and nanoid at one copy each: `check-lockfile-integrity` reads no package gaining a copy (1774 resolutions before and after), where #13288's lock added a second autoprefixer and nanoid. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UBfoEFdVTZ9yyEX5HxsHe4

github-actions · 2026-10-23T16:22:23Z

✅ Console Performance Budget

Metric	Value	Budget
Eager closure (gzip, 77 chunks)	3242.2 KB	3744.1 KB
Main entry chunk (gzip)	81.8 KB	350 KB
Entry file	`index-DTB3rF_1.js`	—
Status	PASS	—

The eager closure is every chunk the entry reaches through static imports — what the browser fetches and parses before the app renders. The entry chunk on its own is a small fraction of it.

📦 Bundle Size Report

Package	Size	Gzipped
app-shell (buildIdentity.js)	0.80KB	0.49KB
app-shell (consoleActionDispatch.js)	0.20KB	0.19KB
app-shell (index.js)	21.41KB	7.90KB
app-shell (runtime-config.js)	24.52KB	8.48KB
app-shell (types.js)	0.01KB	0.04KB
app-shell (urlParams.js)	10.11KB	3.87KB
auth (ActiveOrganizationStorage.js)	27.95KB	10.04KB
auth (AuthContext.js)	0.31KB	0.24KB
auth (AuthGuard.js)	2.07KB	1.00KB
auth (AuthProvider.js)	45.59KB	12.03KB
auth (AuthShell.js)	3.49KB	1.40KB
auth (ForgotPasswordForm.js)	12.21KB	3.45KB
auth (LoginForm.js)	20.67KB	6.12KB
auth (PreviewBanner.js)	0.90KB	0.50KB
auth (RegisterForm.js)	6.72KB	2.24KB
auth (SocialSignInButtons.js)	9.74KB	3.94KB
auth (UserMenu.js)	3.39KB	1.21KB
auth (auth-gate-events.js)	1.62KB	0.83KB
auth (authStyles.js)	5.27KB	1.86KB
auth (createAuthClient.js)	42.84KB	11.66KB
auth (createAuthenticatedFetch.js)	8.54KB	3.46KB
auth (index.js)	3.63KB	1.64KB
auth (invitation-status.js)	1.22KB	0.70KB
auth (org-roles.js)	6.66KB	2.78KB
auth (phone-identifier.js)	1.11KB	0.66KB
auth (types.js)	0.59KB	0.35KB
auth (useAuth.js)	5.30KB	1.02KB
auth (useWorkspaceAdminStatus.js)	11.08KB	4.58KB
collaboration (CommentThread.js)	27.26KB	8.03KB
collaboration (LiveCursors.js)	3.17KB	1.27KB
collaboration (PresenceAvatars.js)	6.28KB	2.60KB
collaboration (PresenceProvider.js)	2.79KB	1.13KB
collaboration (commentAuthorship.js)	1.39KB	0.78KB
collaboration (index.js)	1.93KB	0.85KB
collaboration (useCollaborationTranslation.js)	6.50KB	2.52KB
collaboration (useCommentSearch.js)	1.98KB	0.88KB
collaboration (useConflictResolution.js)	7.75KB	1.86KB
collaboration (useMentionNotifications.js)	1.81KB	0.68KB
collaboration (usePresence.js)	6.33KB	1.84KB
collaboration (useRealtimeSubscription.js)	7.91KB	2.01KB
components (index.js)	614.12KB	150.38KB
core (index.js)	10.18KB	4.04KB
create-plugin (index.js)	27.94KB	9.51KB
data-objectstack (index.js)	253.04KB	70.68KB
fields (index.js)	295.17KB	75.63KB
i18n (LocalizationContext.js)	2.92KB	1.42KB
i18n (builtinAggregateLabels.js)	0.86KB	0.49KB
i18n (currency.js)	2.59KB	1.22KB
i18n (fallbackInterpolation.js)	6.25KB	2.77KB
i18n (i18n.js)	8.87KB	3.64KB
i18n (index.js)	5.52KB	2.39KB
i18n (pickLocalized.js)	9.86KB	3.95KB
i18n (provider.js)	39.35KB	12.88KB
i18n (translateFn.js)	0.20KB	0.18KB
i18n (useDisplayLocale.js)	3.52KB	1.76KB
i18n (useObjectLabel.js)	36.87KB	9.88KB
i18n (useSafeTranslation.js)	7.14KB	2.92KB
layout (index.js)	41.17KB	11.96KB
mobile (MobileProvider.js)	0.92KB	0.49KB
mobile (ResponsiveContainer.js)	0.94KB	0.38KB
mobile (breakpoints.js)	1.51KB	0.70KB
mobile (createOfflineDataSource.js)	5.61KB	1.75KB
mobile (index.js)	1.99KB	0.87KB
mobile (offlineQueue.js)	3.91KB	1.35KB
mobile (pwa.js)	0.97KB	0.49KB
mobile (serviceWorker.js)	1.48KB	0.62KB
mobile (serviceWorkerSource.js)	3.41KB	1.48KB
mobile (useBreakpoint.js)	1.54KB	0.65KB
mobile (useGesture.js)	6.96KB	1.98KB
mobile (useOfflineSync.js)	1.99KB	0.72KB
mobile (usePullToRefresh.js)	6.62KB	2.45KB
mobile (useResponsive.js)	0.72KB	0.42KB
mobile (useSpecGesture.js)	5.52KB	2.10KB
mobile (useTouchTarget.js)	1.01KB	0.54KB
permissions (MePermissionsProvider.js)	15.35KB	5.51KB
permissions (PermissionContext.js)	0.31KB	0.25KB
permissions (PermissionGuard.js)	0.89KB	0.45KB
permissions (PermissionProvider.js)	6.82KB	2.38KB
permissions (ServerReadScope.js)	4.03KB	1.82KB
permissions (discardProofCache.js)	1.04KB	0.55KB
permissions (evaluator.js)	8.33KB	3.07KB
permissions (index.js)	0.99KB	0.43KB
permissions (store.js)	0.91KB	0.42KB
permissions (useFieldPermissions.js)	1.28KB	0.53KB
permissions (usePermissions.js)	4.83KB	2.27KB
plugin-ai (index.js)	16.01KB	3.91KB
plugin-calendar (index.js)	55.41KB	16.19KB
plugin-charts (index.js)	85.95KB	23.65KB
plugin-chatbot (index.js)	237.89KB	56.23KB
plugin-dashboard (index.js)	147.15KB	39.95KB
plugin-designer (index.js)	232.83KB	50.01KB
plugin-detail (index.js)	267.08KB	71.10KB
plugin-editor (index.js)	2.21KB	1.04KB
plugin-form (index.js)	185.46KB	48.48KB
plugin-gantt (index.js)	178.19KB	45.06KB
plugin-grid (index.js)	277.57KB	77.38KB
plugin-kanban (index.js)	64.27KB	19.81KB
plugin-list (index.js)	149.54KB	39.24KB
plugin-map (index.js)	27.11KB	8.99KB
plugin-markdown (index.js)	13.79KB	4.79KB
plugin-report (index.js)	46.42KB	13.06KB
plugin-timeline (index.js)	39.30KB	11.87KB
plugin-tree (index.js)	15.25KB	5.38KB
plugin-view (index.js)	94.26KB	24.27KB
providers (DataSourceProvider.js)	0.75KB	0.39KB
providers (MetadataProvider.js)	1.37KB	0.59KB
providers (ThemeProvider.js)	1.90KB	0.85KB
providers (UploadProvider.js)	12.07KB	3.68KB
providers (index.js)	0.45KB	0.23KB
providers (types.js)	0.01KB	0.04KB
react-runtime (index.js)	5.62KB	2.34KB
react (LazyPluginLoader.js)	4.47KB	1.63KB
react (SchemaRenderer.js)	129.13KB	42.23KB
react (data-invalidation.js)	5.05KB	2.08KB
react (index.js)	4.71KB	2.11KB
react (schema-input.js)	4.31KB	2.07KB
react (spec-input.js)	0.20KB	0.18KB
sdui-parser (body-dialect.js)	4.50KB	1.99KB
sdui-parser (codegen.js)	9.45KB	3.76KB
sdui-parser (dashboard-widget-options.js)	3.07KB	1.30KB
sdui-parser (index.js)	7.30KB	3.12KB
sdui-parser (input-type.js)	2.84KB	1.40KB
sdui-parser (parse.js)	25.28KB	7.81KB
sdui-parser (provenance.js)	3.84KB	1.90KB
sdui-parser (types.js)	0.29KB	0.24KB
sdui-parser (validate.js)	23.87KB	7.83KB
types (ai.js)	4.39KB	2.17KB
types (api-types.js)	0.20KB	0.18KB
types (app.js)	4.12KB	1.61KB
types (authoring-nodes.js)	0.20KB	0.19KB
types (base.js)	0.20KB	0.18KB
types (blocks.js)	0.20KB	0.18KB
types (cloud.js)	0.20KB	0.18KB
types (complex.js)	4.44KB	2.07KB
types (crud.js)	0.20KB	0.18KB
types (dashboard-filter-alias.js)	6.23KB	2.74KB
types (dashboard-widget-layout.js)	2.06KB	0.96KB
types (data-display.js)	3.75KB	1.85KB
types (data-protocol.js)	0.20KB	0.19KB
types (data.js)	0.20KB	0.18KB
types (designer.js)	1.85KB	0.85KB
types (disclosure.js)	0.20KB	0.18KB
types (error-code.js)	1.54KB	0.88KB
types (expression.js)	0.20KB	0.18KB
types (feedback.js)	0.20KB	0.18KB
types (field-types.js)	1.13KB	0.65KB
types (form.js)	0.20KB	0.18KB
types (http-inflight.js)	8.87KB	3.73KB
types (http-retry.js)	4.32KB	2.02KB
types (icon-key-migration.js)	4.26KB	1.63KB
types (index.js)	5.78KB	2.70KB
types (layout.js)	0.20KB	0.18KB
types (managed-by.js)	0.19KB	0.18KB
types (mobile.js)	5.00KB	2.39KB
types (navigation.js)	0.20KB	0.18KB
types (node-slots.js)	7.18KB	2.34KB
types (objectql.js)	0.20KB	0.18KB
types (overlay.js)	0.20KB	0.18KB
types (permissions.js)	2.52KB	1.31KB
types (plugin-scope.js)	0.20KB	0.18KB
types (product-blocks.js)	0.20KB	0.19KB
types (record-approval-decision.js)	0.20KB	0.20KB
types (record-components.js)	0.20KB	0.19KB
types (record-panels.js)	0.20KB	0.19KB
types (record-semantics.js)	1.28KB	0.67KB
types (registry.js)	0.20KB	0.18KB
types (reports.js)	0.20KB	0.18KB
types (select-option.js)	0.20KB	0.19KB
types (spec-report.js)	4.99KB	1.96KB
types (spec-ui-namespace.js)	0.20KB	0.19KB
types (strict-authoring-face.js)	19.93KB	7.26KB
types (system-fields.js)	3.33KB	1.54KB
types (theme.js)	6.28KB	2.87KB
types (ui-action.js)	8.48KB	3.50KB
types (views.js)	0.20KB	0.18KB
types (widget.js)	0.20KB	0.18KB

Size Limits

✅ Core packages should be < 50KB gzipped
✅ Component packages should be < 100KB gzipped
⚠️ Plugin packages should be < 150KB gzipped

objectstack-fleet Bot assigned os-tesla Oct 23, 2026

objectstack-fleet Bot added the dependencies label Oct 23, 2026

github-actions Bot added the apps label Oct 23, 2026

objectstack-fleet Bot marked this pull request as ready for review October 23, 2026 16:33

objectstack-fleet Bot enabled auto-merge October 23, 2026 16:33

objectstack-fleet Bot added this pull request to the merge queue Oct 23, 2026

Merged via the queue into main with commit 889d028 Oct 23, 2026
37 checks passed

objectstack-fleet Bot deleted the claude/project-thread-7altyb branch October 23, 2026 16:49

zhuangjianguo mentioned this pull request Aug 30, 2026

[PM seat] domain:server — 🟢 os-project-manager objectstack-ai/objectstack#6367

Open

Navigation Menu

Repository navigation

chore(deps): lock vite 8.3.5 and pin next 16.3.8, with no manifest range moved (takes over #13288, #11845) - #13399

chore(deps): lock vite 8.3.5 and pin next 16.3.8, with no manifest range moved (takes over #13288, #11845)#13399
objectstack-fleet[bot] merged 1 commit into
mainfrom
claude/project-thread-7altyb

objectstack-fleet Bot commented Oct 23, 2026

Uh oh!

github-actions Bot commented Oct 23, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

objectstack-fleet Bot commented Oct 23, 2026

What changes

Why the vite range stays

Lockfile

Local verification (head 097db08c0, pin 830a63a6 built by pnpm run setup)

Uh oh!

github-actions Bot commented Oct 23, 2026

✅ Console Performance Budget

📦 Bundle Size Report

Size Limits

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Local verification (head `097db08c0`, pin `830a63a6` built by `pnpm run setup`)