Update Packages
Use this workflow when updating dependencies in this repo.
Steps
- Check the pinned package list in
.ncurc.cjs. Do not upgrade packages listed there. - Keep the repo on Node 24. If you change Node runtime settings, update
.nvmrc,engines.node,@types/node, Dockerfiles, and CI together. - Update manifests across the workspace:
shpnpm dlx npm-check-updates -u -ws
- Refresh the lockfile and install updated packages:
shpnpm install
- Verify the update:
shpnpm test pnpm lint
Notes
- Pin registry
dependencies,devDependencies, andoptionalDependenciesto exact versions. Preserve supportedpeerDependenciesranges in public packages: peers describe consumer compatibility, not lockfile reproducibility. For example, keep the email editor's React and React DOM peers at>=19unless its actual compatibility requirements change. npm-check-updatesreads.ncurc.cjs, so the reject list is applied during the manifest update.pnpm installmay also bump the rootpackageManagerfield and regeneratepnpm-lock.yaml.- Do not run
pnpm devorpnpm buildunless the user explicitly asks. - Keep
@hookform/resolversin the.ncurc.cjsreject list and pinned to4.1.0whileapps/webremains onzod@3.25.76. The5.xresolver line importszod/v4/core, which has caused local Next.js/Turbopack resolution failures even though the app code still uses Zod 3.


