Folo is an open-source AI RSS reader that brings everything you follow into one calm timeline, then helps you read it. Follow blogs, news sites, newsletters, podcasts, video channels and social feeds in one place, ask AI about what you read, get a digest of your day, and let summaries and translations do the heavy lifting.
## ๐๐ป Getting Started & Join Our Community
Folo runs in the browser and on iOS, Android, macOS, Windows and Linux, and keeps your subscriptions, read status and stars in sync across all of them. It is under active development, and feedback is welcome for any [issue](https://github.com/RSSNext/Folo/issues) you run into.
| Platform | Download |
| :------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Web | |
| iOS | |
| Android | |
| macOS | |
| Windows | |
| Linux | |
You can also install using the following methods maintained by our community:
- If you are using Arch Linux, you can install the package [folo-appimage](https://aur.archlinux.org/packages/folo-appimage) that is maintained by [timochan](https://github.com/ttimochan) and [grtsinry43](https://github.com/grtsinry43).
- If you are using Linux with [Flatpak](https://flatpak.org), you can install [Folo](https://flatpark.org/apps/is.folo.Folo/) from [FlatPark](https://flatpark.org) that is maintained by [Komh](https://github.com/jing2uo).
- If you are using Nix, you can install the package [follow](https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/fo/follow/package.nix) that is maintained by [iosmanthus](https://github.com/iosmanthus).
- If you are using macOS with [Homebrew](https://brew.sh), you can install the cask [folo](https://formulae.brew.sh/cask/folo) that is maintained by [realSunyz](https://github.com/realSunyz).
- If you are using Windows with [Scoop](https://scoop.sh), you can install the manifest [folo](https://github.com/cscnk52/cetacea/blob/master/bucket/folo.json) that is maintained by [cscnk52](https://github.com/cscnk52).
| [](https://discord.gg/AwWcAQ7euc) | Join our Discord server to connect with developers, request features, and receive support. |
| :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :----------------------------------------------------------------------------------------- |
| [](https://x.com/intent/follow?screen_name=folo_is) | Follow us on X for product updates. |
> \[!IMPORTANT]
>
> **Star Us**, You will receive all release notifications from GitHub without any delay \~
## โจ Features
### Folo AI
Ask about an article, a feed, a folder or everything you follow. Pick your AI model or bring your own API key, and connect MCP services to bring your other tools into Folo AI.
### Timeline Summary
Turn hundreds of new entries into one quick digest of what matters.
### AI Translation and Summaries
Read articles side by side with an AI translation in English, Chinese, Japanese or French, and get an AI summary of any article, on demand or automatically.
### Every Format
Articles, social posts, pictures, videos and podcasts each get a layout made for them, and text-to-speech reads any article aloud with natural voices.
### AI Tasks
Schedule AI tasks that write daily or weekly briefings and deliver them to chat or email.
### Integrations
Send articles to Obsidian, Readwise, Instapaper, Zotero, Cubox, Outline, Readeck or Eagle, and let Actions filter, star, rewrite, notify or summarize new entries with your own rules.
### On Your Phone
Folo for iPhone, iPad and Android brings AI summaries, read-aloud and discovery with you, and picks up where you left off on your computer.
### And More
- Subscribe to any RSS, Atom or JSON feed, plus thousands of [RSSHub](https://github.com/DIYgod/RSSHub) routes for sites without a feed
- Import and export OPML to move from any other reader
- An inbox with its own email address for newsletters
- Customizable keyboard shortcuts and a command menu
- Themes, reading fonts, custom CSS and code highlighting
- Spotlight highlights the keywords you care about
- Open source, with no ads
## ๐ค Contributing
You are welcome to join the open source community to build together, please check our [Contributing Guide](./CONTRIBUTING.md) for more details.
## ๐ Code signing policy
Folo for Windows uses free code signing provided by [SignPath.io](https://about.signpath.io/), a certificate by [SignPath Foundation](https://signpath.org/).
Folo for macOS and iOS is signed and notarized by [Apple Developer Program](https://developer.apple.com/programs/).
All released files are verified with [GitHub artifact attestations](https://github.com/RSSNext/Folo/attestations) to ensure their provenance and integrity.
## ๐ License
Folo is licensed under the GNU Affero General Public License version 3 with the addition of the following special exception:
All content in the `icons/mgc` directory is copyrighted by https://mgc.mingcute.com/ and cannot be redistributed.
---
### Overview (`store-assets/README.md`)
# Store assets
Screenshots, artwork and listing copy for the App Store (iPhone, iPad, Mac), Google Play and the Microsoft Store. Slides are HTML templates rendered with Playwright from real app captures, so every locale shares one design that follows the folo.is landing page (warm paper, orange gradient).
```
listing// Store copy per listing locale (names, subtitles, descriptions,
keywords, release notes, screenshot headlines)
demo-account/ Curated subscriptions per UI locale, capture settings, avatar
promo/ Release promo video specs (see Release promo video)
src/ Brand tokens, device frames, slide layouts, automation helpers
scripts/ Entry points (see below)
captures/ Raw app captures, captures///.png (ignored)
output/ Rendered store images, output//// (ignored)
```
## Locales
`src/locales.ts` maps each listing locale to store locale codes. The five app UI languages (`en`, `zh-Hans`, `zh-Hant`, `ja`, `fr`) get screenshots of a localized app. The other listing locales (`de`, `es`, `es-MX`, `pt-BR`, `ko`, `it`, `ru`) have translated copy and headlines over the English captures.
## Workflow
Run everything from the repository root with `pnpm exec tsx`. The scripts' dependencies are declared in `store-assets/package.json` (a private workspace package); Playwright's Chromium needs a one-time `pnpm exec playwright install chromium`.
1. **Check the copy.** `store-assets/scripts/check-listing.ts [locale...]` validates store length limits and policy rules (no competitor names, no ranking or price claims on Google Play, no URLs in Microsoft Store text).
2. **Switch the demo account's subscriptions** to one UI locale: `store-assets/scripts/demo-account.ts [--dry-run] [--reset] [--park-videos] [--skip-translation]`. It talks to the signed-in desktop app over CDP (port 9555). `--skip-translation` leaves out the translation demo feed while timelines are captured (for English it is a Chinese feed).
3. **Capture the apps** with the demo account signed in:
- Desktop: `store-assets/scripts/capture-desktop.ts [scene,...]` drives an isolated production Folo.app (`FOLO_E2E_USER_DATA_DIR`) over CDP and saves a Mac and a Windows variant of each scene.
- iOS: `store-assets/scripts/sim-locale.ts ` sets the simulator language and a clean status bar, then `store-assets/scripts/capture-ios.ts [scene,...]`. Run the `language` scene first and relaunch the app afterwards, since native tab titles only pick up the new language on launch.
- Android: `store-assets/scripts/capture-android.ts [serial] [scene,...]` on an emulator (demo mode status bar). Set `FOLO_ANDROID_PACKAGE` to capture a side-by-side build such as `is.follow.playerfix`.
- `store-assets/scripts/check-captures.ts` lists the captures each UI locale still needs.
4. **Render** with `store-assets/scripts/render.ts [--deck app-store/iphone,...] [--locale en,ja,...] [--allow-missing]`. `--allow-missing` skips slides whose captures are not taken yet, for previews. Each output folder is emptied before it is written.
5. **Check the images** with `store-assets/scripts/check-output.ts`: one file per slide for every store locale, at the store size, without alpha.
6. **Update the repository README images** with `store-assets/scripts/export-readme.ts`: it writes the banner and the English Mac and iPhone posters the README shows as JPEGs to `output/github/readme`. The README links them as GitHub attachments, kept in a comment on [DIYgodLab/debug#1](https://github.com/DIYgodLab/debug/issues/1) rather than in the repository; an attachment only becomes public once the comment holding it is posted.
7. **Update the App Store creative assets** (the product page header and search results artwork that iOS and iPadOS 27 show): `store-assets/scripts/app-store-creative.ts upload` puts each locale's `output/app-store/creative//universal.png` into the app's Asset Library (identical renders share one upload). Submit them in App Store Connect: Asset Library โ Edit โ select them โ Add for Review โ Submit for Review; this needs an Account Holder, Admin or App Manager and has no API. Review takes up to 48 hours. Then `app-store-creative.ts assign [--dry-run]` sets the approved images as header and search results asset on every localization of the live iOS version, which applies without a new app version.
8. **Update the App Store custom product pages** in `src/custom-pages.ts` (name and screenshot order) and `listing//app-store.json` โ `customPages` (promotional text and the keywords each page takes over; `check-listing.ts` makes sure they come from that locale's `keywords.ios` and that no keyword is on two pages). `store-assets/scripts/app-store-custom-pages.ts sync [--page ai,...] [--skip-screenshots]` creates or updates every page localization with its text, keywords and the iPhone and iPad screenshots in the page's order (about a minute per screenshot set), and `app-store-custom-pages.ts submit` sends the editable page versions to App Review. Searches for a page's keywords show that page instead of the default product page once it is approved.
## Outputs
| Store | Deck | Size |
| --------------- | ----------------------------- | -------------------------------------------------- |
| App Store | `app-store/iphone` | 1320 ร 2868 (6.9") |
| App Store | `app-store/ipad` | 2064 ร 2752 (13") |
| App Store | `app-store/mac` | 2880 ร 1800 |
| App Store | `app-store/creative` | 5244 ร 2950 universal creative asset per locale |
| Google Play | `google-play/phone` | 1440 ร 2560 |
| Google Play | `google-play/feature-graphic` | 1024 ร 500 |
| Microsoft Store | `microsoft-store/desktop` | 3840 ร 2160, the Mac posters; captions repeat them |
| Microsoft Store | `microsoft-store/extras` | 3840 ร 2160 super hero art, 300 ร 300 store logo |
| GitHub | `github/readme` | 2400 ร 1200 README banner, English only |
## Release promo video
`store-assets/scripts/release-video.ts (--stills | --video ) [--captures ]` renders the announcement video of a release, 1920 ร 1080 at 30 fps, from the captures in the slides' style: an intro with the versions, one scene per highlight (a Mac window, a Mac and a phone, or phones with a callout) and an outro with folo.is. The spec format is documented in the script; `promo/example.json` is the desktop 1.15.0 / mobile 0.5.11 video and uses every layout. `--stills` writes one frame per scene and a contact sheet; both modes print each shot's capture time and report text that wraps or leaves its area, and `--video` (which needs `ffmpeg`) renders nothing until that is fixed. The release flow around it, with the post and the quote line, is `.agents/skills/release-promo`.
## Capture notes
- AI scenes (summary, listen, translate, chat, digest, tasks) need a plan with AI quota on the demo account.
- `demo-account/scenes.json` holds per-locale capture settings: the AI chat prompt, words that keep entries and AI answers out of the shots, the folder the hero, digest and mobile summary open, the translation demo feed, the example AI tasks, and localized names and prompts for the built-in AI shortcuts.
- The desktop script syncs the account's `language` and `actionLanguage` to the capture locale (AI answers, summaries and translations follow `actionLanguage`; settings sync is last-writer-wins, so local patches bump `updated`), localizes the AI shortcuts, creates the example AI tasks for the tasks scene and deletes them right after, and retries chat and digest answers that mention an avoided topic.
- The desktop script seeds the app's locale cache (`follow:locale-` in localStorage) from the repository's locale files before capturing: the production Electron build leaves some namespaces (the AI settings and chat panel in Traditional Chinese) in English otherwise.
- Hero, digest and the mobile summary open one folder rather than the all-articles timeline, which can take a minute to load for this account. The desktop hero and translate scenes skip entries whose stored AI summary is not in the capture language (checked for CJK locales).
- The listen slides need a build after 0.5.10 on iPad and Android: before 7d4b23bb4 the player bar lived in the JS tab bar, which is hidden on the article screen. For JS-only changes, swap a new Hermes bundle into the existing app instead of rebuilding: on iOS replace `main.jsbundle` in a copy of the simulator `.app`, ad-hoc sign it and `simctl install` it; on Android replace `assets/index.android.bundle` in the installed APK, `zipalign` and sign it with the Expo template `debug.keystore` (the key the local build used) and `adb install -r` it. Both keep the app data and sign-in.
- Mobile translate scenes: on iOS the per-entry "Show Translation" toggle does not fetch every language, so the script switches on the app-wide AI translation setting for the shot and off again, and waits for the entry's translation row in the app's SQLite database; on Android it uses the entry menu and compares pixels to see the translated title (uiautomator keeps reporting the old one).
- The mobile `language` scenes also write the capture language to the account (`src/account.ts`), so builds after 0.5.10, which sync it, produce AI summaries in that language.
- Callouts: the summary and listen scenes save a `.json` next to the screenshot with the region the slide enlarges (the AI summary card, found by its localized title, and the player bar, found by its testID and its localized stop button). `render.ts` prefers it over the deck's default rectangle, since those elements sit differently per device and entry.
- On iPad, the entry "more" menu opens on a physical tap and its items need a held press (`axe touch --delay 0.2`); on Android, the entry "more" button is found by its localized "More Actions" label, and switching the app language in place offsets the screen until the next launch, so the script relaunches after it. Builds after 0.5.10 expose testIDs (`AXUniqueId` on iOS, `resource-id` on Android), e.g. `timeline-entry-first`, `entry-item-`, `floating-player-bar`.
- Native YouTube feeds (`youtube.com/feeds/videos.xml?playlist_id=UULFโฆ`, the long-form uploads playlist) keep original-language titles and exclude Shorts. The subscription `title` in `feeds.json` replaces their generic "Videos" feed title. A newly added YouTube feed has no thumbnails until its first scheduled refresh; `--park-videos` keeps other locales' YouTube feeds followed (hidden from timelines) until then.
- `demo-account.ts` retries until the account matches the catalog (new feeds can time out while they import); check that its last line reports nothing left to change.
---
### Overview (`apps/mobile/README.md`)
# Folo Mobile App ๐ฑ
This is the mobile client for [Folo](https://app.folo.is), built with [Expo](https://expo.dev). Folo organizes content into one timeline, keeping you updated on what matters, noise-free.
## Features
- Customized information hub for content discovery
- AI-powered features like translation and summary
- Dynamic content support (articles, videos, images, audio)
- $POWER integration for creator economy
- Cross-platform support (iOS & Android [WIP])
- Modern UI design with native feel
## Getting Started
1. Enable Corepack (if not already enabled)
```bash
corepack enable
```
2. Install dependencies
```bash
pnpm install
```
3. Start the development server
```bash
pnpm run dev
```
You can run the app on:
- iOS Simulator (`pnpm run ios`)
- iOS Device (`pnpm run ios:device`)
- Android Emulator (`pnpm run android`)
- Development build for full native feature testing
## Project Structure
```
src/
โโโ modules/ # Feature-specific modules
โ โโโ discover/ # Discovery feed features
โ โโโ ...
โโโ screens/ # App screens using file-based routing
โโโ ...
```
## Development
- Built with Expo SDK [>=52]
- Uses [Expo Router](https://docs.expo.dev/router/introduction/) for navigation
- Styling with [NativeWind](https://www.nativewind.dev/)
- State management with Jotai and Zustand
- API integration with Tanstack Query
- Full TypeScript support
## Useful Resources
- [Expo Documentation](https://docs.expo.dev/)
- [NativeWind Documentation](https://www.nativewind.dev/)
- [Main Project Repository](https://github.com/RSSNext/Follow)
## Need Help?
- Join our [Discord](https://discord.gg/AwWcAQ7euc)
- Follow us on [Twitter](https://x.com/folo_is)
- Contact the mobile development team
## License
This project is licensed under the GNU Affero General Public License version 3. See the main project repository for full license details.
---
### Overview (`apps/ota/README.md`)
# OTA Service Operations
This runbook covers release rollout verification and rollback for the `apps/ota` Cloudflare Worker.
## Scope
- GitHub Releases is the publishing source of truth.
- Cloudflare Worker, KV, and R2 are the delivery layer.
- Run `cf` commands from `apps/ota`. `cloudflare.config.ts` configures the Worker, and `--mode dev` selects the dev Worker (`pnpm run dev`, `pnpm run deploy:dev`, `pnpm run deploy:prod`).
- `cf` cannot stream live logs or set a single secret yet. Use `wrangler tail folo-ota` and `wrangler secret put --name folo-ota` for those.
- The verified v1 routes are:
- `GET /manifest`
- `GET /assets/*`
- `GET /policy`
- `POST /internal/sync`
- `GET /internal/health`
Desktop release automation is file-driven:
- `apps/desktop/release-plan.json`
- `apps/desktop/release.json`
Desktop release modes:
- `build`: publish direct installer assets only
- `ota`: publish renderer OTA assets and direct installer assets together
## Request Shape
`/manifest`:
- Requires `expo-platform` and `expo-runtime-version` headers.
- Accepts `expo-channel-name`; defaults to `production`.
- Accepts `product`; defaults to `mobile`.
- Returns `204` when no compatible OTA release exists.
Desktop `/manifest`:
- Uses `X-App-Platform`, `X-App-Version`, and `X-App-Channel`.
- Accepts optional `X-App-Runtime-Version`; defaults to `X-App-Version`.
- Accepts optional `X-App-Renderer-Version`.
- Returns desktop JSON with `renderer` and optional `app` payloads.
- Never returns direct `app` payloads for `mas` or `mss`.
`/policy`:
- Requires `platform` and `installedBinaryVersion`.
- Accepts `channel`; defaults to `production`.
- Accepts `product`; defaults to `mobile`.
- Detects the current live store version automatically:
- `ios`: App Store lookup API
- `android`: Google Play storefront
- Returns `none` or `prompt`.
Desktop `/policy`:
- Uses `X-App-Platform`, `X-App-Version`, and `X-App-Channel`.
- Resolves `distribution` from `X-App-Platform`.
- Detects the current live store version automatically for store distributions:
- `mas`: Mac App Store storefront
- `mss`: Microsoft Store public update service
- Returns `none` or `prompt` plus distribution-specific `storeUrl`.
Store version caching:
- Scheduled sync refreshes storefront versions into KV every 5 minutes.
- `POST /internal/sync` refreshes both GitHub release metadata and storefront versions.
- `/policy` reads cached storefront versions first.
- If a cache entry is missing, `/policy` fetches the storefront version once and backfills KV.
## Release Checklist
1. Confirm the Git tag exists for the target release, for example `mobile/v0.4.2`.
2. Confirm the GitHub Release contains both `ota-release.json` and `dist.tar.zst`.
3. Trigger an OTA sync after publishing or updating release assets.
4. Verify `/internal/health` reports a fresh `lastSuccessAt`.
5. Verify `/internal/health` reports a fresh `storeVersionLastSuccessAt`.
6. Verify `/manifest` resolves the expected `releaseVersion` for every target platform.
7. Download the returned launch asset URL and confirm it is reachable.
8. Verify `/policy` returns the expected action for the current installed version and storefront.
9. Run the automated OTA and mobile verification commands before closing the rollout.
## Rollback Checklist
1. Identify the last known good OTA release version for the affected `channel`, `runtimeVersion`, and platform set.
2. Read the current KV pointers before changing anything.
3. Overwrite the affected `latest::::` keys with the previous good `releaseVersion`.
4. Re-run the manual verification commands for `/manifest` and `/policy`.
5. Correct the GitHub Release source of truth before the next sync.
## Verified v1 Limitation
Rollback by KV pointer edit is only a temporary mitigation in the current implementation.
The sync job always promotes the highest compatible `releaseVersion` from GitHub Releases. If the bad release still exists as a valid published source, the next scheduled or manual sync can point `latest:*` back to the bad version.
Do not rely on KV edits alone. Before the next sync, either:
- remove or invalidate the bad OTA release assets from GitHub Releases, or
- publish a newer corrective OTA release on the same `runtimeVersion`.
Hard freeze and disable flags are not implemented in the verified v1 Worker yet.
## Environment Variables
Set these before running the manual checks:
```bash
export OTA_BASE_URL="https://ota.folo.is"
export OTA_PRODUCT="mobile"
export OTA_PLATFORM="ios"
export OTA_CHANNEL="production"
export OTA_RUNTIME_VERSION="0.4.1"
export OTA_INSTALLED_BINARY_VERSION="0.4.1"
export OTA_DESKTOP_PLATFORM="desktop/windows/exe"
export OTA_RELEASE_VERSION="0.4.2"
export OTA_SYNC_TOKEN_HEADER="x-ota-sync-token"
export OTA_SYNC_TOKEN=""
export OTA_GOOD_RELEASE_VERSION="0.4.1"
```
Production and development Workers must also provide an `OTA_CODE_SIGNING_PRIVATE_KEY` secret containing the PEM-encoded PKCS#8 private key that matches `apps/mobile/code-signing/certificate.pem`.
## Manual Verification Commands
Trigger a sync and inspect health:
```bash
OTA_BASE_URL="$OTA_BASE_URL" \
OTA_SYNC_TOKEN="$OTA_SYNC_TOKEN" \
OTA_SYNC_TOKEN_HEADER="$OTA_SYNC_TOKEN_HEADER" \
node ../../.github/scripts/trigger-ota-sync.mjs
curl --fail --silent --show-error \
"$OTA_BASE_URL/internal/health"
```
Verify `/manifest` for iOS:
```bash
curl --fail --silent --show-error \
-D /tmp/ota-manifest.headers \
-H "expo-platform: ios" \
-H "expo-runtime-version: $OTA_RUNTIME_VERSION" \
-H "expo-channel-name: $OTA_CHANNEL" \
"$OTA_BASE_URL/manifest?product=$OTA_PRODUCT" \
| tee /tmp/ota-manifest.json
jq -r '.metadata.releaseVersion' /tmp/ota-manifest.json
jq -r '.launchAsset.url' /tmp/ota-manifest.json
curl --fail --silent --show-error \
"$(jq -r '.launchAsset.url' /tmp/ota-manifest.json)" \
-o /tmp/ota-launch-asset
```
Verify `/manifest` for Android:
```bash
curl --fail --silent --show-error \
-H "expo-platform: android" \
-H "expo-runtime-version: $OTA_RUNTIME_VERSION" \
-H "expo-channel-name: $OTA_CHANNEL" \
"$OTA_BASE_URL/manifest?product=$OTA_PRODUCT" \
| jq -r '.metadata.releaseVersion'
```
Verify `/policy`:
```bash
curl --fail --silent --show-error \
"$OTA_BASE_URL/policy?product=$OTA_PRODUCT&platform=$OTA_PLATFORM&channel=$OTA_CHANNEL&installedBinaryVersion=$OTA_INSTALLED_BINARY_VERSION" \
| tee /tmp/ota-policy.json
jq . /tmp/ota-policy.json
```
Verify desktop `/manifest` for a direct Windows build:
```bash
curl --fail --silent --show-error \
-H "X-App-Platform: $OTA_DESKTOP_PLATFORM" \
-H "X-App-Version: 1.5.0" \
-H "X-App-Runtime-Version: 1.5.0" \
-H "X-App-Renderer-Version: 1.5.0" \
-H "X-App-Channel: stable" \
"$OTA_BASE_URL/manifest" \
| tee /tmp/desktop-ota-manifest.json
jq . /tmp/desktop-ota-manifest.json
```
Verify desktop `/policy` for MAS:
```bash
curl --fail --silent --show-error \
-H "X-App-Platform: desktop/macos/mas" \
-H "X-App-Version: 1.5.0" \
-H "X-App-Channel: stable" \
"$OTA_BASE_URL/policy" \
| tee /tmp/desktop-ota-policy.json
jq . /tmp/desktop-ota-policy.json
```
## Automated Verification Commands
Run these from the repository root:
```bash
pnpm --filter @follow/ota test
pnpm --filter @follow/ota typecheck
pnpm --dir apps/desktop/layer/main exec vitest run src/updater/api.test.ts src/updater/index.test.ts
pnpm --dir apps/desktop/layer/main typecheck
pnpm --filter @follow/mobile exec vitest run src/modules/ota/__tests__/client.test.ts src/modules/ota/__tests__/store.test.ts src/modules/ota/__tests__/provider.test.ts
pnpm --filter @follow/mobile typecheck
pnpm exec prettier --check .github/workflows/publish-ota.yml .github/workflows/tag.yml .github/scripts/trigger-ota-sync.mjs .github/scripts/trigger-ota-sync.test.ts
pnpm exec prettier --check .github/scripts/build-ota-release.mjs .github/scripts/build-ota-release.test.ts
```
---
### Overview (`apps/mobile/e2e/README.md`)
# Mobile E2E
## Requirements
- Install Maestro CLI.
- Android: install the app on a booted emulator.
- iOS: provide a standalone simulator app bundle via `MAESTRO_IOS_APP_PATH`, or place a local `build-*.tar.gz` from `eas build --local --platform ios --profile e2e-ios-simulator` in `apps/mobile`.
- Export `E2E_EMAIL` if you want to reuse a fixed account. Otherwise the runner script creates a unique address.
## Commands
```bash
pnpm run e2e:doctor
pnpm run e2e:android
pnpm run e2e:ios
pnpm run e2e:ios:bootstrap
```
## iOS Notes
- `pnpm run e2e:ios` runs two real journeys in sequence:
- `auth.yaml`: register -> sign out -> log in
- `content.yaml`: ensure onboarding feed unfollowed -> follow -> timeline/read-unread -> unfollow
- The iOS runner resets the simulator, disables password autofill prompts, installs the provided app bundle, then executes Maestro.
- Auth and content run sequentially against the same signed-in app. Each journey writes its own debug artifacts and JUnit report under `auth/` or `content/` in `MAESTRO_DEBUG_OUTPUT` (default: `e2e/artifacts/ios`). A failed journey stops the runner.
## Prod iOS auth bootstrap
When non-auth iOS self-tests need a signed-in simulator quickly, bootstrap auth through the standard iOS runner mode:
```bash
pnpm run e2e:ios:bootstrap
```
This mode uses the auth bootstrap helper on iOS when `EXPO_PUBLIC_E2E_ENV_PROFILE=prod` or `EXPO_PUBLIC_E2E_ENV_PROFILE=local`, and falls back to the normal iOS registration flow for other environments.
Optional environment variables:
- `E2E_EMAIL`
- `E2E_PASSWORD`
- `MAESTRO_IOS_DEVICE_ID`
- `E2E_API_URL`
- `E2E_CALLBACK_URL`
- `E2E_BUNDLE_ID`
The bootstrap script signs in against prod using the mobile fallback token header, writes the auth cookie into the simulator's `ExpoSQLiteStorage` fallback store, and relaunches the app.
## Environment
- `E2E_EMAIL`
- `E2E_PASSWORD`
- `MAESTRO_DEBUG_OUTPUT`
- `MAESTRO_IOS_APP_PATH`
- `EXPO_PUBLIC_E2E_ENV_PROFILE`
- `EXPO_PUBLIC_E2E_LANGUAGE`
## Local native StoreKit verification
To exercise `expo-iap` itself instead of the local `buyProduct` helper shortcut,
build a simulator app with all of the following settings:
```bash
# Run from apps/mobile/ios after pod install. Set UDID to a dedicated test simulator.
EXPO_PUBLIC_E2E_ENV_PROFILE=local EXPO_PUBLIC_E2E_LANGUAGE=en \
EXPO_PUBLIC_E2E_IAP_NATIVE=1 PROFILE=e2e-ios-simulator \
xcodebuild -workspace Folo.xcworkspace -scheme Folo -configuration Release \
-sdk iphonesimulator -destination "id=${UDID}" build \
CODE_SIGNING_ALLOWED=NO ENABLE_TESTING_SEARCH_PATHS=YES \
'SWIFT_ACTIVE_COMPILATION_CONDITIONS=$(inherited) STOREKIT_TESTING'
```
Use the isolated API at `http://localhost:3000` and a local test account. The flag
requires an enabled native `SKTestSession` using the bundled StoreKit file before
loading products or requesting, restoring, or verifying purchases. Missing test
support fails closed. The helper injects a randomly named readiness product into
a temporary copy of the local configuration and requires StoreKit to return it;
it does not change the six subscription products or expose the probe in the app.
This detects simulator failures that silently ignore test configuration writes.
The ordinary application behavior is unchanged when the
flag is absent. Never use this verification against a production API or Apple
store account.
Activate the local configuration through a temporary Xcode scheme's Run โ
Options โ StoreKit Configuration before launching the test app. The validated
run used a separate temporary workspace/scheme, the Release app above, and an
iOS 18.5 simulator. Leave the project's normal scheme and real store settings
unchanged. A standalone launch is not sufficient on every simulator runtime:
iOS 26.5 (23F77) rejected configuration writes with StoreKitTest code 3.
For a prelaunch readiness probe, copy the bundled `.storekit` file to the temporary
scheme, add a `NonConsumable` product with a unique `is.follow.e2e.probe.` ID, and
set `FOLO_E2E_STOREKIT_PROBE_ID` to that same ID in the scheme's launch environment.
The helper creates its own temporary copy containing this product and verifies
that it is available before any purchase. Never add this probe to the app's six
subscription identifiers or App Store Connect.
The test launch also needs Xcode's XCTest runtime frameworks. Without these
search paths, StoreKitTest can abort inside `XCTestLibrary` before returning from
session initialization. Set `DYLD_FRAMEWORK_PATH` / `DYLD_LIBRARY_PATH` in the
temporary scheme, or use their `SIMCTL_CHILD_` forms for a standalone diagnostic:
```bash
simulator_developer="$(xcode-select -p)/Platforms/iPhoneSimulator.platform/Developer"
SIMCTL_CHILD_DYLD_FRAMEWORK_PATH="${simulator_developer}/Library/Frameworks:${simulator_developer}/Library/PrivateFrameworks" \
SIMCTL_CHILD_DYLD_LIBRARY_PATH="${simulator_developer}/usr/lib" \
SIMCTL_CHILD_FOLO_E2E_STOREKIT_CANCEL_ONCE=1 \
xcrun simctl launch --terminate-running-process "${UDID}" is.follow
```
Omit `SIMCTL_CHILD_FOLO_E2E_STOREKIT_CANCEL_ONCE` for a success-only run.
The test-only helper then injects StoreKit's `userCancelled` error; the first
`useIAP` error callback clears it and resets test settings, retaining transactions.
The reset is necessary on the validated iOS 18.5 runtime: setting the error to
`nil` alone reports success but leaves the next native purchase failing. Recovery
checks the cleared error, disabled dialogs and local probe again. A subsequent
purchase awaits this recovery promise and fails closed if recovery fails. Verify the UI leaves its loading state after cancellation, then verify
`[StoreKit E2E]` events for `request-purchase`, `purchase-success`,
`server-verified`, and `transaction-finished`, as well as the local API billing
state. These events deliberately omit receipts, account tokens, and transaction
payloads. Restore can be exercised in the same session; preparing a new test
session clears its transactions.
---
### Overview (`apps/mobile/native/README.md`)
# follow-native
Nope
# API documentation
- [Documentation for the latest stable release](https://docs.expo.dev/versions/latest/sdk/follow-native/)
- [Documentation for the main branch](https://docs.expo.dev/versions/unversioned/sdk/follow-native/)
# Installation in managed Expo projects
For [managed](https://docs.expo.dev/archive/managed-vs-bare/) Expo projects, please follow the installation instructions in the [API documentation for the latest stable release](#api-documentation). If you follow the link and there is no documentation available then this library is not yet usable within managed projects — it is likely to be included in an upcoming Expo SDK release.
# Installation in bare React Native projects
For bare React Native projects, you must ensure that you have [installed and configured the `expo` package](https://docs.expo.dev/bare/installing-expo-modules/) before continuing.
### Add the package to your npm dependencies
```
npm install follow-native
```
### Configure for Android
### Configure for iOS
Run `npx pod-install` after installing the npm package.
# Contributing
Contributions are very welcome! Please refer to guidelines described in the [contributing guide](https://github.com/expo/expo#contributing).
---
### Overview (`apps/mobile/src/lib/navigation/readme.md`)
## Docs
https://www.notion.so/rss3/React-Native-Navigation-Yet-1c035ea049b48068bdc1c21009961622
---
### Overview (`apps/desktop/layer/renderer/src/modules/command/README.md`)
# Folo Command Abstractions
this module encapsulates the command abstractions specifically designed for the Folo feature, which is leveraged through CMD-K.
The architectural design of the API takes inspiration from the [VSCode Command Abstractions](https://code.visualstudio.com/api/references/contribution-points#contributes.commands).
The registry component has been adapted from the innovative work found in [AFFiNE](https://github.com/toeverything/AFFiNE/blob/de81527e294ee99865ae7218fa4d22ad0660bf34/packages/frontend/core/src/commands/registry/README.md).
Furthermore, the hook design principles draw inspiration from the ideas proposed by [Supabase](https://github.com/supabase/supabase/pull/27044).
---
### Dependency Upgrade 2026 09 22 (`docs/dependency-upgrade-2026-09-22.md`)
# Dependency upgrade audit โ 2026-09-22
Status: source review, installation and the documented local functional acceptance checks are complete. External-service and platform limits are recorded below. This audit records the completed local validation before the separately authorized dev publication.
## Method and scope
The starting inventory contained 207 outdated direct packages, plus the explicit Floating UI DOM override. Comparing effective manifest versions (including catalog and override resolution) with HEAD gives 205 upgraded existing direct packages, one new direct package (`@lexical/code-prism`), and two changed override-only packages (`@floating-ui/dom`, `react-server-dom-webpack`). The original TypeScript and legacy Vite plugin versions remain unchanged for documented compatibility reasons. pnpm is an additional toolchain upgrade. All 208 package candidates have a recorded version decision. The package manager was subsequently added to the toolchain review (pnpm 10.17.0 โ 12.5.1). Each updated dependency was reviewed against upstream changelog/release material and actual package source diffs; relevant shared runtime was included. Large monorepos were narrowed to consumed packages. Generated bundles, unrelated integrations and unrelated framework implementations were excluded; this is not a claim that every upstream line was read.
Exact npm metadata, refs, raw diffs and focused source diffs are retained in `/tmp/folo-dependency-review-20260922`, `/tmp/follow-runtime-audit` and `/tmp/follow-tooling-audit`. These are temporary session evidence; the source URLs and family reports below are the durable record. Official commit histories substitute only when projects have no conventional changelog (including DefinitelyTyped, generated icon data and ai-tools). Such substitutions are identified in the corresponding notes.
## Compatibility decisions
- React/React DOM use 19.2.8, the latest compatible patch for Expo 57 / React Native 0.86.3's React 19.2 renderer, with a single workspace React version.
- Expo uses the latest SDK 57 patches and its supported React Native 0.86.3. Babel stays on 7.29.7 because Expo preset 57 and NativeWind require Babel 7.
- Mobile NativeWind uses Tailwind 3.4.19; desktop/landing use Tailwind 4.3.3. Mobile resolves its own Tailwind types.
- Electron Vite 5 uses Vite 7.3.6, React plugin 5.2.0 and legacy plugin 7.2.1. The newest legacy plugin 8 requires Vite 8/Rolldown's chunk APIs. Worker/landing use separately reviewed Vite 8 / React plugin 6.
- TypeScript stays on 6.0.3: the real TypeScript 7.0.2 substitution fails in typescript-eslint because its package exports no JS compiler API. See the [executable compatibility investigation](dependency-upgrade-typescript-2026-09-22.md).
- `@vercel/node` uses 12.0.1, the latest release with public source/changelog provenance. Version 13.0.1 has identical published runtime but an untraceable newer build-utils peer. See [source verification](dependency-upgrade-vercel-node-2026-09-22.md).
- pnpm 12.5.1 migrates `.npmrc` layout policy into workspace settings, replaces `onlyBuiltDependencies` with `allowBuilds`, removes the obsolete `ignorePatchFailures: false` flag, and preserves one consistent hoisted dependency layout throughout mobile CI (see the post-publication configuration fix in the package-manager audit). Frozen installation and graph checks are recorded in [the package-manager audit](dependency-upgrade-pnpm-2026-09-22.md).
## Required adaptations
- Better Auth account selectors now use local account IDs. Expo's asynchronous cookies and atomic chunk storage protocol are implemented and tested.
- Jotai 3 removed private storage type paths; types derive from public `createJSONStorage`.
- The jsdom 30 desktop package graph no longer contains `symbol-tree`; removing the stale Forge copy entry fixes a real package-generation failure. Unsigned `.app` creation and packaged runtime module loading passed. Fresh pnpm 12 platform filtering also exposed an eager AppX maker import on macOS; the Windows Store maker now loads only in its existing Microsoft Store branch.
- Electron 44 removes renderer `clipboard`: importing it caused a real preload failure and disabled all IPC. The preload now retains standard `navigator.clipboard`; main-process read IPC returns a promise. Removed `openAsHidden` is replaced by the existing startup argument.
- Motion modal enter frames and event subscriptions now clean up on unmount. Real browser E2E exposed a delayed `controls.start()` after the modal unmounted.
- Lexical 0.51 requires explicit `@lexical/code-prism`; the real editor imports the replacement highlighter.
- unplugin-ast uses typed Yuku nodes. Its Tailwind template transformation was checked for whitespace, interpolation and unrelated tags.
- OTA tar chunks use Uint8Array validation and the current stream completion signature.
- Firebase uses modular native APIs and App Check retry handling; Expo IAP uses `verifyPurchase`. Exact PostHog/React peers avoid duplicate runtime instances.
- Worker Satori/HarfBuzz and resvg assets, landing request boundaries and Worker context changes are documented in their family reports.
- UIKit 1.0 changes its consumed Tailwind sibling to `color-mix`, which dropped nine native alpha colors. A dynamic RGB/alpha-variable adapter preserves the official palette and opacity multiplication; see the [counterfactual compilation and native resolver tests](dependency-upgrade-mobile-2026-09-22.md#uikit-alpha-regression-and-continuous-test-coverage). Mobile and reader test scripts now participate in the root recursive test command.
## Validation evidence
A subsequent acceptance run failed despite passing test assertions: `/tmp/folo-frontend-acceptance-test.log` records an unhandled `window is not defined` rejection in the TTS stream cleanup after the renderer test environment had been torn down. `playEntryTts` starts a background stream loop; the scheduling test previously ended as soon as a chunk was scheduled. The test now waits for the mocked audio context to close and checks that `srcObject` is restored before teardown. Production playback code is unchanged. The new wait follows interval cleanup in the actual implementation; the final full rerun passed all 130 files and 688 tests with no unhandled errors (`/tmp/folo-frontend-acceptance-test-final.log`). The two existing CLI skips remain. The failed log is retained.
The quality checks passed with the counts below. The final ordinary iOS app passed continuous authentication (2m 41s) and content (3m 08s), plus single-tap article opening, cold-start deep links and modal dismissal. Settled iOS light/dark screenshots confirmed readable text, fills and separators; retained visual limits are recorded below. The final Android app passed its continuous core journey in 5m 58s. See the [iOS report](dependency-upgrade-ios-2026-09-22.md) and [Android report](dependency-upgrade-android-2026-09-22.md) for exact artifacts, observations and retained earlier failures.
The separate local StoreKit build exercised the real expo-iap path: simulated cancellation, recovery, retry, purchase-success callback, local server verification, transaction finishing and restore all passed. Read-only database checks found one subscription for the expected owner in the Xcode environment, Basic / active / yearly / current. Restore preserved the same period end, `2027-09-22T08:04:38.273Z`. The checked-in fixture copies retain the seven original product IDs and prices; the readiness probe exists only in the task's temporary test configuration. The fixture correction and the iOS 18.5 simulated-error reset workaround are documented in the iOS report. The final provider changes also passed mobile typecheck and targeted lint (`/tmp/folo-mobile-acceptance-typecheck.log`, `/tmp/folo-mobile-acceptance-lint.log`).
This is local acceptance of the recorded flows. Production App Store/Play billing, external OAuth providers, Firebase attestation and push delivery, production analytics, signed/notarized distribution, and Windows/Linux installer execution were not validated. Existing native status-bar contrast issues and the transient Android theme-switch rendering frame remain visual limitations. UIKit compilation/resolver tests and settled light/dark native screenshots passed for the inspected text, fills and separators. No production deployment or real-money purchase was performed.
| Check | Observed result |
| ------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Full frontend typecheck, final dependencies | 20/20 tasks passed after final mobile/reader adaptations, under Node 24.15.0 / pnpm 12.5.1; `/tmp/folo-frontend-acceptance-typecheck.log` |
| Full frontend lint after final source adaptations | 0 errors, 977 warnings after final adaptations; `/tmp/folo-frontend-acceptance-lint.log` |
| Full frontend tests, including mobile and reader | 130 files, 688 tests passed; 2 pre-existing CLI tests skipped; `/tmp/folo-frontend-acceptance-test-final.log`. Includes mobile 35 files / 152 tests, HTML reader 2 files / 12 tests, SSR 15 tests, and the final migration/UIKit regressions. |
| Shared packages, CLI, mobile HTML renderer builds | 5/5 build tasks passed; `/tmp/folo-build-final-filtered.log` |
| Desktop production web/PWA | Passed including modal cleanup; `/tmp/folo-desktop-web-final2.log` |
| Desktop Electron build | Passed including preload fix and post-pnpm-12 rebuild; `/tmp/folo-pnpm12-e2e.log` |
| Unsigned macOS app packaging and packaged runtime | Passed on Node 24.15.0: app.asar runtime includes working jsdom CSS/Unicode parsing, language detection and font-list modules, and the preload IPC bridge. `/tmp/folo-pnpm12-package.log`, `/tmp/folo-pnpm12-packaged-runtime.log`. Signing, notarization and installer publication were not invoked. |
| Existing product web/Electron E2E | Web core and two-session settings sync passed with Playwright 1.63 and its matching bundled Chromium 153.0.8010.12 (53.8s); `/tmp/folo-e2e-web-bundled-final.log`. Also passed with installed Chrome 153.0.8010.53. After pnpm 12 relinking, all 3 journeys passed again in 3.9m (`/tmp/folo-pnpm12-e2e.log`). Electron 44.4.3 core flow passed in 3.1m, including preload IPC, text/PNG clipboard, registration, logout/restart/login, subscription changes and read state; `/tmp/folo-e2e-electron-final2.log`. |
| Component browser integration | Passed: real Folo Lexical Prism/code exit/Unicode/undo/redo/autolink; RHF + Zod async defaults/validation/submit/reset; Radix menu/Escape/select/checkbox/keyboard slider; Floating UI resize; zoom buttons/wheel/reset; KaTeX MathML; XYFlow nodes/edge; Sentry isolated transport. No page errors; `/tmp/folo-component-e2e/system-chrome-result.log` |
| Full repository formatting | `pnpm run format:check` passed after final adaptations; `/tmp/folo-frontend-acceptance-format.log` |
| Native iOS/Android, SSR Node/Worker, landing | See family reports for actual build, UI interaction and external-service limits |
## Test side effect
The first native clipboard probe used Electron read handles directly when restoring. Electron 44 rejected those handles, leaving the test PNG in the system clipboard. That process exited without a materialized copy of the original contents, so the pre-test clipboard could not be recovered. Subsequent runs materialize every MIME payload before writing and correctly restore their own starting state; that does not recover the original clipboard. No clipboard contents were logged.
## Supplementary packages and toolchain
| Package | Change | Reviewed source and validation |
| -------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `@lexical/code-prism` | Newly explicit 0.51.0 dependency | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0); Prism highlighter source was reviewed with the Lexical family. The actual Folo editor passed code-fence creation, Prism tokenization, exit, undo/redo and link interaction checks. |
| `react-server-dom-webpack` | Override only, 19.2.7 โ 19.2.8 | [diff](https://github.com/react/react/compare/6117d7cca4906492c51fe6a03381e35adfd86e7d...1dd4ecbdabf826f527fc9a58c05ea70375b7d170); [changelog](https://raw.githubusercontent.com/react/react/1dd4ecbdabf826f527fc9a58c05ea70375b7d170/CHANGELOG.md); the patch changes RSC action-reference decoding and async-iterator error completion, with no client reconciler change. Landing Worker rendering/navigation and SSR builds passed. |
| `pnpm` | 10.17.0 โ 12.5.1 | [Migration and source audit](dependency-upgrade-pnpm-2026-09-22.md); frozen install leaves the lockfile byte-identical, followed by repeated checks, browser/Electron journeys and packaged-app launch. |
## Package review ledger
The manifest column includes compatibility-specific versions when multiple applications need different major versions; `catalog:` values resolve through pnpm-workspace.yaml. The impact-check column identifies what must be covered; passing status comes from the validation records, not from the existence of a planned test.
| Dependency | Starting โ reviewed target | Current manifests | Changelog / release and upstream diff | Read scope and impact | Impact check |
| ----------------------------------------- | -------------------------------------------------------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- |
| `@babel/core` | 7.29.0 โ 7.29.7 | 7.29.7 | [changes](https://raw.githubusercontent.com/babel/babel/4fba7541180bf5f58256d8e358b544e3831ad090/CHANGELOG.md); [diff](https://github.com/babel/babel/compare/v7.29.0...4fba7541180bf5f58256d8e358b544e3831ad090) | Input source maps cannot traverse outside package root; preserves original mapped identifiers and preserveFormat positions. Parser/async-generator finally/Safari rest-destructuring fixes reviewed. Keep Babel7 because Expo57 preset/plugins depend on7. | desktop/mobile bundles, sourcemap/config load |
| `@base-ui/react` | 1.6.0 โ 1.8.0 | 1.8.0 | [changes](https://raw.githubusercontent.com/mui/base-ui/47b40521eab921c2756bf9bdb0b0f07fbfdb8c8c/CHANGELOG.md); [diff](https://github.com/mui/base-ui/compare/b34551d644f2e58ebf8fc1050d949f6654ceca6c...47b40521eab921c2756bf9bdb0b0f07fbfdb8c8c) | Official1.7/1.8 complete release notes read; Folo only imports Tooltip. Read tooltip root/trigger/store/provider/positioner/popup/portal/viewport and shared positioning/render/focus/hover source. Handles are inert without mounted root; explicit trigger delay beats zero provider delay; arrowless start/end origin and capped popup first measurement fixed, disabled anchor stops scroll tracking, lazy render refs merged before clone. Other component changes not consumed. | landing tooltip hover/focus/Escape, edge placement and rerender E2E |
| `@better-auth/expo` | 1.6.23 โ 1.7.5 | 1.7.5 | [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Reviewed by backend runtime/root: OAuth cookie URL replaced by one-time ticket handoff; getCookie returns Promise; existing await-compatible sync storage retained. | mobile auth typecheck/available native E2E |
| `@better-auth/stripe` | 1.6.23 โ 1.7.5 | 1.7.5 | [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Reviewed by backend runtime: organization enabled guard/customerType, delete hook ctx, required subscription-cancel event type. Personal Folo subscription configuration unchanged. | auth typecheck and local auth E2E |
| `@cloudflare/vite-plugin` | 1.43.1 โ 1.57.1 | 1.57.1 | [history](https://raw.githubusercontent.com/cloudflare/workers-sdk/6e7712725698df46db9ec25ac738dd155ff8d39e/packages/vite-plugin-cloudflare/CHANGELOG.md); [diff](https://github.com/cloudflare/workers-sdk/compare/c5d5e893e575b00a62a886d1da395b6246948d18...6e7712725698df46db9ec25ac738dd155ff8d39e.diff); [family audit](dependency-upgrade-ssr-2026-09-22.md) | Official changelog and upstream source changes reviewed by root; RSC registration/loading and Miniflare request lifecycle impact require local build and Worker tests. | Family build, regression tests and affected product flows |
| `@cloudflare/workers-types` | 5.20260708.1 โ 5.20260922.1 | 5.20260922.1 | [workerd releases](https://github.com/cloudflare/workerd/releases); [diff](https://github.com/cloudflare/workerd/compare/99057e45cb7152cc5efc59b8d2182386fe1e3eec...761847b67636b6eaed5e0860e98772f8443bed5e); [family audit](dependency-upgrade-icons-types-2026-09-22.md) | Official Workers API declaration diff reviewed by runtime audit; compile Worker handlers and SSR bindings. | typecheck/build; focused icons and DOM sanitizer regression |
| `@eslint/compat` | 2.1.0 โ 2.1.1 | 2.1.1 | [changes](https://raw.githubusercontent.com/eslint/rewrite/a4466ca3f8dc7d6817c4dd91c10a989b83ecb30d/packages/compat/CHANGELOG.md); [diff](https://github.com/eslint/rewrite/compare/b8949534bf7f498d941007f3adc2740157965b49...a4466ca3f8dc7d6817c4dd91c10a989b83ecb30d) | fixupRule now returns markVariableAsUsed's result instead of discarding it; other changes are JSDoc. Affects compatibility-wrapped lint rules only. | lint |
| `@expo/dom-webview` | 57.0.0 โ 57.0.1 | 57.0.1 | [History](https://raw.githubusercontent.com/expo/expo/b9503d06b8e130abfca1bc16f671dbefb41ad709/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...b9503d06b8e130abfca1bc16f671dbefb41ad709.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `@expo/metro-runtime` | 57.0.3 โ 57.0.16 | 57.0.16 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/@expo/metro-runtime/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `@fastify/middie` | 9.3.3 โ 9.3.4 | 9.3.4 | [changes](https://github.com/fastify/middie/releases/tag/v9.3.4); [diff](https://github.com/fastify/middie/compare/e038188b33b9436e1be9f9d1c1920416ec6c18f1...310c7ef480bf1db2508316db7a42fdf274e6802e) | normalizePathForMatching resolves and validates HTTP(S) absolute-form request targets before middleware matching, closing path middleware bypass. Affects SSR middleware routing and malformed request handling. | SSR HTTP requests, SSR tests |
| `@floating-ui/core` | 1.7.5 โ 1.8.0 | 1.8.0 | [changes](https://raw.githubusercontent.com/floating-ui/floating-ui/12d94738472e922e1b3fa31b02b2b61b9ed77e6a/packages/core/CHANGELOG.md); [diff](https://github.com/floating-ui/floating-ui/compare/d8020ee98c702caa31fa9b4d929ca782c6b58c59...12d94738472e922e1b3fa31b02b2b61b9ed77e6a) | Adds opt-in layoutViewport; empty virtual inline rects no longer produce invalid position; RTL disjoint inline rects and centered overflow sizing fixed. Reviewed middleware runtime diff and optional type widening. | popover positioning at viewport edge, resize and scroll E2E |
| `@floating-ui/dom` | 1.7.5 โ 1.8.0 | 1.8.0 (override) | [changes](https://raw.githubusercontent.com/floating-ui/floating-ui/12d94738472e922e1b3fa31b02b2b61b9ed77e6a/packages/dom/CHANGELOG.md); [diff](https://github.com/floating-ui/floating-ui/compare/2c3bf2a45fa06dc562853bcbcd03ffb36289c366...12d94738472e922e1b3fa31b02b2b61b9ed77e6a) | autoUpdate refreshes stale observer rectangles immediately and on root resize; correct fixed clipping ancestors and scrollbar gutters; virtual getClientRects safely falls back to empty. | popover positioning at viewport edge, resize and scroll E2E |
| `@floating-ui/react` | 0.27.19 โ 0.27.20 | 0.27.20 | [changes](https://raw.githubusercontent.com/floating-ui/floating-ui/12d94738472e922e1b3fa31b02b2b61b9ed77e6a/packages/react/CHANGELOG.md); [diff](https://github.com/floating-ui/floating-ui/compare/d8020ee98c702caa31fa9b4d929ca782c6b58c59...12d94738472e922e1b3fa31b02b2b61b9ed77e6a) | Removes redundant passive scroll options; useFloating normalizes optional element references to null; widens exact optional types while retaining callback bivariance. | popover/menu E2E and typecheck |
| `@floating-ui/react-dom` | 2.1.8 โ 2.1.9 | 2.1.9 | [changes](https://raw.githubusercontent.com/floating-ui/floating-ui/12d94738472e922e1b3fa31b02b2b61b9ed77e6a/packages/react-dom/CHANGELOG.md); [diff](https://github.com/floating-ui/floating-ui/compare/d8020ee98c702caa31fa9b4d929ca782c6b58c59...12d94738472e922e1b3fa31b02b2b61b9ed77e6a) | Optional arrow and useFloating option types explicitly accept undefined. Runtime positioning requires paired DOM 1.8.0 dependency; review core/DOM before applying override. | popover/menu/tooltip E2E, typecheck |
| `@folo-services/ai-tools` | 0.2.66 โ 0.2.69 | catalog: | [changes](https://github.com/RSSNext/follow-server/commits/4b93def2698ecf39335041076a4e4d602c001431/packages/ai-tools); [diff](https://github.com/RSSNext/follow-server/compare/7d89a88a452585ffca995219132d5b478aff0168...4b93def2698ecf39335041076a4e4d602c001431) | Matched every published source file to official repo snapshots (old19/19 and new25/25), read 750-line git diff plus six-commit release history (no standalone changelog). Exports now include runtime tools, AI7 contextSchema/toolsContext replaces experimental context, DB access uses explicit AsyncLocalStorage binding, logger is worker-safe. Folo only imports types; frontend AI message/tool rendering needs typecheck/regression, no server-only imports introduced. | AI store/display tests and renderer build |
| `@fontsource/sn-pro` | 5.2.6 โ 5.3.0 | 5.3.0 | [changes](https://raw.githubusercontent.com/fontsource/font-files/02b28c06b126c852a5b966b44aef777ca923f6f6/fonts/google/sn-pro/CHANGELOG.md); [diff](https://github.com/fontsource/font-files/compare/9c577ab7e8e60335f7783e5fdcd82e50b29ee268...02b28c06b126c852a5b966b44aef777ca923f6f6) | Read Fontsource5.3 changelog and targeted raw old/new git diff (full monorepo diff was truncated): adds default CSS TypeScript declaration/export, variable axis metadata now object; every existing package CSS file unchanged. Binary font assets checked by package comparison. Package comparison found woff files rebuilt while woff2 bytes and CSS stay identical; modern browser path unchanged. | font load and app typography build/browser check |
| `@hookform/resolvers` | 5.4.0 โ 5.9.1 | 5.9.1 | [changes](https://github.com/react-hook-form/resolvers/releases/tag/v5.9.1); [diff](https://github.com/react-hook-form/resolvers/compare/3d2992472adf5735b46b175e22bea82fddf13854...f18ddfbb5f75a24b77c408565ad767eba4dd6704) | Read Zod resolver plus toNestErrors: invokes schema-own parse to preserve locale/schema instance, selects Zod4 before Zod3 marker; null-prototype error maps support reserved names; chooses union branch with least errors; checkbox/radio error refs point to actual DOM; bracket array paths now normalize to dotted segments. Other resolver families are unused. | Zod form validation, invalid-field focus, nested-array errors; typecheck |
| `@iconify-json/logos` | 1.2.11 โ 1.2.14 | 1.2.14 | [Iconify history](https://github.com/iconify/icon-sets/commits/master/json/logos.json); [diff](https://github.com/iconify/icon-sets/compare/ce5cb24e37e76ad883223b45b790839d0a4195bf...239eabda7a46b12e7a4825e0e70f45ae57cb8d97); [family audit](dependency-upgrade-icons-types-2026-09-22.md) | Official source refs matched complete npm icon data; four consumed logos unchanged; renamed upstream logos have aliases. | typecheck/build; focused icons and DOM sanitizer regression |
| `@iconify-json/lucide` | 1.2.116 โ 1.2.135 | 1.2.135 | [Iconify history](https://github.com/iconify/icon-sets/commits/master/json/lucide.json); [diff](https://github.com/iconify/icon-sets/compare/e24a0be5ffeed7a870ecd4d130811677af09b5ff...45c27a7be4b7760318a434387ab095ec8d22b179); [family audit](dependency-upgrade-icons-types-2026-09-22.md) | Official source refs matched complete npm icon data; consumed icons unchanged; renamed icons retain aliases. | typecheck/build; focused icons and DOM sanitizer regression |
| `@iconify-json/mingcute` | 1.2.7 โ 1.2.8 | 1.2.8 | [official change record](https://github.com/Richard9394/MingCute/releases); [source diff](https://github.com/iconify/icon-sets/compare/eecf87a83eb59db3d0679472d5e60739a687d9d3...0d7df736cf93f3bf4b7dd262957f1f33f0ab6569) | Published SVGs are reoptimized from outlined fills to strokes; verified loading-3-line, close-line, down-line, up-line, right-line and check-fill geometries. No old icon keys disappear; 12 additional keys. Corrected the pre-existing invalid check-filled class to check-fill. Test select checkmark, spinner and dialog close icons. | typecheck, lint, test, affected build and E2E |
| `@iconify-json/simple-icons` | 1.2.89 โ 1.2.97 | 1.2.97 | [official change record](https://github.com/simple-icons/simple-icons/releases); [source diff](https://github.com/iconify/icon-sets/compare/896e50d65e4633a147a6c574c4f7716f4ef1d049...54e319ec21d234b7f9891f5912b94347929243af) | Upstream 16.25โ16.32 adds 14 brands and updates LM Studio, Payload CMS, Shortcut, TanStack and Threads; the Folo icon consumed by Sidebar is unchanged. Checked actual published icons.json as well as upstream data diff. Test sidebar logo. | typecheck, lint, test, affected build and E2E |
| `@iconify/tools` | 5.0.12 โ 5.0.14 | 5.0.14 | [changes](https://github.com/iconify/tools/releases/tag/5.0.14); [diff](https://github.com/iconify/tools/compare/d6dc0ec8ed6927efa1f225c3d9a672c70d0490a1...bd16da78f29c7df335508fac47fb36d327530914) | Read release entry and full exact upstream diff: no runtime source changes, dependency refresh to svg-utils/modern-tar/SVGO/utils. Existing importDirectory, cleanupSVG, parseColors and runSVGO APIs unchanged; test generated icon CSS/build. | desktop/landing icon generation and build |
| `@iconify/utils` | 3.1.4 โ 3.1.7 | 3.1.7 | [changes](https://github.com/iconify/iconify/commits/37c897c83fcfdba2ece3ec936da264f89ec9326d/packages/utils); [diff](https://github.com/iconify/iconify/compare/440f3be0d0a65e4a83f3050798e03fa366050d3d...37c897c83fcfdba2ece3ec936da264f89ec9326d) | Read all changed utils runtime plus official publication commit log (no standalone version changelog): adds opt-in FileSystemHMRIconLoader and loader discriminator; existing FileSystemIconLoader preserves candidate casing, SVG preamble cleanup and transform. Consumed color parser/comparison code unchanged. | desktop/landing Tailwind icon build and visible icons |
| `@lexical/code` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@lexical/link` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@lexical/list` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@lexical/mark` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@lexical/markdown` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@lexical/react` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@lexical/rich-text` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `@number-flow/react` | 0.6.1 โ 0.6.2 | 0.6.2 | [changes](https://github.com/barvian/number-flow/releases/tag/%40number-flow%2Freact%400.6.2); [diff](https://github.com/barvian/number-flow/compare/a33470eacc9323e00aa70f02cfb2524bbd0157cb...a7b78f5d4d4b1e2cd4cb53d09d7158461bad493a) | Core ignores identical data double-commits, skips layout reads when animation unavailable/hidden/reduced motion, didUpdate guarded by preUpdated. React adapter unchanged. | numeric transitions and reduced-motion E2E |
| `@playwright/test` | 1.61.1 โ 1.63.0 | 1.63.0 | [family audit](dependency-upgrade-playwright-2026-09-22.md) | Official1.62/1.62.1/1.63 releases plus runner/worker/Chromium/Electron/locator/frames/timeout source reviewed; see Playwright audit. Initial Electron about:blank remains observable, page.close coordinates main-process navigation; Chromium request override cookies stripped to use cookie store, EventSource excluded from networkidle. Reporter throw now fails run, trace formatv9 internal changes. | matching Chromium153 install, complete web+Electron E2E |
| `@radix-ui/react-accordion` | 1.2.16 โ 1.2.20 | 1.2.20 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-avatar` | 1.2.2 โ 1.2.6 | 1.2.6 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/avatar/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Dev warnings move to conditional development export. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-checkbox` | 1.3.7 โ 1.3.11 | 1.3.11 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Tracks user interaction generations so programmatic checked updates notify forms without activating clickable ancestors. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-context-menu` | 2.3.3 โ 2.3.7 | 2.3.7 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Dev warnings move to conditional development export. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-dialog` | 1.1.19 โ 1.1.23 | 1.1.23 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Title/description mount counters remove dangling ARIA references. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-dropdown-menu` | 2.1.20 โ 2.1.24 | 2.1.24 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-hover-card` | 1.1.19 โ 1.1.23 | 1.1.23 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/hover-card/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-label` | 2.1.11 โ 2.1.15 | 2.1.15 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/label/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/ae1a64e23eb5ddf59d86f844eca89514c5c4c9c7...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-navigation-menu` | 1.2.18 โ 1.2.22 | 1.2.22 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/navigation-menu/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-popover` | 1.1.19 โ 1.1.23 | 1.1.23 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/popover/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-progress` | 1.1.12 โ 1.1.16 | 1.1.16 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/progress/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-radio-group` | 1.4.3 โ 1.4.7 | 1.4.7 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/radio-group/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Tracks user changes and avoids stale interaction markers when reselecting the active radio. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-scroll-area` | 1.2.14 โ 1.2.18 | 1.2.18 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-select` | 2.3.3 โ 2.3.7 | 2.3.7 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-slider` | 1.4.3 โ 1.4.7 | 1.4.7 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Commit compares the full values array, fixing thumbs that cross or overlap. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-slot` | 1.3.0 โ 1.3.3 | 1.3.3 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/fcc325259aa2e67716dbe99e60f21c256396580b...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-switch` | 1.3.3 โ 1.3.7 | 1.3.7 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Tracks user interaction generations so programmatic checked updates notify forms without activating clickable ancestors. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-tabs` | 1.1.17 โ 1.1.21 | 1.1.21 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | No behavioral source change beyond dependency refresh and named/pure component factories. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-toast` | 1.2.19 โ 1.2.23 | 1.2.23 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Escape closes focused toast only, or latest toast if focus is outside. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@radix-ui/react-tooltip` | 1.2.12 โ 1.2.16 | 1.2.16 | [official change record](https://github.com/radix-ui/primitives/releases); [source diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Renders children once; aria-label uses a separate hidden label and custom content id remains synchronized. Shared release improves tree shaking, republishes provenance and restores RSC compatibility. | browser component interaction E2E; desktop settings/menu/scroll E2E; web build |
| `@react-native-community/image-editor` | 4.3.0 โ 4.3.1 | 4.3.1 | [History](https://github.com/callstack/react-native-image-editor/releases); [Git diff](https://github.com/callstack/react-native-image-editor/compare/8fec8293c6961f737e10f9c111d0bb18f7eee1d3...40c6da3be1d339af4cfffc7648c3302287832cb1.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `@react-native-firebase/analytics` | 25.1.0 โ 26.4.0 | 26.4.0 | [Analytics changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/analytics/CHANGELOG.md); [Same exact release range](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0); [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `@react-native-firebase/app` | 25.1.0 โ 26.4.0 | 26.4.0 | [App changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/app/CHANGELOG.md); [25.1 โ 26.4 source](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0); [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `@react-native-firebase/app-check` | 25.1.0 โ 26.4.0 | 26.4.0 | [App Check changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/app-check/CHANGELOG.md); [Same exact release range](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0); [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `@react-native-firebase/messaging` | 25.1.0 โ 26.4.0 | 26.4.0 | [Messaging changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/messaging/CHANGELOG.md); [Same exact release range](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0); [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `@sentry/react` | 10.64.0 โ 10.75.1 | 10.75.1 | [changes](https://raw.githubusercontent.com/getsentry/sentry-javascript/8025a92d3d08aac4fdcd97d8e78a0888bf3fd54e/CHANGELOG.md); [diff](https://github.com/getsentry/sentry-javascript/compare/5736a381ec4f09caf26854067d1d624fb4f84d24...8025a92d3d08aac4fdcd97d8e78a0888bf3fd54e) | Reviewed all 10.65โ10.75.1 notes and 2,400 lines of consumed browser/core/React source diff. Logs enabled by default but require explicit logger/integration; beforeSend runs before error sampling; preserves incoming trace across ignored spans, fixes child timeout bookkeeping, cross-realm errors and duplicate console wrapping; React Router removes unmounted routes and preserves descendant prefixes. Folo uses HTTP/capture-console integrations and wrapped React Router; no dataCollection/monitor/AI hooks. | SSR navigation and isolated error capture/transport regression |
| `@shikijs/themes` | 4.3.1 โ 4.4.3 | 4.4.3 | [changes](https://github.com/shikijs/shiki/releases/tag/v4.4.3); [diff](https://github.com/shikijs/shiki/compare/fdff6e2384b8d97afd3f33aa82ce52700d58972e...48cd2cc695ed2e3357c3f9c370578ea843d6d9a3) | Package exports unchanged; coordinated grammar/theme assets refresh with Shiki4.4.3. | code block light/dark UI |
| `@shikijs/transformers` | 4.3.1 โ 4.4.3 | 4.4.3 | [changes](https://github.com/shikijs/shiki/releases/tag/v4.4.3); [diff](https://github.com/shikijs/shiki/compare/fdff6e2384b8d97afd3f33aa82ce52700d58972e...48cd2cc695ed2e3357c3f9c370578ea843d6d9a3) | No transformer runtime change, synchronized Shiki4.4.3 version; core token/frontmatter changes audited. | code block transformed output |
| `@tailwindcss/postcss` | 4.3.2 โ 4.3.3 | 4.3.3 | [official change record](https://github.com/tailwindlabs/tailwindcss/releases); [source diff](https://github.com/tailwindlabs/tailwindcss/compare/v4.3.2...v4.3.3) | 4.3.3: read package release notes and shared scanner/CSS source. Fix nested @source discovery, Vite module rescan, PostCSS invalidation, CSS nesting/shadow opacity and font fallbacks. Check built styles, dark theme and responsive admin layout. | typecheck, lint, test, affected build and E2E |
| `@tanstack/query-async-storage-persister` | 5.101.2 โ 5.103.2 | 5.103.2 | [changes](https://raw.githubusercontent.com/TanStack/query/e0f6c5542fc767f77a6cf1d5546591beae05f10f/packages/query-async-storage-persister/CHANGELOG.md); [diff](https://github.com/TanStack/query/compare/610e8d1684614f63e13f5829ad4bc375782ff06d...e0f6c5542fc767f77a6cf1d5546591beae05f10f) | Reviewed with backend tooling source audit: removes experimental_prefetchInRender/result.promise/private callbacks (no Folo usages); fixes StrictMode mutation subscriptions, optimistic Suspense cache wakeup, selector stale errors, disabled stale timers and retryer identities. Persisters have no direct runtime source change; paired core update. | query/store tests; two-session settings/auth/reload E2E |
| `@tanstack/query-sync-storage-persister` | 5.101.2 โ 5.103.2 | 5.103.2 | [changes](https://raw.githubusercontent.com/TanStack/query/e0f6c5542fc767f77a6cf1d5546591beae05f10f/packages/query-sync-storage-persister/CHANGELOG.md); [diff](https://github.com/TanStack/query/compare/610e8d1684614f63e13f5829ad4bc375782ff06d...e0f6c5542fc767f77a6cf1d5546591beae05f10f) | Reviewed with backend tooling source audit: removes experimental_prefetchInRender/result.promise/private callbacks (no Folo usages); fixes StrictMode mutation subscriptions, optimistic Suspense cache wakeup, selector stale errors, disabled stale timers and retryer identities. Persisters have no direct runtime source change; paired core update. | query/store tests; two-session settings/auth/reload E2E |
| `@tanstack/react-query` | 5.101.2 โ 5.103.2 | 5.103.2 | [official change record](https://github.com/TanStack/query/releases); [source diff](https://github.com/TanStack/query/compare/@tanstack/react-query@5.101.2...@tanstack/react-query@5.103.2) | Reviewed with backend tooling source audit: removes experimental_prefetchInRender/result.promise/private callbacks (no Folo usages); fixes StrictMode mutation subscriptions, optimistic Suspense cache wakeup, selector stale errors, disabled stale timers and retryer identities. Persisters have no direct runtime source change; paired core update. | query/store tests; two-session settings/auth/reload E2E |
| `@tanstack/react-query-devtools` | 5.101.2 โ 5.103.2 | 5.103.2 | [changes](https://raw.githubusercontent.com/TanStack/query/e0f6c5542fc767f77a6cf1d5546591beae05f10f/packages/react-query-devtools/CHANGELOG.md); [diff](https://github.com/TanStack/query/compare/610e8d1684614f63e13f5829ad4bc375782ff06d...e0f6c5542fc767f77a6cf1d5546591beae05f10f) | Reviewed with backend tooling source audit: removes experimental_prefetchInRender/result.promise/private callbacks (no Folo usages); fixes StrictMode mutation subscriptions, optimistic Suspense cache wakeup, selector stale errors, disabled stale timers and retryer identities. Persisters have no direct runtime source change; paired core update. | query/store tests; two-session settings/auth/reload E2E |
| `@tanstack/react-query-persist-client` | 5.101.2 โ 5.103.2 | 5.103.2 | [changes](https://raw.githubusercontent.com/TanStack/query/e0f6c5542fc767f77a6cf1d5546591beae05f10f/packages/react-query-persist-client/CHANGELOG.md); [diff](https://github.com/TanStack/query/compare/610e8d1684614f63e13f5829ad4bc375782ff06d...e0f6c5542fc767f77a6cf1d5546591beae05f10f) | Reviewed with backend tooling source audit: removes experimental_prefetchInRender/result.promise/private callbacks (no Folo usages); fixes StrictMode mutation subscriptions, optimistic Suspense cache wakeup, selector stale errors, disabled stale timers and retryer identities. Persisters have no direct runtime source change; paired core update. | query/store tests; two-session settings/auth/reload E2E |
| `@tanstack/react-virtual` | 3.14.5 โ 3.14.13 | 3.14.13 | [changes](https://raw.githubusercontent.com/TanStack/virtual/78371e851e90fd74e984deeb0c3fd8098e2cd4f3/packages/react-virtual/CHANGELOG.md); [diff](https://github.com/TanStack/virtual/compare/151e9f47abd4ef2d3b11936c04be8908e6bd0607...78371e851e90fd74e984deeb0c3fd8098e2cd4f3) | Avoids flushSync inside React ref commit; preserves keys across lazy measurements, follows append+trim, fixes end-anchor clamping/prepend/smooth scroll, resets iOS deferrals and scroll-end debounce; remeasure only fully above-fold items, gap invalidation, O(lanes) placement. Affects feed list/grid and subscription settings. | long feed list scroll/resize/scroll restoration E2E |
| `@toon-format/toon` | 2.3.0 โ 4.1.1 | 4.1.1 | [changes](https://github.com/toon-format/toon/releases/tag/v4.1.1); [diff](https://github.com/toon-format/toon/compare/3c66a1beada062dac82fa4f06c4dab2ed066407a...a9e6d97eca931379824f3b6a1ba8fbfbda7d3c53) | Runtime source and release review by backend runtime agent; see shared runtime audit. Check local usages and frontend runtime build. | typecheck, tests, app E2E |
| `@types/jsdom` | 28.0.3 โ 30.0.0 | 30.0.0 | [Upstream version/dependency change](https://github.com/DefinitelyTyped/DefinitelyTyped/commit/307059ebbff2bcaf3920b699839d7ae0f49353f5); [family audit](dependency-upgrade-dom-2026-09-22.md) | Reviewed official DefinitelyTyped declarations for jsdom 30; see DOM audit. | typecheck/build; focused icons and DOM sanitizer regression |
| `@types/node` | 26.1.1 โ 26.6.2 | 26.6.2 | [official change record](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/master/types/node); [source diff](https://github.com/DefinitelyTyped/DefinitelyTyped/commit/a5db06bb77bb3c63b274f337d8ffd28c4b4fa7c4) | Read DefinitelyTyped path history and changed declarations: KeyObject accepted by createPublicKey, BinaryLike crypto inputs, fs readFile overloads, global ReadableWritablePair, ForkOptions/windowsHide; new Node 26 APIs do not imply runtime availability on Node 24. Quic/ffi/stream-iter additions are unused. Full typecheck required. | typecheck, lint, test, affected build and E2E |
| `@types/react` | 19.2.17 โ 19.2.18 | 19.2.18 | [upstream change](https://github.com/DefinitelyTyped/DefinitelyTyped/pull/75334); [diff](https://github.com/DefinitelyTyped/DefinitelyTyped/compare/fbbe9480f84cc20727e9ff9a7bba7a1cb66157a9...a414786ca9309a76c8a35fe249dab28668a69b79); [family audit](dependency-upgrade-icons-types-2026-09-22.md) | All 13 published declarations matched official DefinitelyTyped commit; use() permits renderer-provided usable extension; current consumer compatible. | typecheck/build; focused icons and DOM sanitizer regression |
| `@types/react-dom` | 19.2.3 โ 19.2.7 | 19.2.7 | [history](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/master/types/react-dom); [diff](https://github.com/DefinitelyTyped/DefinitelyTyped/compare/58c1a3a0f80ba685c43aec3606bfebf2faa97d67...8443606b19593c505271bda9ad1238e10a2ef78a); [family audit](dependency-upgrade-icons-types-2026-09-22.md) | All 14 published declarations matched official DefinitelyTyped commit; SSR headersLengthHint renamed maxHeadersLength, onHeaders uses HeadersDescriptor, neither option consumed here. | typecheck/build; focused icons and DOM sanitizer regression |
| `@types/semver` | 7.7.1 โ 7.8.0 | 7.8.0 | [official change record](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/master/types/semver); [source diff](https://github.com/DefinitelyTyped/DefinitelyTyped/commit/96da354e8b42c53928a0d6908ccf413e8c8aae5c) | Adds truncate declaration only; existing release script SemVer calls retain signatures. Check scripts typecheck. | typecheck, lint, test, affected build and E2E |
| `@vercel/node` | 5.8.22 โ 12.0.1 | 12.0.1 | [family audit](dependency-upgrade-vercel-node-2026-09-22.md) | Official vercel/vercel f82a013โc628be7 Sept8 source sync and node changelog read. 12.0.1 is newest traceable official release; npm13.0.1 dist files identical but its build-utils14.10.1 peer has no corresponding public source sync, so held. Folo only imports VercelRequest/Response declarations, unchanged byte-for-byte. | webhook HTTP integration and typecheck |
| `@vite-pwa/assets-generator` | 1.0.2 โ 2.0.0 | 2.0.0 | [family audit](dependency-upgrade-css-2026-09-22.md) | Tooling reviewer read official releases and changed CSS minifier/PWA generator source; see family audit for configuration/runtime effects and generated-asset checks. | Family build, regression tests and affected product flows |
| `@vitejs/plugin-legacy` | 7.2.1 โ 7.2.1 | 7.2.1 | [changes](https://raw.githubusercontent.com/vitejs/vite/d0d032b24e8511e61a1c0328e85945f5dd33c2c0/packages/plugin-legacy/CHANGELOG.md); [diff](https://github.com/vitejs/vite/compare/48139b4828cbb8b6325aec229fa2a9be923d88a2...d0d032b24e8511e61a1c0328e85945f5dd33c2c0) | Retained latest v7: v8 changelog and source show peer Vite8, Rolldown prebuilt-chunk/minifier integration and new import.meta.resolve browser threshold. Desktop electron-vite retains Vite7, so plugin8 is incompatible. | desktop/web production builds |
| `@vitejs/plugin-react` | 5.1.4 โ 5.2.0 (compatibility lanes: {'5': '5.2.0', '6': '6.1.1'}) | 5.2.0, 6.1.1 | [official change record](https://github.com/vitejs/vite-plugin-react/releases); [source diff](https://github.com/vitejs/vite-plugin-react/compare/640fd358a0e82393acfce4e92e19a6ac6e1641a7...04cac5020e349f452d76c5a4f6d788ad4b38930a); [diff](https://github.com/vitejs/vite-plugin-react/compare/f066114c3e6bf18f5209ff3d3ef6bf1ab46d3866...fda3a86095556b49ae3c995eb57a30d4e0b8fa8d); [changelog](https://raw.githubusercontent.com/vitejs/vite-plugin-react/fda3a86095556b49ae3c995eb57a30d4e0b8fa8d/packages/plugin-react/CHANGELOG.md) | 5.2 source and changelog only widens Vite8 peer range.6.0.3โ6.1.1 reviewed tooling source: native compiler opt-in and RefreshSig dev fix; preserved desktop5 while Vite7 remains. | dev HMR, productionbuild, web/Electron E2E |
| `@vitejs/plugin-rsc` | 0.5.27 โ 0.5.35 | 0.5.35 | [history](https://raw.githubusercontent.com/vitejs/vite-plugin-react/a309c8b0b0303c008a4d7b07881bea7e0b6cbbbb/packages/plugin-rsc/CHANGELOG.md); [diff](https://github.com/vitejs/vite-plugin-react/compare/d8e0f4f9ccd9b622a4a40784565e31f9151aeec7...a309c8b0b0303c008a4d7b07881bea7e0b6cbbbb.diff); [family audit](dependency-upgrade-ssr-2026-09-22.md) | Official changelog and upstream source changes reviewed by root; RSC registration/loading and Miniflare request lifecycle impact require local build and Worker tests. | Family build, regression tests and affected product flows |
| `@xyflow/react` | 12.11.2 โ 12.11.6 | 12.11.6 | [changes](https://raw.githubusercontent.com/xyflow/xyflow/0a1f9575b25679f2880175de8d3eae21aedde921/packages/react/CHANGELOG.md); [diff](https://github.com/xyflow/xyflow/compare/dd308ab401d49518f73d1e91c43faf254ff5a4c9...0a1f9575b25679f2880175de8d3eae21aedde921) | Read all changed React and system runtime: provider reset clears callbacks/defaultEdgeOptions on unmount, minimap uses fresh panZoom on remount and visible-only bounds; pan selection touch/middle/Control behavior fixed; useKeyPress handles 3+ chords; parent extent honors initial dimensions; dev-only attribution warning. | AI flow diagram pan/zoom and remount E2E |
| `ai` | 7.0.18 โ 7.0.109 | 7.0.109 | [changes](https://raw.githubusercontent.com/vercel/ai/4e8c387622ee1bb0d55841664416d38754d5c9a3/packages/ai/CHANGELOG.md); [diff](https://github.com/vercel/ai/compare/f0d9a6c0fbbd57392fedcc7f05ad479808bcd377...4e8c387622ee1bb0d55841664416d38754d5c9a3) | Runtime source and release review by backend runtime agent; see shared runtime audit. Check local usages and frontend runtime build. | typecheck, tests, app E2E |
| `autoprefixer` | 10.5.2 โ 10.6.1 | 10.6.1 | [official change record](https://github.com/postcss/autoprefixer/releases); [source diff](https://github.com/postcss/autoprefixer/compare/e99e38122ce706747c903ef321a3c1df2d7ada3e...c99614d9148886493b749a1a39442f4de56fbf53) | Read data/prefixes and brackets parser diff: initial-letter support, malformed parentheses/gradient/grid-gap fixes. Test generated CSS and visual layout. | typecheck, lint, test, affected build and E2E |
| `axios` | 1.18.1 โ 1.20.0 | 1.20.0 | [changes](https://raw.githubusercontent.com/axios/axios/84a9f3b9a4f3244b8c8e818f557d64c7b964fb25/CHANGELOG.md); [diff](https://github.com/axios/axios/compare/a209bfb1e5dcbce3cecbf4bd955339d006358887...84a9f3b9a4f3244b8c8e818f557d64c7b964fb25) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `babel-preset-expo` | 57.0.2 โ 57.0.12 | 57.0.12 | [History](https://raw.githubusercontent.com/expo/expo/f6f5af06b95cb7d511b52641885b2fb5adad525d/packages/babel-preset-expo/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/6ffed84381e2d2bb80c2fc713d99724f707d6c06...f6f5af06b95cb7d511b52641885b2fb5adad525d.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `better-auth` | 1.6.23 โ 1.7.5 | 1.7.5 | [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Reviewed by backend runtime:1.7 account selectors use local account.id; issuer required migration revoked1.7.3; Expo cookie async/ticket handoff and 2FA method union. Desktop/mobile unlink and async cookie call sites adapted. | local signup/login/logout/settings/account E2E |
| `camelcase-keys` | 10.0.2 โ 10.0.3 | 10.0.3 | [changes](https://github.com/sindresorhus/camelcase-keys/releases/tag/v10.0.3); [diff](https://github.com/sindresorhus/camelcase-keys/compare/3f304acdc5177aa119f383b3b09557bd70d7916c...5b57e0a0716b99ed70a8971e60b33523b2939327) | Type-only fix preserves parent stopPaths through nested array boundaries; runtime conversion unchanged. API normalization callers should retain identical results. | typecheck, authentication and settings E2E |
| `chrono-node` | 2.9.1 โ 2.10.1 | 2.10.1 | [changes](https://github.com/wanasit/chrono/releases/tag/v2.10.1); [diff](https://github.com/wanasit/chrono/compare/b459d05a6376cd3b30f3fbee7f91995d6296c868...82c0e5bc0e4db19eb402423baf1b558850947b2b) | Adds Chinese ago durations, year-month English parser and complete two-digit-year disambiguation; validates/constructs offset dates in UTC to avoid host DST gaps. New Italian and other locale refinements do not run in Folo (en/zh/ja only). | natural-date AI mentions and deterministic date regression |
| `code-inspector-plugin` | 1.6.6 โ 2.0.9 | 2.0.9 | [official change record](https://github.com/zh-lx/code-inspector/blob/main/docs/en/more/changelog.md); [source diff](https://github.com/zh-lx/code-inspector/compare/794befb2c4a75e70569837dc70219cdc563680e3...2bae210a6c4587ca4b68aa9dc89bf297b57a1f79) | Official 2.0 changelog adds optional AI/terminal; 2.0.3 makes node-pty optional, 2.0.7 removes postinstall. Read server startup coordination, token auth, path validation, use-client and behavior types. Existing config has no AI provider, so aiEnabled remains false. Test dev startup/transform and production bundle absence of inspector. | typecheck, lint, test, affected build and E2E |
| `cssnano` | 8.0.2 โ 9.0.5 | 9.0.5 | [family audit](dependency-upgrade-css-2026-09-22.md) | Tooling reviewer read official releases and changed CSS minifier/PWA generator source; see family audit for configuration/runtime effects and generated-asset checks. | Family build, regression tests and affected product flows |
| `daisyui` | 5.6.16 โ 5.7.43 | 5.7.43 | [changes](https://raw.githubusercontent.com/saadeghi/daisyui/7fbfd0b3f82d3ff3898868028c0bdaf941361e61/CHANGELOG.md); [diff](https://github.com/saadeghi/daisyui/compare/4538db6e1843f35686e18d5d093af3efb5613f25...7fbfd0b3f82d3ff3898868028c0bdaf941361e61) | Read all 5.6.17โ5.7.43 changelog and 2,328 lines of plugin/runtime CSS diff. Nested CSS layers are moved under selectors before Tailwind registration; prefix scanner handles attributes, escapes and arrays; fix disabled control/validator specificity, nested modal/list selector leakage, RTL dropdown/input/toast, input font-size fallback, flex-shrink and aria active states. New menu-paged opt-in. SSR uses plugin/CSS, requiring rendered style validation. | SSR production build and form/menu/theme browser validation |
| `dayjs` | 1.11.21 โ 1.11.23 | 1.11.23 | [changes](https://raw.githubusercontent.com/iamkun/dayjs/4549b8d03307891143e8a50d39fcdab1f16f77cf/CHANGELOG.md); [diff](https://github.com/iamkun/dayjs/compare/a25f01e8154290b203ab480ffeedc60c80bd0710...4549b8d03307891143e8a50d39fcdab1f16f77cf) | Timezone conversion computes offsets with tzOffset rather than host DST arithmetic; invalid input exits without RangeError. Affects date/time presentation and timezone conversion. | date timezone regression, entry timestamp E2E |
| `dompurify` | 3.4.11 โ 3.4.15 | 3.4.15 | [changes](https://github.com/cure53/DOMPurify/releases/tag/3.4.15); [diff](https://github.com/cure53/DOMPurify/compare/0cae5187403132f96a6d357649e4b15633fc210a...1d7460c4f8a27be825c11b1c9d346d79db32c1e5) | Hardens XML clobbering, cached ownerDocument/node access and exact Attr removal; removes declarative patch linkage; safely neutralizes removed in-place trees, guards allowlist hook mutations, runs hooks on retained custom elements, preserves removed records. Adds safe SVG attributes. Affects sanitized article HTML, SVG and hook policy. | article HTML/SVG malicious-markup browser regressions |
| `dotenv` | 17.4.2 โ 18.0.2 | 18.0.2 | [changes](https://raw.githubusercontent.com/motdotla/dotenv/520371222b10685aae76be3ee327c5910eea7ad6/CHANGELOG.md); [diff](https://github.com/motdotla/dotenv/compare/a61f616a3160bb6e6f22ff55f08b7eba3a3fab68...520371222b10685aae76be3ee327c5910eea7ad6) | Runtime source and release review by backend runtime agent; see shared runtime audit. Check local usages and frontend runtime build. | typecheck, tests, app E2E |
| `drizzle-kit` | 0.31.10 โ 0.31.11 | 0.31.11 | [official change record](https://github.com/drizzle-team/drizzle-orm/releases); [source diff](https://github.com/drizzle-team/drizzle-orm/compare/4aa6ecfee4b4728dadf6f77f071a149878a3c6c0...15454dbe49d827c6081f3d0231e2e7985e517295) | Patch adds warning for non-increasing migration journal timestamps in CLI check. Reviewed cli/check.ts; no migration schema change requested. Check existing migrations and build. | typecheck, lint, test, affected build and E2E |
| `drizzle-orm` | 0.45.2 โ 0.45.3 | 0.45.3 | [changes](https://github.com/drizzle-team/drizzle-orm/releases/tag/0.45.3); [diff](https://github.com/drizzle-team/drizzle-orm/compare/273c78071d4841b497f5144734b38294df7ec64b...15454dbe49d827c6081f3d0231e2e7985e517295) | Reviewed by backend runtime: adds opt-in Netlify driver; existing SQLite/node-pg drivers unchanged. | SQLite/state tests and feed persistence |
| `electron` | 43.1.0 โ 44.4.3 | 44.4.3 | [changes](https://github.com/electron/electron/releases/tag/v44.4.3); [diff](https://github.com/electron/electron/compare/v43.1.0...v44.4.3) | Read Electron 44 release, all stable 44.1โ44.4.3 notes, official breaking changes, full git diff inventory and consumed source: clipboard JS/native MIME pipeline, app lifecycle/certificate, webContents frames, protocol/net streaming, menus, context bridge/preload IPC. Async clipboard and removed openAsHidden require adaptation; minimum macOS13, 64-bit only. | Family build, regression tests and affected product flows |
| `electron-context-menu` | 4.1.2 โ 5.1.0 | 5.1.0 | [changes](https://github.com/sindresorhus/electron-context-menu/releases/tag/v5.1.0); [diff](https://github.com/sindresorhus/electron-context-menu/compare/acfd5b3d0a48e04429d9794bf5ae73a3c4ae924d...3cd0382f2a12f09357b58dc2ed1c190718f654cd) | Read v5/v5.1 official releases and all index runtime diff: Electron44 async MIME clipboard, canvas copying, optional video frames/PIP, file URL hiding, menu cleanup/custom replacement, event.frame targeting, destroyed WebContents disposal and error handling. | Family build, regression tests and affected product flows |
| `electron-ipc-decorator` | 1.0.1 โ 1.0.2 | 1.0.2 | [changes](https://raw.githubusercontent.com/innei/electron-ipc-decorator/v1.0.2/CHANGELOG.md); [diff](https://github.com/innei/electron-ipc-decorator/compare/v1.0.1...v1.0.2) | createIpcProxy caches group proxies in a Map; method wrappers still invoke group.method with unchanged args. Affects all desktop IPC services. | Electron IPC and core E2E |
| `es-toolkit` | 1.49.0 โ 1.52.0 | 1.52.0 | [changes](https://raw.githubusercontent.com/toss/es-toolkit/32f4c8fb33828ad6512064ba84b0fdd8fda966a3/CHANGELOG.md); [diff](https://github.com/toss/es-toolkit/compare/c8d3c367dd509f5d8f137c6b623a30926fecd1f4...32f4c8fb33828ad6512064ba84b0fdd8fda966a3) | Reviewed by backend runtime: compat merge preserves null array values and nested omit paths fixed; normal top-level omit unchanged, other added helpers opt-in. | store/utils tests and settings/feed E2E |
| `eslint` | 10.6.0 โ 10.11.0 | 10.11.0 | [official change record](https://github.com/eslint/eslint/releases); [source diff](https://github.com/eslint/eslint/compare/5d12a0419636abb71628b7e45063a943c454a7c7...3c0b7c6e1fe2dec778b97a996018126f22d437ae) | Read release changelog and no-var/no-unused-vars source, safer fixes around ASI/catch/hoisted declarations; stricter correctness checks may expose lint violations. Full workspace lint is the acceptance gate. | typecheck, lint, test, affected build and E2E |
| `expo` | 57.0.4 โ 57.0.24 | 57.0.24 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/b31bd70c8873eee2894bc5cc3b3460abca0cdea0...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-apple-authentication` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-apple-authentication/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-application` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-application/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-background-task` | 57.0.2 โ 57.0.19 | 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-background-task/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-blur` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-blur/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-build-properties` | 57.0.3 โ 57.0.21 | 57.0.21 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-build-properties/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-clipboard` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-clipboard/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-constants` | 57.0.3 โ 57.0.19 | 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-constants/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-dev-client` | 57.0.5 โ 57.0.19 | 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-dev-client/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-device` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-device/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-document-picker` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-document-picker/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-file-system` | 57.0.0 โ 57.0.7 | 57.0.7 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-file-system/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-glass-effect` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-glass-effect/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-haptics` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-haptics/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-iap` | 4.3.6 โ 5.6.3 | 5.6.3 | [Central release history](https://openiap.dev/docs/updates/releases); [breaking 5.0.0 release](https://github.com/hyodotdev/openiap/releases/tag/expo-iap-5.0.0); [5.6.3 release](https://github.com/hyodotdev/openiap/releases/tag/expo-iap-5.6.3); [Exact source range](https://github.com/hyodotdev/openiap/compare/764103bcfe9717f539ab8785ec28ad1c33bd3100...5047690eff2410d92dec98cc0a9218ef51d3aaa1); [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `expo-image` | 57.0.0 โ 57.0.5 | 57.0.5 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-image/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-image-manipulator` | 57.0.2 โ 57.0.19 | 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-image-manipulator/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-image-picker` | 57.0.2 โ 57.0.19 | 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-image-picker/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-linear-gradient` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-linear-gradient/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-linking` | 57.0.2 โ 57.0.10 | 57.0.10 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-linking/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/6ffed84381e2d2bb80c2fc713d99724f707d6c06...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-localization` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-localization/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-media-library` | 57.0.1 โ 57.0.5 | 57.0.5 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-media-library/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-network` | 57.0.0 โ 57.0.2 | 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-network/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-notifications` | 57.0.3 โ 57.0.20 | 57.0.20 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-notifications/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-secure-store` | 57.0.0 โ 57.0.4 | 57.0.4 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-secure-store/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-sharing` | 57.0.3 โ 57.0.21 | 57.0.21 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-sharing/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/6ffed84381e2d2bb80c2fc713d99724f707d6c06...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-splash-screen` | 57.0.2 โ 57.0.9 | 57.0.9 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-splash-screen/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-sqlite` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-sqlite/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-status-bar` | 57.0.0 โ 57.0.1 | 57.0.1 | [History](https://raw.githubusercontent.com/expo/expo/b9503d06b8e130abfca1bc16f671dbefb41ad709/packages/expo-status-bar/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...b9503d06b8e130abfca1bc16f671dbefb41ad709.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-store-review` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-store-review/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-symbols` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-symbols/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-system-ui` | 57.0.0 โ 57.0.4 | 57.0.4 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-system-ui/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-task-manager` | 57.0.2 โ 57.0.19 | 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-task-manager/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-updates` | 57.0.6 โ 57.0.23 | 57.0.23 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-updates/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-video` | 57.0.0 โ 57.0.4 | 57.0.4 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-video/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `expo-web-browser` | 57.0.0 โ 57.0.3 | 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-web-browser/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `fastify` | 5.10.0 โ 5.12.5 | 5.12.5 | [changes](https://github.com/fastify/fastify/releases/tag/v5.12.5); [diff](https://github.com/fastify/fastify/compare/c47975e8a4c0cb1cb066749b948c0e6e22c97663...ba235fdcd9a83a4c7ccf793f7b2596a8f65389b6) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `firebase` | 12.16.0 โ 12.19.0 | 12.19.0 | [changes](https://raw.githubusercontent.com/firebase/firebase-js-sdk/9045b759b70e9d19b8cf007d69d988893d845a1e/CHANGELOG.md); [diff](https://github.com/firebase/firebase-js-sdk/compare/51aca877ca4706229dc9e77b3ebf787c91c91078...9045b759b70e9d19b8cf007d69d988893d845a1e) | Runtime reviewer read app/messaging/installations/component/util source and notes: app duplicate config diagnostics and linear error-template parser; consumed messaging token/SW behavior unchanged. | Family build, regression tests and affected product flows |
| `foxact` | 0.3.8 โ 0.3.12 | 0.3.12 | [official change record](https://github.com/SukkaW/foxact/releases); [source diff](https://github.com/SukkaW/foxact/compare/0.3.8...0.3.12) | Clipboard fallback preserves whitespace after all:unset; media/visibility/hash subscriptions use stable event-target-bus adapters; optional History provider and browser/getReactChildren utilities added; React namespace import compatibility. Existing Folo hook calls retain API. | responsive UI and clipboard interactions |
| `fuse.js` | 7.4.2 โ 7.5.0 | 7.5.0 | [changes](https://raw.githubusercontent.com/krisk/Fuse/457fe762c6418357896d78311f7def8c937a64f8/CHANGELOG.md); [diff](https://github.com/krisk/Fuse/compare/2fadbfa8c4277d7698f9d12387f57f86ae0ff382...457fe762c6418357896d78311f7def8c937a64f8) | Corrects field word count for whitespace, normalizes object key weights, top-N heap shares comparator/tie break with complete sorting, honors minMatchCharLength for exact matches. Scores/order may change; Folo search/mentions/OPML selection impacted. | search suggestions and mentions UI; matching regression |
| `happy-dom` | 20.10.6 โ 20.14.5 | 20.14.5 | [Releases](https://github.com/capricorn86/happy-dom/releases); [Git diff](https://github.com/capricorn86/happy-dom/compare/fed1de26802bd628f71e691158edf3faa70d52d4...0d4cdbe7442af49d16b49ddf1acf7cc9684ed318.diff); [family audit](dependency-upgrade-dom-2026-09-22.md) | Reviewed official releases and custom elements, animation/CSS caches, DOM parser source; see DOM audit. | typecheck/build; focused icons and DOM sanitizer regression |
| `hono` | 4.12.28 โ 4.13.8 | 4.13.8 | [changes](https://github.com/honojs/hono/releases/tag/v4.13.8); [diff](https://github.com/honojs/hono/compare/626b185d0e80fa1c2a3cc1a8945afd0df6aaf3ec...098e11912ab244c5c33931de007f04dc8e3c2929) | Reviewed by backend runtime: cached request body preserves Content-Type; query excludes fragments; CORS keeps Vary; stream abort errors guarded. | OTA API tests and HTTP E2E |
| `i18next` | 26.3.5 โ 26.4.2 | 26.4.2 | [changes](https://raw.githubusercontent.com/i18next/i18next/4dba50f20669c3678db0812255716eb7693ad2da/CHANGELOG.md); [diff](https://github.com/i18next/i18next/compare/8eed4accc6c69398e9e25f79b617249fd3f7b1ec...4dba50f20669c3678db0812255716eb7693ad2da) | Nested interpolation now escapes replacement dollar sequences preventing infinite nesting; caches resolution hierarchy with fallback invalidation and explicit clearCache for dynamic options; strict selector type fix. | localization switch/sync/reload E2E, interpolation regression |
| `immer` | 11.1.11 โ 11.1.18 | 11.1.18 | [official change record](https://github.com/immerjs/immer/releases); [source diff](https://github.com/immerjs/immer/compare/60ca295e1185db80322ef55ec3fb8475cbc960c7...b00474e3755954f6b27a392dcb4bce97254c100c) | Reverts overbroad constructor/prototype blocking; drafts relocated base objects after sorting; preserves sharing for no-op arrays and finalizes child drafts safely; fixes patch index keys, null paths and curried types; removes Iterator global declaration. | stores unit tests and feed/settings E2E |
| `input-otp` | 1.4.2 โ 1.5.0 | 1.5.0 | [changes](https://raw.githubusercontent.com/guilhermerodz/input-otp/3daad8fc88c9a041dbce98e97185efd65b3d87de/CHANGELOG.md); [diff](https://github.com/guilhermerodz/input-otp/compare/81ccdb48c010d800b24942aa231909f0c971b1ca...3daad8fc88c9a041dbce98e97185efd65b3d87de) | Read1.5.0 stable/beta notes and all3runtime diffs. Constrained-ancestor badge gutter check avoids overflow, ResizeObserver feature detect,16px fallback, timeouts cleanup, guarded selection ref, CSP nonce and translate=no. Existing onComplete signature retained; iOS selection experiment explicitly withdrawn. | 2FA/login code typing, selection, paste, completion and modal overflow E2E |
| `jotai` | 2.20.1 โ 3.0.0 | 3.0.0 | [official change record](https://github.com/pmndrs/jotai/releases); [source diff](https://github.com/pmndrs/jotai/compare/v2.20.1...v3.0.0) | v3 removes deprecated atomFamily/loadable/setSelf/delay and Babel/CJS exports; ESM requires Node22.12 and TS5.5. Folo uses supported atoms/select/storage/split; three deep SyncStorage type imports need public-compatible replacement. Hook subscription lifecycle changed and needs persisted-setting/state E2E. Reviewed together with backend tooling agent. | typecheck, store/unit tests, settings two-session E2E |
| `js-yaml` | 5.2.1 โ 5.4.2 | 5.4.2 | [Changelog](https://github.com/nodeca/js-yaml/blob/494400bd45cad078123cfc057e674a9a0a8d9983/CHANGELOG.md); [source diff](https://github.com/nodeca/js-yaml/compare/ac16b42c46c11c5c7f66062bfc78b168b5f07ecd...494400bd45cad078123cfc057e674a9a0a8d9983); [family audit](dependency-upgrade-http-yaml-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `jsdom` | 29.1.1 โ 30.1.1 | 30.1.1 | [Releases](https://github.com/jsdom/jsdom/releases); [Git diff](https://github.com/jsdom/jsdom/compare/9b9ea7e10b7842cd38c61458a38774cc3b60c24c...0a117f4581b067800fdb3287e22e7cec82221a3c.diff); [family audit](dependency-upgrade-dom-2026-09-22.md) | Reviewed official releases and DOM/attributes/parser/iterators source changes; see DOM audit. | typecheck/build; focused icons and DOM sanitizer regression |
| `katex` | 0.17.0 โ 0.18.7 | 0.18.7 | [changes](https://raw.githubusercontent.com/KaTeX/KaTeX/cd5ec4fb23803a6645ba90cccca2eeb7bc7be8dd/CHANGELOG.md); [diff](https://github.com/KaTeX/KaTeX/compare/3dec5495f080cb9d082db36ada2207e7a8c80aaf...cd5ec4fb23803a6645ba90cccca2eeb7bc7be8dd) | Read0.18.0..0.18.7 changelog and all changed runtime/CSS: generic internal classes become katex-prefixed; bundled matching CSS is imported by desktop/mobile HTML and no custom old selectors found. Settings/macros own-property checks block inherited values, invalid environments become ParseError, braced delimiters/empty tagged rows/escaped htmlData commas fixed; reflectbox/mapsfrom added. | article/math browser render with bundled CSS, invalid-expression fallback |
| `ky` | 2.0.2 โ 2.1.0 | 2.1.0 | [changes](https://github.com/sindresorhus/ky/releases/tag/v2.1.0); [diff](https://github.com/sindresorhus/ky/compare/0a24c44fe4a15d0545c840facc56e473dd0b315b...d27ad21266d162ee218d4ea69dce192b84b6f967) | Rejects malformed HTTP base URLs; validates retry counts and normalizes mutable retry settings, distinguishes Retry-After delay seconds from reset timestamps; totalTimeout bounds hooks/body/JSON reads, successful-body timeouts now reject; fixes empty progress, signal replace/clear and numeric retry merge. Normalized hook options become readonly. | API auth/settings/feed E2E; timeout/retry regression |
| `lexical` | 0.46.0 โ 0.51.0 | 0.51.0 | [changes](https://raw.githubusercontent.com/facebook/lexical/c9aea68c6173ad2c3358721bb07bef60900c6fd0/CHANGELOG.md); [diff](https://github.com/facebook/lexical/compare/041c8642c0c0f4d0b7e791f3c499dfeac50a4a9e...c9aea68c6173ad2c3358721bb07bef60900c6fd0) | Read official 0.47โ0.51 changelog and exact git diff for consumed editor-state/updates/text/paragraph/decorator/config synthesis, React composer/editable/portal plugins, CodeNode/core/Prism, LinkNode/link actions, list nodes/indent/backspace, MarkNode, full Markdown and rich-text runtime. ESM-only; Prism re-export removed (adapted); JSON compact is opt-in, legacy full JSON remains default; legacy custom node statics preserved. Risks: composition, selection, copy/paste, Markdown roundtrip, custom nodes/history. | Family build, regression tests and affected product flows |
| `lightningcss` | 1.32.0 โ 1.33.0 | 1.33.0 | [family audit](dependency-upgrade-css-2026-09-22.md) | Tooling reviewer read official releases and changed CSS minifier/PWA generator source; see family audit for configuration/runtime effects and generated-asset checks. | Family build, regression tests and affected product flows |
| `lint-staged` | 17.0.8 โ 17.5.1 | 17.5.1 | [changes](https://raw.githubusercontent.com/lint-staged/lint-staged/f8b1ab18b8da6ece2179cc6b6bc7a15ef412803b/CHANGELOG.md); [diff](https://github.com/lint-staged/lint-staged/compare/5f3b8f28e895972bd5a2cdba733327b49859b91f...f8b1ab18b8da6ece2179cc6b6bc7a15ef412803b) | Read17.1..17.5.1 notes and task spawning/chunking/parallel runner/config/options/staged-files/gitWorkflow source. Replaces Listr runner, final-command-length splitting, nested parallel tasks opt-in, worktree backups tracked by full SHA/run UUID, explicit intent-to-add rejection, config-local binary resolution and merge filtering. Existing sequential task arrays remain valid. | isolated temporary git repo hook workflow with partial unstaged preservation, failure rollback and intent-to-add rejection |
| `lru-cache` | 11.5.2 โ 11.5.3 | 11.5.3 | [changes](https://raw.githubusercontent.com/isaacs/node-lru-cache/7e71a1f3babdc68dfbadde91f28eaeea919dad9b/CHANGELOG.md); [diff](https://github.com/isaacs/node-lru-cache/compare/16b3a916662ab449d496b7b4b4f04132565d1d28...7e71a1f3babdc68dfbadde91f28eaeea919dad9b) | Adds react-native conditional exports and diagnostics-channel stub; cache logic unchanged. | typecheck, article/cache behavior |
| `motion` | 12.42.2 โ 13.4.0 | 13.4.0 | [official change record](https://github.com/motiondivision/motion/releases); [source diff](https://github.com/motiondivision/motion/compare/40e8756c63b258c9dd07de9501cb788410eefb02...a6ea2f9289e8bdace16b25b8142b9b53d37284a9) | v13 removes implicit optional emotion prop validation (Folo uses no styled/emotion integration); fixes AnimatePresence exit placement preserving existing DOM identity, empty propagation removal and React ref access; adds optional animation APIs. Reviewed release and focused source with tooling agent. | modal/list transition E2E, screenshots, web/electron build |
| `nanoid` | 5.1.16 โ 6.0.1 | 6.0.1 | [changes](https://raw.githubusercontent.com/ai/nanoid/9247b6dbfe97854e6e136784ae5dde0c672d22c5/CHANGELOG.md); [diff](https://github.com/ai/nanoid/compare/6ccc67bbaba71d3d77a21d9b636f4171a268ce49...9247b6dbfe97854e6e136784ae5dde0c672d22c5) | Runtime source and release review by backend runtime agent; see shared runtime audit. Check local usages and frontend runtime build. | typecheck, tests, app E2E |
| `nativewind` | 4.2.6 โ 4.2.7 | 4.2.7 | [History](https://raw.githubusercontent.com/nativewind/nativewind/35e054a9f328b7dee995a8e7f54456c7cfe7911c/packages/nativewind/CHANGELOG.md); [Git diff](https://github.com/nativewind/nativewind/compare/d5cfd40f52354e71423ff5ba743d2591c47d2757...35e054a9f328b7dee995a8e7f54456c7cfe7911c.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `next-intl` | 4.13.1 โ 4.14.6 | 4.14.6 | [history](https://raw.githubusercontent.com/amannn/next-intl/331b77a01f2be7baf9bdf9d8bc654ec085131550/CHANGELOG.md); [diff](https://github.com/amannn/next-intl/compare/976ca1f83a6e06b5646865b87c4fb461cbf84374...331b77a01f2be7baf9bdf9d8bc654ec085131550.diff); [family audit](dependency-upgrade-ssr-2026-09-22.md) | Root read complete official changelog and consumed runtime source; SSR/landing audit report. | Family build, regression tests and affected product flows |
| `postcss` | 8.5.16 โ 8.5.28 | 8.5.28 | [official change record](https://github.com/postcss/postcss/releases); [source diff](https://github.com/postcss/postcss/compare/92ccc93ff15bd193491d67fad9763e62d489dfad...e544bffc4f4b3966d8ec69c41744b3ed65afc64a) | Read changelog/container walker: stack-safe traversal, safer fromJSON prototypes/source-map paths, custom-property/comment/semicolon and BOM handling. Verify CSS build and visual layout. | typecheck, lint, test, affected build and E2E |
| `posthog-react-native` | 4.54.4 โ 4.75.0 | 4.75.0 | [Changelog at feature commit](https://github.com/PostHog/posthog-js/blob/5cfec8bdc3f1311fab0c1fa8a5b248f4f8b0fba9/packages/react-native/CHANGELOG.md); [4.75.0 release](https://github.com/PostHog/posthog-js/releases/tag/posthog-react-native%404.75.0); [Source range through 4.75 feature](https://github.com/PostHog/posthog-js/compare/94a053043847293a4427e315e67c798b58894107...5cfec8bdc3f1311fab0c1fa8a5b248f4f8b0fba9); [family audit](dependency-upgrade-mobile-runtime-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `prettier` | 3.9.4 โ 3.9.8 | 3.9.8 | [official change record](https://github.com/prettier/prettier/releases); [source diff](https://github.com/prettier/prettier/compare/3.9.4...3.9.8) | Read 3.9.5โ3.9.8 notes and TS parser/embedded HTML printer diffs: correct idempotency around Markdown/Liquid/lists and embedded HTML; unsupported TypeScript warning adjustments. Formatting tool only; no bulk reformat. | typecheck, lint, test, affected build and E2E |
| `prettier-plugin-tailwindcss` | 0.8.0 โ 0.8.1 | 0.8.1 | [changes](https://raw.githubusercontent.com/tailwindlabs/prettier-plugin-tailwindcss/fad3e0740088240af58046d9a8b05b47dd85f7b6/CHANGELOG.md); [diff](https://github.com/tailwindlabs/prettier-plugin-tailwindcss/compare/f77532e1c604f1ab06bc1b9902f6d9b115150998...fad3e0740088240af58046d9a8b05b47dd85f7b6) | Sorts raw JS class literals without erasing escapes; supports Svelte4 AST child/value shapes. Folo uses JSX/TS class literals. | format checks |
| `radix-ui` | 1.6.2 โ 1.6.7 | 1.6.7 | [changes](https://raw.githubusercontent.com/radix-ui/primitives/9aebdd45abd447b84092ecf20f8bcd27f2398c36/packages/react/radix-ui/CHANGELOG.md); [diff](https://github.com/radix-ui/primitives/compare/7b0b5d03783168f054a691a894433d7ffa43c166...9aebdd45abd447b84092ecf20f8bcd27f2398c36) | Root entry retains primitive types, adds per-primitive exports; all changed primitive implementations audited separately. | Radix component E2E/typecheck |
| `raw-body` | 3.0.2 โ 4.0.0 | 4.0.0 | [History](https://github.com/stream-utils/raw-body/blob/c3949f885af40733c680eb410b7d1f5aeddc2877/HISTORY.md); [source diff](https://github.com/stream-utils/raw-body/compare/4cf8e0a2591802e01f05f93e39a6a5b3610a183c...c3949f885af40733c680eb410b7d1f5aeddc2877); [family audit](dependency-upgrade-http-yaml-2026-09-22.md) | Official release/changelog and upstream source diff reviewed by runtime reviewer; see linked audit for consumed APIs and impact. | Family build, regression tests and affected product flows |
| `react` | 19.2.7 โ 19.2.8 | 19.2.8 | [diff](https://github.com/react/react/compare/6117d7cca4906492c51fe6a03381e35adfd86e7d...1dd4ecbdabf826f527fc9a58c05ea70375b7d170); [changelog](https://raw.githubusercontent.com/react/react/1dd4ecbdabf826f527fc9a58c05ea70375b7d170/CHANGELOG.md) | 19.2.8 RSC decoder loads only the last submitted action reference; async iterator throw completion handlers use noop, avoiding repeated error handling. No client reconciler change. Retain 19.2 branch to match Expo57/RN0.86 renderer. | web/mobile/Electron E2E, RSC/SSR build |
| `react-dom` | 19.2.7 โ 19.2.8 | 19.2.8 | [diff](https://github.com/react/react/compare/6117d7cca4906492c51fe6a03381e35adfd86e7d...1dd4ecbdabf826f527fc9a58c05ea70375b7d170); [changelog](https://raw.githubusercontent.com/react/react/1dd4ecbdabf826f527fc9a58c05ea70375b7d170/CHANGELOG.md) | Shares React19.2.8 patch source; client DOM runtime unchanged. RSC performance fixes only; kept paired with React19.2.8. | web/Electron E2E, SSR hydration |
| `react-error-boundary` | 6.1.2 โ 6.1.6 | 6.1.6 | [changes](https://raw.githubusercontent.com/bvaughn/react-error-boundary/1efba11fd3bdc2cc8f604ff45db36e3bc67adc59/CHANGELOG.md); [diff](https://github.com/bvaughn/react-error-boundary/compare/90b9a7e8766faa7890eff14ffedc77ea80740179...1efba11fd3bdc2cc8f604ff45db36e3bc67adc59) | Handles thrown null in reset/resetKeys, stabilizes context identity, fixes ref/defaulted-prop typing and explicit undefined fallback. | error boundary/reset browser regression and typecheck |
| `react-hook-form` | 7.81.0 โ 7.88.0 | 7.88.0 | [changes](https://raw.githubusercontent.com/react-hook-form/react-hook-form/28334faa6105b0475060592c6bf27dca87e3941e/CHANGELOG.md); [diff](https://github.com/react-hook-form/react-hook-form/compare/46b217e034dd92f7aa3cb3a478815556b416b299...28334faa6105b0475060592c6bf27dca87e3941e) | Read all changed runtime source: reset guards discard stale async resolver results; per-field delayed errors are canceled on reset/unregister/manual updates; Activity reconnect resyncs form/watch/array subscriptions; nested array dirty/reset keeps values, avoids resurrecting removed rows; Controller correctly handles FileList and null parents; field paths now max 10 segments. New ErrorMessage/getErrors/Form actions are opt-in. | Form validation/reset/dirty and array regression, login/settings browser E2E |
| `react-i18next` | 17.0.8 โ 17.0.15 | 17.0.15 | [changes](https://raw.githubusercontent.com/i18next/react-i18next/7d38e0919507f0d339ac29b9fbd5f718eaadc829/CHANGELOG.md); [diff](https://github.com/i18next/react-i18next/compare/a46ad23ad07f1a3440d03cce80d0cab7ad23e2f0...7d38e0919507f0d339ac29b9fbd5f718eaadc829) | Hardens less-than parsing with allowedTags, retains valid sole-element children, responds to resolved-language/fallback changes, fixes ICU defaults and TS overloads. | language synchronization E2E, formatted translations |
| `react-intersection-observer` | 10.0.3 โ 11.0.1 | 11.0.1 | [changes](https://github.com/thebuilder/react-intersection-observer/releases/tag/v11.0.1); [diff](https://github.com/thebuilder/react-intersection-observer/compare/fdfcd59cee6dc0a4db6c10398650587905e5d6d1...aa231b3a23ec000db0edb434693f9661ff422970) | Read10.1/11.0/11.0.1notes and InView/useInView/useOnInView/observe/sharedref source. Observation starts from callback ref; React19 cleanup and stale-owner guards prevent leaks; cleanup idempotent; triggerOnce waits actual threshold and can be disabled to resume, scrollMargin supported; initial false callbacks still suppressed. | load-more and impressions on scrolling, threshold/skip/remount E2E |
| `react-native` | 0.86.0 โ 0.86.3 | 0.86.3 | [History](https://raw.githubusercontent.com/react/react-native/95cffbff2e071e278987c7d7cd51fbc970dd5622/CHANGELOG.md); [Git diff](https://github.com/react/react-native/compare/a632f9efe24bac8b3a113c78469948f55bde0f5d...95cffbff2e071e278987c7d7cd51fbc970dd5622.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-css-interop` | 0.2.6 โ 0.2.7 | 0.2.7 | [History](https://raw.githubusercontent.com/nativewind/nativewind/35e054a9f328b7dee995a8e7f54456c7cfe7911c/packages/react-native-css-interop/CHANGELOG.md); [Git diff](https://github.com/nativewind/nativewind/compare/d5cfd40f52354e71423ff5ba743d2591c47d2757...35e054a9f328b7dee995a8e7f54456c7cfe7911c.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-edge-to-edge` | 1.8.1 โ 1.8.2 | 1.8.2 | [History](https://github.com/zoontek/react-native-edge-to-edge/releases); [Git diff](https://github.com/zoontek/react-native-edge-to-edge/compare/592579d27f49aa499ce6443cf08bb3ab73f39f64...72b27014ddce5b1c53c694da206203416789a210.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-gesture-handler` | 3.0.2 โ 3.3.0 | 3.3.0 | [animation family audit](dependency-upgrade-animation-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-keyboard-controller` | 1.22.0 โ 1.22.5 | 1.22.5 | [History](https://github.com/kirillzyusko/react-native-keyboard-controller/releases); [Git diff](https://github.com/kirillzyusko/react-native-keyboard-controller/compare/b80086f1207e36d634f93afabb65eb886fe1a2fe...35a06b2acb8ffe96a0ccd7799e0e4d9c03338141.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-pager-view` | 8.0.3 โ 9.0.4 | 9.0.4 | [History](https://github.com/callstack/react-native-pager-view/releases); [Git diff](https://github.com/callstack/react-native-pager-view/compare/9f5e13997ecc2cb406a30902b06e4c8cdf1257a6...bfd8a5ac54a26550fdf3566c32e14340f4c96557.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-reanimated` | 4.5.1 โ 4.7.0 | 4.7.0 | [animation family audit](dependency-upgrade-animation-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-safe-area-context` | 5.8.0 โ 5.10.0 | 5.10.0 | [History](https://github.com/AppAndFlow/react-native-safe-area-context/releases); [Git diff](https://github.com/AppAndFlow/react-native-safe-area-context/compare/5a9ad5e337ba7048f0ef6e720a5a56a8840bc548...b9542bd75bea0ee5ff1c9a3f961ab41eb1199425.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-screens` | 4.25.2 โ 4.28.0 | 4.28.0 | [History](https://github.com/software-mansion/react-native-screens/releases); [Git diff](https://github.com/software-mansion/react-native-screens/compare/a9d5735610d56215df140ab6a7a3bb899da91cda...2381ed8d72fe19185fc8415cb61df7b79bbf4376.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-uikit-colors` | 0.6.2 โ 1.0.0 | 1.0.0 | [History](https://github.com/Innei/apple-uikit-colors/commit/9520b5177cbc3969cd35c60debc480527d49f326); [Git diff](https://github.com/Innei/apple-uikit-colors/compare/66a965275fdfcf1ee142d5ac6486f0687a796496...9520b5177cbc3969cd35c60debc480527d49f326.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-volume-manager` | 2.0.8 โ 2.2.0 | 2.2.0 | [History](https://github.com/hirbod/react-native-volume-manager/releases); [Git diff](https://github.com/hirbod/react-native-volume-manager/compare/b77d6e640089cbed0c6f1d6037aa59210df45201...c825487e9699dc2cced89240a7e36295d5d87206.diff); [family audit](dependency-upgrade-mobile-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-native-worklets` | 0.10.2 โ 0.13.0 | 0.13.0 | [animation family audit](dependency-upgrade-animation-2026-09-22.md) | Root mobile / backend_tooling_review source and official changelog review; see mobile audit report. | Family build, regression tests and affected product flows |
| `react-router` | 8.2.0 โ 8.4.0 | 8.4.0 | [official change record](https://github.com/remix-run/react-router/releases); [source diff](https://github.com/remix-run/react-router/compare/react-router@8.2.0...react-router@8.4.0) | Read v8.3/v8.4 notes and context/hooks diffs. Splits contexts and removes old UNSAFE context shapes; admin only uses public hooks. Check generated routes, auth redirect, browser back/forward and direct route reload. | typecheck, lint, test, affected build and E2E |
| `react-zoom-pan-pinch` | 4.0.3 โ 4.2.0 | 4.2.0 | [changes](https://raw.githubusercontent.com/BetterTyped/react-zoom-pan-pinch/34abc1ffbc124f2adf9c959f81ce6c6f2c2f219f/CHANGELOG.md); [diff](https://github.com/BetterTyped/react-zoom-pan-pinch/compare/f4b5d9e4893f61a90d998430bb3adee6008261ec...34abc1ffbc124f2adf9c959f81ce6c6f2c2f219f) | Read all changed runtime source and4.0.4..4.2 release notes: zoom button step becomes absolute increment, controls return settling promises; unmount cleans listeners/timers/RAF; input/contenteditable/native draggable regions excluded from pan; text selectable except active pan; horizontal wheels do not zoom; ResizeObserver realigns bounds after resizing, deferring while pointer held; new keyboard/fit helpers opt-in. | image viewer zoom buttons/wheel/pan/reset/resize/close-reopen E2E |
| `satori` | 0.26.0 โ 0.33.4 | 0.33.4 | [history](https://github.com/vercel/satori/releases/tag/0.33.4); [diff](https://github.com/vercel/satori/compare/eab60eeecca1bcefc95d69a674f20f572155fe26...9668d2097d149275cc4c0f741b113ea60671e57e.diff); [family audit](dependency-upgrade-ssr-2026-09-22.md) | Root read complete official changelog and consumed runtime source; SSR/landing audit report. | Family build, regression tests and affected product flows |
| `shiki` | 4.3.1 โ 4.4.3 | 4.4.3 | [changes](https://github.com/shikijs/shiki/releases/tag/v4.4.3); [diff](https://github.com/shikijs/shiki/compare/fdff6e2384b8d97afd3f33aa82ce52700d58972e...48cd2cc695ed2e3357c3f9c370578ea843d6d9a3) | Detects YAML frontmatter, binary-searches token split breakpoints, expands language aliases/grammars (cmd now Batch), updates grammar/theme bundles. API unchanged. | article markdown/code rendering E2E |
| `simple-git-hooks` | 2.13.1 โ 2.14.0 | 2.14.0 | [changes](https://raw.githubusercontent.com/toplenboren/simple-git-hooks/e9aebbd596e5bd986f5c44da0dc99e22c64bf6ad/CHANGELOG.md); [diff](https://github.com/toplenboren/simple-git-hooks/compare/1abdcd7fd486058db76fe930542fd75e335ee462...e9aebbd596e5bd986f5c44da0dc99e22c64bf6ad) | Resolves worktree hooks in shared git dir, INIT_CWD project root, Bun isolated layout; missing package.json skips; identical hooks are not rewritten. Official 2.14.0 release and main source diff read. | prepare install, temporary worktree hook smoke test |
| `sonner` | 2.0.7 โ 2.0.8 | 2.0.8 | [official change record](https://github.com/emilkowalski/sonner/releases); [source diff](https://github.com/emilkowalski/sonner/compare/06048270633a4f0cb954688d571e7bed2bc597f4...ecce1841c55e4a72dfe139a8992b56498660125e) | Repairs StrictMode toast recreation/subscription replay, ID zero, stale action leakage, custom dismissal, listener removal, swipe direction and modal top-layer accessibility. | toast create/update/dismiss and modal E2E |
| `stripe` | 22.3.0 โ 22.6.2 | 22.6.2 | [changes](https://raw.githubusercontent.com/stripe/stripe-node/d9d092737b4a891f0beaf47c26c222972a4c7b0f/CHANGELOG.md); [diff](https://github.com/stripe/stripe-node/compare/3c5c172c0dbabc0c34a1fd14b910ad5ada110a53...d9d092737b4a891f0beaf47c26c222972a4c7b0f) | Reviewed by backend runtime: rejects empty webhook secret, supplies default POST idempotency keys, validates request paths and enforces body timeouts; API version explicitly preserved server-side. | typecheck/SSR build; no live billing charge |
| `svg-parser` | 2.0.4 โ 2.1.0 | 2.1.0 | [changes](https://raw.githubusercontent.com/Rich-Harris/svg-parser/4cdc36283a99f7b686bdf8fc56afa2561e49e6fc/CHANGELOG.md); [diff](https://github.com/Rich-Harris/svg-parser/compare/v2.0.4...4cdc36283a99f7b686bdf8fc56afa2561e49e6fc) | Full parser source diff: empty/whitespace input now explicit error; bounded80column snippets with1line context, line/column/snippet metadata. Successful SVG AST unchanged;2.0.5toolchain only. | icon SVG parse/build plus invalid SVG smoke |
| `tailwind-merge` | 3.6.0 โ 3.7.0 | 3.7.0 | [official change record](https://github.com/dcastil/tailwind-merge/releases); [source diff](https://github.com/dcastil/tailwind-merge/compare/d54f7e5713c653d0171971405344f7c6e44d418f...511d68a65d8fa11ae8a549b5a1d5cf4dced41101) | 3.7 color()/light-dark validators, extra Tailwind classes and logical padding conflict resolution. Read validators and default-config source. Test class merging in Button/select and theme. | typecheck, lint, test, affected build and E2E |
| `tailwind-variants` | 3.2.2 โ 3.3.1 | 3.3.1 | [official change record](https://github.com/heroui-inc/tailwind-variants/releases); [source diff](https://github.com/heroui-inc/tailwind-variants/compare/fb6e0bfdebc54b1189ec2e74ff68c75d26da6322...v3.3.1) | Read changelog and new internal tv/class-resolver implementation. TS rewrite with per-instance compiled variants/caches; each slot result captures its own parent props, fixing cross-render contamination. Test disabled/active/variant classes over repeated state changes. | typecheck, lint, test, affected build and E2E |
| `tailwindcss` | 3.4.17 โ 3.4.19 (compatibility lanes: {'3': '3.4.19', '4': '4.3.3'}) | 3.4.19, 4.3.3 | [official change record](https://github.com/tailwindlabs/tailwindcss/releases); [source diff](https://github.com/tailwindlabs/tailwindcss/compare/v4.3.2...v4.3.3); [diff](https://github.com/tailwindlabs/tailwindcss/compare/v3.4.17...v3.4.19); [changelog](https://raw.githubusercontent.com/tailwindlabs/tailwindcss/v3.4.19/CHANGELOG.md) | 3.4.18/19 fixes TS config require.cache, require-first load with jiti fallback, async PostCSS config loader, removes empty important selectors, CSS math parser preserves sibling/custom functions and raw supports queries. v4.3.3: read full shared scanner, AST nesting, selectors, variables, shadow alpha, theme colors/font/preflight plus PostCSS input invalidation diffs; uses native nesting only below declaration-containing rule, hoists/merges at-rules preserving cascade and specificity. | mobile Metro/native UI build |
| `tar` | 7.5.19 โ 7.5.22 | 7.5.22 | [changes](https://raw.githubusercontent.com/isaacs/node-tar/2a22bfc5d3a432a606d9da0e2d87ba634aa3b1cb/CHANGELOG.md); [diff](https://github.com/isaacs/node-tar/compare/be440da64e9fe80c68c755d8147328ea1cc2a9ad...2a22bfc5d3a432a606d9da0e2d87ba634aa3b1cb) | Limits recursive ancestor filter search to100; abort destroys decompressor and ignores late callbacks; transform type accepts falsy no-transform values. | desktop updater archive tests/build |
| `tar-stream` | 3.2.0 โ 3.2.1 | 3.2.1 | [changes](https://github.com/mafintosh/tar-stream/releases/tag/v3.2.1); [diff](https://github.com/mafintosh/tar-stream/compare/5e4ddbeb30b9f8e137cfbf9b970c1a6a7c7ea07b...246572f479d92b0748b21c873e58c64a84a0b826) | Adds native streamx type definitions and package exports; runtime unchanged. Release page is empty; commit diff is the available release record. | archive typecheck and updater tests |
| `tldts` | 7.4.7 โ 7.4.14 | 7.4.14 | [changes](https://raw.githubusercontent.com/remusao/tldts/637f6f397789e2c7b4deda669fccae278f3124c1/CHANGELOG.md); [diff](https://github.com/remusao/tldts/compare/c43f3f113164626a96ebbe71f8979f7c512ad382...637f6f397789e2c7b4deda669fccae278f3124c1) | Parser unchanged. Read generated trie file mapping and underlying full readable PSL rule changes: new ai.studio/cloud.run/Claude/Cursor/Canva hosts, Azure regional wildcards, country second-level domains, removal of discontinued platforms. | domain extraction regression |
| `tsdown` | 0.22.4 โ 0.23.0 | 0.23.0 | [official change record](https://github.com/rolldown/tsdown/releases); [source diff](https://github.com/rolldown/tsdown/compare/v0.22.4...v0.23.0) | 0.23 removes deps.skipNodeModulesBundle; replaced with deps.neverBundle:true in client-sdk config, keeping DTS workspace externals. Read deps resolver source. Default dependency subpath resolution changes; verify SDK exports, ESM and declarations. | typecheck, lint, test, affected build and E2E |
| `tsx` | 4.23.0 โ 4.23.15 | 4.23.15 | [official change record](https://github.com/privatenumber/tsx/releases); [source diff](https://github.com/privatenumber/tsx/compare/1dfad376d8fd8bf63b2b39d62797acb2e7ca173a...ca66105a17a2a4c6503fe3a12b5b9ec408286011) | Read 4.23.13โ15 release and ESM load/cache sources: Node 24 require(esm) namespace bridge, builtin exclusion and bounded lazy cache scanning. Test CLI entry loading and runtime scripts. | typecheck, lint, test, affected build and E2E |
| `turbo` | 2.10.4 โ 2.11.2 | 2.11.2 | [official change record](https://github.com/vercel/turborepo/releases); [source diff](https://github.com/vercel/turborepo/compare/v2.10.4...v2.11.2) | Read 2.11 release notes and CLI args fix: package manager metadata support and repeatable --args/--scope handling. Cache/link/task graph behavior needs full uncached workspace lint/typecheck/build/test. | typecheck, lint, test, affected build and E2E |
| `typescript` | 6.0.3 โ 6.0.3 | catalog: | [family audit](dependency-upgrade-typescript-2026-09-22.md) | Retain latest TypeScript6 compatibility line. TypeScript7.0.2 package exports only version/versionMajorMinor; real substitution in typescript-eslint8.63 parser fails reading Cjs while6.0.3 parses successfully. Native CLI cannot replace missing JS compiler API. Official evidence and executable probe in TypeScript audit. | full typecheck and lint withTS6; isolated TS7 incompatibility probe |
| `unplugin-ast` | 0.17.2 โ 0.19.0 | 0.19.0 | [changes](https://github.com/unplugin/unplugin-ast/releases/tag/v0.19.0); [diff](https://github.com/unplugin/unplugin-ast/compare/c9f8c923014ecdd1fd87cff10b7e3b02d1152c60...385d75199bcf86b44a69c0b27f2de188e5dadabc) | 0.18 replaces Babel AST with Yuku parser/codegen; 0.19 switches native RolldownString. Removed ast-kit re-export and AST shape changes require typed tw transformer adaptation. Read src parser, walk, transform, wrapper transform and option diffs. | template wrapper transformation tests, desktop build and UI styles |
| `use-sync-external-store` | 1.6.0 โ 1.7.0 | 1.7.0 | [changes](https://raw.githubusercontent.com/react/react/1d34f91dfde6bba84d08b683aaba164c7194dacb/CHANGELOG.md); [diff](https://github.com/react/react/compare/861811347b8fa936b4a114fc022db9b8253b3d86...1d34f91dfde6bba84d08b683aaba164c7194dacb) | Read exact package source diff and React release/package-version commit history. Only Flow cast syntax and repository URL change in this package; selector memoization/shim behavior unchanged. No standalone 1.7 changelog is published; React 19.3 release notes are broader than this package. | store unit tests and two-client settings E2E |
| `vinext` | 1.0.0-beta.0 โ 1.0.0-beta.11 | 1.0.0-beta.11 | [official releases](https://github.com/cloudflare/vinext/releases); [upstream diff](https://github.com/cloudflare/vinext/compare/4fad98a20e226e2031faaa6a6b7fa4cdd0065510...468f72eaba537718217b63c5b495cf5d181da4e0); [family audit](dependency-upgrade-landing-2026-09-22.md) | Tooling reviewer read beta1..11 release notes and consumed RSC/SSR/router/middleware/worker source; official source and detailed effects in audit. | Family build, regression tests and affected product flows |
| `vite` | 7.3.1 โ 7.3.6 (compatibility lanes: {'7': '7.3.6', '8': '8.3.0'}) | 7.3.6, 8.3.0 | [official change record](https://github.com/vitejs/vite/releases); [source diff](https://github.com/vitejs/vite/compare/v8.1.4...v8.3.0); [diff](https://github.com/vitejs/vite/compare/95e8923f35d0252c9f6eb2d5e358c084542706f1...0a7b53ba230c6e68f502a89864534c607d393ab7); [changelog](https://raw.githubusercontent.com/vitejs/vite/0a7b53ba230c6e68f502a89864534c607d393ab7/packages/vite/CHANGELOG.md) | Vite8.1.4โ8.3.0 reviewed by tooling agent: Rolldown assets, CSS escaping/minify and glob fixes. Vite7 source fully reviewed: disable client fetchModule, enforce server.fs for remote transports and stripped queries, prevent optimized sourcemap traversal/Windows alternate paths; Safari destructuring workaround and esbuild0.28 allowance. | build and dev/e2e across apps |
| `vite-bundle-analyzer` | 1.3.8 โ 1.3.9 | 1.3.9 | [changes](https://raw.githubusercontent.com/nonzzz/vite-bundle-analyzer/43a88cda4f21e4951b3abd21c5ed73c1583622b3/CHANGELOG.md); [diff](https://github.com/nonzzz/vite-bundle-analyzer/compare/3cdda3d7aaf5dd21d7fc049836a620f1a3004175...43a88cda4f21e4951b3abd21c5ed73c1583622b3) | Browser opener catches sync/child errors and reports platform-specific instructions; WSL path uses wslpath. No production bundle transform change. | desktop build |
| `vitest` | 4.1.10 โ 5.0.1 | 5.0.1 | [official change record](https://github.com/vitest-dev/vitest/releases); [source diff](https://github.com/vitest-dev/vitest/compare/v4.1.10...v5.0.1) | Read v5 migration/release and defaults source: clearMocks now true, no ancestor config discovery, unawaited async assertions fail, sequential removed, new output directory. Repo has explicit configs. Full tests and coverage required. | typecheck, lint, test, affected build and E2E |
| `wrangler` | 4.107.1 โ 4.136.1 | 4.136.1 | [official change record](https://github.com/cloudflare/workers-sdk/releases); [source diff](https://github.com/cloudflare/workers-sdk/compare/wrangler@4.107.1...wrangler@4.136.1) | Read 4.108โ4.136 changelog plus module-collection, Miniflare email and ConfigController source. Removes legacy service environments; modern compatibility-date Node behavior, offline email event tracing, fixed module names and dev lifecycle. Existing explicit date/env shape retained. System Wrangler only, local dry-run/email tests; no deployment. | typecheck, lint, test, affected build and E2E |
| `zod` | 4.4.3 โ 4.6.5 | 4.6.5 | [changes](https://github.com/colinhacks/zod/releases/tag/v4.6.5); [diff](https://github.com/colinhacks/zod/compare/f3c9ec03ba7a28ae72d25cc295f38674bee0f559...59bbc03e10c636b9eb3c393dfeb552819774ec21) | Reviewed by backend runtime: lazy parse errors and shared schema prototypes; opt-in compile/validate/memoizer; recursion/default/discriminator/URL/JSON-schema fixes. | form validation and local API E2E |
| `zustand` | 5.0.14 โ 5.0.15 | 5.0.15 | [changes](https://github.com/pmndrs/zustand/releases/tag/v5.0.15); [diff](https://github.com/pmndrs/zustand/compare/bfb2a9e7ce52608d54d8a077fb87ac9d12e73c58...2115efb9e270e73ad1d3472dfe0e0c7b8c6abcd4) | persist.clearStorage increments hydrationVersion to invalidate in-flight rehydration; devtools regex handles paths containing spaces. Affects logout/reset and persisted stores. | store unit tests, auth/settings reload E2E |
No source-review candidates remain unassigned. Latest-version compatibility exceptions are explicit above; external-service and device-only test limitations remain separately recorded.
---
### Dependency Upgrade Android 2026 09 22 (`docs/dependency-upgrade-android-2026-09-22.md`)
# Android native verification
## Build and isolation
- Final upgraded dependency installation was complete before this build started.
- Built the generated Android project with Temurin 17.0.20.1, matching the repository's Android CI Java major version. JDK 25 had failed during three CMake configuration tasks with restricted JNI warnings; JDK 17 passed those tasks without modifying dependency sources.
- Command: `ANDROID_HOME=/Users/diygod/Library/Android/sdk JAVA_HOME=/tmp/folo-deps-jdk17/Contents/Home PROFILE=e2e-ios-simulator EXPO_PUBLIC_E2E_ENV_PROFILE=local EXPO_PUBLIC_E2E_LANGUAGE=en ./gradlew assembleRelease -PreactNativeArchitectures=arm64-v8a -x lint -x test --no-daemon --max-workers=4`.
- Release build passed in 5 minutes 38 seconds: 1,782 tasks, 1,744 executed and 38 up-to-date. Build log: `/tmp/folo-deps-android-build-jdk17.log`.
- Installed the resulting 73,488,326-byte APK on a dedicated API 36 arm64 emulator, `emulator-5580`. Inspected its bundled `assets/app.config`: E2E profile `local`, language `en`.
- The task AVD uses `/tmp/folo-deps-android-avd/FoloDependencyReview.avd`, created from device configuration only with fresh task data. The user's existing AVD and connected physical Pixel were not modified.
- `adb reverse tcp:3000 tcp:3000` connects the app's localhost API URL to the disposable test backend. The emulator's TCP proxy rejects external destinations; this prevents Firebase/Google background requests from reaching external services. This isolation limits external image, attestation, push and billing verification and is not evidence of their success.
## Test data
After the final backend test suite finished (so no later truncate could remove fixtures), invoked the application's real `refreshOnboardingFeedRecords()` under committed `.env.test` with an additional localhost:5433 URL guard. No schema or production record was changed.
- Feed: `1300310806025338880`, `folo://onboarding`, `Welcome to Folo`.
- Entries: `1300310806075670528`, `1300310806075670529`, `1300310806075670530`.
- Seed evidence: `/tmp/folo-deps-onboarding-seed.log`.
## Runtime validation
The real Release app displayed the email, Google and GitHub signup options and registered a task-only account against the local backend. No AndroidRuntime fatal exception or ReactNativeJS error was present in the startup check.
The first auth journey exposed two real defects. First, the screen registration effect appended metadata after sibling screens whenever it ran again, while the tab bar navigated by metadata array position. The visible order became Subscriptions, Discover, Settings, Home although the screen indices remained Home, Subscriptions, Discover, Settings. Labels, selection and destination indices could disagree. Evidence: `/tmp/folo-deps-android-maestro-auth.log`, `/tmp/folo-deps-android-auth-progress.png`, `/tmp/folo-deps-android-auth-failure.xml`.
`TabScreen.tsx` now replaces registrations by their stable screen index and sorts the metadata by that index. `Tabbar.tsx` uses the route's actual screen index for both navigation and focus. Mobile typecheck passed; lint reported no errors in these files (the two existing `any` warnings remain). The fixed release rebuilt successfully in 1 minute 20 seconds, with 26 tasks executed and 1,756 reused: `/tmp/folo-deps-android-build-navfix.log`.
Added `e2e/flows/android/tab-navigation.yaml` to the normal Android auth journey. It switches Settings, Subscriptions, Discover and Home three times, asserting each screen's own control or content, then cold-starts the app and checks the persisted session and correct Settings/Home mapping. Final flow results and content checks are recorded below after execution.
The second auth run showed the correct tab order, but the Settings assertion still failed because **all** main-screen touch handlers stopped responding after signup. A cold restart with the same stored session immediately restored interaction, narrowing the fault to state left behind after signup. The Android success toast mounts `ToastContainer` through a persistent root sibling. Its two full-screen views used `pointerEvents="box-only"`, and clearing the toast stack left those invisible views mounted and intercepting touches. `ToastContainer.tsx` now returns `null` for an empty stack and uses `box-none` for layout containers so background touches can pass through while a toast is visible. This conclusion is Android-specific: iOS success toasts use the native Toaster module.
The navigation regression passed after cold restart on the same persisted account: all three cycles, session restoration, and the final Settings/Home assertions. Log: `/tmp/folo-deps-android-maestro-navigation.log`. The toast fix passed mobile typecheck and lint, and the final release rebuilt successfully in 1 minute 54 seconds: `/tmp/folo-deps-android-build-toastfix.log`.
Added `e2e/flows/android/content.yaml` to the auth journey to reuse the existing subscription and reader flows. The complete sequence now covers signup, logout, password login, repeated tab navigation, cold-start session persistence, removing the onboarding subscription, discovering and following it again, opening an article, long-press read/unread toggles, and unfollowing it.
With the toast fix, signup, immediate Settings navigation, logout and password login all passed in one uninterrupted run. The stronger tab regression then exposed a third issue: after password login, the dismissed modal left the soft keyboard visible over the bottom tabs. `EmailLogin` and `EmailSignUp` now explicitly dismiss the keyboard and clear its focus when submitting. This is an app behavior fix, rather than a test that hides the keyboard to bypass the problem.
The reader flow now selects the first entry by test ID instead of a fixed screen coordinate, waits for actual WebView body text, and scrolls to the `Your Subscriptions` section before returning to the timeline and testing read/unread actions. Thus a blank or broken article renderer cannot pass merely because the timeline disappears.
The subscription preflight successfully removed the real subscription, opened Discover and submitted a URL. Android's default text-input capitalization changed `folo://onboarding` into `Folo://onboarding`, causing the follow lookup to fail. Discover's search field now disables automatic capitalization and correction so URL text is preserved. The resulting error also exposed raw request context appended by the API SDK; `FollowUrl` now uses the existing `sanitizeErrorMessage` helper before displaying the error, keeping request headers out of this screen.
Verified renderer freshness separately from the React Native bundle: rebuilding `apps/mobile/web-app` against final dependencies into an isolated temporary directory produced `index-cc0j7Wei.js` and `index-BWpPiY9n.css`, identical to the final workspace `out/rn-web/html-renderer/index.html`. Android's generated assets still referenced an earlier renderer copied during prebuild. Replaced only that generated `html-renderer` directory with the final build before the final APK build. Renderer build log: `/tmp/folo-deps-android-renderer-build.log`.
A later uninterrupted auth run reproduced an Android native presentation race after sign-out reload: the Login route existed in the JS navigation stack (`Top of stack is already LoginScreen`), but no native modal was visible. Removing that invisible route with Android Back and reopening it made the modal appear, establishing a native-mount timing problem rather than an API or disabled-button failure. `RootStackNavigation` now waits for the root native screen's `onAppear` before rendering queued routes on Android. `WrappedScreenItem` composes that notification into its existing focus/lifecycle handler; queued route state is retained. The initial fix was Android-only; a later iOS A/B demonstrated an analogous startup ordering failure and extended this readiness gate to both platforms, as recorded in the iOS report. The Android registration flow now asserts the automatic anonymous login modal before any manual open-auth action; sign-out similarly requires its automatic login modal without a recovery tap.
Actual article inspection also found a pre-existing mobile reader gap: onboarding content is stored as Markdown and the desktop reader explicitly selects a Markdown renderer, but the mobile WebView parsed it as HTML and displayed literal `###` and `**`. The WebView now converts only onboarding entry content with the existing shared Markdown parser, then passes its HTML through the normal sanitizer and custom media/link renderer. Added actual render tests for headings/emphasis/native image wrappers, media hiding, unsafe URL filtering, and preservation of ordinary HTML articles. The two renderer test files pass all 12 tests with `pnpm exec vitest run --config vite.config.mts --environment happy-dom src/App.test.tsx src/spotlight.test.tsx` from `apps/mobile/web-app/html-renderer`; log `/tmp/folo-deps-android-markdown-tests.log`. These defects were found during dependency E2E; the Markdown, toast and capitalization mistakes existed in application code before the upgrade and are not all attributed to upstream changes.
The final Markdown-enabled WebView production build contains `index-DZ2Ze5om.js` and `index-DmJdjm9r.css`. Android's generated bundled resources were refreshed from this output; the iOS owner was given the same asset names. Mobile and WebView typechecks passed; lint on the navigation and reader changes has no errors (four pre-existing warnings). Logs: `/tmp/folo-deps-android-nativegate-typecheck.log`, `/tmp/folo-deps-android-markdown-typecheck.log`, `/tmp/folo-deps-android-nativegate-lint.log`, `/tmp/folo-deps-android-markdown-renderer-build.log`.
## Completed continuous journey
After the final pnpm 12 frozen installation, rebuilt the Android release with the navigation gate and Markdown reader: **PASS in 3 minutes 23 seconds**, 1,782 tasks (1,500 executed, 282 reused). Verified `assets/html-renderer/index.html` inside the resulting APK references `index-DZ2Ze5om.js`. Build log: `/tmp/folo-deps-android-build-nativegate.log`.
The new-account continuous journey then **passed in 4 minutes 44 seconds**, without manual Back recovery, forced restart between signup/logout/login, or bypassing assertions:
1. Automatic anonymous login presentation and real signup.
2. Immediate Settings navigation, real sign-out, automatic login presentation after JS reload, and real password login.
3. Three complete Settings/Subscriptions/Discover/Home cycles, then cold-start persisted session and correct tab destinations.
4. Unfollow, Discover by the exact onboarding URL, follow form submission and the real subscription appearing.
5. Open the first timeline entry; assert the actual introductory paragraph in the WebView and scroll to the parsed `Your Subscriptions` heading.
6. Return to the timeline, long-press and toggle read/unread with the opposite menu action asserted.
7. Unfollow and assert the subscription is gone.
Evidence: `/tmp/folo-deps-android-maestro-nativegate.log` and its matching Maestro debug directory. A subsequent Android cold-start deep-link regression is included in `android/core.yaml`; its independent execution result is recorded below.
The first independent cold-start deep-link test exposed another pre-existing startup race before navigation mounted. The screen remained on `Database Migrations...` although logs showed migration completing in 4 ms and full initialization in 271 ms. `initialize/migration.ts` mutated the same object returned by `useSyncExternalStore`, so React's snapshot identity comparison could ignore completion when the UI subscribed before migration ended. It also supported only one listener. The store now publishes a new complete `{ success, error }` snapshot and notifies a Set of subscribers; cleanup removes only its own listener. Three real React tests mount consumers before an asynchronous database completion (including two simultaneous consumers), check a consumer mounted after completion, check error propagation to the recovery UI, and ensure unmounting one subscriber does not disconnect the remaining consumer. Tests, mobile typecheck and lint pass: `/tmp/folo-deps-android-migration-tests.log`, `/tmp/folo-deps-android-migration-typecheck.log`, `/tmp/folo-deps-android-migration-lint.log`. The failed pre-fix deep-link attempt remains recorded at `/tmp/folo-deps-android-maestro-deep-link.log`; a post-fix native result is required below.
The final continuous run exposed an intermittent article tap failure that had also appeared before the final color/migration changes. A controlled A/B on the same row and coordinate reproduced it: a stationary **150 ms** touch did nothing; a **50 ms** touch immediately opened the article. `ItemPressable.tsx` set a 100 ms long-press threshold with a no-op handler. React Native's actual `Pressability.js` cancels `onPress` once that long-press handler fires, before the native context menu appears. Restored React Native's standard 500 ms threshold while retaining the no-op handler required by the [native context-menu/navigation workaround](https://github.com/nandorojo/zeego/issues/61). The iOS-specific implementation is separate and unchanged. This was a pre-existing application threshold, not a demonstrated change in RN's press-cancellation behavior. A/B screenshots: `/tmp/folo-deps-android-tap150.png`, `/tmp/folo-deps-android-tap50.png`; the latter also shows real Markdown headings and emphasis correctly rendered in the final WebView. Post-fix ordinary taps and long-press read/unread must both pass below; the failed continuous attempt is preserved in `/tmp/folo-deps-android-maestro-complete.log`.
Post-fix A/B passed on the rebuilt APK: the same stationary 150 ms touch now opens the article (`/tmp/folo-deps-android-tap150-fixed.png`), and a 650 ms long press opens the native read/unread menu without navigating or crashing (`/tmp/folo-deps-android-longpress-fixed.png`). The bundle source map was checked for the actual 500 ms threshold. Removed the Android reader's temporary tap-retry option, so the final flow must open the article with a single ordinary tap. Build `/tmp/folo-deps-android-build-press.log` passed in 1 minute 1 second (26 executed tasks, 1,756 reused); mobile typecheck, targeted lint and formatting passed.
The post-migration-fix cold-start deep-link test also passed independently: `/tmp/folo-deps-android-maestro-deep-link-fixed.log`. It stops the process, opens `folo://add?url=folo%3A%2F%2Fonboarding&type=url`, asserts the actual follow form and feed title with no login screen, dismisses the modal, and checks Settings navigation. The flow is included in the normal Android `core.yaml` journey.
## Final acceptance
The APK containing all final Android changes, including UIKit alpha compatibility, immutable migration snapshots and the 500 ms press threshold, passed the **entire continuous Android core flow in 5 minutes 58 seconds**: `/tmp/folo-deps-android-maestro-verified.log`. This includes new-account registration, logout/reload and automatic login, password login, three cycles of all four tabs, cold session restoration, follow/unfollow, a single ordinary article tap without a retry, actual Markdown paragraph/heading rendering, long-press read/unread toggles, and the cold-start follow deep link. No manual recovery was used during this run.
Then switched the dedicated emulator from light to dark appearance and exercised Settings and Discover in both modes. Search fill, secondary text, card backgrounds and separators update with the theme. Captured the real UI:
- `/tmp/folo-deps-android-settings-light.png`
- `/tmp/folo-deps-android-settings-dark.png`
- `/tmp/folo-deps-android-discover-light.png`
- `/tmp/folo-deps-android-discover-dark.png`
An independent screenshot review caught missing username/Edit text and partially drawn icons in the immediate dark-mode transition frame. A cold restart followed by Settings navigation and animation completion produced `/tmp/folo-deps-android-settings-dark-cold.png`, independently inspected with the username, Edit label, icons and separators all correctly visible. The stable light frame is `/tmp/folo-deps-android-settings-light-settled.png`. Stable cold-start visual acceptance passes; the transient theme-switch frame is retained as a limitation rather than counted as a successful render. Actual compilation of `text-white/95` produces the correct `#fffffff2`; this does not involve the upgraded UIKit `color-mix` compatibility path.
A separate pre-existing visual limitation remains: the global automatic status-bar style uses dark text in light mode even where the Settings avatar gradient is dark. This contrast issue is outside the dependency alpha fix and was not expanded into another product change. Appearance flow logs: `/tmp/folo-deps-android-colors-light.log`, `/tmp/folo-deps-android-colors-dark.log`, `/tmp/folo-deps-android-colors-cold.log`. UIKit's individual translucent separator/fill/modifier values additionally have actual NativeWind CSSInterop compilation/resolver coverage in `scripts/uikit-colors.test.ts`, including light/dark RGBA values; screenshots complement those numeric assertions rather than replacing them. After independent review, the dedicated emulator was shut down; the user's AVD and physical device were untouched.
Android attestation against Firebase, push delivery, Play billing and external feed media remain outside this local isolated run. The Android native modules compile and initialize, and the real app exercises the local API/auth/session/database/reader/subscription paths. iOS StoreKit verification is recorded separately by its test owner.
---
### Dependency Upgrade Animation 2026 09 22 (`docs/dependency-upgrade-animation-2026-09-22.md`)
# Native animation dependency review โ 2026-09-22
## Reviewed versions and evidence
| Package | Upgrade | Official release / changelog | Git diff |
| ---------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| react-native-gesture-handler | 3.0.2 โ 3.3.0 | [3.1](https://github.com/software-mansion/react-native-gesture-handler/releases/tag/v3.1.0), [3.2](https://github.com/software-mansion/react-native-gesture-handler/releases/tag/v3.2.0), [3.2.1](https://github.com/software-mansion/react-native-gesture-handler/releases/tag/v3.2.1), [3.3](https://github.com/software-mansion/react-native-gesture-handler/releases/tag/v3.3.0) | [exact npm source refs](https://github.com/software-mansion/react-native-gesture-handler/compare/9b6257aa945a6015fd448b9ed12234e9c9909b3d...dfd7ff373491c998148b10a0f927a5d35b9f9ec2) |
| react-native-reanimated | 4.5.1 โ 4.7.0 | [4.5.2](https://github.com/software-mansion/react-native-reanimated/releases/tag/4.5.2), [4.5.3](https://github.com/software-mansion/react-native-reanimated/releases/tag/4.5.3), [4.6](https://github.com/software-mansion/react-native-reanimated/releases/tag/4.6.0), [4.7 changelog](https://github.com/software-mansion/react-native-reanimated/blob/d36edbce863e3bfa63bad010247d03c2d330a367/packages/react-native-reanimated/CHANGELOG.md) | [exact npm source refs](https://github.com/software-mansion/react-native-reanimated/compare/c51ebe4f3dbd8c8d2af931d79060811b46acba28...d36edbce863e3bfa63bad010247d03c2d330a367) |
| react-native-worklets | 0.10.2 โ 0.13.0 | [0.11](https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.11.0), [0.11.1โ.3](https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.11.3), [0.12](https://github.com/software-mansion/react-native-reanimated/releases/tag/worklets-0.12.0), [0.13 changelog](https://github.com/software-mansion/react-native-reanimated/blob/4a9824aae44159ac40c84c053067f14803259667/packages/react-native-worklets/CHANGELOG.md) | [exact npm source refs](https://github.com/software-mansion/react-native-reanimated/compare/3c04eb6d61ca4f43a10a5c04f127fa6f7a9de7ad...4a9824aae44159ac40c84c053067f14803259667) |
Read the listed release records and relevant source hunks from the complete compare diff (not the GitHub compare API's 300-file-capped list). Local evidence is retained under `/tmp/folo-mobile-review-20260922//`: source.diff, review-focus.diff, review-native.diff and release history. Review focuses on APIs and native execution paths used here; it is not a claim of reviewing every unrelated upstream example or generated test fixture.
## Compatibility and migration
[Official Reanimated compatibility](https://docs.swmansion.com/react-native-reanimated/docs/guides/compatibility/) and both packages' published `compatibility.json` list React Native 0.86 for Reanimated 4.7 and Worklets 0.13. Reanimated 4.7 requires Worklets 0.13, so update them together. Expo 57 / RN 0.86.3 stays unchanged. Gesture Handler's 3.3 source still carries the 3.2 compatibility row (RN 0.83โ0.87); this is stale version-label metadata, not an explicit 3.3 compatibility guarantee. Its native build source preserves AGP <=8 Kotlin fallback while supporting AGP9, and there is no observed RN0.86 removal. Native build/testing remains required to validate this inference. Existing Expo install exclusions already include all three.
Clear Metro's transformed-worklet cache and rebuild both native apps. A JS-only reload or an old Expo Go binary cannot validate the new native ABI. No app source change was required by the reviewed public APIs.
## Gesture Handler impact
Read `ReanimatedSwipeable.tsx`, legacy detector mount/event handling, Android `GestureHandlerOrchestrator.kt`, `RNGestureHandlerModule.kt`, iOS gesture/button component handling, and Gradle changes. Swipe callbacks now use stable wrappers and `scheduleOnRN`; pan/tap configurations remain stable across callback updates. Disabled or recycled buttons cancel correctly; scrolling cancels presses, keyboard dismissal avoids accidental presses, nested parent/child arbitration and detached-view final events are fixed. Worklets runtime binding now uses the Worklets module directly. Touchable owns its managed native handler rather than delegating through GestureDetector. Legacy `Gesture.Pan()` remains available; relations cannot mix legacy and new hook-based gestures.
Folo affected surfaces: SwipeableItem list actions, picture lightbox pan/pinch/double-tap, sheets, nested ScrollViews, keyboard-open forms and recycled list buttons. Check that swipes survive rerenders and fire actions once, scrolling never activates a pressed item, disabled buttons never submit, pinch/pan finish cleanly when views unmount, and sheet/content scrolling arbitrate correctly.
## Reanimated impact
Read native/web `useAnimatedRef`, `measure.native.ts`, common types, native mutables and fixed Synchronizable state, feature flags, `ReanimatedCommitHook.cpp`, and `ReanimatedModuleProxy.cpp`. UI-side refs changed from callable values to ShareableHost `.value`; exported `measure(ref)` performs the conversion and returns null for absent views. Public JS `.current` and public measure calls are still supported. Folo uses those public APIs in UserAvatar, EntryPictureItem, EntrySocialItem and NavigationHeader; no UI-side `animatedRef()` calls or renamed internal AnimatedRefOnJS types were found. Existing callers accept nullable dimensions.
The new light-tree layout proxy becomes default. Surface lifecycle registration/cleanup, z-index commits, stale transform restoration, exiting view ordering and layout animation retargeting change. Mutables always use fixed Synchronizable dirty flags; the old opt-out flag is removed. CSS callback delivery and native platform transitions are added, with platform transition flags off by default. Folo does not enable removed flags or shared-element transitions.
Verify avatar/image lightbox opening from correct bounds, offscreen/unmounted refs without crashes, list insertion/deletion/reorder transitions, sticky/navigation headers, player controls, loading animation, background/foreground restoration, and overlay z-order. The sheet-transitions patch only changes the provider wrapper/context and border radius; preserve it and verify open/close scale, drag threshold cancellation, corners and scrolling.
## Worklets impact
Read Babel closure/factory transforms, native and web scheduling, `WorkletRuntime.cpp`, Synchronizable atomic access and compatibility changes. Closure metadata becomes arrays and empty closures are omitted; Babel output/native runtime must match. Serializable handles and worklet context objects are removed. Folo/its sheet patch do not access `__closure`, `__init` or custom Serializable handles. `runOnUI` remains available through Reanimated; batching now serializes arguments separately. Hermes microtasks drain in native code and after individual frame callbacks. Runtime teardown aborts pending jobs under the runtime lock, fixing recreation races. Bundle networking moves to its own module; Folo does not opt into it. Existing sheet package code is transformed from ordinary worklet directives, not pinned precompiled closure metadata.
Verify UIโRN callbacks, consecutive measure/open operations, Promise/error handling, active animations during background/reload, and no native/JS version mismatch after rebuilding.
## Validation status
Source review approves trying the latest compatible set. Installation, typechecking, Metro export, native builds and device E2E are owned by the root/frontend agents and must be recorded separately. No native runtime success is claimed by this source review.
---
### Dependency Upgrade Css 2026 09 22 (`docs/dependency-upgrade-css-2026-09-22.md`)
# CSS and PWA dependency review โ 2026-09-22
| Dependency | Upgrade | Read change record and source | Application impact |
| -------------------------- | --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| lightningcss | 1.32.0 โ 1.33.0 | [Release](https://github.com/parcel-bundler/lightningcss/releases/tag/v1.33.0); [diff](https://github.com/parcel-bundler/lightningcss/compare/7f8a861bdee476fe90c89a8badeb3fd33a99c51a...1d680fa14e9a089c92dc0929f869d6757ae91c30) | Read selector, style-rule printer, relative color alpha, dimension/percentage printer, bundler, JS resolver declaration, and position-try changes. New highlight/search/scroll-navigation selectors and anchor-position rules; identical light/dark colors collapse; negative scientific dimensions keep the correct sign; nested unknown at-rules stay in their original style block. JS resolver additionally accepts external imports. Existing JS calls remain valid. SSR build and CSS rendering need validation. |
| cssnano | 8.0.2 โ 9.0.5 | [Package changelog](https://github.com/cssnano/cssnano/blob/c7f757ddce5f9517a9fe3b257f055620d22b73bd/packages/cssnano-preset-default/CHANGELOG.md); [diff](https://github.com/cssnano/cssnano/compare/185e1c790ac307a14f4385c506b2f2e0f4563c7e...c7f757ddce5f9517a9fe3b257f055620d22b73bd) | Read all intervening default-preset notes, core config loading, default preset, merge-rule conflict/hoisting, shorthand validation/fallback, selector folding, gradient stops, layer removal, charset/whitespace, and SVG encode/decode source. Native ESM requires Node ^22.22.3 / ^24.15.0 / >=26. Automatic config discovery is now cwd-only `.cssnanorc.json` or `cssnano.config.js`; unsupported preset shorthand/subpath imports removed. Repo invokes the default through PostCSS, with no separate cssnano config. Explicit `module.exports` export retains supported Node CJS interop. Production desktop/SSR CSS may change because minification better preserves logical/physical property conflicts, important flags, unsupported env/var fallbacks, cascade-layer order, gradient fixup, and encoded SVG contents. |
| @vite-pwa/assets-generator | 1.0.2 โ 2.0.0 | [1.0.3](https://github.com/vite-pwa/assets-generator/releases/tag/v1.0.3), [1.0.4](https://github.com/vite-pwa/assets-generator/releases/tag/v1.0.4), [2.0.0](https://github.com/vite-pwa/assets-generator/releases/tag/v2.0.0); [diff](https://github.com/vite-pwa/assets-generator/compare/5dc86fd5040f361a84856c3fec682347487d4e0d...50ac879774181792677c7d64ddbb6f513d76f9da) | Read entire runtime source diff and export/dependency changes. ESM-only, Node >=20.19; explicit public subpaths retained. Sharp updated, APIs gain explicit result types, CLI colors switch implementation. Adds iPhone 17/Air splash dimensions and custom device entries, ignoring unknown device names. Folo's TS configuration already uses ESM public `config` imports and no splash generation. Validate the custom orange background/padding, 64/192/512 transparent icons, 512 maskable, 180 Apple icon, and favicon generated in an isolated output directory. |
Complete upstream diffs and focused extracts are cached in `/tmp/folo-dependency-review-20260922/{lightningcss,cssnano,vite-pwa__assets-generator}/`. Node 24.15.0 used locally satisfies these requirements; CI uses current Node 22 or current LTS resolution, not an older fixed patch.
## Validation
Installed cssnano 9.0.5 and lightningcss 1.33.0 were exercised in Chromium using 14 fixture cases, both separately and together. Across 966 computed-property comparisons, all layout, typography, specificity, fallback, and pseudo-content results matched. Gradient direction/stop normalization, SVG serialization, and relative-alpha color representation produced different strings; screenshots of the complete 312 ร 1052 fixture frames showed at most 1/255 difference in any color channel. This explicitly allows the existing color quantization rather than claiming byte-identical CSS or pixels. Fixtures, original/minified CSS, computed results, and screenshots are in `/tmp/folo-css-e2e-20260922/`.
PWA generator 2.0.0 was invoked through the renderer's actual installed binary with a temporary copy of the real TS configuration and the script's `public/icon.svg` argument. It generated 64/192/512 transparent icons, the 512 maskable icon, 180 Apple icon, and 48 favicon. Dimensions and transparent/orange corners passed, HTML links and manifest entries were retained. Five images were pixel-identical to the 1.0.2 baseline after alpha compositing. The maskable image changed 1,001 pixels (0.38%), all on the one-pixel antialiased foreground boundary; foreground bounds stayed `(114, 130)โ(405, 407)`, and visual inspection retained the same logo and orange background. This is a renderer/sharp edge difference, not a geometry change. Evidence is in `/tmp/folo-pwa-e2e-20260922/`; no project assets were overwritten.
Landing's production CSS build exposed three invalid `file:disabled:*` selectors. Changing them to `disabled:file:*` restores valid disabled-input file-button styling, and the rebuilt CSS no longer emits those warnings. Landing typecheck and tests passed; its final build/browser results are recorded in the landing review. Frontend agent owns the desktop/SSR production builds. Local rendering validation used Node 26.9.0; the earlier compatibility audit used Node 24.15.0.
---
### Dependency Upgrade Dom 2026 09 22 (`docs/dependency-upgrade-dom-2026-09-22.md`)
# DOM dependency upgrade review โ 2026-09-22
Review is scoped to Folo consumers; upstream generated assets and unrelated tests are excluded.
| Package | Version | Upstream evidence | Impact and review |
| -------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `jsdom` | 29.1.1 โ 30.1.1 | [Releases](https://github.com/jsdom/jsdom/releases), [Git diff](https://github.com/jsdom/jsdom/compare/9b9ea7e10b7842cd38c61458a38774cc3b60c24c...0a117f4581b067800fdb3287e22e7cec82221a3c.diff) | Node minimum is now ^22.22.2 / ^24.15.0 / >=26. Reviewed release notes for 30.0.0 through 30.1.1 and the consumed API, Window, attributes, document parsing/serialization, Document/Element/Node/NodeIterator changes. Document implementation links replace DOMSymbolTree; query and named-property caches invalidate around adoption and mutations; window close preserves its document while cancelling work. Folo consumes this in Electron readability sanitization, so malformed HTML, SVG/MathML, iframe allowlisting and DOMPurify behavior need security regressions and real reader verification. Unused range/layout and upstream test fixtures were excluded from line-level review. |
| `happy-dom` | 20.10.6 โ 20.14.5 | [Releases](https://github.com/capricorn86/happy-dom/releases), [Git diff](https://github.com/capricorn86/happy-dom/compare/fed1de26802bd628f71e691158edf3faa70d52d4...0d4cdbe7442af49d16b49ddf1acf7cc9684ed318.diff) | Read all intervening release notes and the application-relevant runtime diff: CSS computed-style caching/invalidation, variable fallback resolution, property Proxy API, shorthand parsing, WAAPI/keyframe behavior, custom element identity/upgrades, mutation observers, CookieStore, HTML comments, selectors and CORS. CSS parser renames and type-only/formatting changes were mechanically normalized to expose semantic changes; generated Chromium property lists were not individually audited. This is a test environment dependency; animation/layout-sensitive tests must be paired with browser/Electron E2E because its behavior is not proof of browser fidelity. |
| `@types/jsdom` | 28.0.3 โ 30.0.0 | [Upstream version/dependency change](https://github.com/DefinitelyTyped/DefinitelyTyped/commit/307059ebbff2bcaf3920b699839d7ae0f49353f5) | Read this commit diff and compared published index.d.ts files: identical declarations. Changes align major version with jsdom and undici-types with v8. Typechecking validates the consumed constructor/window surface. DefinitelyTyped uses commit history rather than release notes. |
## Validation
Final validation passed: the sanitizer suite covers malformed and hostile HTML with the real DOM implementation (7 tests), and the complete frontend run passed 130 files / 688 tests with 2 pre-existing CLI skips and no unhandled errors. Typecheck passed 20/20 tasks. Real browser/Electron reader journeys and the packaged macOS runtime also passed; packaged jsdom parsing includes CSS and Unicode checks. See the [master acceptance and E2E evidence](dependency-upgrade-2026-09-22.md#validation-evidence), including `/tmp/folo-frontend-acceptance-test-final.log`, `/tmp/folo-frontend-acceptance-typecheck.log`, `/tmp/folo-pnpm12-e2e.log` and `/tmp/folo-pnpm12-packaged-runtime.log`. The retained TTS test teardown failure and its test-only cleanup fix are recorded there.
---
### Dependency Upgrade Http Yaml 2026 09 22 (`docs/dependency-upgrade-http-yaml-2026-09-22.md`)
# HTTP, YAML and Web Firebase dependency review
Reviewed official release notes and the actual upstream source changes below. Versions are exact direct-dependency pins. The cached evidence under `/tmp/folo-dependency-review-20260922` includes full upstream diffs; conclusions below describe the source paths read, rather than treating downloaded files as reviewed evidence.
## Axios 1.18.1 โ 1.20.0
- [Changelog](https://github.com/axios/axios/blob/v1.20.0/CHANGELOG.md), [1.20 release](https://github.com/axios/axios/releases/tag/v1.20.0), [source diff](https://github.com/axios/axios/compare/a209bfb1e5dcbce3cecbf4bd955339d006358887...84a9f3b9a4f3244b8c8e818f557d64c7b964fb25).
- Read Axios/InterceptorManager, dispatch/merge configuration, signal composition, URL combination, HTTP/fetch/XHR adapter and proxy-bypass changes. Config lookup now excludes prototype-inherited options; fetch options cannot replace protected request fields. Interceptor IDs remain monotonic when ejected; failed synchronous interceptors prevent dispatch. Already-aborted signals fail immediately, fetch `maxRedirects: 0` means manual redirects, progress flushes on completion, and status-zero XHR navigation aborts report `ECONNABORTED`. HTTP pooled-socket listeners and data-URL size limits are corrected. The form-data floor incorporates header-injection fixes.
- The only repository reference is the landing manifest; no application import was found. There is no Axios-backed product flow to invent a test for. Landing build remains the integration gate.
## Fastify 5.10.0 โ 5.12.5
- [Official releases](https://github.com/fastify/fastify/releases), [source diff](https://github.com/fastify/fastify/compare/c47975e8a4c0cb1cb066749b948c0e6e22c97663...ba235fdcd9a83a4c7ccf793f7b2596a8f65389b6).
- Read intervening 5.11/5.12 release notes and `fastify.js`, route, reply, handle-request, content-type parser, four-oh-four, validation and schema normalization diffs. Changes include QUERY method/body rules, lowercase route lookup, quoted content-type parameters, resetting global-regexp parser state, preserving async request context, correct reply header removal, and applying current not-found preHandlers to `callNotFound`. Shutdown closes idle connections without force-closing active ones. Schema handling now honors boolean false and recursively normalizes header schemas; async validator results no longer confuse user `{error,value}` objects with validation control objects. Falsy coerced root values are preserved.
- Folo SSR uses Fastify with middie and request-context in both Node and the Worker shim. Four real local HTTP tests cover the plugin combination, concurrent isolated context, HTML/content headers, delegated 404 hooks, quoted JSON content types and falsy payloads, plus the raw-body flows below. Parent task additionally validates actual SSR routes/build.
## js-yaml 5.2.1 โ 5.4.2
- [Changelog](https://github.com/nodeca/js-yaml/blob/494400bd45cad078123cfc057e674a9a0a8d9983/CHANGELOG.md), [source diff](https://github.com/nodeca/js-yaml/compare/ac16b42c46c11c5c7f66062bfc78b168b5f07ecd...494400bd45cad078123cfc057e674a9a0a8d9983).
- Read 5.2.2โ5.4.2 notes and loader/constructor, dumper/styler, timestamp, merge and defaults source. The new AST API is not used by Folo. Relevant fixes address nested-flow parse complexity, prototype fallback, alias/merge validation and expansion limits, years 0000โ0099, whitespace-only quoting, Unicode key lengths, per-document BOMs and block-scalar newline retention. `forceQuotes` only applies to strings. Merge syntax outside key position remains ordinary text.
- Consumers are Electron hot-update manifests and release YAML scripts; they use ordinary load/dump with `lineWidth: -1`, without custom tags or AST mutation. A manifest roundtrip test verifies nested file records, SHA512 strings, maximum safe size, quoted dates, Unicode multiline release notes and whitespace-only strings against the installed package. Actual update download/application remains the parent task's desktop gate.
## raw-body 3.0.2 โ 4.0.0
- [History](https://github.com/stream-utils/raw-body/blob/c3949f885af40733c680eb410b7d1f5aeddc2877/HISTORY.md), [source diff](https://github.com/stream-utils/raw-body/compare/4cf8e0a2591802e01f05f93e39a6a5b3610a183c...c3949f885af40733c680eb410b7d1f5aeddc2877).
- Read the 4.0 history, package exports/engines and TypeScript implementation of options, Node stream accumulation, decoder and completion cleanup. It is ESM-only and requires Node 22+. Buffer output remains the default. TextDecoder replaces iconv behavior, UTF-32 is absent, invalid limits throw, strings from pre-encoded streams are rejected, and premature stream closure settles as an aborted request. Length and limit enforcement happen during accumulation. Folo supplies neither an encoding nor a custom limit, so decoder changes do not affect signature bytes.
- `api/vercel_webhook.ts` imports the default function and computes HMAC over the Buffer. A real HTTP test invokes that actual handler with a dummy local secret and a staging event, splits multibyte UTF-8 across two-byte chunks, and verifies valid signatures return 200 while a changed signature returns 403. No Cloudflare call occurs. A second real socket test verifies interrupted bodies reject with `request.aborted` rather than hanging. Deployment must use Node 22+; local verification uses Node 26.
## Firebase Web 12.16.0 โ 12.19.0
- [Firebase changelog](https://github.com/firebase/firebase-js-sdk/blob/9045b759b70e9d19b8cf007d69d988893d845a1e/packages/firebase/CHANGELOG.md), [source diff](https://github.com/firebase/firebase-js-sdk/compare/51aca877ca4706229dc9e77b3ebf787c91c91078...9045b759b70e9d19b8cf007d69d988893d845a1e).
- Read aggregate release notes and app, messaging, installations, component and util changelog/source changes. The actual app API preserves same-config initialization and improves different-config duplicate-app diagnostics. Error-template interpolation in util switches from a regex to linear scanning to avoid pathological work; missing placeholders and fallback behavior remain explicit. Messaging token requests and service-worker listeners do not change in this range; its source edits are formatting/type organization, with inherited util/component updates.
- Desktop `push-notification.ts` uses only `firebase/app` and `firebase/messaging`. New AI/Gemini/Imagen, Firestore and App Check features are outside its import graph. Existing service-worker readiness, permission, token-registration and notification-navigation flows remain the meaningful browser checks. Successful real FCM delivery requires an authorized environment and is not claimed by the local library tests.
## Validation
- `pnpm --filter @follow/ssr exec vitest run --config vitest.config.ts src/lib/dependency-upgrade-http.integration.test.ts`: 4 tests passed; `/tmp/folo-http-integration-tests.log`.
- `pnpm --filter @follow/electron-main exec vitest run --config vitest.config.ts src/updater/dependency-upgrade-yaml.test.ts`: 1 test passed; `/tmp/folo-yaml-integration-tests.log`.
- SSR typecheck passed; `/tmp/folo-http-typecheck.log`. Mobile typecheck after Firebase/IAP migration also passed; `/tmp/folo-mobile-services-typecheck.log`.
- These are real installed-library/HTTP integration checks, not a substitute for parent-task browser, Electron or native simulator E2E results. No deployment, external webhook, production credentials or real purchase was used.
---
### Dependency Upgrade Icons Types 2026 09 22 (`docs/dependency-upgrade-icons-types-2026-09-22.md`)
# Icon data and declaration dependency review
## Verified versions and source provenance
| Package | Upgrade | Official history and exact source diff |
| --------------------------- | --------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `@iconify-json/logos` | 1.2.11 โ 1.2.14 | [Iconify history](https://github.com/iconify/icon-sets/commits/master/json/logos.json), [diff](https://github.com/iconify/icon-sets/compare/ce5cb24e37e76ad883223b45b790839d0a4195bf...239eabda7a46b12e7a4825e0e70f45ae57cb8d97) |
| `@iconify-json/lucide` | 1.2.116 โ 1.2.135 | [Iconify history](https://github.com/iconify/icon-sets/commits/master/json/lucide.json), [diff](https://github.com/iconify/icon-sets/compare/e24a0be5ffeed7a870ecd4d130811677af09b5ff...45c27a7be4b7760318a434387ab095ec8d22b179) |
| `@cloudflare/workers-types` | 5.20260708.1 โ 5.20260922.1 | [workerd releases](https://github.com/cloudflare/workerd/releases), [diff](https://github.com/cloudflare/workerd/compare/99057e45cb7152cc5efc59b8d2182386fe1e3eec...761847b67636b6eaed5e0860e98772f8443bed5e) |
| `@types/react` | 19.2.17 โ 19.2.18 | [upstream change](https://github.com/DefinitelyTyped/DefinitelyTyped/pull/75334), [diff](https://github.com/DefinitelyTyped/DefinitelyTyped/compare/fbbe9480f84cc20727e9ff9a7bba7a1cb66157a9...a414786ca9309a76c8a35fe249dab28668a69b79) |
| `@types/react-dom` | 19.2.3 โ 19.2.7 | [history](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/master/types/react-dom), [diff](https://github.com/DefinitelyTyped/DefinitelyTyped/compare/58c1a3a0f80ba685c43aec3606bfebf2faa97d67...8443606b19593c505271bda9ad1238e10a2ef78a) |
Iconify and DefinitelyTyped do not publish a conventional package changelog for these artifacts. Read their official commit histories/change descriptions instead, and examined package-scoped git diffs. Original npm gitHeads for the icon packages did not resolve in `iconify/icon-sets`; source commits were found by history and then independently verified by comparing every icon, alias and dimension with the old/new npm JSON. All four endpoints matched. For DefinitelyTyped, every published declaration matched the corresponding git tree: 13 React declaration files and 14 ReactDOM declaration files, at both endpoints. No guessed version tag or broken compare URL is used as evidence.
Cached raw source, histories, original npm artifacts and verification output are under `/tmp/folo-dependency-review-20260922/{iconify-json__logos,iconify-json__lucide,cloudflare__workers-types,types__react,types__react-dom}`.
## Impact assessment
**Logos:** 85 added icon bodies, 36 changed bodies, and two body-to-alias migrations (`apache` โ `apache-http`, `aurora` โ `apache-aurora`). Existing names remain resolvable. Geometry/brand updates include Google app logos and several vendor marks; older Google designs gain explicit 2020 names. Folo's four source-referenced logos are `youtube-icon`, `google-icon`, `telegram`, and `spotify-icon`, all unchanged in this range.
**Lucide:** 123 added bodies, 108 changed bodies, and three body-to-alias migrations (`building-2`, `history`, `trash-2`). Additions cover device, infrastructure, music, payment and household symbols; revisions update existing path geometry. Folo's two references in landing SocialProof, `heart` and `arrow-up-right`, retain identical data. Both icon packages contain data, not executable implementation. Read the git data changes for identifiers, aliases and dimensions, and checked the entire actual consumer set against old/new bodies. Unused new artwork does not introduce a product interaction requiring an invented E2E flow.
**Workers types:** read the declaration source changes and generated public-surface delta, plus relevant official workerd release entries. R2 put overload edits are formatting only; KV signatures remain unchanged. Additions include Node globals, `ExecutionContext.abort`, performance entries/observers, tracing spans, Analytics SQL, Browser Run metadata/accessibility/session APIs, dynamic Hyperdrive, Images signed URLs/direct upload/text rasterization and Workflow subscriptions/location hints. Corrections include nullable Node server address, discriminated Workflow retry callback/rollback types, optional container snapshot options and trace-log truncation/error metadata. OTA consumes KV, R2, fetch/stream/response and scheduled execution types, not those newly added services. This package is declaration-only: updating it does not deploy a newer workerd runtime or change compatibility flags.
**React types:** `Usable` gains a renderer-augmentation registry; existing promise/context uses remain valid. ReactDOM canary `browser()` uses this hook. Staying on 19.2 matches the React Native renderer constraint; latest 19.3 declarations are intentionally excluded.
**ReactDOM types:** corrected SSR options rename `headersLengthHint` to `maxHeadersLength`, give Node pipeable `onHeaders` a `HeadersDescriptor` instead of browser `Headers`, and allow separate script/style nonces. Node resume options now include appropriate shell callbacks rather than a browser abort signal. Browser/Bun/Node exports gain missing resume/version declarations. Canary-only additions include `browser(reason)` and `onBrowserBailout`; test-only form-event and transition coverage also changed. Repository searches found no use of the removed/misdeclared SSR options. Existing render/hydrate signatures remain applicable.
## Verification
Used the actual installed Iconify `getIconData` and `iconToSVG` against the proposed new JSON, resolving all six project references and all five migrated aliases; all eleven produced non-empty SVG bodies and valid view boxes. Source comparison establishes that the six currently rendered icons are unchanged. Parent-task landing/desktop build and UI E2E verify extraction and rendering in the complete application.
Declaration upgrades require the final frontend/OTA/mobile typecheck and build after installation. They contain no runtime code to test in isolation. Installation was deliberately left to the coordinating agent to avoid interrupting the native build; this report does not claim an unrun final typecheck.
---
### Dependency Upgrade Ios 2026 09 22 (`docs/dependency-upgrade-ios-2026-09-22.md`)
# iOS dependency-upgrade verification โ 2026-09-22
## Environment and final artifact
All ordinary-app interactions targeted the dedicated `Folo Deps E2E 20260922` simulator (`0BF02D72-E6DE-43C6-9BE8-7489FD951BD9`, iOS 26.5). No other simulator or user installation was reset. API requests used the isolated local service at `http://localhost:3000`; no production account or data was involved.
The final ordinary Release simulator app is `/tmp/folo-deps-ios-ordinary-build/Build/Products/Release-iphonesimulator/Folo.app`, bundle `is.follow`, version 0.5.9 (12). It uses independent DerivedData so the separate IAP artifact is not overwritten. It was built with `PROFILE=e2e-ios-simulator`, `EXPO_PUBLIC_E2E_ENV_PROFILE=local`, `EXPO_PUBLIC_E2E_LANGUAGE=en`, `ONLY_ACTIVE_ARCH=YES`, `ARCHS=arm64`, and `CODE_SIGNING_ALLOWED=NO`. Xcode build passed; `/tmp/folo-deps-ios-ordinary-final-build.log` contains the final build result. `EXPO_PUBLIC_E2E_IAP_NATIVE` is unset, `STOREKIT_TESTING` is not defined, and `otool -L` confirms no StoreKitTest framework linkage. The obsolete `/tmp/folo-deps-ios-final-ordinary.app` copy was removed after being superseded.
Installed versions include Expo 57.0.24, React 19.2.8, React Native 0.86.3, Gesture Handler 3.3.0, Reanimated 4.7.0, Worklets 0.13.0, Screens 4.28.0, and Keyboard Controller 1.22.5. Compatibility/change reviews are in the mobile and animation reports.
The final app includes keyboard dismissal, Discover URL preservation, sanitized FollowUrl errors, UIKit alpha compatibility, immutable migration snapshots, native-root readiness gating, and the onboarding Markdown renderer. Its `rn-web/html-renderer/assets/index-DZ2Ze5om.js` exactly matches `out/rn-web` by SHA-256 (`4a9633218ea0898d0c474a7b2fb55071c5b6feced0b752a2582720238ccb6a98`); its stylesheet is `index-DmJdjm9r.css`. All temporary lifecycle-diagnostic code was removed before this build, and its three diagnostic markers are absent from the actual Hermes bundle.
## Runner correction
The documented full iOS command previously executed only `auth.yaml`. `e2e/run-maestro.sh` now executes `auth.yaml` followed by `content.yaml` against the same signed-in app, stops on a failure, and writes separate `auth/junit.xml` and `content/junit.xml` reports alongside independent debug folders. Shell syntax and `git diff --check` passed. The README describes these outputs.
## Earlier diagnostic run
Before the last keyboard/search/error-display refinements, the clean simulator passed the authentication journey (3m 58s) and content journey (3m 1s). Authentication covered real registration, sign-out confirmation, and email sign-in. AXe independently confirmed the signed-in home screen and three onboarding articles. Content covered discover/follow, subscriptions, article/video tabs, article navigation/back, long-press read/unread mutations, and unsubscribe. A separate local API read confirmed the test account's subscriptions changed from one onboarding feed to zero. Profile modal presentation, interactive swipe dismissal, and subsequent Settings โ General navigation also worked.
These results motivated repeating both journeys on the final artifact rather than treating the earlier binary as the final verification.
## Earlier full-run checkpoint
The corrected `pnpm run e2e:ios` completed with exit 0 on the earlier Release artifact and a fresh local account. Authentication passed in **4m 41s** and content passed in **2m 56s**. The independent reports are `/tmp/folo-deps-maestro-ios/final-full/auth/junit.xml` and `/tmp/folo-deps-maestro-ios/final-full/content/junit.xml`; command output is `/tmp/folo-deps-ios-final-full.log`.
AXe independently captured the actual article screen during the content flow. `/tmp/folo-ios-final-entry-auto.png` shows the title, feed attribution, AI summary, article image, and body text inside the upgraded WebView/HTML renderer. It also exposed literal Markdown markers in the onboarding content. The Android review confirmed that desktop parses this same fixture as Markdown, so mobile requires an additional renderer correction and visual recheck; that follow-up is recorded below.
After both flows completed, the profile modal opened from the home avatar, dismissed with an interactive downward swipe, and Settings โ General still accepted taps. The settled accessibility snapshot `/tmp/folo-ios-final-general-after-modal-settled.json` contains the General heading, navigation back control, and AI Summary switch. The app was then terminated and launched again without clearing its data; `/tmp/folo-ios-final-cold-start.png` shows the signed-in home screen and the three onboarding entries, confirming persisted-session recovery.
## Local native IAP follow-up
The ordinary Release artifact above did not define `STOREKIT_TESTING`. Therefore its local helper shortcut is not evidence for the upgraded `expo-iap` purchase callback. A separate explicitly flagged build was used for this additional check; its completed results are recorded separately below.
### StoreKit fixture and simulator diagnosis
The native purchase check uses a separate task-created iOS 18.5 simulator (`FAD6D669-EC1D-4C69-A997-8CFA51FD7FFE`), a dedicated local account, the isolated API, and a Release app with `EXPO_PUBLIC_E2E_IAP_NATIVE=1` and `STOREKIT_TESTING`. The ordinary app does not enable this path. A temporary workspace/scheme under `/tmp/folo-iap-xcode` activates the local StoreKit configuration before launching the compiled app; the repository Xcode project and normal scheme are unchanged. No Apple account was entered and no real purchase was made. Product discovery may consult the store catalog before the local readiness check, so this result does not claim that all Apple network activity was absent.
The first iOS 26.5 (23F77) attempt failed to save a StoreKit test configuration (code 3), consistent with the [Apple developer-forum report](https://developer.apple.com/forums/thread/826971). Moving to 18.5 alone was insufficient: the repository's test fixture still produced an empty product catalog. An independent UIKit + StoreKitTest app isolated the fixture from Expo, React Native and `expo-iap`:
| Controlled configuration | Actual native result |
| ------------------------------------------------------------------- | ----------------------------------------------------------------- |
| One local non-consumable readiness product | 1 product |
| Full original Folo fixture plus that same product | 0 products |
| Same fixture with subscription groups removed | 1 product |
| Add subscription group references and correct free-trial mode only | 0 products |
| Also restore group localizations and subscription code-offer arrays | 8 products (the probe, preview product and all six subscriptions) |
Both repository `.storekit` resources now include `subscriptionGroupID`, group `localizations: []`, per-subscription `codeOffers: []`, and `introductoryOffer.paymentMode: "free"`. These match the [Apple Backyard Birds reference configuration](https://github.com/apple/sample-backyard-birds/blob/f955a1f0f7136c38cc016cbfcd1ad85e89c596c5/Misc/Store.storekit). The grouped experiment establishes the broken fixture and repaired result; it does not claim that every missing field was independently necessary. The native control then purchased both the non-consumable and Basic annual subscription with verified `Xcode` transactions using the exact same subscription/settings objects as Folo. No real App Store product configuration changed.
The simulator also exposed a second testing issue. After injecting `userCancelled`, `setSimulatedError(nil, forAPI: .purchase)` returned successfully and the native getter returned `nil`, but the next independent `Product.purchase()` still failed with `StoreKitError.unknown`. This reproduces without JavaScript or Expo. Resetting test settings, re-enabling disabled dialogs and retaining existing transactions restored the next native purchase. The test-only helper now follows that sequence, checks the cleared error and the unique local product again, and logs `purchase-error-cleared`. A subsequent JS purchase awaits the same recovery promise; recovery failure remains closed instead of falling through to the real store. Apple documents the normal nil-clearing contract in [WWDC23: What's new in StoreKit 2](https://developer.apple.com/videos/play/wwdc2023/10140/); the additional reset is justified by the observed 18.5 behavior.
Raw control evidence is in `/tmp/folo-storekit-probe/{purchase-events,cancel-events,cancel-reset-events,fixed-catalog-events}.log`, with the corresponding standalone source/configuration variants retained in that directory. The final flagged Folo build passed in `/tmp/folo-deps-ios-iap-build-final.log` and contains the final root presentation gate, UIKit variables, migration snapshots and `index-DZ2Ze5om.js` renderer. Mobile provider typecheck and targeted lint passed.
## Final ordinary app and startup ordering regression
The first clean launch of the final dependency set failed the automatic login assertion after 30 seconds: `/tmp/folo-deps-ios-ordinary-complete.log` and `/tmp/folo-deps-ios-ordinary-auth-failure.png`. The backend returned an anonymous session correctly, and tapping the Articles/Videos selector changed the actual screen, ruling out a blanket touch-interception failure. Temporary local-only lifecycle instrumentation then recorded the Login route entering the navigation atom **206 ms before** the native root's `onAppear`. No modal component render followed; tapping the avatar again found the same Login route already at the top of the stack. This demonstrates a startup ordering/render failure, rather than proving that UIKit discarded an already-rendered modal.
Extended the existing Android root-readiness gate to iOS: routes remain in the atom while `ScreenItemsMapper` waits for the root native `onAppear`. Existing focus and lifecycle callbacks remain composed. The controlled second run recorded root appearance, root rerender and Login modal render in order, followed by Login's own native appearance. Its screenshot is `/tmp/folo-deps-ios-ordinary-gate-fixed.png`, and the safe event-only trace is `/tmp/folo-deps-ios-root-gate-events.log`. All temporary HTTP diagnostics were then removed and the Release app rebuilt. This application startup race became reproducible with the final initialization timing; it is not attributed to a proven upstream UIKit defect.
The final uninstrumented app passed the complete fresh-account sequence with no manual recovery: **authentication 2m 41s, content 3m 8s**. This covers initial automatic login, real registration, logout/JS reload and automatic login presentation, password login, unfollow/discover/follow, subscription display, a **single ordinary article tap with no retry option**, actual body paragraph and Markdown heading assertions, native long-press read/unread actions, and final unsubscribe. Evidence is `/tmp/folo-deps-ios-ordinary-final.log` and `/tmp/folo-deps-maestro-ios/ordinary-final/{auth,content}/junit.xml`, both with zero failures.
Mobile typecheck passed (`/tmp/folo-deps-ios-root-gate-typecheck.log`); targeted lint has zero errors and four pre-existing warnings (`/tmp/folo-deps-ios-root-gate-lint.log`). Formatting, YAML syntax and `git diff --check` passed.
The additional AXe pass terminated the process and opened `folo://add?url=folo%3A%2F%2Fonboarding&type=url` through the actual iOS URL-confirmation prompt. The restored session reached the real Follow form with no login screen or migration stall, and saving it returned to the timeline. Evidence: `/tmp/folo-deps-ios-ordinary-cold-deeplink-ready.json` and `.png`. The article then opened with one AXe tap; `/tmp/folo-deps-ios-ordinary-reader.png` shows parsed **Timeline** emphasis and the **Your Timeline** heading instead of raw Markdown punctuation.
Stable Settings and Appearance screens were inspected in both system themes: `/tmp/folo-deps-ios-ordinary-settings-light.png`, `/tmp/folo-deps-ios-ordinary-settings-dark.png`, `/tmp/folo-deps-ios-ordinary-appearance-light.png`, and `/tmp/folo-deps-ios-ordinary-appearance-dark.png`. User name/Edit, icons, secondary text, fills and separators remain visible, complementing the actual CSSInterop numeric alpha tests. A separate existing status-bar limitation remains: dark status-bar text can have poor contrast against the Settings gradient and the dark Appearance background. This is not counted as a passing contrast check or attributed to the UIKit alpha compatibility fix.
Finally opened the Profile modal from the home avatar, dismissed it with a real downward swipe, then navigated Settings โ General. The settled accessibility tree contains the General heading and AI Summary switch, and `/tmp/folo-deps-ios-ordinary-general-after-modal.png` records the responsive screen. The dedicated iOS 26.5 simulator was then shut down after restoring light appearance. No user simulator, production account or production service was altered. The final app remains at the independent DerivedData path above; logs and screenshots are retained.
### Final native IAP result
The final app exercised the actual `expo-iap` `requestPurchase` / `useIAP` callbacks; the local `buyProduct` shortcut was bypassed. All times below are 2026-09-22 UTC+8, from the narrowly filtered `/tmp/folo-ios-iap18-final-events.log`:
| Time | Observed result |
| -------- | ------------------------------------------------------------------------------------------------ |
| 16:00:38 | Unique local probe visible, dialogs disabled, session ready |
| 16:01:27 | All six local subscription products loaded |
| 16:04:14 | First actual request returned `user-cancelled`; loading cleared and native recovery completed |
| 16:04:38 | Retried request โ `purchase-success` โ `server-verified` โ `transaction-finished` |
| 16:06:20 | Restore request โ `restore-purchases` โ `server-verified`; UI displayed โSubscription restored.โ |
The local API changed from no billing subscription to `source=apple`, `plan=basic`, `status=active`, `productId=is.follow.basic.yearly`, `periodEnd=2027-09-22T08:04:38.273Z`, and `canManage=true`. The same API fields remained unchanged after restore. Independent, read-only database checks before and after restore confirmed `environment=Xcode`, current entitlement, the expected account owner and exactly one matching row. Their safe projections were byte-identical: `/tmp/folo-deps-iap-db-verification.txt` and `/tmp/folo-deps-iap-db-restored-verification.txt`. Neither file includes signed transactions, account tokens or personal data. Purchase and restore screenshots are `/tmp/folo-ios-iap18-final-purchased.png` and `/tmp/folo-ios-iap18-final-restored.png`.
Server verification used the real Apple SDK and the existing local environment support. Review found that its Xcode/LocalTesting decoder skips signature verification; the backend now excludes both environments in production. Real-SDK regression tests reject forged Xcode and LocalTesting transactions in production while retaining the local Xcode test path. The local purchase check therefore did not require weakening production verification or adding Apple server credentials.
This establishes the local purchase, cancellation recovery, explicit transaction finishing and restore paths. Real Apple sandbox/production account authentication, payments, external notifications, subscription renewal delivery and production rollout remain outside this local test. The dedicated 18.5 app and temporary Xcode workspace were stopped after verification; its simulator was shut down. The test app, narrowly filtered event logs, screenshots and standalone diagnostic sources are retained. After both native checks completed, the task-created DerivedData intermediates and compiler caches were removed to recover disk space. Both final `.app` bundles, build logs, screenshots and standalone control evidence were preserved.
---
### Dependency Upgrade Landing 2026 09 22 (`docs/dependency-upgrade-landing-2026-09-22.md`)
# Landing dependency review โ 2026-09-22
## vinext 1.0.0-beta.0 โ 1.0.0-beta.11
Read all eleven intervening [official releases](https://github.com/cloudflare/vinext/releases) and the application-consumed changes in the [upstream diff](https://github.com/cloudflare/vinext/compare/4fad98a20e226e2031faaa6a6b7fa4cdd0065510...468f72eaba537718217b63c5b495cf5d181da4e0). Local evidence: `/tmp/folo-dependency-review-20260922/vinext/` (`review-releases.md`, complete `source.diff`, and focused source extracts). This is a scoped review of the App Router and Worker paths used by landing, not a claim that every upstream Pages Router or generated declaration change was read.
- **Configuration and build identity:** explicit Vite aliases now precede inferred tsconfig/shim entries and are copied without mutating the object retained for server restart. This directly affects landing's `next-intl/config` alias. React is deduplicated in all environments. New compiler opt-in and multi-stage Worker/CDN options are not enabled by this update. Import-meta transforms distinguish project sources from bundled dependencies and use emitted identities, avoiding build-host paths and unnecessary Worker `process.cwd()` access. Vite worker bundles receive their own image-import plugin.
- **Routing and middleware:** read `middleware-matcher-pattern`, `middleware-runtime`, `app-rsc-handler`, and request/redirect normalization changes. Matcher configuration is validated; patterns that can cause excessive backtracking are rejected. Landing's ordinary `/:path*` remains supported. Matching tries encoded then once-decoded paths; userland middleware receives the original encoded path with `.rsc` and transport `_rsc` normalization kept separate. Internal locale rewrites retain query values. Middleware-eligible single-stage requests now remain private rather than allowing a CDN hit to bypass middleware. Interception-selector validation and source authorization are stricter; landing does not use intercepted/parallel routes.
- **Request state:** `headers` and cookie shims keep speculative dynamic-usage probes in child async scopes and propagate dynamic classification without contaminating siblings. Middleware cookie overlays remain visible to `cookies()` separately from raw request `headers()`. Cookie mutations synchronize at actionโrender phase; SameSite/partitioned/priority metadata is normalized and emitted. Landing's download page reads request headers; no application server actions or direct cookie mutation were found.
- **SSR and metadata:** read `app-ssr-entry`, `app-ssr-stream`, `app-page-stream`, metadata resolver/rendering, and metadata-route response changes. Dynamic SSR yields one React task before the first HTML pull; completion and metadata readiness are tracked separately. Flight byte chunks are preserved without broad string replacement and can be mirrored into the Next transport. `generateMetadata`/`generateViewport` receive parent metadata; viewport-fit and theme-color normalization are supported. Streamed icons carry stable ownership/order markers. Metadata endpoints honor cacheability, avoid caching explicit no-store, and support generated sitemap identities. These paths affect every localized layout, title/description/OG tags, favicon, viewport, and robots output.
- **Fonts:** Google/local font state is shared across module instances using global symbols, local font identifiers derive from the actual declaration, and preload URLs match hashed font sources. Landing uses Geist through `next/font/google`; check CSS, preload delivery, and no hydration differences.
- **Browser navigation:** read navigation runtime/shim and bootstrap/history/hydration changes. Raw query spelling is preserved independently of URLSearchParams serialization; static HTML may hydrate search parameters from the browser. Prefetch freshness is checked on lookup, server/config stale bounds are combined, a navigation promotes its queued prefetch, superseded setup is cancelled, and history snapshots preserve the appropriate tree. Fragment scrolling defers to the next frame. Initial hydration seeds visited history rather than preventing a subsequent Link prefetch. Test localized links, query/hash, back/forward, and quick navigation after hydration.
- **Worker entry:** read `app-router-entry` and image optimization diff. Instrumentation and cache/image adapters initialize before user rendering; trusted prerender state comes from platform context and external internal headers are filtered. Asset subrequests preserve original request semantics. The only image-size default change removes width 16. Landing's custom Worker previously forwarded only `request`; it now forwards `env` and `ctx` to retain ASSETS access and waitUntil/revalidation lifecycle. No deployment occurred.
## Validation
Installed vinext beta.11 with Vite 8.3.0, Cloudflare Vite plugin 1.57.1, RSC plugin 0.5.35, and next-intl 4.14.6. `pnpm --filter @follow/landing build`, `typecheck`, and `test` passed; the test run contains 9 passing tests across 4 files. Targeted ESLint of every changed landing source and test also passed. The production build generated the Worker and standalone outputs. Existing partial-webpack-support and large-chunk/plugin-time warnings remain; the invalid file-input pseudo-selector warnings were fixed as described in the CSS review.
The emitted Worker ran through the Cloudflare Vite preview at `127.0.0.1:4399`, rather than a development server. Actual HTTP checks covered all three locale home pages (200), English/Chinese pricing (200), Japanese/English download (200), privacy policy (200), robots (200/plain text), both AASA paths (200/JSON/cache 300), an unknown route (404), and the custom image endpoint. Width 128 returned JPEG with immutable caching; removed width 16 correctly returned 400. Final results are in `/tmp/folo-landing-http-final.json`; server/build/check logs use `/tmp/folo-landing-*.log`.
Browser checks used agent-browser with installed system Chrome, not Playwright's bundled browser. Verified:
- Hydrated Human/Agent tabs switch both ways and render the agent skill link; fallback feed cards render the expected titles. Geist fonts load and the page has the expected title, description, canonical, viewport-fit, and light/dark theme metadata.
- Header navigation reaches pricing/download; monthly and annual billing display their respective prices. Back/forward restore the previous page and the exact `dep=a%20b+z` query spelling. The Built Open fragment link reaches `/#open` and brings the section into view.
- Chinese links retain `/zh`, Japanese download content and `html` language render, and macOS request headers choose the macOS download group. Expanding other downloads exposes iOS, Android, Windows, and Linux with the expected destinations. No installers or external account actions were triggered.
- The 375 ร 812 Chinese download layout and 1440 ร 1000 desktop layout were visually inspected. Browser page-error collection was empty after these interactions. Screenshots include `/tmp/folo-landing-zh-mobile.png`, `/tmp/folo-landing-downloads.png`, and `/tmp/folo-landing-home-final.png`.
The production-like run exposed an existing unbounded upstream wait in landing's own data fetches. The homepage stalled when public API requests did not respond, and the discover-sources route had the same issue. Both now abort requests after 5 seconds and use their existing fallback data. New behavior tests cover stalled hero/metrics requests, successful response timer cleanup, discover fallback/retry/cache headers, and successful discover caching. On the rebuilt Worker the locale home pages returned in 7โ9 seconds including rendering, and discover returned 24 fallback entries in 6 seconds with `max-age=60`. These are observed end-to-end durations, not a claim that a 5-second fetch deadline bounds total rendering to exactly 5 seconds. Successful public production API freshness was not verified; the local checks exercised the fallback path.
No Cloudflare deployment was performed. The existing `cf:deploy` scripts invoke `vinext deploy`, which already reported removal in the old beta.0 CLI as well as beta.11; repository workflow search found no callers. This pre-existing publishing-script limitation was recorded rather than introducing an unaudited deployment package. Local production Worker build and execution passed, but they are not evidence of a deployment.
---
### Dependency Upgrade Mobile 2026 09 22 (`docs/dependency-upgrade-mobile-2026-09-22.md`)
# Mobile dependency review โ 2026-09-22
Scope: direct mobile dependency changes reviewed against their actual published Git refs. Large monorepo comparisons were narrowed to the package and hand-written runtime/native/build code; generated bundles, lockfiles, example applications and unrelated experimental APIs are not represented as line-by-line product review. Each source below was read, not only downloaded. Formal changelogs are used where supplied; missing ones are explicitly identified and release-commit history substitutes are linked.
## Dependency evidence and impact
| Dependency | Before โ after | Upstream evidence | Changes and regression surface |
| -------------------------------------- | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `@expo/metro-runtime` | 57.0.3 โ 57.0.16 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/@expo/metro-runtime/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Reviewed runtime patch set and Expo monorepo changes: development loading/error integration and runtime alignment. Check Metro bundle/load and release startup. |
| `@react-native-community/image-editor` | 4.3.0 โ 4.3.1 | [History](https://github.com/callstack/react-native-image-editor/releases); [Git diff](https://github.com/callstack/react-native-image-editor/compare/8fec8293c6961f737e10f9c111d0bb18f7eee1d3...40c6da3be1d339af4cfffc7648c3302287832cb1.diff) | AGP 9 conditionally applies Kotlin plugin; image editing implementation unchanged. Check native compilation and crop flow. |
| `babel-preset-expo` | 57.0.2 โ 57.0.12 | [History](https://raw.githubusercontent.com/expo/expo/f6f5af06b95cb7d511b52641885b2fb5adad525d/packages/babel-preset-expo/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/6ffed84381e2d2bb80c2fc713d99724f707d6c06...f6f5af06b95cb7d511b52641885b2fb5adad525d.diff) | Hermes v1 object-rest/destructuring transform ordering, decorators and lazy classes change. Check release Metro compilation and runtime execution. |
| `expo` | 57.0.4 โ 57.0.24 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/b31bd70c8873eee2894bc5cc3b3460abca0cdea0...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Native URLSession callbacks are serialized; empty responses, aborts and stream chunk races are corrected. UTF-8 TextDecoder now carries partial sequences/BOM state; Blob bridges RN data. DOM webview resends props on DOM-ready; dynamic imports return promises; JSI scheduler uses weak lifetimes; optional Scene support and bundle URL handling change. Check article webview, streaming, images, reload and deep links. |
| `expo-apple-authentication` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-apple-authentication/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-application` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-application/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Adds opt-in provisioning profile expiration query, unused by Folo; build/SPM alignment. Check native startup. |
| `expo-background-task` | 57.0.2 โ 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-background-task/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-blur` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-blur/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Corrects Android view-order lookup, relevant to overlay/gesture hierarchy. Check blurred modal and interactions. |
| `expo-build-properties` | 57.0.3 โ 57.0.21 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-build-properties/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Optional Scene configuration and Expo native build-property alignment. Folo does not opt into Scene changes. Check generated native configuration and builds. |
| `expo-clipboard` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-clipboard/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-constants` | 57.0.3 โ 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-constants/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-dev-client` | 57.0.5 โ 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-dev-client/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-device` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-device/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-document-picker` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-document-picker/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-file-system` | 57.0.0 โ 57.0.7 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-file-system/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Android SAF cached lengths/rename and legacy UTF-8 range reads; iOS read permissions and edited iCloud PHAsset resource resolution. Check downloaded/exported media and file imports. |
| `expo-glass-effect` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-glass-effect/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Tint color accepts ColorValue; OS capability helper updates. Check native control color/appearance. |
| `expo-haptics` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-haptics/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Android feedback is dispatched on the main queue. Check actions that emit haptics. |
| `expo-image` | 57.0.0 โ 57.0.5 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-image/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Glide invalid cache entries are deleted before replacement; native imageLoaded listeners are gated. Optional Expo Observe emits sanitized URLs (credentials removed, queries off; personal-photo schemes excluded). Check image loading/cache and error fallbacks. |
| `expo-image-manipulator` | 57.0.2 โ 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-image-manipulator/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-image-picker` | 57.0.2 โ 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-image-picker/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | JPEG base64 consistency, nil crop failure rejection and video fast path authorization. Check image selection/cancel and avatars. |
| `expo-linear-gradient` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-linear-gradient/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-linking` | 57.0.2 โ 57.0.10 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-linking/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/6ffed84381e2d2bb80c2fc713d99724f707d6c06...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-localization` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-localization/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-media-library` | 57.0.1 โ 57.0.5 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-media-library/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Android swaps dimensions for 90/270-degree orientation, resolves missing dimensions and loops FileChannel transfer for large files; iOS permits iCloud network reads. Check saved images/video dimensions and gallery permission. |
| `expo-network` | 57.0.0 โ 57.0.2 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-network/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-notifications` | 57.0.3 โ 57.0.20 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-notifications/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Android guards OEM launch-intent failures; iOS token/delegate lifecycle uses synchronized registry snapshots and abort guards. Check launch/notification permission; remote delivery requires platform credentials/device and is recorded separately. |
| `expo-secure-store` | 57.0.0 โ 57.0.4 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-secure-store/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Deleting keys commits both legacy and current Android key entries and handles failures. Check sign-out/relaunch and auth persistence. |
| `expo-sharing` | 57.0.3 โ 57.0.21 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-sharing/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/6ffed84381e2d2bb80c2fc713d99724f707d6c06...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-splash-screen` | 57.0.2 โ 57.0.9 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-splash-screen/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-sqlite` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-sqlite/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | CREATE TABLE IF NOT EXISTS is moved outside the version guard to fix first sync/async initialization races; schema unchanged. Check SQLite auth fallback across restart and account switch. |
| `expo-status-bar` | 57.0.0 โ 57.0.1 | [History](https://raw.githubusercontent.com/expo/expo/b9503d06b8e130abfca1bc16f671dbefb41ad709/packages/expo-status-bar/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...b9503d06b8e130abfca1bc16f671dbefb41ad709.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-store-review` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-store-review/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Uses foreground scene lookup. Store review prompts remain platform-controlled. |
| `expo-symbols` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-symbols/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Fallback symbol styling corrected. Check native symbols in both themes. |
| `expo-system-ui` | 57.0.0 โ 57.0.4 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-system-ui/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Reviewed version range: native/SPM minimum iOS 16.4, paired Expo internal dependency and build fixes; Folo already targets iOS 16.4. No new application API migration. Check native compilation, fresh launch and the corresponding device/share/link/appearance operation. |
| `expo-task-manager` | 57.0.2 โ 57.0.19 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-task-manager/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Task callbacks and one-shot reentrancy/cleanup are corrected. Check background task registration/lifecycle. |
| `expo-updates` | 57.0.6 โ 57.0.23 | [History](https://raw.githubusercontent.com/expo/expo/7687b07947a5c866adeb11abbceae72403ccb188/packages/expo-updates/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/5104cb89c3938bc9653e0cbad43da3a43a2e77a7...7687b07947a5c866adeb11abbceae72403ccb188.diff) | Rejects unsafe asset names including slash Unicode forms before filesystem writes/deletes; repairs/skips incomplete launch records; Android atomic embedded registration and correct one-day retention. iOS embedded assets avoid initial copies and support diff bases; scale-index hashes and UTF-8 logging fixed. pending state clears if no new update. Check fresh offline launch, local update bundle/export and reload; signed production delivery is not exercised. |
| `expo-video` | 57.0.0 โ 57.0.4 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-video/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Stable iOS object-id locking, idempotent main-thread release/cancellation and Android app-context fallback. Check play/pause, route dismissal and repeated player mount. |
| `expo-web-browser` | 57.0.0 โ 57.0.3 | [History](https://raw.githubusercontent.com/expo/expo/9e5319c0f821a27b7924841903abae50e2b41790/packages/expo-web-browser/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...9e5319c0f821a27b7924841903abae50e2b41790.diff) | Rejects when ASWebAuthenticationSession cannot start instead of hanging. Check open/cancel and deep-link auth callback; external identity providers require separate credentials. |
| `nativewind` | 4.2.6 โ 4.2.7 | [History](https://raw.githubusercontent.com/nativewind/nativewind/35e054a9f328b7dee995a8e7f54456c7cfe7911c/packages/nativewind/CHANGELOG.md); [Git diff](https://github.com/nativewind/nativewind/compare/d5cfd40f52354e71423ff5ba743d2591c47d2757...35e054a9f328b7dee995a8e7f54456c7cfe7911c.diff) | Paired with css-interop 0.2.7: stable animated interop avoids hook-order changes, unspecified Appearance fallback and box-shadow fallthrough; supports Reanimated 3/4 Babel plugins. Keep Tailwind 3 on mobile. Check themes, conditional animated styles and release transform. |
| `react-native-edge-to-edge` | 1.8.1 โ 1.8.2 | [History](https://github.com/zoontek/react-native-edge-to-edge/releases); [Git diff](https://github.com/zoontek/react-native-edge-to-edge/compare/592579d27f49aa499ce6443cf08bb3ab73f39f64...72b27014ddce5b1c53c694da206203416789a210.diff) | AGP 9 support, splits isEdgeToEdge property/library helpers. Check Android system-bar and keyboard insets. |
| `react-native-css-interop` | 0.2.6 โ 0.2.7 | [History](https://raw.githubusercontent.com/nativewind/nativewind/35e054a9f328b7dee995a8e7f54456c7cfe7911c/packages/react-native-css-interop/CHANGELOG.md); [Git diff](https://github.com/nativewind/nativewind/compare/d5cfd40f52354e71423ff5ba743d2591c47d2757...35e054a9f328b7dee995a8e7f54456c7cfe7911c.diff) | Stable animated interop fixes conditional hooks; unspecified Appearance falls back and box-shadow style fallthrough corrected; Reanimated Babel compatibility. Check theme changes and animated styles. |
| `react-native` | 0.86.0 โ 0.86.3 | [History](https://raw.githubusercontent.com/react/react-native/95cffbff2e071e278987c7d7cd51fbc970dd5622/CHANGELOG.md); [Git diff](https://github.com/react/react-native/compare/a632f9efe24bac8b3a113c78469948f55bde0f5d...95cffbff2e071e278987c7d7cd51fbc970dd5622.diff) | Expo 57 explicitly pairs RN 0.86.3; latest RN 0.87.1 is outside this SDK. Reviewed 0.86.2/0.86.3 release notes and source diff: Hermes 1.17 startup/memory, EventEmitter/native-props locking, Android reentrant Intent dispatch, animated null transform/opacity reset, DOM modal-parent semantics, RCTFont weight zero and Yoga display-contents layout. Check fresh launch, links, animations, modals and list layouts. |
| `@expo/dom-webview` | 57.0.0 โ 57.0.1 | [History](https://raw.githubusercontent.com/expo/expo/b9503d06b8e130abfca1bc16f671dbefb41ad709/CHANGELOG.md); [Git diff](https://github.com/expo/expo/compare/e3eb896c5fdcd89e0cded98ff4e35c9db12cc9c0...b9503d06b8e130abfca1bc16f671dbefb41ad709.diff) | No formal changelog. Reviewed exact published-source diff and release commit history: package/build version changes only; no runtime changes. Check WebView article rendering. |
| `react-native-safe-area-context` | 5.8.0 โ 5.10.0 | [History](https://github.com/AppAndFlow/react-native-safe-area-context/releases); [Git diff](https://github.com/AppAndFlow/react-native-safe-area-context/compare/5a9ad5e337ba7048f0ef6e720a5a56a8840bc548...b9542bd75bea0ee5ff1c9a3f961ab41eb1199425.diff) | Fabric detachment preserves insets, Yoga updates edge props without overwriting dynamic styles, web nested-provider rect/ResizeObserver cleanup, ref forwarding and AGP 9. Check notches, headers, modals and keyboard. |
| `react-native-volume-manager` | 2.0.8 โ 2.2.0 | [History](https://github.com/hirbod/react-native-volume-manager/releases); [Git diff](https://github.com/hirbod/react-native-volume-manager/compare/b77d6e640089cbed0c6f1d6037aa59210df45201...c825487e9699dc2cced89240a7e36295d5d87206.diff) | Android handles volume keys only while native volume UI is hidden; guards context/window focus and cleans listeners. Java 17/react-android/AGP9 changes; iOS unchanged. Check video volume lifecycle. |
| `react-native-keyboard-controller` | 1.22.0 โ 1.22.5 | [History](https://github.com/kirillzyusko/react-native-keyboard-controller/releases); [Git diff](https://github.com/kirillzyusko/react-native-keyboard-controller/compare/b80086f1207e36d634f93afabb65eb886fe1a2fe...35a06b2acb8ffe96a0ccd7799e0e4d9c03338141.diff) | Native weak/null teardown guards, UTF-16/nil input handling; tracks all extender views and recycle state. Corrects user-driven animation/layout synchronization, OTP selection y=0, stale target, initial chat offset and interactive dismiss. Reanimated event refs and deferred registration cleanup. Check auth/search/composer inputs, keyboard drag dismissal, focus and route transitions. |
| `react-native-uikit-colors` | 0.6.2 โ 1.0.0 | [History](https://github.com/Innei/apple-uikit-colors/commit/9520b5177cbc3969cd35c60debc480527d49f326); [Git diff](https://github.com/Innei/apple-uikit-colors/compare/66a965275fdfcf1ee142d5ac6486f0687a796496...9520b5177cbc3969cd35c60debc480527d49f326.diff) | No formal changelog/release; reviewed release commit history and consumed source across all three packages. React Native hooks and core palette values are unchanged, but its published dependency tailwindcss-uikit-colors changes nine alpha colors from rgba(var(...)) to color-mix(...). Actual native compilation dropped all nine declarations. The native config now uses separate RGB/alpha variables from the official dynamic palette and multiplies utility opacity with calc(); tested all nine classes plus /50, and actual native resolver values in light/dark. See the alpha regression evidence below. |
| `react-native-pager-view` | 8.0.3 โ 9.0.4 | [History](https://github.com/callstack/react-native-pager-view/releases); [Git diff](https://github.com/callstack/react-native-pager-view/compare/9f5e13997ecc2cb406a30902b06e4c8cdf1257a6...bfd8a5ac54a26550fdf3566c32e14340f4c96557.diff) | Android 9 replaces ViewPager2 with Compose Horizontal/VerticalPager and stable per-view LifecycleOwner; preserves retained screens through fragment detach, translates scroll/selection/state events and nested gestures. iOS propagates safe areas from UIKit, rotates vertical pager, emits initial selection and waits for modal transitions before animated setPage. Check tabs, image viewer, swipe, programmatic page changes, modal return and nested scroll on both platforms. |
| `react-native-screens` | 4.25.2 โ 4.28.0 | [History](https://github.com/software-mansion/react-native-screens/releases); [Git diff](https://github.com/software-mansion/react-native-screens/compare/a9d5735610d56215df140ab6a7a3bb899da91cda...2381ed8d72fe19185fc8415cb61df7b79bbf4376.diff) | 4.28 requires New Architecture/RN84+, satisfied by RN86. Reviewed stable-v4 JS/Fabric, iOS Screen/Stack/Header/ContentWrapper/traits, Android Screen/Stack/Header/sheet/safearea and C++ removal/geometry diffs. Synchronous shadow/header updates default on; iOS snapshots stay inside original dismissed view to prevent touch-blocking ghost views; orientation inherits parent; obsolete transition flags always on. Android sheet/IME animations coordinate, listeners clean up, stable C++ callback ownership prevents teardown races; header inset/transparent geometry and transition finalization change. New v5/experimental navigation APIs are unused. Check push/pop/swipe, repeated modal open/close, touch responsiveness, keyboard, safe areas and orientation. |
## Application changes
- Better Auth Expo 1.7 uses asynchronous cookie reads. Awaited API-client headers, retry, login/migration and debug reads. Account unlink now sends the database account ID; backend translates legacy clients under the authenticated user.
- Reused the official Better Auth asynchronous storage adapter for serialized UTF-8 chunk writes. The cookie observer understands both legacy count-only chunks and new slot/fallback markers, so incomplete writes do not trigger false account changes.
- Added a dual-slot interruption/recovery regression test. Targeted cookie/migration tests: 14 passed in two files.
## Validation ledger
Native Release builds and the final Android/iOS authentication, content and theme journeys have passed on isolated local services. See the [Android verification](./dependency-upgrade-android-2026-09-22.md), [iOS verification](./dependency-upgrade-ios-2026-09-22.md) and [animation compatibility review](./dependency-upgrade-animation-2026-09-22.md) for exact artifacts and actions. The separate iOS 18.5 local StoreKit check also passed through actual expo-iap cancellation, retry, server verification, transaction finishing and restore; independent database reads confirmed one Xcode subscription with correct ownership and unchanged expiry after restore. External service delivery, real Apple sandbox/production payments and production OTA rollout remain outside these local results.
## Compatibility bounds
- React Native stays on the newest Expo-57-supported patch (0.86.3). React is 19.2.8 throughout the frontend workspace to avoid a second renderer/hook runtime; 19.3 is not in this native renderer compatibility line.
- Babel stays on the newest 7.x line consumed by Expo 57. NativeWind 4 uses mobile Tailwind 3; desktop Tailwind upgrades are independent.
- Firebase, purchase/analytics SDKs, Gesture Handler, Reanimated and Worklets are audited in companion reports before installation.
## UIKit alpha regression and continuous test coverage
The initial review was too narrow: `react-native-uikit-colors/tailwind` re-exports its sibling `tailwindcss-uikit-colors`, so that sibling is consumed runtime. A follow-up read covered the full `generate-tailwind-config.ts` and `src/tailwind.ts` changes between the exact refs linked above, and checked the published 0.6.2/1.0.0 tarballs. The generator deliberately replaced `rgba(var(...))` with `color-mix(...)` to support opacity modifiers. Core Apple palette values and native hooks are unchanged. This is an upgrade regression, rather than an existing color defect.
Counterfactual compilation against the same installed Tailwind 3 / CSSInterop 0.2.7 toolchain produced 9/9 declarations with published UIKit 0.6.2, 0/9 with unadapted 1.0.0, and 9/9 after adaptation. `withNativeUIKit` replaces only the nine dynamic alpha-color entries; `RootProviders` supplies numeric RGB and intrinsic-alpha variables from `useColorsVariants`, retaining the official light/dark palette. Native `rgb` and `calc` support opacity multiplication without `color-mix` or hardcoded substitute colors.
The regression tests compile all nine semantic classes with and without `/50`. They also run the actual published CSSInterop native `resolveValue` implementation with mocked platform services: separator resolves to alpha 0.34/0.6, system fill `/50` to 0.1/0.18, and secondary label to the official light/dark RGB with alpha 0.6. Evidence: `/tmp/folo-uikit-alpha-audit/{consumed-source.diff,compile-comparison.log}` and `apps/mobile/scripts/uikit-colors.test.ts`. Final simulator screenshots and theme interactions are recorded in the native platform reports.
The mobile and HTML-renderer packages now expose their existing Vitest configurations through `scripts.test`, so root recursive tests include their auth, purchase, migration and reader regressions. Existing TTS/spotlight tests use the Vitest runner, release-script tests resolve fixtures from their own file URL, and GitHub-output assertions check the existing delimiter format. These changes fix test discovery/cwd assumptions without changing release scripts.
Final Node 24 / pnpm 12 checks passed: mobile typecheck; lint with no errors; the complete mobile suite (35 files, 152 tests); HTML renderer (2 files, 12 tests); root recursive test command (130 files, 688 passed, 2 existing CLI skips). Logs: `/tmp/folo-frontend-final-{typecheck,lint,test,format}.log`. The migration snapshot/multiple-subscriber regression and UIKit tests are included in this count.
## Dev build workflow follow-up
The first published dev SHA passed local native acceptance but exposed a clean-runner Expo configuration failure before native compilation. The workflow HTML assets path resolved to `apps/out` instead of repository-root `out`. The fallback renderer build then inherited conflicting pnpm 12 linker overrides and automatically replaced modules inside the active Expo process. All six mobile build jobs now use an absolute repository-root output path and the same hoisted workspace layout throughout. The exact failure evidence, install recovery and validation boundary are recorded in [the pnpm audit](dependency-upgrade-pnpm-2026-09-22.md#dev-ci-follow-up-mobile-config-evaluation). This is build-environment repair; application code and reviewed dependency versions are unchanged.
---
### Dependency Upgrade Mobile Runtime 2026 09 22 (`docs/dependency-upgrade-mobile-runtime-2026-09-22.md`)
# Mobile service dependency review โ 2026-09-22
This covers the six directly used mobile service packages below. Upstream release histories and the actual source diffs were read, with native bridge code, JavaScript implementation, exports, and Folo call sites considered together. Generated bindings, examples, and unrelated monorepo packages were separated from the runtime review. Approval here means the source migration is understood; the native build and device scenarios at the end remain separate validation gates.
| Package | Previous โ selected | Release/changelog evidence | Source comparison |
| ---------------------------------- | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `@react-native-firebase/app` | 25.1.0 โ 26.4.0 | [App changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/app/CHANGELOG.md) | [25.1 โ 26.4 source](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0) |
| `@react-native-firebase/analytics` | 25.1.0 โ 26.4.0 | [Analytics changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/analytics/CHANGELOG.md) | [Same exact release range](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0) |
| `@react-native-firebase/messaging` | 25.1.0 โ 26.4.0 | [Messaging changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/messaging/CHANGELOG.md) | [Same exact release range](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0) |
| `@react-native-firebase/app-check` | 25.1.0 โ 26.4.0 | [App Check changelog](https://github.com/invertase/react-native-firebase/blob/06701af5fdc19bae9f379567eadb29dfe81953c0/packages/app-check/CHANGELOG.md) | [Same exact release range](https://github.com/invertase/react-native-firebase/compare/e0a565d8a73a9b103d140ffacfb8876b30d8bdc5...06701af5fdc19bae9f379567eadb29dfe81953c0) |
| `expo-iap` | 4.3.6 โ 5.6.3 | [Central release history](https://openiap.dev/docs/updates/releases), [breaking 5.0.0 release](https://github.com/hyodotdev/openiap/releases/tag/expo-iap-5.0.0), [5.6.3 release](https://github.com/hyodotdev/openiap/releases/tag/expo-iap-5.6.3) | [Exact source range](https://github.com/hyodotdev/openiap/compare/764103bcfe9717f539ab8785ec28ad1c33bd3100...5047690eff2410d92dec98cc0a9218ef51d3aaa1) |
| `posthog-react-native` | 4.54.4 โ 4.75.0 | [Changelog at feature commit](https://github.com/PostHog/posthog-js/blob/5cfec8bdc3f1311fab0c1fa8a5b248f4f8b0fba9/packages/react-native/CHANGELOG.md), [4.75.0 release](https://github.com/PostHog/posthog-js/releases/tag/posthog-react-native%404.75.0) | [Source range through 4.75 feature](https://github.com/PostHog/posthog-js/compare/94a053043847293a4427e315e67c798b58894107...5cfec8bdc3f1311fab0c1fa8a5b248f4f8b0fba9) |
## Firebase app/core
Read `RNFBApp.podspec`, `package.json`, Expo plugin source, `firebase_spm.rb`, the JavaScript TurboModule resolver and registry, the native event emitter integration, and the Android/iOS thread-safe handle map implementations. v26 requires New Architecture and resolves `NativeRNFBTurboApp`/`NativeRNFBTurboUtils` through `TurboModuleRegistry`; the registry binds native methods lazily while preserving application routing and iOS null serialization. Event subscriptions use the same native host for registration and removal. The handle registry moves entries under a private lock and leaves SDK cleanup outside the lock. Named-app storage now supports prototype-named keys; destruction runs all callbacks even if one fails.
Native dependency versions advance to Firebase iOS 12.18.0, Android BoM 34.18.0, and Firebase JS 12.17.1. iOS minimum is 15, below Folo's configured 16.4. RN 0.86's New Architecture satisfies the architecture requirement. This does not replace an actual build against its generated C++ bindings.
**Migration:** SPM becomes available by default on compatible RN versions. Upstream explicitly rejects SPM with static frameworks because Firebase products produce duplicate symbols. Folo uses `useFrameworks: "static"`. Its Expo app plugin now sets `ios.disableSPM: true`; the plugin writes `$RNFirebaseDisableSPM = true` after `prepare_react_native_project!`, before targets. There is no separate `Podfile.properties.json` key for this setting. Native prebuild must regenerate the Podfile before installing these pods.
## Firebase Analytics
Read the modular `lib/index.ts` implementation and removed namespaced exports, validation/type changes, Android `NativeRNFBTurboAnalytics`, and iOS `RNFBAnalyticsModule.mm` changes. The exported modular `logEvent` returns `void`, though the native operation still uses a Promise internally. Event validation now enforces an alphabetic first character, 1โ40 alphanumeric/underscore characters, and reserved prefixes. Consent updates preserve omitted fields instead of implicitly denying them. Native item conversion rejects unsafe casts; iOS session completion is serialized onto the main queue. SHA-256 conversion inputs now require 64 valid hex characters.
**Affected Folo behavior:** launch, navigation, login, subscription and user identity events. `FirebaseAnalyticsTypes.Module` is removed, so the tracker now accepts a small explicit interface and initialization supplies official `logEvent(analytics, โฆ)`, `setUserId`, and `setUserProperties` closures. This keeps native code out of the shared tracker and supports synchronous `logEvent`. Existing Folo mapped event names use valid snake_case. Existing adapter tests retain the internal-property filtering and input immutability checks. Server acceptance of analytics events is not established by those tests.
## Firebase Messaging
Read modular exports/registration and background processing, iOS AppDelegate registration generation handling, FIRMessaging delegate forwarding, notification-center callbacks, Android broadcast filtering and persistent notification storage. Native modules are now TurboModules and exported types use `RemoteMessage` directly. iOS APNs registration has an independent timeout and superseded attempts reject distinctly; cached registration/settings state updates only after native success. Background processing completes even without a handler or when a handler fails. Foreground messages with `content-available: 0` emit correctly. The notification-open event fires for the default action, and existing delegates retain ownership of completion callbacks, which prevents double completion. Android filters control broadcasts, supports a configurable stored-notification limit including zero, and removes stored IDs by exact comparison.
**Migration:** Folo's hook now invokes the official modular token, registration, refresh, initial-notification and notification-open functions. The existing permission โ APNs-ready โ FCM-token โ backend-save sequence and bounded registration retry behavior remain intact. The SDK explicitly documents that ARM64 simulators may time out on real APNs registration. Simulator notification injection can establish navigation behavior but cannot prove APNs/FCM token issuance or delivery.
## Firebase App Check
Read `lib/index.ts`, removed `namespaced.ts`, provider validation and native configuration/token paths. `initializeAppCheck` now synchronously returns `AppCheck`; native provider configuration continues asynchronously. The default namespace factory and its types are removed. Valid Apple provider names include debug, deviceCheck, appAttest and appAttestWithDeviceCheckFallback; Android accepts debug/playIntegrity. Native iOS now fails closed with `appCheck/provider-not-ready` until the real provider is configured rather than installing a debug provider first. Token auto-refresh is enabled after provider configuration.
**Migration:** initialization constructs `ReactNativeFirebaseAppCheckProvider` directly and caches the single returned instance. Token retrieval reuses that instance. A focused helper retries only `appCheck/provider-not-ready` after 25/50/100/200 ms, then preserves the error. Attestation errors do not trigger this retry. The existing request layer's synthetic fallback behavior was not broadened. Auto-refresh is now explicitly supplied in the initialization options, where the SDK consumes it.
## Expo IAP
The package-local changelog is a pointer to centralized release history. Read the official individual release notes across 4.x/5.x, including the 5.0 legacy API removal, and the wrapper source diff: `src/index.ts`, `useIAP.ts`, iOS wrappers, purchase-list decoders, native restore helper, Swift module/helper, and Android Gradle changes.
v5 removes `validateReceipt`, legacy platform request aliases, `inapp`, legacy alternative billing APIs and purchase platform aliases. Canonical requests use `apple`/`google`, and current purchase records identify `store`. The hook now deduplicates purchase delivery from both the native event and request return for 30 seconds. Listener initialization and native Swift cleanup are generation-scoped, so old teardown does not close a new connection. Native query serialization is atomic: malformed entries fail the query rather than disappearing from the returned purchases. Restore propagates native sync failures instead of masking them as an empty successful query. Native error metadata is carried in an envelope, and the JS layer preserves canonical error codes even when Expo adds a source location. Gradle accommodates AGP 9's built-in Kotlin and raises default compile/target SDK fallback to 36; Apple/Google native dependencies are 3.4.0/3.5.2.
**Migration:** `AppleIAPProvider` now destructures `verifyPurchase` as `verifyStorePurchase` for the optional JWS retrieval fallback. `getTransactionJwsIOS`, canonical `request.apple`, `type: "subs"`, and the explicit no-auto-finish option remain supported. The authoritative flow still sends the signed transaction or transaction identity to Folo's backend, waits for successful verification, then finishes the transaction. Local store verification alone never grants entitlement. Current app code does not consume the removed platform aliases. The app's own transaction dedupe remains useful across native redelivery and failed backend verification.
The existing localhost `StoreKitTestHelper.buyProduct` shortcut bypasses the `expo-iap` purchase request/hook path. Passing that shortcut alone is insufficient evidence for this upgrade. Native E2E should exercise the actual `useIAP` product request, purchase callback, verification and finish path, plus user cancellation and restore failure/success.
## PostHog React Native
The npm metadata has no `gitHead`. The upstream feature commit used in the comparison still contains a 4.74.2 package/changelog version, so the official 4.75.0 release body was separately read: it identifies commit `5cfec8b` and adds partial survey responses with persistent resume. This provenance distinction is deliberate.
Read the intervening changelog and implementation changes in `src/posthog-rn.ts`, error tracking context/handlers, optional Expo Updates/native plugin loading and lifecycle paths. Changes relevant to Folo include safer identity/reset persistence, native identity/consent serialization, error-handler sharing across clients, restoring the previous RN error handler on shutdown, and a two-second cap on persisting fatal exceptions before handing control back to RN. Exceptions can include release-time Expo update metadata and current app state. A failing before-send hook drops an event; it no longer sends the unmodified event. Feature-flag reload fixes prevent stale identity evaluations. Shared-core notes also describe bounded retries, offline flush coalescing, preserving newly queued events during an in-flight flush, and the Hermes random-number/UUID edge-case fix.
New push subscription and opened-event capture default to enabled **only with the optional native plugin**; those native events bypass JS `before_send`. Folo currently installs neither that plugin nor the legacy replay plugin, so that new bridge path is unavailable. No optional native plugin was added by this migration. Folo still constructs the JS client with its session-level 5% `before_send` sampler and uncaught/unhandled error capture. Surveys, native replay, symbol-upload tooling and new push APIs are not directly consumed by the current initialization. If adding the optional native plugin later, its push defaults must be reviewed against the intended sampling/notification policy.
## Verification and remaining native scenarios
- The service-focused Vitest invocation completed successfully: 17 files, 67 tests, including App Check initialization retry bounds, existing messaging registration ordering/retries, Apple verification request/JWS filtering, and Firebase/PostHog adapter behavior. Log: `/tmp/folo-mobile-services-tests.log`.
- These are application contract/unit tests. They do not establish native bridge correctness, real APNs/FCM delivery, App Attest/Play Integrity acceptance, or an App Store purchase.
- After installing all selected packages, mobile/shared typechecks and a regenerated native build must pass. Check startup for missing TurboModules, exercise article-open notification navigation from foreground/background/cold launch, and verify that denied notification permission makes no token registration request.
- Test fresh App Check startup and a subsequent authenticated backend call. Observe the real attestation path on a suitably configured device; do not count synthetic fallback as successful attestation.
- Exercise the actual Expo IAP purchase path with StoreKit local test products or an authorized sandbox account: product loading, cancellation, duplicate callback, backend rejection (transaction remains unfinished), success (finish after verification), restart/redelivery, restore success and failure. No real purchase or production credentials were used by this review.
- Test PostHog against a local ingestion fixture with sampled-in and sampled-out clients, identify/reset, caught exceptions, queued events and shutdown. Live vendor analytics receipt is a separate external-service check.
---
### Dependency Upgrade Playwright 2026 09 22 (`docs/dependency-upgrade-playwright-2026-09-22.md`)
# Playwright dependency review โ 2026-09-22
`@playwright/test` 1.61.1 โ 1.63.0 is approved for installation, followed by the repository's real web and Electron E2E suites.
Read the official [1.62.0](https://github.com/microsoft/playwright/releases/tag/v1.62.0), [1.62.1](https://github.com/microsoft/playwright/releases/tag/v1.62.1), and [1.63.0](https://github.com/microsoft/playwright/releases/tag/v1.63.0) release notes and the [upstream diff](https://github.com/microsoft/playwright/compare/39e3553a4f283a41134d75d7e404484bd9e6865a...1b025d7e20a026371cd5f98ba0cdce48892737c8). The complete diff is cached at `/tmp/folo-dependency-review-20260922/playwright__test/source.diff`. Read all changes to runner/common/worker, public locator/page/Electron clients, timeout/wait helpers, Chromium runtime (excluding generated CDP declarations), server browser/context/page/Electron, frames/DOM/frame selectors, browser revisions, and TS config loading. This review targets the APIs consumed by Folo, and does not claim a line-by-line review of unrelated MCP, recorder, component-gallery, Firefox, or WebKit implementations.
## Changes and application impact
- Runner scheduling adds named locks and optional isolated retries; the default remains immediate retries. Folo uses one worker and no new options. Teardown projects now run after `maxFailures`; graceful worker shutdown sends heartbeats, so a live slow teardown is not killed merely for taking longer than the parent timeout. Reporter errors now fail an otherwise passing run. Trace schema moves to version 9, with different source/attachment paths and explicit subtitles/parameters; Folo uses the bundled HTML/list reporters and does not parse trace internals.
- New component stories, WebP screenshots, AbortSignal cancellation, cross-frame locators, visibility filtering, OPFS/passkey storage persistence, and expanded media options are opt-in. Existing action timeouts and automatic scrolling remain the defaults. Removed experimental component-test internals and private Babel-plugin configuration are unused here. The 1.62.1 TS-config regressions were corrected; net source diff retains the previous permissive resolution behavior.
- Frame lookup is consolidated into one selector callback path. Strict locators still reject multiple elements, absent nodes retain hidden/detached and zero-count assertion semantics, and actions still retry detached nodes. Cross-frame search refuses matches in more than one frame; ordinary selectors continue to resolve in one frame. Aria references receive a new frame sequence after a full navigation, preventing references from accidentally matching a new document.
- Chromium response-body fallback now refetches only safe GET subresources/prefetches, preventing duplicate POST or other side effects during tracing. Intercepted requests remove the captured `cookie` override and let Chromium use its cookie store. This directly affects authentication checks that intercept network requests. EventSource requests no longer prevent network idle; waits should still use page state or URL where practical.
- Electron's page close uses main-process `webContents.close`, avoiding a CDP close/navigation race; the default still skips beforeunload unless requested. Launch retains explicit environment and timeout support. `firstWindow` still returns an available initial window, so the repository helper must wait for a non-`about:` URL and DOMContentLoaded before injecting renderer helpers. Crash/close now consistently dispose pending requests and contexts.
- Browser payloads change from Chromium 149 to 153.0.8010.12, Firefox 151 to 155, and WebKit 26.5 to 26.6. Install the matching Chromium browser before the web E2E run. Debian 11 and Ubuntu 20.04 are no longer supported; repository CI and this macOS host do not target them. Linux arm64 now uses Chrome for Testing.
## Verification owner
Frontend agent owns installation and the existing web/Electron end-to-end runs. Require real authentication, navigation, settings persistence, report generation, and clean Electron shutdown after the update. Existing runs on 1.61.1 are baseline evidence only, not validation of 1.63.0.
---
--- METRICS ---
- Files Extracted: 20
- Estimated Token Budget: ~125495 tokens
- Canonical Reference: https://codewiki.google/github.com/RSSNext/Folo
