Skip to content

🤖 fix: bump effect to stable 4.0.4 and dependencies within range - #7625

Merged
ThomasK33 merged 6 commits into
mainfrom
dependencies-23jh
Oct 26, 2026
Merged

ThomasK33 merged 6 commits into
mainfrom
dependencies-23jh

Conversation

@ThomasK33

@ThomasK33 ThomasK33 commented Oct 26, 2026 •

Copy link
Copy Markdown
Member

Summary

Moves effect from 4.0.0-rc.112 to stable 4.0.4 and takes every dependency update that stays inside its semver range and passes our gates, in the root app, vscode/ and packages/chat-components. Packages whose newest in-range release breaks us are pinned exactly at the last working version, with the reason below.

Background

We were still on an Effect v4 release candidate after v4 went stable, and many other dependencies had drifted behind their in-range releases. Majors are out of scope for this PR.

Implementation

Five commits:

  1. effect 4.0.0-rc.112 → 4.0.4. 4.0.5 and later rewrite TestClock and break the streamBridge and routerSubscriptions heartbeat tests, so this stops at 4.0.4.
  2. bun update (Bun 1.4.3, 7-day minimumReleaseAge respected) plus in-range bumps of exact pins: @aws-sdk/client-bedrock 3.1152.0, @modelcontextprotocol/client 2.3.1, @duckdb/node-api 1.5.6-r.1, the playwright trio 1.64.1, eslint-plugin-storybook 10.6.2. The trpc-cli patch is ported to 0.12.4 (the code moved to dist/parse-router.js).
  3. vscode/: @types/node 20.19.43, esbuild 0.27.7 (@types/vscode stays at 1.107 so it does not pass engines.vscode). packages/chat-components: tailwind-merge 3.7, @types/react 19.3, vite 6.4.4.
  4. Fixes for what CI found on the first push: hold jest and every @radix-ui package at main's versions, remove a nested marked 17.0.6 that streamdown had resolved next to the root 17.0.1 pin, and move one highlightWorker test off c3 (Shiki 3.23 added a c3 grammar).
  5. Pin those holds exactly in package.json (jest, babel-jest, each direct @radix-ui dependency) and keep main's nested streamdown/rehype-harden 1.1.7.

Code changes the bumps needed:

  • react-router stabilized useTransitions (dropped the unstable_ prefix).
  • Tailwind 4.3 made scrollbar-none a core utility, which changes the class order in 5 files.
  • geist renamed LICENSE.TXT to LICENSE.txt.
  • @types/node 24.19 / undici 7.30 overload changes needed small type fixes in five tests.

Held back (pinned exactly)

Package Pinned at Why the newer in-range release is held
ai, @ai-sdk/* ai 7.0.107, @ai-sdk/* at their current lock versions 7.0.143 changes DecisionModel/EvaluationModel types (~100 type errors in streamManager). Needs its own PR.
rehype-harden 1.1.6 (streamdown's nested copy stays at main's 1.1.7) 1.1.8 lets relative links through without a defaultOrigin, which MarkdownFilePreview relies on blocking.
@novnc/novnc 1.6.0 1.7 drops the lib/ CJS build we import.
posthog-node 5.56.0 5.56.1 adds a dynamic @opentelemetry/api import that check-startup-imports cannot resolve.
@swc/core (override) 1.15.3 1.16 breaks vite-plugin-top-level-await.
prettier 3.7.4 3.9 reformats 182 files.
typescript-eslint 8.48.1 8.71 adds ~620 type-aware lint errors.
@types/bun 1.3.3 1.4.3 references a @types/node 26 type.
jest, babel-jest 30.2.0 30.5 makes module.register() throw in its sandboxed loader. Storybook's serverRequire calls it to load .storybook/test-runner.ts, so every Storybook suite fails to run.
@radix-ui/* main's versions, direct deps pinned exactly Radix 1.3 (dismissable-layer 1.2) changes Escape and outside-pointer handling: the analytics modal Escape test, the bug-bash repros that probe the DismissableLayer fiber, and four Pixel stories broke. Needs its own PR.
ghostty-web 0.4.0-next.7 Newer than the 0.4.0 that ^ resolves to.

Validation

  • make typecheck, make static-check, make lint-eslint, make build pass after the rebase on main.
  • Storybook test-runner locally: 148 suites, 814 tests pass.
  • make test-bugbash-repros-sandbox: 74 + 2 repro files pass.
  • tests/ui/layout/analyticsModal.test.ts (jest) passes again after the Radix hold.
  • The bug-bash sandbox inputs key is unchanged (playwright-core version kept), so the pinned sandbox image stays valid.
  • Bug bash on the first push (before the jest and Radix holds): 6 default charters with Sonnet 5.5 in the sandbox ($2.45). No confirmed bugs. Four findings were explorer mistakes or intended behavior (title vs branch name, the Artifacts shortcut toggle). One pre-existing cosmetic issue: Chromium draws no ellipsis on the clipped composer placeholder at 390px, which predates this change.

Risks

Medium-low. Most bumps are patch or minor releases inside existing ranges. The widest surface is effect (backend services and tests) and the react-router/Tailwind bumps (renderer). The packages known to change behavior are held back above.


Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $16.91

4.0.5 and later rewrite TestClock and break the streamBridge and
routerSubscriptions heartbeat tests, so this stops at 4.0.4.

---
_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
Ran `bun update` (Bun 1.4.3, 7-day minimumReleaseAge) and bumped exact pins
that have in-range releases: @aws-sdk/client-bedrock 3.1152.0,
@modelcontextprotocol/client 2.3.1, @duckdb/node-api 1.5.6-r.1, the
playwright trio 1.64.1, eslint-plugin-storybook 10.6.2. Ported the trpc-cli
patch to 0.12.4 (the code moved to dist/parse-router.js).

Held back, each pinned exactly because the newer in-range release breaks us:
- ai and @ai-sdk/*: 7.0.143 changes DecisionModel/EvaluationModel types and
  blows up streamManager typing (~100 errors). Needs its own PR.
- rehype-harden 1.1.6: 1.1.8 lets relative links through without a
  defaultOrigin, which MarkdownFilePreview relies on blocking.
- @novnc/novnc 1.6.0: 1.7 drops the lib/ CJS build we import.
- posthog-node 5.56.0: 5.56.1 adds a dynamic @opentelemetry/api import that
  check-startup-imports cannot resolve.
- @swc/core 1.15.3 (override): 1.16 breaks vite-plugin-top-level-await.
- prettier 3.7.4: 3.9 reformats 182 files.
- typescript-eslint 8.48.1: 8.71 adds ~620 type-aware lint errors.
- @types/bun 1.3.3: 1.4.3 references a @types/node 26 type.
- ghostty-web: pinned to 0.4.0-next.7, newer than the 0.4.0 that ^ resolves to.

Code changes for the bumps: react-router stabilized useTransitions, Tailwind
4.3 made scrollbar-none a core utility (class order), Radix Select 2.4 needs
an HTMLFormElement global in happy-dom tests, geist renamed LICENSE.TXT, and
@types/node 24.19 / undici 7.30 overload changes in five tests.

---
_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
vscode: @types/node 20.19.43, esbuild 0.27.7. @types/vscode stays at 1.107
because it must not pass engines.vscode (^1.106.0).
chat-components: bun update (tailwind-merge 3.7, @types/react 19.3, vite 6.4.4).

---
_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
@ThomasK33

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 26, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-26T17:25:13.781074Z 95d5f4d New commits
🔒 Security Review ✅ Completed 2026-10-26T18:56:55.626654Z 95d5f4d Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Delightful!

Reviewed commit: 7bfbe78a21

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: 7bfbe78a21

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@github-actions

github-actions Bot commented Oct 26, 2026 •

Copy link
Copy Markdown
Contributor

🟢 e2e stories (Haiku): 14 passed

22 agent steps · 7 replayed from cache · 15 model calls · 46.4k tokens (24% cached)
Spend: $0.09 of the $1.00 cap (proxy ledger)

All 14 tests in 9 files
Test Agent Time
🟢 chatRestart.e2e.ts · 1 passed 1 step · 1 call 6.1s
🟢 a chat survives a restart of the server 1 step · 1 call 6.1s
🟢 compaction.e2e.ts · 1 passed 1 step · 1 call 4.8s
🟢 /compact replaces the old chat with a summary 1 step · 1 call 4.8s
🟢 pluginTrustRestart.e2e.ts · 1 passed 4 steps · 2 calls 10.4s
🟢 a trusted plugin hook stays trusted after the server restarts 4 steps · 2 calls 10.4s
🟢 settingsRoundTrip.e2e.ts · 1 passed 2 steps · 1 call 10.4s
🟢 a chat survives trips through Settings 2 steps · 1 call 10.4s
🟢 sidebarPerWorkspace.e2e.ts · 1 passed 4 steps · 1 call 4.9s
🟢 a new workspace starts with its right sidebar collapsed while another keeps it open 4 steps · 1 call 4.9s
🟢 smoke.e2e.ts · 1 passed 2 steps · 1 call 6.7s
🟢 the agent opens the playground workspace 2 steps · 1 call 6.7s
🟢 streamErrors.e2e.ts · 1 passed 1 step · 1 call 7.4s
🟢 stream errors show in the chat, and the chat recovers 1 step · 1 call 7.4s
🟢 todoNudge.e2e.ts · 1 passed 1 step · 1 call 3.2s
🟢 the agent finishes open TODO items after the turn-end nudge 1 step · 1 call 3.2s
🟢 touchAlignment.e2e.ts · 6 passed 6 steps · 6 calls 22.9s
🟢 the Settings close button is level with the title on a touch screen 390px wide 1 step · 1 call 3.9s
🟢 the Settings close button is level with the title on a touch screen 768px wide 1 step · 1 call 4.3s
🟢 Backup settings checkboxes are small and level with their labels on a touch phone 1 step · 1 call 4.2s
🟢 the heartbeat checkbox is small and level with its label on a touch phone 1 step · 1 call 3.3s
🟢 a reply's model and time stay on one line on a touch phone 1 step · 1 call 3.3s
🟢 the workspace actions menu stays on the title row on a touch phone 1 step · 1 call 3.8s

e2e 0.20.0 · 1m 21s · web · run artifacts

🟢 e2e Electron stories (Haiku): 3 passed

3 agent steps · 3 model calls · 8.0k tokens (22% cached)
Spend: $0.02 of the $1.00 cap (proxy ledger)

All 3 tests in 3 files
Test Agent Time
🟢 electron/deepLink.e2e.ts · 1 passed 1 step · 1 call 6.5s
🟢 a deep link of a second launch starts a chat in the running app 1 step · 1 call 6.5s
🟢 electron/menuBar.e2e.ts · 1 passed 1 step · 1 call 6.7s
🟢 the workspace menu bar is the desktop title bar 1 step · 1 call 6.7s
🟢 electron/smoke.e2e.ts · 1 passed 1 step · 1 call 6.5s
🟢 Xum Electron opens the playground workspace 1 step · 1 call 6.5s

e2e 0.20.0 · 22.2s · electron · run artifacts

🟢 e2e agent repros (Haiku): no tests selected

Spend: $0.00 of the $1.00 cap (proxy ledger)

e2e 0.20.0 · 6.9s · 2 targets (web, phone) · run artifacts

CI on the first push found four regressions from the in-range bumps:

- jest 30.5 makes module.register() throw inside the sandboxed loader, and
  Storybook's serverRequire calls it to load .storybook/test-runner.ts, so
  every Storybook test suite failed to run. jest stays at 30.2.0 (exact pin;
  the 30.x tree in bun.lock is main's).
- Radix 1.3 (dismissable-layer 1.2) changes Escape and outside-pointer
  handling: tests/ui analyticsModal, the bug-bash repros that probe the
  DismissableLayer fiber and four Pixel stories broke. Every @radix-ui
  package goes back to main's version, and the HTMLFormElement test shims
  that Radix Select 2.4 needed are reverted.
- streamdown had resolved its own marked 17.0.6 next to the root 17.0.1 pin
  that listItemRanges relies on; the nested copy is removed.
- Shiki 3.23 added a c3 grammar, so highlightWorker.test.ts now uses a
  language that only Highlights knows.

---
_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
@ThomasK33

Copy link
Copy Markdown
Member Author

@codex review

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: a35aed058a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: a35aed058a

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

…-harden

- babel-jest still declared ^30.5.2 while the lock holds 30.2.0: pin it at
  30.2.0 with jest.
- Pin each direct @radix-ui dependency at its locked (main) version, so a
  later `bun update` keeps the Radix hold. Radix pins its internal
  packages exactly, so this holds the whole tree.
- Restore main's nested streamdown/rehype-harden 1.1.7 instead of 1.1.8.

---
_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking: `high`_
# Conflicts:
#	patches/trpc-cli@0.12.4.patch
@ThomasK33

Copy link
Copy Markdown
Member Author

@codex security review

@chatgpt-codex-connector

Copy link
Copy Markdown

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 95d5f4d1d1

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

  • You comment "@codex security review"
  • A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

@ThomasK33

Copy link
Copy Markdown
Member Author

Readiness record for head 95d5f4d1d1:

  • CI: Required passes on this head (Storybook, Unit, Integration, E2E, Bug-bash sandbox, Visual Regression Testing included). Pixel / Review shows 679 snapshots awaiting a human sign-in; it is not ruleset-required.
  • Codex: code and security reviews clean on this head (thumbs-up), no open threads. Review rounds: 4 heads (7bfbe78, a35aed0, 7769d5f, 95d5f4d).
  • Independent advisor (clean context): first pass found babel-jest declared ^30.5.2 against a 30.2.0 lock and a nested streamdown/rehype-harden 1.1.8. Both are fixed in 7769d5f; the follow-up check on this head reported clean.
  • Bug bash (sandbox, 6 charters, $2.45): no confirmed bugs.
  • Follow-ups (not in this PR): the held majors-in-range listed in the body, mainly ai/@ai-sdk/*, Radix 1.3, jest 30.5 (blocked on Storybook test-runner), typescript-eslint, prettier.

Enqueuing in the merge queue per the maintainer's instruction.


Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $16.91

@ThomasK33
ThomasK33 added this pull request to the merge queue Oct 26, 2026
Merged via the queue into main with commit 0c9a0c0 Oct 26, 2026
74 of 77 checks passed
@ThomasK33
ThomasK33 deleted the dependencies-23jh branch October 26, 2026 19:17
yermakoffivan pushed a commit to yermakoffivan/mux that referenced this pull request Oct 27, 2026
…iew stays the LCP (coder#7638)

Fixes coder#7637

## Summary

`geist` 1.8.1 (from coder#7625) made Geist Mono's text box taller:
ascent/descent went from 955/245 to 1005/295 units, so a 12 px code
line's text box grew from 14 px to 16 px. The phone static workspace
view paints the seeded code line before Geist Mono loads (fallback
monospace, 14 px tall). The live app's code line now paints larger than
that copy, so Chrome records a second, later LCP entry and Lighthouse
simulates LCP at the end of the JS load. This PR adds
`ascent-override`/`descent-override`/`line-gap-override` to the Geist
Mono `@font-face`, which restores 1.5.1's vertical metrics and keeps the
bump.

## Background

- Static view (coder#6879/coder#6880): on a phone `/workspace/<id>` the early
script paints the transcript tail before the app loads. Geist Mono is
deliberately not preloaded (coder#6216, comment in `staticAssets.ts`), so
code in the static view paints in the fallback monospace.
- Before coder#7625, the live code line (Geist Mono 1.5.1, 178x14 px text
box) was no larger than the static copy (fallback, 180x14), so the
static paint stayed the final LCP. After coder#7625 it is 175x16, which is
larger.
- Font tables (fontTools, `unitsPerEm` 1000,
`fsSelection.USE_TYPO_METRICS` set in both):

| geist | hhea/typo ascent | descent | lineGap | content height |
| --- | --- | --- | --- | --- |
| 1.5.1 | 955 | 245 | 0 | 1.2 em |
| 1.8.1 | 1005 | 295 | 0 | 1.3 em |

The ascent minus descent is the same (710), so the overrides move no
glyph: the baseline in a fixed line-height stays where it is. They only
shrink the inline text box back to 1.2 em, which also restores the
pre-bump height of inline-code backgrounds and of `line-height: normal`
monospace text (for example the terminal default font).

## Bisect

Check: seed like the auditor (`seed.mjs`, 4 text rows), run `xum server`
with `env -i`, `XUM_DISABLE_TELEMETRY=1`, a temp `XUM_ROOT` and a free
port, then open the workspace page in headless Chromium (Playwright;
412x823, DPR 1.75, `isMobile`, `hasTouch`, a Moto G Power UA, service
workers blocked, a fresh browser per run). It records every
`largest-contentful-paint` entry. PASS = no entry outside the static
view after the static paint.

| Build | Result | LCP entries (time, size, element) |
| --- | --- | --- |
| 6959dfc (base) | PASS 3/3 | 392 ms 9306 static code line (no later
entry) |
| 0c9a0c0 (main) | FAIL 3/3 | 352 ms 9306 static, then 728 ms 9555
live code line (runs 2 and 3: 60 → 416 ms, 56 → 388 ms) |
| 0c9a0c0 + geist 1.5.1 only | PASS 3/3 | 400 ms 9306 static (no
later entry) |
| this PR | PASS 5/5 | 348 ms 9306 static (no later entry); live text
box 175x14 |

Reverting `geist` alone flips the check, so I did not bisect the
Tailwind pair or the other packages.

## Validation

- LCP-entry check above: head PASS 5/5, main FAIL 3/3.
- `make first-run-view-parity`: `parity.json` is identical on base and
on this PR. The paragraph boxes match, and both sides show the same
shell pixel diff in one 14x14 icon box, so that diff was there before
this PR.
- `make check-phone-chrome`: the phone skeleton matches the live page.
- `make static-check` passes.
- Built CSS has the three descriptors in the Geist Mono `@font-face`.

No test added. The defect is a rendered text-box size in a real browser
with real font files. A happy-dom or build-time check cannot measure
that, and a test that reads the CSS would only repeat the three values.
The browser check above is the reliable gate, and the Lighthouse VM
covers it after merge.

## Risks

Low. The change is CSS only and touches the Geist Mono face only. Glyph
positions stay the same. Text boxes of monospace text go back to their
pre-coder#7625 height. Geist (sans) also changed its metrics in 1.8.1
(920/220/100 → 1005/295/0). I did not change it: it is preloaded, so the
static view and the live app already paint it with the same font.

---

_Generated with `xum` • Model: `anthropic:claude-opus-5-5` • Thinking:
`high`_

<!-- mux-attribution: model=anthropic:claude-opus-5-5 thinking=high -->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant