mirror of
https://github.com/simstudioai/sim.git
synced 2026-09-24 15:45:35 +08:00
Waleed
f0b79c5cc6
16.2.12 is the current stable (published 2026-07-25) and its entire changelog is two PRs: a docs backport and vercel/next.js#95831, "Fixes to support TypeScript 7". That second one matters here. `apps/sim` declares `typescript: ^7.0.2` and the lockfile resolves 7.0.2, while 16.2.11 predates any TS7 handling — not even the actionable-error guard (#95837), which was never merged. The upstream symptom is `next build` dying with a silent SIGSEGV during its type-check step, because the legacy TypeScript JS API that Next called is gone in TS7. Builds pass today only because Next detects @typescript/native-preview as the compiler and takes a different path, so we are accidentally-working rather than supported. 16.2.12 adds the `experimental.useTypeScriptCli` backend that makes this configuration official. Zero build-performance content in the patch, so this is not a speed change. Bumps all eight pins in lockstep — next, @next/env and the four @next/swc-* binaries at the root, plus the three app/package copies. The swc binaries must move with next: they are platform-gated optionalDependencies, so a version skew or a gate exclusion leaves them out of bun.lock entirely and `bun install --frozen-lockfile` installs no compiler at all (the #5945 failure). Also re-dates the bunfig.toml gate note, which said to drop the next entries on 2026-07-28 — yesterday. 16.2.12 is inside the 7-day window until 2026-08-01, so following that instruction would have blocked this bump and re-triggered the missing-compiler failure. Re-date on future bumps rather than deleting the entries early.
53 lines
2.9 KiB
TOML
53 lines
2.9 KiB
TOML
[install]
|
|
exact = true
|
|
# Supply-chain gate: only install package versions published at least 7 days ago
|
|
# (blocks freshly published, potentially compromised releases).
|
|
minimumReleaseAge = 604800
|
|
# @typescript/native-preview stays excluded permanently: it only publishes nightly
|
|
# dev builds, so every version is structurally younger than any age gate.
|
|
# The exactly pinned Pi 0.80.10 packages were vetted for the cloud-review SDK
|
|
# migration; they age out of the gate on 2026-07-24 — drop these four entries then.
|
|
# next@16.2.12, @next/env@16.2.12 and the @next/swc-* binaries carry the July 2026 security
|
|
# advisories (SSRF, cache confusion, DoS, middleware bypass — GHSA-89xv-2m56-2m9x et al.,
|
|
# fixed in 16.2.11) plus the TypeScript 7 support backport (vercel/next.js#95831) that
|
|
# 16.2.11 lacks — this repo resolves typescript to 7.x, and on 16.2.11 `next build`'s
|
|
# type-check step can die with a silent SIGSEGV because the legacy TS JS API is gone in TS7.
|
|
# Published 2026-07-25, they age out of the gate on 2026-08-01 — drop these entries then,
|
|
# and re-date this note on any further bump rather than deleting the entries early: removing
|
|
# them while the pinned version is still inside the 7-day window blocks the bump outright.
|
|
# The swc binaries ship in lockstep with next and
|
|
# MUST be excluded alongside it: they are next's platform-gated optionalDependencies, so
|
|
# gating them out leaves them absent from bun.lock entirely, and `bun install
|
|
# --frozen-lockfile` then installs no compiler at all — next falls back to downloading one
|
|
# at build time, which fails in CI.
|
|
# @anthropic-ai/sdk is exactly pinned to 0.114.0, vetted for the agent-events
|
|
# streaming work (adaptive thinking display types + transform-json-schema);
|
|
# published 2026-07-23, it ages out of the gate on 2026-07-30 — drop this entry then.
|
|
# @e2b/code-interpreter (2.7.0, published 2026-07-23) and its `e2b` dependency
|
|
# (2.36.1, published 2026-07-27) carry the fix for Pi's Create PR runs dying mid-stream
|
|
# with "protocol error: received unsupported compressed output": e2b 2.36.0 moved envd's
|
|
# Connect transport off the 2.0.0-rc.3 connect-web and onto undici 8 for Node >= 22.19.0,
|
|
# which is this app's engine floor. Only these two are excluded — the rest of the chain
|
|
# (@connectrpc/connect{,-web} 2.1.2, @bufbuild/protobuf 2.13.0, undici 8.8.0) already
|
|
# clears the gate, and `tar` resolves to 7.5.21, which satisfies e2b's ^7.5.19 without
|
|
# an exception. They age out on 2026-07-30 and 2026-08-03 — drop both entries then.
|
|
minimumReleaseAgeExcludes = [
|
|
"@typescript/native-preview",
|
|
"@earendil-works/pi-agent-core",
|
|
"@earendil-works/pi-ai",
|
|
"@earendil-works/pi-coding-agent",
|
|
"@earendil-works/pi-tui",
|
|
"next",
|
|
"@next/env",
|
|
"@next/swc-darwin-arm64",
|
|
"@next/swc-darwin-x64",
|
|
"@next/swc-linux-arm64-gnu",
|
|
"@next/swc-linux-x64-gnu",
|
|
"@anthropic-ai/sdk",
|
|
"@e2b/code-interpreter",
|
|
"e2b",
|
|
]
|
|
|
|
[run]
|
|
env = { NEXT_PUBLIC_APP_URL = "http://localhost:3000" }
|