# Libraries and version policy

Major dependencies, their declared versions, owners and upgrade constraints.

Versions below are read from `pnpm-workspace.yaml`’s catalog and workspace manifests at this documentation revision. A range is shown as declared; the lockfile owns its resolved version. Package locations identify direct consumers, not every transitive import.

## Upgrade policy [#upgrade-policy]

The catalog uses exact pins. `minimumReleaseAge: 2880` enforces a two-day quarantine, including transitive resolution and frozen installs. Choose the newest version old enough to qualify. The workspace currently has no `minimumReleaseAgeExclude` entries. Only a security fix may bypass the quarantine: an exact-version entry with its advisory commented, removed once the version is two days old.

The docs integration pins `fumadocs-mdx` 15.4.7 and `fumadocs-core` 16.17.1. At selection time (2026-10-15 06:12 UTC), core 16.17.2 was less than 48 hours old. No docs dependency receives a quarantine exclusion. No `fumadocs-ui` is installed.

Native modules follow Expo’s compatibility check, not the newest npm release. Changing a native module invalidates the compiled development client and requires a rebuild. Web React can advance independently; native React stays compatible with React Native’s renderer. `pnpm update:native` runs Expo’s fix workflow; review its changes as an SDK migration.

Keep Drizzle kit/ORM on the same build, Better Auth and its adapters compatible, the MCP SDK verified with the auth plugin, and one files-sdk copy across consumers. The files-sdk patch is version-specific. Effect persistence/pin changes require ADR-0006’s workerd fault gate. The JavaScript updater deliberately refuses coupled/native upgrades that need their own verification.

## Dependency reference [#dependency-reference]

| Library | Declared version | Why it is here | Direct consumers |
| --- | --- | --- | --- |
| `@base-ui/react` | `1.9.0` | Accessible unstyled UI primitives. | `packages/ui` |
| `@better-auth/core` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `packages/auth` |
| `@better-auth/drizzle-adapter` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `packages/auth` |
| `@better-auth/expo` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/mobile`, `packages/auth` |
| `@better-auth/mcp` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` |
| `@better-auth/oauth-provider` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `packages/auth` |
| `@better-auth/passkey` | `1.7.7` | Better Auth plugin/adapter; upgraded with its core family. | `apps/web`, `apps/mobile`, `packages/auth` |
| `@clack/prompts` | `1.8.1` | Interactive setup prompts. | `packages/project-setup-cli` |
| `@cloudflare/vite-plugin` | `1.63.1` | Build TanStack Start for workerd. | `apps/web` |
| `@ddedic/expo-fancy-ota-updates` | `^1.5.0` | OTA update presentation. | `apps/mobile` |
| `@effect/sql-pg` | `4.0.2` | Workerd persisted-queue spike; not the production queue backend. | `packages/api` |
| `@effect/vitest` | `4.0.2` | Test Effect timeouts using a virtual clock. | `packages/api`, `packages/email` |
| `@expo/ui` | `~57.0.22` | Native SwiftUI/Compose interface surfaces. | `apps/mobile`, `packages/widgets` |
| `@firecrawl/anydoc-wasm` | `0.2.4` | Browser document conversion to Markdown; patched for per-conversion instances. | `apps/web`, `packages/api` |
| `@fontsource-variable/inter` | `5.3.0` | Locally hosted product typography. | `apps/web`, `packages/ui` |
| `@headless-tree/core` | `1.7.0`, `^1.7.0` | Headless hierarchical tree behavior. | `apps/web`, `packages/ui` |
| `@headless-tree/react` | `1.7.0` | React tree integration. | `apps/web` |
| `@modelcontextprotocol/server` | `2.3.1` | MCP server protocol and tool transport. | `apps/web`, `packages/api` |
| `@orpc/client` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `apps/mobile`, `packages/api`, `packages/errors` |
| `@orpc/openapi` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api` |
| `@orpc/server` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api`, `packages/errors` |
| `@orpc/shared` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `packages/api` |
| `@orpc/tanstack-query` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `apps/mobile` |
| `@orpc/zod` | `2.0.0-beta.43` | Typed RPC, OpenAPI or query adapter; keep the oRPC family aligned. | `apps/web`, `packages/api` |
| `@shadcn/react` | `0.3.1` | Shared shadcn integration. | `packages/ui` |
| `@shopify/flash-list` | `2.0.2` | Efficient native lists. | `apps/mobile` |
| `@shopify/react-native-skia` | `2.6.2` | Native graphics. | `apps/mobile` |
| `@t3-oss/env-core` | `0.13.11` | Validated environment contracts. | `packages/env` |
| `@takumi-rs/core` | `2.15.1` | Native development rendering for OG images. | `apps/web` |
| `@takumi-rs/wasm` | `2.15.1` | Worker-compatible OG renderer. | `apps/web` |
| `@tanstack/ai` | `0.68.0` | Assistant streaming, client state, persistence or provider adapter. | `apps/web`, `packages/db`, `packages/api` |
| `@tanstack/ai-anthropic` | `0.21.1` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` |
| `@tanstack/ai-client` | `0.39.2` | Assistant streaming, client state, persistence or provider adapter. | `apps/web` |
| `@tanstack/ai-gemini` | `0.37.2` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` |
| `@tanstack/ai-openai` | `0.29.1` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` |
| `@tanstack/ai-persistence` | `0.8.3` | Assistant streaming, client state, persistence or provider adapter. | `packages/api` |
| `@tanstack/ai-react` | `0.30.3` | Assistant streaming, client state, persistence or provider adapter. | `apps/web` |
| `@tanstack/react-form` | `1.33.5` | Typed form state and validation. | `apps/web` |
| `@tanstack/react-query` | `5.104.2` | Server state, caching and invalidation. | `apps/web`, `apps/mobile` |
| `@tanstack/react-router` | `1.170.44` | Typed routing and navigation. | `apps/web` |
| `@tanstack/react-router-ssr-query` | `1.167.3` | SSR/query hydration integration. | `apps/web` |
| `@tanstack/react-start` | `1.169.1` | SSR and HTTP route entry points. | `apps/web`, `packages/intl` |
| `@tanstack/react-table` | `9.3.1` | Data table state. | `apps/web` |
| `@tanstack/react-virtual` | `3.14.17` | Virtualized lists for the ReUI cascader. | `packages/ui` |
| `@types/node` | `26.6.5` | Compile-time declarations; no application runtime. | `.`, `apps/mobile`, `packages/env` |
| `@types/react` | `19.2.4`, `~19.2.4` | Compile-time declarations; no application runtime. | `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/intl`, `packages/react-utils`, `packages/app-update`, `packages/widgets` |
| `@types/react-dom` | `19.3.0` | Compile-time declarations; no application runtime. | `apps/web`, `packages/ui`, `packages/intl` |
| `aws4fetch` | `1.0.20` | Worker-side S3 signing for direct and multipart R2 uploads. | `packages/storage` |
| `babel-plugin-react-compiler` | `1.0.0` | Compile supported React components/hooks. | `apps/web` |
| `better-auth` | `1.7.7` | Identity, sessions and plugin integration. | `apps/web`, `apps/mobile`, `packages/auth`, `packages/db` |
| `class-variance-authority` | `0.7.1` | Typed component variants. | `packages/ui` |
| `cmdk` | `1.1.1` | Command palette behavior. | `packages/ui` |
| `cn` | `0.4.0` | Conditional class composition. | `packages/ui` |
| `date-fns` | `4.4.0` | Date manipulation in shared UI. | `apps/web`, `packages/ui` |
| `dotenv` | `18.0.7` | Load local server/script environment files. | `.`, `apps/web`, `packages/auth`, `packages/env`, `packages/db`, `packages/api` |
| `drizzle-kit` | `1.0.0-rc.5-5935859` | Generate reviewed SQL migrations with the matching ORM build. | `packages/db` |
| `drizzle-orm` | `1.0.0-rc.5-5935859` | Typed queries, schema and relations. | `apps/web`, `packages/flags`, `packages/auth`, `packages/db`, `packages/api` |
| `effect` | `4.0.2` | Bounded jobs and outbound transports, using stable APIs. | `packages/api`, `packages/email` |
| `embla-carousel-react` | `8.6.0` | Carousel primitives. | `packages/ui` |
| `evlog` | `2.31.0` | Structured application logging. | `apps/web` |
| `expo` | `~57.0.27` | Native SDK and build/runtime integration. | `apps/mobile` |
| `expo-router` | `~57.0.25` | File-based native navigation. | `apps/mobile` |
| `expo-widgets` | `~57.0.23` | iOS widget integration. | `apps/mobile`, `packages/widgets` |
| `files-sdk` | `2.6.2` | Files gateway, storage operations and soft deletion. | `apps/web`, `packages/storage`, `packages/api` |
| `fumadocs-core` | `16.17.1` | Page tree, metadata loading and server search without a UI theme. | `apps/web` |
| `fumadocs-mdx` | `15.4.7` | Compile MDX, frontmatter, searchable text and processed Markdown at build time. | `apps/web` |
| `i18next` | `26.4.4` | Language resources and translation. | `apps/web`, `apps/mobile`, `packages/intl` |
| `input-otp` | `1.5.0` | One-time-code input. | `packages/ui` |
| `lucide-react` | `1.56.0` | Consistent interface icons. | `apps/web`, `packages/ui` |
| `neon` | `8.4.1` | Setup-time Neon provisioning. | `packages/project-setup-cli` |
| `next-themes` | `0.4.6` | Existing web theme provider. | `apps/web`, `packages/ui` |
| `nitro` | `3.0.260903-beta` | Node development/server build adapter. | `apps/web` |
| `oxfmt` | `0.72.0` | Formatting. | `.` |
| `oxlint` | `1.87.0` | Linting and module-boundary rules. | `.` |
| `pg` | `8.23.1` | Postgres transport for Drizzle. | `apps/web`, `packages/auth`, `packages/db`, `packages/api` |
| `qrcode.react` | `^4.2.0` | Web QR codes for account/security flows. | `apps/web` |
| `react` | `19.2.3`, `19.3.0` | Component rendering; native follows its renderer version. | `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/intl`, `packages/react-utils`, `packages/app-update`, `packages/widgets` |
| `react-day-picker` | `10.0.2` | Calendar selection. | `packages/ui` |
| `react-dom` | `19.2.3`, `19.3.0` | Web rendering and server HTML output. | `apps/web`, `apps/mobile`, `packages/ui`, `packages/intl`, `packages/react-utils`, `packages/widgets` |
| `react-i18next` | `17.0.16` | React translation bindings. | `apps/web`, `apps/mobile`, `packages/intl` |
| `react-native` | `0.86.3` | Native renderer and platform primitives. | `apps/mobile`, `packages/ads`, `packages/purchases`, `packages/widgets` |
| `react-native-android-widget` | `^0.21.0` | Android widget integration. | `apps/mobile`, `packages/widgets` |
| `react-native-gesture-handler` | `~2.32.0` | Native gesture recognition. | `apps/mobile` |
| `react-native-keyboard-controller` | `1.21.9` | Native keyboard coordination. | `apps/mobile` |
| `react-native-passkey` | `^3.6.1` | Native passkey integration. | `apps/mobile` |
| `react-native-purchases` | `10.12.2` | RevenueCat native purchase SDK. | `apps/mobile` |
| `react-native-reanimated` | `4.5.1` | Native animation execution. | `apps/mobile` |
| `react-native-safe-area-context` | `~5.7.0` | Safe-area insets. | `apps/mobile` |
| `react-native-screens` | `4.26.2` | Native navigation screens. | `apps/mobile` |
| `react-native-svg` | `15.15.4` | Native vector graphics. | `apps/mobile` |
| `react-native-web` | `~0.21.0` | Web adapter for React Native. | `apps/mobile` |
| `react-native-worklets` | `0.10.1` | Worklet execution required by native animation. | `apps/mobile` |
| `react-phone-number-input` | `3.4.18` | Phone input. | `packages/ui` |
| `react-resizable-panels` | `4.14.5` | Resizable panels. | `packages/ui` |
| `recharts` | `3.10.1` | Application charts. | `apps/web`, `packages/ui` |
| `shadcn` | `4.21.4` | Component installation and registry tooling. | `packages/ui` |
| `shiki` | `4.5.0` | Syntax highlighting; docs run it at build time. | `packages/ui` |
| `sonner` | `2.0.8` | Toast feedback. | `apps/web`, `packages/ui` |
| `tailwindcss` | `4.3.3` | Semantic utility styling. | `apps/web`, `packages/ui` |
| `takumi-js` | `2.15.1` | JSX-to-OG rendering integration. | `apps/web` |
| `turbo` | `2.11.7` | Workspace task orchestration. | `.` |
| `tw-animate-css` | `1.4.0` | UI animation utilities. | `packages/ui` |
| `typescript` | `7.0.2`, `~6.0.3` | Type checking; native uses the JS compiler line for Expo config. | `.`, `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/flags`, `packages/intl`, `packages/auth`, `packages/storage`, `packages/env`, `packages/react-utils`, `packages/db`, `packages/api`, `packages/errors`, `packages/app-update`, `packages/email`, `packages/widgets` |
| `vaul` | `1.1.2` | Drawer behavior. | `packages/ui` |
| `vite` | `8.3.4` | Web build pipeline and development server. | `apps/web` |
| `vitest` | `5.0.4` | Unit and integration test runner. | `apps/web`, `apps/mobile`, `packages/ads`, `packages/ui`, `packages/purchases`, `packages/flags`, `packages/intl`, `packages/auth`, `packages/storage`, `packages/env`, `packages/react-utils`, `packages/db`, `packages/api`, `packages/errors`, `packages/app-update`, `packages/email`, `packages/widgets` |
| `wrangler` | `4.149.0` | Worker build/deploy/local runtime. | `apps/web` |
| `zod` | `4.6.7` | Validate public contracts and third-party payloads. | `.`, `apps/web`, `apps/mobile`, `packages/flags`, `packages/auth`, `packages/env`, `packages/db`, `packages/api`, `packages/errors` |
| `@aws-sdk/client-s3` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` |
| `@aws-sdk/lib-storage` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` |
| `@aws-sdk/s3-presigned-post` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` |
| `@aws-sdk/s3-request-presigner` | `3.1150.0` | S3-compatible Node storage transport, uploads or signing. | `packages/storage` |
| `@expo/dom-webview` | `~57.0.1` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `@expo/metro-runtime` | `~57.0.16` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `@expo/vector-icons` | `^15.1.1` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-application` | `~57.0.3` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-clipboard` | `~57.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-constants` | `~57.0.21` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-dev-client` | `~57.0.19` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-device` | `~57.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-file-system` | `~57.0.7` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-font` | `~57.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-glass-effect` | `~57.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-haptics` | `~57.0.3` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-image` | `~57.0.5` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-linking` | `~57.0.12` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-local-authentication` | `~57.0.3` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-localization` | `~57.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-network` | `~57.0.2` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-notifications` | `~57.0.22` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-secure-store` | `~57.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-splash-screen` | `~57.0.9` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-status-bar` | `~57.0.1` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-store-review` | `~57.0.3` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-symbols` | `~57.0.3` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-system-ui` | `~57.0.4` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-updates` | `~57.0.25` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |
| `expo-web-browser` | `~57.0.3` | Expo SDK platform capability; use the SDK-compatible version. | `apps/mobile` |