mirror of
https://github.com/getpaseo/paseo.git
synced 2026-10-24 10:12:44 +00:00
1f5b6143d6
* fix(plugins): keep React out of the server plugin host * fix(plugins): align SDK guidance and tests with runtime boundaries * fix(plugin): loosen the react peer to ~19.1.0 The plugin SDK pins its react peer to exactly 19.1.0, and that pin is what a downstream `npm i -g @getpaseo/cli` resolves against. So every user ends up with react 19.1.0 in their global node_modules, where corporate dependency scanners flag it: the CVE-2025-55182 advisory range covers 19.1.0 even though the vulnerability itself lives in react-server-dom-webpack/-parcel/-turbopack, none of which the CLI installs. The user is then left hand-patching node_modules or uninstalling Paseo. Widening the peer to ~19.1.0 lets a downstream install pick the latest 19.1.x patch (19.1.9 today) while this repo stays on 19.1.0, which the root override still pins. Keeping the repo itself on 19.1.0 is deliberate. react-native 0.81.5 embeds a 19.1.0 Paper renderer that hard-throws "Incompatible React versions" on any exact mismatch, and it is reachable from Fabric builds too: RendererImplementation.js requires the Paper shim unconditionally in findNodeHandle, unstable_batchedUpdates, sendAccessibilityEvent and three other entry points, and react-native-gesture-handler re-exports findNodeHandle. Bumping the app's react is therefore not safe until react-native moves. The published CLI tree contains no react-native, so downstream installs are not subject to that constraint. Supersedes the earlier 19.1.5/19.1.9 version-bump approach on this branch, which would have broken the mobile app. * Enforce example import ownership including client types * Update Nix dependency hash for plugin peer metadata * Group plugin APIs under client and server entry trees * Resolve plugin type dependencies through declarations * Validate declarations for implicit plugin type imports * Preserve optional imports and validate declaration references * Refresh Nix hash for plugin declaration resolver * Canonicalize plugin paths consistently on Windows * Normalize plugin ownership paths across resolver boundaries --------- Co-authored-by: liujin0506 <liujin0506@qq.com> Co-authored-by: Mohamed Boudra <boudra.moha@gmail.com>
50 lines
1.8 KiB
Markdown
50 lines
1.8 KiB
Markdown
<!--
|
|
Please follow this template. The PR template applies whether you opened the PR via the web UI, `gh pr create`, or any other tool.
|
|
|
|
You MUST read CONTRIBUTING.md before sending a PR.
|
|
-->
|
|
|
|
### Linked issue
|
|
|
|
Closes #
|
|
|
|
### Type of change
|
|
|
|
- [ ] Bug fix
|
|
- [ ] New feature
|
|
- [ ] Enhancement
|
|
- [ ] Refactor
|
|
- [ ] Docs
|
|
|
|
### Reasoning
|
|
|
|
<!-- A short description of the reasoning of this change in your own words. What was wrong, and how do you hope this PR fixes it. If you can't explain this briefly, the PR is probably too big. This description must be grounded in real user flows and framed as value provided to Paseo users. -->
|
|
|
|
### Goals
|
|
|
|
<!-- A bullet list of what this PR wants to accomplish, include requirements and acceptance criteria. This helps lock down the scope of the PR and prevent expanding scope over the intended goal. -->
|
|
|
|
### Non-goals
|
|
|
|
<!-- A bullet list of what this PR does not want to accomplish. Add any intentional trade offs taken. This helps lock down the scope of the PR and prevent expanding scope over the intended goal. -->
|
|
|
|
### QA
|
|
|
|
<!--
|
|
This is the section I read most carefully. I need to see that *you* tested this, not that the diff looks plausible.
|
|
|
|
- For UI changes: a screenshot or short video on every affected platform (mobile, web, desktop). UI claims without visual proof are not enough.
|
|
- For behavior changes: the actual steps you ran, and what you observed.
|
|
- For bug fixes: how you reproduced the bug before, and confirmed it's fixed after.
|
|
-->
|
|
|
|
### Checklist
|
|
|
|
- [ ] Plugin changes follow the [SDK import boundaries](../docs/plugins.md#sdk-import-boundaries) (if applicable)
|
|
- [ ] One focused change
|
|
- [ ] `npm run typecheck` passes
|
|
- [ ] `npm run lint` passes
|
|
- [ ] `npm run format` passes
|
|
- [ ] QA evidence
|
|
- [ ] Tests added or updated where it made sense
|