# Libraries and version policy Major dependencies, their declared versions, owners and upgrade constraints. Versions below are read from `pnpm-workspace.yaml`’s catalog and workspace manifests at this documentation revision. A range is shown as declared; the lockfile owns its resolved version. Package locations identify direct consumers, not every transitive import. ## Upgrade policy [#upgrade-policy] The catalog uses exact pins. `minimumReleaseAge: 2880` enforces a two-day quarantine, including transitive resolution and frozen installs. Choose the newest version old enough to qualify. The workspace currently has no `minimumReleaseAgeExclude` entries. Only a security fix may bypass the quarantine: an exact-version entry with its advisory commented, removed once the version is two days old. The docs integration pins `fumadocs-mdx` 15.4.7 and `fumadocs-core` 16.17.1. At selection time (2026-10-15 06:12 UTC), core 16.17.2 was less than 48 hours old. No docs dependency receives a quarantine exclusion. No `fumadocs-ui` is installed. Keep Drizzle kit/ORM on the same build, Better Auth and its adapters compatible, the MCP SDK verified with the auth plugin, and one files-sdk copy across consumers. The files-sdk patch is version-specific. Effect persistence/pin changes require ADR-0006’s workerd fault gate. The JavaScript updater deliberately refuses coupled/native upgrades that need their own verification. ## Dependency reference [#dependency-reference] | Library | Declared version | Why it is here | Direct consumers | | ---------------------------------- | -------------------- | ------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `@base-ui/react` | `1.9.0` | Accessible unstyled UI primitives. | `packages/ui` | | `@better-auth/core` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `packages/auth` | | `@better-auth/drizzle-adapter` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `packages/auth` | | `@better-auth/mcp` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` | | `@better-auth/oauth-provider` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` | | `@better-auth/passkey` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` | | `@clack/prompts` | `1.8.1` | Interactive setup prompts. | `packages/project-setup-cli` | | `@cloudflare/vite-plugin` | `1.63.1` | Build TanStack Start for workerd. | `apps/web` | | `@effect/sql-pg` | `4.0.2` | Workerd persisted-queue spike; not the production queue backend. | `packages/api` | | `@effect/vitest` | `4.0.2` | Test Effect timeouts using a virtual clock. | `packages/api`, `packages/email` | | `@firecrawl/anydoc-wasm` | `0.2.4` | Browser document conversion to Markdown; patched for per-conversion instances. | `apps/web`, `packages/api` | | `@fontsource-variable/inter` | `5.3.0` | Locally hosted product typography. | `apps/web`, `packages/ui` | | `@headless-tree/core` | `1.7.0`, `^1.7.0` | Headless hierarchical tree behavior. | `apps/web`, `packages/ui` | | `@headless-tree/react` | `1.7.0` | React tree integration. | `apps/web` | | `@modelcontextprotocol/server` | `2.3.1` | MCP server protocol and tool transport. | `apps/web`, `packages/api` | | `@orpc/client` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api`, `packages/errors` | | `@orpc/openapi` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api` | | `@orpc/server` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api`, `packages/errors` | | `@orpc/shared` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `packages/api` | | `@orpc/tanstack-query` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web` | | `@orpc/zod` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api` | | `@shadcn/react` | `0.3.1` | Shared shadcn integration. | `packages/ui` | | `@t3-oss/env-core` | `0.13.11` | Validated environment contracts. | `packages/env` | | `@takumi-rs/core` | `2.15.1` | Native development rendering for OG images. | `apps/web` | | `@takumi-rs/wasm` | `2.15.1` | Worker-compatible OG renderer. | `apps/web` | | `@tanstack/ai` | `0.68.0` | Assistant streaming, client state, persistence or provider adapter. | `apps/web`, `packages/db`, `packages/api` | | `@tanstack/ai-anthropic` | `0.21.1` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-client` | `0.39.2` | Assistant streaming, client state, persistence or provider adapter. | `apps/web` | | `@tanstack/ai-gemini` | `0.37.2` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-openai` | `0.29.1` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-persistence` | `0.8.3` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-react` | `0.30.3` | Assistant streaming, client state, persistence or provider adapter. | `apps/web` | | `@tanstack/react-form` | `1.33.5` | Typed form state and validation. | `apps/web` | | `@tanstack/react-query` | `5.104.2` | Server state, caching and invalidation. | `apps/web` | | `@tanstack/react-router` | `1.170.44` | Typed routing and navigation. | `apps/web` | | `@tanstack/react-router-ssr-query` | `1.167.3` | SSR/query hydration integration. | `apps/web` | | `@tanstack/react-start` | `1.169.1` | SSR and HTTP route entry points. | `apps/web`, `packages/intl` | | `@tanstack/react-table` | `9.3.1` | Data table state. | `apps/web` | | `@tanstack/react-virtual` | `3.14.17` | Virtualized lists for the ReUI cascader. | `packages/ui` | | `@types/node` | `26.6.5` | Compile-time declarations; no application runtime. | `.`, `packages/env` | | `@types/react` | `19.2.4`, `~19.2.4` | Compile-time declarations; no application runtime. | `apps/web`, `packages/ui`, `packages/intl`, `packages/react-utils` | | `@types/react-dom` | `19.3.0` | Compile-time declarations; no application runtime. | `apps/web`, `packages/ui`, `packages/intl` | | `aws4fetch` | `1.0.20` | Worker-side S3 signing for direct and multipart R2 uploads. | `packages/storage` | | `babel-plugin-react-compiler` | `1.0.0` | Compile supported React components/hooks. | `apps/web` | | `better-auth` | `1.7.7` | Identity, sessions and plugin integration. | `apps/web`, `packages/auth`, `packages/db` | | `class-variance-authority` | `0.7.1` | Typed component variants. | `packages/ui` | | `cmdk` | `1.1.1` | Command palette behavior. | `packages/ui` | | `cn` | `0.4.0` | Conditional class composition. | `packages/ui` | | `date-fns` | `4.4.0` | Date manipulation in shared UI. | `apps/web`, `packages/ui` | | `dotenv` | `18.0.7` | Load local server/script environment files. | `.`, `apps/web`, `packages/auth`, `packages/env`, `packages/db`, `packages/api` | | `drizzle-kit` | `1.0.0-rc.5-5935859` | Generate reviewed SQL migrations with the matching ORM build. | `packages/db` | | `drizzle-orm` | `1.0.0-rc.5-5935859` | Typed queries, schema and relations. | `apps/web`, `packages/flags`, `packages/auth`, `packages/db`, `packages/api` | | `effect` | `4.0.2` | Bounded jobs and outbound transports, using stable APIs. | `packages/api`, `packages/email` | | `embla-carousel-react` | `8.6.0` | Carousel primitives. | `packages/ui` | | `evlog` | `2.31.0` | Structured application logging. | `apps/web` | | `files-sdk` | `2.6.2` | Files gateway, storage operations and soft deletion. | `apps/web`, `packages/storage`, `packages/api` | | `fumadocs-core` | `16.17.1` | Page tree, metadata loading and server search without a UI theme. | `apps/web` | | `fumadocs-mdx` | `15.4.7` | Compile MDX, frontmatter, searchable text and processed Markdown at build time. | `apps/web` | | `i18next` | `26.4.4` | Language resources and translation. | `apps/web`, `packages/intl` | | `input-otp` | `1.5.0` | One-time-code input. | `packages/ui` | | `lucide-react` | `1.56.0` | Consistent interface icons. | `apps/web`, `packages/ui` | | `neon` | `8.4.1` | Setup-time Neon provisioning. | `packages/project-setup-cli` | | `next-themes` | `0.4.6` | Existing web theme provider. | `apps/web`, `packages/ui` | | `nitro` | `3.0.260903-beta` | Node development/server build adapter. | `apps/web` | | `oxfmt` | `0.72.0` | Formatting. | `.` | | `oxlint` | `1.87.0` | Linting and module-boundary rules. | `.` | | `pg` | `8.23.1` | Postgres transport for Drizzle. | `apps/web`, `packages/auth`, `packages/db`, `packages/api` | | `qrcode.react` | `^4.2.0` | Web QR codes for account/security flows. | `apps/web` | | `react` | `19.2.3`, `19.3.0` | Component rendering. | `apps/web`, `packages/ui`, `packages/intl`, `packages/react-utils` | | `react-day-picker` | `10.0.2` | Calendar selection. | `packages/ui` | | `react-dom` | `19.2.3`, `19.3.0` | Web rendering and server HTML output. | `apps/web`, `packages/ui`, `packages/intl`, `packages/react-utils` | | `react-i18next` | `17.0.16` | React translation bindings. | `apps/web`, `packages/intl` | | `react-phone-number-input` | `3.4.18` | Phone input. | `packages/ui` | | `react-resizable-panels` | `4.14.5` | Resizable panels. | `packages/ui` | | `recharts` | `3.10.1` | Application charts. | `apps/web`, `packages/ui` | | `shadcn` | `4.21.4` | Component installation and registry tooling. | `packages/ui` | | `shiki` | `4.5.0` | Syntax highlighting; docs run it at build time. | `packages/ui` | | `sonner` | `2.0.8` | Toast feedback. | `apps/web`, `packages/ui` | | `tailwindcss` | `4.3.3` | Semantic utility styling. | `apps/web`, `packages/ui` | | `takumi-js` | `2.15.1` | JSX-to-OG rendering integration. | `apps/web` | | `turbo` | `2.11.7` | Workspace task orchestration. | `.` | | `tw-animate-css` | `1.4.0` | UI animation utilities. | `packages/ui` | | `typescript` | `7.0.2` | Type checking. | `.`, `apps/web`, `packages/ui`, `packages/flags`, `packages/intl`, `packages/auth`, `packages/storage`, `packages/env`, `packages/react-utils`, `packages/db`, `packages/api`, `packages/errors`, `packages/email` | | `vaul` | `1.1.2` | Drawer behavior. | `packages/ui` | | `vite` | `8.3.4` | Web build pipeline and development server. | `apps/web` | | `vitest` | `5.0.4` | Unit and integration test runner. | `apps/web`, `packages/ui`, `packages/flags`, `packages/intl`, `packages/auth`, `packages/storage`, `packages/env`, `packages/react-utils`, `packages/db`, `packages/api`, `packages/errors`, `packages/email` | | `wrangler` | `4.149.0` | Worker build/deploy/local runtime. | `apps/web` | | `zod` | `4.6.7` | Validate public contracts and third-party payloads. | `.`, `apps/web`, `packages/flags`, `packages/auth`, `packages/env`, `packages/db`, `packages/api`, `packages/errors` | | `@aws-sdk/client-s3` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@aws-sdk/lib-storage` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@aws-sdk/s3-presigned-post` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@aws-sdk/s3-request-presigner` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` |