Versions below are read from pnpm-workspace.yaml’s catalog and workspace manifests at this documentation revision. A range is shown as declared; the lockfile owns its resolved version. Package locations identify direct consumers, not every transitive import.
Upgrade policy
The catalog uses exact pins. minimumReleaseAge: 2880 enforces a two-day quarantine, including transitive resolution and frozen installs. Choose the newest version old enough to qualify. minimumReleaseAgeExclude currently holds a security entry, better-auth 1.7.16 and the transitive packages of the same release (GHSA-4wq4-2ppv-q3hg, GHSA-c85h-5mrr-mgx4) until 2026-11-05 21:24 UTC, and two owner-decision entries: TanStack Query 5.105.3 until 2026-11-04 20:40 UTC and the Expo SDK 58.0.23 patches until 2026-11-05 17:07 UTC. See the comments in pnpm-workspace.yaml. Only a security fix or an explicit owner decision may bypass the quarantine: an exact-version entry with its advisory or decision commented, removed once the version is two days old.
The docs integration pins fumadocs-mdx 15.4.10 and fumadocs-core 16.17.8 (published 2026-10-23, taken after the 48-hour quarantine). No docs dependency receives a quarantine exclusion. No fumadocs-ui is installed.
Native modules follow Expo’s compatibility check, not the newest npm release. Changing a native module invalidates the compiled development client and requires a rebuild. Web React can advance independently; native React stays compatible with React Native’s renderer. pnpm update:native runs Expo’s fix workflow; review its changes as an SDK migration.
Keep Drizzle kit/ORM on the same build, Better Auth and its adapters compatible, the MCP SDK verified with the auth plugin, and one files-sdk copy across consumers. The files-sdk patch is version-specific. Effect persistence/pin changes require ADR-0006’s workerd fault gate. The JavaScript updater deliberately refuses coupled/native upgrades that need their own verification.
Dependency reference
| Library | Declared version | Why it is here | Direct consumers |
|---|---|---|---|
@base-ui/react | 1.9.0 | Accessible unstyled UI primitives. | packages/ui |
@better-auth/core | 1.7.16 | Better Auth plugin/adapter; upgraded with its core family. | packages/auth |
@better-auth/drizzle-adapter | 1.7.16 | Better Auth plugin/adapter; upgraded with its core family. | packages/auth |
@better-auth/expo | 1.7.16 | Better Auth plugin/adapter; upgraded with its core family. | apps/mobile, packages/auth |
@better-auth/mcp | 1.7.16 | Better Auth plugin/adapter; upgraded with its core family. | apps/web, packages/auth |
@better-auth/oauth-provider | 1.7.16 | Better Auth plugin/adapter; upgraded with its core family. | apps/web, packages/auth |
@better-auth/passkey | 1.7.16 | Better Auth plugin/adapter; upgraded with its core family. | apps/web, apps/mobile, packages/auth |
@clack/prompts | 1.8.1 | Interactive setup prompts. | packages/project-setup-cli |
@cloudflare/vite-plugin | 1.67.0 | Build TanStack Start for workerd. | apps/web |
@ddedic/expo-fancy-ota-updates | 1.5.0 | OTA update presentation. | apps/mobile |
@effect/sql-pg | 4.1.2 | Workerd persisted-queue spike; not the production queue backend. | packages/api |
@effect/vitest | 4.1.2 | Test Effect timeouts using a virtual clock. | packages/api, packages/email |
@expo/ui | ~58.0.27 | Native SwiftUI/Compose interface surfaces. | apps/mobile, packages/widgets |
@firecrawl/anydoc-wasm | 0.2.4 | Browser document conversion to Markdown; patched for per-conversion instances. | apps/web, packages/api |
@fontsource-variable/inter | 5.3.0 | Locally hosted product typography. | apps/web, packages/ui |
@headless-tree/core | 1.8.0, ^1.8.0 | Headless hierarchical tree behavior. | apps/web, packages/ui |
@headless-tree/react | 1.8.0 | React tree integration. | apps/web |
@modelcontextprotocol/server | 2.4.0 | MCP server protocol and tool transport. | apps/web, packages/api |
@orpc/client | 2.0.0-beta.48 | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | apps/web, apps/mobile, packages/api, packages/errors |
@orpc/openapi | 2.0.0-beta.48 | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | apps/web, packages/api |
@orpc/server | 2.0.0-beta.48 | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | apps/web, packages/api, packages/errors |
@orpc/shared | 2.0.0-beta.48 | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | packages/api |
@orpc/tanstack-query | 2.0.0-beta.48 | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | apps/web, apps/mobile |
@orpc/zod | 2.0.0-beta.48 | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | apps/web, packages/api |
@shadcn/react | 0.3.1 | Shared shadcn integration. | packages/ui |
@shopify/flash-list | 2.3.2 | Efficient native lists. | apps/mobile |
@shopify/react-native-skia | 2.14.0 | Native graphics. | apps/mobile |
@t3-oss/env-core | 0.13.11 | Validated environment contracts. | packages/env |
@takumi-rs/core | 2.19.0 | Native development rendering for OG images. | apps/web |
@takumi-rs/wasm | 2.19.0 | Worker-compatible OG renderer. | apps/web |
@tanstack/ai | 1.0.1 | Assistant streaming, client state, persistence or provider adapter. | apps/web, packages/db, packages/api |
@tanstack/ai-anthropic | 1.0.0 | Assistant streaming, client state, persistence or provider adapter. | packages/api |
@tanstack/ai-client | 1.0.1 | Assistant streaming, client state, persistence or provider adapter. | apps/web |
@tanstack/ai-gemini | 1.0.1 | Assistant streaming, client state, persistence or provider adapter. | packages/api |
@tanstack/ai-openai | 1.0.1 | Assistant streaming, client state, persistence or provider adapter. | packages/api |
@tanstack/ai-persistence | 1.0.1 | Assistant streaming, client state, persistence or provider adapter. | packages/api |
@tanstack/ai-react | 1.0.1 | Assistant streaming, client state, persistence or provider adapter. | apps/web |
@tanstack/react-form | 1.33.5 | Typed form state and validation. | apps/web |
@tanstack/react-query | 5.105.3 | Server state, caching and invalidation. | apps/web, apps/mobile |
@tanstack/react-router | 1.170.46 | Typed routing and navigation. | apps/web |
@tanstack/react-router-ssr-query | 1.167.3 | SSR/query hydration integration. | apps/web |
@tanstack/react-start | 1.169.4 | SSR and HTTP route entry points. | apps/web, packages/intl |
@tanstack/react-table | 9.3.1 | Data table state. | apps/web |
@tanstack/react-virtual | 3.14.25 | Virtualized lists for the ReUI cascader. | packages/ui |
@types/node | 26.6.5 | Compile-time declarations; no application runtime. | ., apps/mobile, packages/env |
@types/react | 19.3.0, ~19.3.0 | Compile-time declarations; no application runtime. | apps/web, apps/mobile, packages/ads, packages/ui, packages/purchases, packages/intl, packages/react-utils, packages/app-update, packages/widgets, packages/email |
@types/react-dom | 19.3.0 | Compile-time declarations; no application runtime. | apps/web, packages/ui, packages/intl, packages/email |
aws4fetch | 1.0.20 | Worker-side S3 signing for direct and multipart R2 uploads. | packages/storage |
babel-plugin-react-compiler | 1.0.0 | Compile supported React components/hooks. | apps/web |
better-auth | 1.7.16 | Identity, sessions and plugin integration. | apps/web, apps/mobile, packages/auth, packages/db |
class-variance-authority | 0.7.1 | Typed component variants. | packages/ui |
cmdk | 1.1.1 | Command palette behavior. | packages/ui |
cn | 0.5.2 | Conditional class composition. | packages/ui |
date-fns | 4.4.0 | Date manipulation in shared UI. | apps/web, packages/ui |
dotenv | 18.0.9 | Load local server/script environment files. | ., apps/web, packages/auth, packages/env, packages/db, packages/api |
drizzle-kit | 1.0.0-rc.5 | Generate reviewed SQL migrations with the matching ORM build. | packages/db |
drizzle-orm | 1.0.0-rc.5 | Typed queries, schema and relations. | apps/web, packages/flags, packages/auth, packages/db, packages/api |
effect | 4.1.2 | Bounded jobs and outbound transports, using stable APIs. | packages/api, packages/email |
embla-carousel-react | 8.6.0 | Carousel primitives. | packages/ui |
evlog | 2.34.0 | Structured application logging. | apps/web |
expo | ~58.0.23 | Native SDK and build/runtime integration. | apps/mobile |
expo-router | ~58.0.30 | File-based native navigation. | apps/mobile |
expo-widgets | ~58.0.27 | iOS widget integration. | apps/mobile, packages/widgets |
files-sdk | 2.6.2 | Files gateway, storage operations and soft deletion. | apps/web, packages/storage, packages/api |
fumadocs-core | 16.17.9 | Page tree, metadata loading and server search without a UI theme. | apps/web |
fumadocs-mdx | 15.4.10 | Compile MDX, frontmatter, searchable text and processed Markdown at build time. | apps/web |
i18next | 26.7.1 | Language resources and translation. | apps/web, apps/mobile, packages/intl |
input-otp | 1.5.0 | One-time-code input. | packages/ui |
lucide-react | 1.66.0 | Consistent interface icons. | apps/web, packages/ui |
neon | 8.16.0 | Setup-time Neon provisioning. | packages/project-setup-cli |
next-themes | 0.4.6 | Existing web theme provider. | apps/web, packages/ui |
nitro | 3.0.261029-rc | Node development/server build adapter. | apps/web |
oxfmt | 0.75.0 | Formatting. | . |
oxlint | 1.90.0 | Linting and module-boundary rules. | . |
pg | 8.23.1 | Postgres transport for Drizzle. | apps/web, packages/auth, packages/db, packages/api |
qrcode.react | 4.2.0 | Web QR codes for account/security flows. | apps/web |
react | 19.3.0, 19.3.1 | Component rendering; native follows its renderer version. | apps/web, apps/mobile, packages/ads, packages/ui, packages/purchases, packages/intl, packages/react-utils, packages/app-update, packages/widgets |
react-day-picker | 10.0.2 | Calendar selection. | packages/ui |
react-dom | 19.3.0, 19.3.1 | Web rendering and server HTML output. | apps/web, apps/mobile, packages/ui, packages/intl, packages/react-utils, packages/widgets, packages/email |
react-email | 6.11.6 | Email layout components, rendered on the server only and synchronously (ADR-0014). | packages/email |
react-i18next | 17.1.11 | React translation bindings. | apps/web, apps/mobile, packages/intl |
react-native | 0.88.1 | Native renderer and platform primitives. | apps/mobile, packages/ads, packages/purchases, packages/widgets |
react-native-android-widget | 0.21.0 | Android widget integration. | apps/mobile, packages/widgets |
react-native-gesture-handler | ~3.3.0 | Native gesture recognition. | apps/mobile |
react-native-keyboard-controller | 1.22.7 | Native keyboard coordination. | apps/mobile |
react-native-passkey | 3.6.1 | Native passkey integration. | apps/mobile |
react-native-purchases | 10.12.2 | RevenueCat native purchase SDK. | apps/mobile |
react-native-reanimated | 4.7.1 | Native animation execution. | apps/mobile |
react-native-safe-area-context | ~5.11.1 | Safe-area insets. | apps/mobile |
react-native-screens | 4.30.1 | Native navigation screens. | apps/mobile |
react-native-svg | 15.16.0 | Native vector graphics. | apps/mobile |
react-native-web | ~0.21.4 | Web adapter for React Native. | apps/mobile |
react-native-worklets | 0.13.0 | Worklet execution required by native animation. | apps/mobile |
react-phone-number-input | 3.4.18 | Phone input. | packages/ui |
react-resizable-panels | 4.16.1 | Resizable panels. | packages/ui |
recharts | 3.10.1 | Application charts. | apps/web, packages/ui |
shadcn | 4.23.0 | Component installation and registry tooling. | packages/ui |
shiki | 4.6.0 | Syntax highlighting; docs run it at build time. | packages/ui |
skullet | 0.0.3 | Loading skeletons measured from a sample of the real component (platform/skeleton). | apps/web |
sonner | 2.0.8 | Toast feedback. | apps/web, packages/ui |
tailwindcss | 4.3.3 | Semantic utility styling. | apps/web, packages/ui |
takumi-js | 2.19.0 | JSX-to-OG rendering integration. | apps/web |
turbo | 2.11.10 | Workspace task orchestration. | . |
tw-animate-css | 1.4.0 | UI animation utilities. | packages/ui |
typescript | 7.0.2, ~6.0.3 | Type checking; native uses the JS compiler line for Expo config. | ., apps/web, apps/mobile, packages/ads, packages/ui, packages/purchases, packages/flags, packages/intl, packages/auth, packages/storage, packages/env, packages/react-utils, packages/db, packages/api, packages/errors, packages/app-update, packages/email, packages/widgets |
vaul | 1.1.2 | Drawer behavior. | packages/ui |
vite | 8.3.5 | Web build pipeline and development server. | apps/web |
vitest | 5.0.5 | Unit and integration test runner. | apps/web, apps/mobile, packages/ads, packages/ui, packages/purchases, packages/flags, packages/intl, packages/auth, packages/storage, packages/env, packages/react-utils, packages/db, packages/api, packages/errors, packages/app-update, packages/email, packages/widgets |
wrangler | 4.156.1 | Worker build/deploy/local runtime. | apps/web |
zod | 4.6.7 | Validate public contracts and third-party payloads. | ., apps/web, apps/mobile, packages/flags, packages/auth, packages/env, packages/db, packages/api, packages/errors |
@aws-sdk/client-s3 | 3.1161.0 | S3-compatible Node storage transport, uploads or signing. | packages/storage |
@aws-sdk/lib-storage | 3.1161.0 | S3-compatible Node storage transport, uploads or signing. | packages/storage |
@aws-sdk/s3-presigned-post | 3.1161.0 | S3-compatible Node storage transport, uploads or signing. | packages/storage |
@aws-sdk/s3-request-presigner | 3.1161.0 | S3-compatible Node storage transport, uploads or signing. | packages/storage |
@expo/dom-webview | ~58.0.2 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
@expo/metro-runtime | ~58.0.17 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
@expo/vector-icons | 15.1.1 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-application | ~58.1.2 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-clipboard | ~58.0.4 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-constants | ~58.0.15 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-dev-client | ~58.0.18 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-device | ~58.0.5 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-file-system | ~58.0.13 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-font | ~58.0.11 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-glass-effect | ~58.0.5 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-haptics | ~58.0.7 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-image | ~58.0.18 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-linking | ~58.0.16 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-local-authentication | ~58.0.2 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-localization | ~58.0.5 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-network | ~58.0.4 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-observe | ~58.0.18 | EAS Observe: startup and navigation metrics, JS errors and native crashes; sends only with an EAS project id. | apps/mobile |
expo-notifications | ~58.1.8 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-secure-store | ~58.0.2 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-splash-screen | ~58.0.13 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-status-bar | ~58.0.4 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-store-review | ~58.0.2 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-symbols | ~58.0.4 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-system-ui | ~58.0.7 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-updates | ~58.0.21 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |
expo-web-browser | ~58.0.7 | Expo SDK platform capability; use the SDK-compatible version. | apps/mobile |