# Libraries and version policy Major dependencies, their declared versions, owners and upgrade constraints. Versions below are read from `pnpm-workspace.yaml`’s catalog and workspace manifests at this documentation revision. A range is shown as declared; the lockfile owns its resolved version. Package locations identify direct consumers, not every transitive import. ## Upgrade policy [#upgrade-policy] The catalog uses exact pins. `minimumReleaseAge: 2880` enforces a two-day quarantine, including transitive resolution and frozen installs. Choose the newest version old enough to qualify. `minimumReleaseAgeExclude` currently holds one owner-decision entry (`@x18n/*` 0.1.1 until 2026-10-30 04:13 UTC); the oRPC 2.0.0-beta.47 and better-auth 1.7.14 entries left on 2026-10-29 after turning 48 hours old. See the comments in `pnpm-workspace.yaml`. Only a security fix or an explicit owner decision may bypass the quarantine: an exact-version entry with its advisory or decision commented, removed once the version is two days old. The docs integration pins `fumadocs-mdx` 15.4.10 and `fumadocs-core` 16.17.8 (published 2026-10-23, taken after the 48-hour quarantine). No docs dependency receives a quarantine exclusion. No `fumadocs-ui` is installed. Native modules follow Expo’s compatibility check, not the newest npm release. Changing a native module invalidates the compiled development client and requires a rebuild. Web React can advance independently; native React stays compatible with React Native’s renderer. `pnpm update:native` runs Expo’s fix workflow; review its changes as an SDK migration. Keep Drizzle kit/ORM on the same build, Better Auth and its adapters compatible, the MCP SDK verified with the auth plugin, and one files-sdk copy across consumers. The files-sdk patch is version-specific. Effect persistence/pin changes require ADR-0006’s workerd fault gate. The JavaScript updater deliberately refuses coupled/native upgrades that need their own verification. ## Dependency reference [#dependency-reference] | Library | Declared version | Why it is here | Direct consumers | | ---------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `@base-ui/react` | `1.9.0` | Accessible unstyled UI primitives. | `packages/ui` | | `@better-auth/core` | `1.7.14` | Better Auth plugin/adapter; upgraded with its core family. | `packages/auth` | | `@better-auth/drizzle-adapter` | `1.7.14` | Better Auth plugin/adapter; upgraded with its core family. | `packages/auth` | | `@better-auth/expo` | `1.7.14` | Better Auth plugin/adapter; upgraded with its core family. | `apps/mobile`, `packages/auth` | | `@better-auth/mcp` | `1.7.14` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` | | `@better-auth/oauth-provider` | `1.7.14` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` | | `@better-auth/passkey` | `1.7.14` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `apps/mobile`, `packages/auth` | | `@clack/prompts` | `1.8.1` | Interactive setup prompts. | `packages/project-setup-cli` | | `@cloudflare/vite-plugin` | `1.65.0` | Build TanStack Start for workerd. | `apps/web` | | `@ddedic/expo-fancy-ota-updates` | `^1.5.0` | OTA update presentation. | `apps/mobile` | | `@effect/sql-pg` | `4.0.6` | Workerd persisted-queue spike; not the production queue backend. | `packages/api` | | `@effect/vitest` | `4.0.6` | Test Effect timeouts using a virtual clock. | `packages/api`, `packages/email` | | `@expo/ui` | `~58.0.23` | Native SwiftUI/Compose interface surfaces. | `apps/mobile`, `packages/widgets` | | `@firecrawl/anydoc-wasm` | `0.2.4` | Browser document conversion to Markdown; patched for per-conversion instances. | `apps/web`, `packages/api` | | `@fontsource-variable/inter` | `5.3.0` | Locally hosted product typography. | `apps/web`, `packages/ui` | | `@headless-tree/core` | `1.8.0`, `^1.8.0` | Headless hierarchical tree behavior. | `apps/web`, `packages/ui` | | `@headless-tree/react` | `1.8.0` | React tree integration. | `apps/web` | | `@modelcontextprotocol/server` | `2.4.0` | MCP server protocol and tool transport. | `apps/web`, `packages/api` | | `@orpc/client` | `2.0.0-beta.47` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `apps/mobile`, `packages/api`, `packages/errors` | | `@orpc/openapi` | `2.0.0-beta.47` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api` | | `@orpc/server` | `2.0.0-beta.47` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api`, `packages/errors` | | `@orpc/shared` | `2.0.0-beta.47` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `packages/api` | | `@orpc/tanstack-query` | `2.0.0-beta.47` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `apps/mobile` | | `@orpc/zod` | `2.0.0-beta.47` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api` | | `@shadcn/react` | `0.3.1` | Shared shadcn integration. | `packages/ui` | | `@shopify/flash-list` | `2.3.2` | Efficient native lists. | `apps/mobile` | | `@shopify/react-native-skia` | `2.14.0` | Native graphics. | `apps/mobile` | | `@t3-oss/env-core` | `0.13.11` | Validated environment contracts. | `packages/env` | | `@takumi-rs/core` | `2.18.2` | Native development rendering for OG images. | `apps/web` | | `@takumi-rs/wasm` | `2.18.2` | Worker-compatible OG renderer. | `apps/web` | | `@tanstack/ai` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `apps/web`, `packages/db`, `packages/api` | | `@tanstack/ai-anthropic` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-client` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `apps/web` | | `@tanstack/ai-gemini` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-openai` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-persistence` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` | | `@tanstack/ai-react` | `1.0.0` | Assistant streaming, client state, persistence or provider adapter. | `apps/web` | | `@tanstack/react-form` | `1.33.5` | Typed form state and validation. | `apps/web` | | `@tanstack/react-query` | `5.105.0` | Server state, caching and invalidation. | `apps/web`, `apps/mobile` | | `@tanstack/react-router` | `1.170.46` | Typed routing and navigation. | `apps/web` | | `@tanstack/react-router-ssr-query` | `1.167.3` | SSR/query hydration integration. | `apps/web` | | `@tanstack/react-start` | `1.169.4` | SSR and HTTP route entry points. | `apps/web`, `packages/intl` | | `@tanstack/react-table` | `9.3.1` | Data table state. | `apps/web` | | `@tanstack/react-virtual` | `3.14.23` | Virtualized lists for the ReUI cascader. | `packages/ui` | | `@types/node` | `26.6.5` | Compile-time declarations; no application runtime. | `.`, `apps/mobile`, `packages/env` | | `@types/react` | `19.3.0`, `~19.3.0` | Compile-time declarations; no application runtime. | `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/intl`, `packages/react-utils`, `packages/app-update`, `packages/widgets` | | `@types/react-dom` | `19.3.0` | Compile-time declarations; no application runtime. | `apps/web`, `packages/ui`, `packages/intl` | | `aws4fetch` | `1.0.20` | Worker-side S3 signing for direct and multipart R2 uploads. | `packages/storage` | | `babel-plugin-react-compiler` | `1.0.0` | Compile supported React components/hooks. | `apps/web` | | `better-auth` | `1.7.14` | Identity, sessions and plugin integration. | `apps/web`, `apps/mobile`, `packages/auth`, `packages/db` | | `class-variance-authority` | `0.7.1` | Typed component variants. | `packages/ui` | | `cmdk` | `1.1.1` | Command palette behavior. | `packages/ui` | | `cn` | `0.5.0` | Conditional class composition. | `packages/ui` | | `date-fns` | `4.4.0` | Date manipulation in shared UI. | `apps/web`, `packages/ui` | | `dotenv` | `18.0.9` | Load local server/script environment files. | `.`, `apps/web`, `packages/auth`, `packages/env`, `packages/db`, `packages/api` | | `drizzle-kit` | `1.0.0-rc.5` | Generate reviewed SQL migrations with the matching ORM build. | `packages/db` | | `drizzle-orm` | `1.0.0-rc.5` | Typed queries, schema and relations. | `apps/web`, `packages/flags`, `packages/auth`, `packages/db`, `packages/api` | | `effect` | `4.0.6` | Bounded jobs and outbound transports, using stable APIs. | `packages/api`, `packages/email` | | `embla-carousel-react` | `8.6.0` | Carousel primitives. | `packages/ui` | | `evlog` | `2.34.0` | Structured application logging. | `apps/web` | | `expo` | `~58.0.19` | Native SDK and build/runtime integration. | `apps/mobile` | | `expo-router` | `~58.0.26` | File-based native navigation. | `apps/mobile` | | `expo-widgets` | `~58.0.23` | iOS widget integration. | `apps/mobile`, `packages/widgets` | | `files-sdk` | `2.6.2` | Files gateway, storage operations and soft deletion. | `apps/web`, `packages/storage`, `packages/api` | | `fumadocs-core` | `16.17.8` | Page tree, metadata loading and server search without a UI theme. | `apps/web` | | `fumadocs-mdx` | `15.4.10` | Compile MDX, frontmatter, searchable text and processed Markdown at build time. | `apps/web` | | `i18next` | `26.5.11` | Language resources and translation. | `apps/web`, `apps/mobile`, `packages/intl` | | `input-otp` | `1.5.0` | One-time-code input. | `packages/ui` | | `lucide-react` | `1.62.0` | Consistent interface icons. | `apps/web`, `packages/ui` | | `neon` | `8.13.0` | Setup-time Neon provisioning. | `packages/project-setup-cli` | | `next-themes` | `0.4.6` | Existing web theme provider. | `apps/web`, `packages/ui` | | `nitro` | `3.0.260903-beta` | Node development/server build adapter. | `apps/web` | | `oxfmt` | `0.75.0` | Formatting. | `.` | | `oxlint` | `1.90.0` | Linting and module-boundary rules. | `.` | | `pg` | `8.23.1` | Postgres transport for Drizzle. | `apps/web`, `packages/auth`, `packages/db`, `packages/api` | | `qrcode.react` | `^4.2.0` | Web QR codes for account/security flows. | `apps/web` | | `react` | `19.3.0`, `19.3.1` | Component rendering; native follows its renderer version. | `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/intl`, `packages/react-utils`, `packages/app-update`, `packages/widgets` | | `react-day-picker` | `10.0.2` | Calendar selection. | `packages/ui` | | `react-dom` | `19.3.0`, `19.3.1` | Web rendering and server HTML output. | `apps/web`, `apps/mobile`, `packages/ui`, `packages/intl`, `packages/react-utils`, `packages/widgets` | | `react-i18next` | `17.1.9` | React translation bindings. | `apps/web`, `apps/mobile`, `packages/intl` | | `react-native` | `0.88.0` | Native renderer and platform primitives. | `apps/mobile`, `packages/ads`, `packages/purchases`, `packages/widgets` | | `react-native-android-widget` | `^0.21.0` | Android widget integration. | `apps/mobile`, `packages/widgets` | | `react-native-gesture-handler` | `~3.3.0` | Native gesture recognition. | `apps/mobile` | | `react-native-keyboard-controller` | `1.22.7` | Native keyboard coordination. | `apps/mobile` | | `react-native-passkey` | `^3.6.1` | Native passkey integration. | `apps/mobile` | | `react-native-purchases` | `10.12.2` | RevenueCat native purchase SDK. | `apps/mobile` | | `react-native-reanimated` | `4.7.1` | Native animation execution. | `apps/mobile` | | `react-native-safe-area-context` | `~5.10.1` | Safe-area insets. | `apps/mobile` | | `react-native-screens` | `4.30.0` | Native navigation screens. | `apps/mobile` | | `react-native-svg` | `15.16.0` | Native vector graphics. | `apps/mobile` | | `react-native-web` | `~0.21.4` | Web adapter for React Native. | `apps/mobile` | | `react-native-worklets` | `0.13.0` | Worklet execution required by native animation. | `apps/mobile` | | `react-phone-number-input` | `3.4.18` | Phone input. | `packages/ui` | | `react-resizable-panels` | `4.15.0` | Resizable panels. | `packages/ui` | | `recharts` | `3.10.1` | Application charts. | `apps/web`, `packages/ui` | | `shadcn` | `4.23.0` | Component installation and registry tooling. | `packages/ui` | | `shiki` | `4.5.0` | Syntax highlighting; docs run it at build time. | `packages/ui` | | `sonner` | `2.0.8` | Toast feedback. | `apps/web`, `packages/ui` | | `tailwindcss` | `4.3.3` | Semantic utility styling. | `apps/web`, `packages/ui` | | `takumi-js` | `2.18.2` | JSX-to-OG rendering integration. | `apps/web` | | `turbo` | `2.11.10` | Workspace task orchestration. | `.` | | `tw-animate-css` | `1.4.0` | UI animation utilities. | `packages/ui` | | `typescript` | `7.0.2`, `~6.0.3` | Type checking; native uses the JS compiler line for Expo config. | `.`, `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/flags`, `packages/intl`, `packages/auth`, `packages/storage`, `packages/env`, `packages/react-utils`, `packages/db`, `packages/api`, `packages/errors`, `packages/app-update`, `packages/email`, `packages/widgets` | | `vaul` | `1.1.2` | Drawer behavior. | `packages/ui` | | `vite` | `8.3.5` | Web build pipeline and development server. | `apps/web` | | `vitest` | `5.0.5` | Unit and integration test runner. | `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/flags`, `packages/intl`, `packages/auth`, `packages/storage`, `packages/env`, `packages/react-utils`, `packages/db`, `packages/api`, `packages/errors`, `packages/app-update`, `packages/email`, `packages/widgets` | | `wrangler` | `4.152.0` | Worker build/deploy/local runtime. | `apps/web` | | `zod` | `4.6.7` | Validate public contracts and third-party payloads. | `.`, `apps/web`, `apps/mobile`, `packages/flags`, `packages/auth`, `packages/env`, `packages/db`, `packages/api`, `packages/errors` | | `@aws-sdk/client-s3` | `3.1157.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@aws-sdk/lib-storage` | `3.1157.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@aws-sdk/s3-presigned-post` | `3.1157.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@aws-sdk/s3-request-presigner` | `3.1157.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` | | `@expo/dom-webview` | `~58.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `@expo/metro-runtime` | `~58.0.15` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `@expo/vector-icons` | `^15.1.1` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-application` | `~58.1.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-clipboard` | `~58.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-constants` | `~58.0.13` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-dev-client` | `~58.0.15` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-device` | `~58.0.5` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-file-system` | `~58.0.11` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-font` | `~58.0.10` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-glass-effect` | `~58.0.5` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-haptics` | `~58.0.7` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-image` | `~58.0.17` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-linking` | `~58.0.14` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-local-authentication` | `~58.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-localization` | `~58.0.5` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-network` | `~58.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-observe` | `~58.0.16` | EAS Observe: startup and navigation metrics, JS errors and native crashes; sends only with an EAS project id. | `apps/mobile` | | `expo-notifications` | `~58.1.6` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-secure-store` | `~58.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-splash-screen` | `~58.0.11` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-status-bar` | `~58.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-store-review` | `~58.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-symbols` | `~58.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-system-ui` | `~58.0.6` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-updates` | `~58.0.18` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` | | `expo-web-browser` | `~58.0.6` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |