[cixzhang]

Supersedes #10650 (co-authored by dependabot).

Maintainer impact

• Before: apps, examples, the CLI, the build package, test utilities and the seven themes declare older floors: React 19.2.7, lucide-react 1.18.0, StyleX 0.19.0, Testing Library, zod, vega, recharts and others.
• After: they declare dependabot's production-group floors, with one copy each of StyleX, React and @testing-library/dom in the lockfile.
• chore(deps): bump the production-dependencies group across 1 directory with 30 updates #10650's failing points, fixed here:
  • One StyleX: the catalog moves to 0.19.1, and the lockfile resolves every StyleX package to 0.19.1, including Core's ^0.19.0 and Storybook's @stylexjs/unplugin. chore(deps): bump the production-dependencies group across 1 directory with 30 updates #10650 had two copies, which failed the typecheck and the docsite build. Core's peer stays ^0.19.0.
  • One @testing-library/dom (10.4.2): the DateInput and layerClickBoundary UI tests pass (164 of 164).
  • recast stays 0.23.21, matching the shadcn override. The CLI's source-variants tests pass.
  • No vite change: the catalog keeps vite: ^8.1.3, so @astryxdesign/build's optional peer keeps its published floor. chore(deps): vite 8.1.3 → 8.3.5 in the lockfile #10707 moves the installed vite.
  • A Changeset names the build package, the CLI and the seven themes, whose dependency floors change. It credits the contributor. No peer range changes.
• Follow-ups the newer releases need:
  • lucide-react 1.66 declares each icon as LucideIcon, so the docsite's playground type generator now matches both declaration forms. It finds 2,016 icons where it found 1.
  • The StyleX capability registry (internal/stylex-capabilities) and the AGENTS.md summary are regenerated for 0.19.1. The 88 of 92 supported features are unchanged.
  • The docsite keeps monaco-editor 0.55. With 0.57, the playground's editor model never appears to the browser contracts: window.monaco has no models, and 8 playground-preview-isolation cases time out. That bump needs its own change.
  • The CLI keeps postcss: ^8.5.23, because the workspace's security-floor override keeps PostCSS on 8.5.25 and a higher floor would be untested.
• Left to their own pull requests:
  • next (chore(deps): next 16.3.6 → 16.4.5 (security releases) #9788);
  • vite (chore(deps): vite 8.1.3 → 8.3.5 in the lockfile #10707);
  • postcss-selector-parser (chore(deps): one postcss-selector-parser, 7.1.7 #10705);
  • @modelcontextprotocol/sdk (chore(deps): @modelcontextprotocol/sdk 1.30.0 → 1.32.2 #10706).
• Release age: every new floor is older than the workspace's 7-day minimumReleaseAge (the newest, lucide-react 1.66.0, is from 2026-10-31), and the lockfile passes the supply-chain policy check.

Change

• 23 package.json files: chore(deps): bump the production-dependencies group across 1 directory with 30 updates #10650's ranges, except next, vite, recast, postcss-selector-parser, @modelcontextprotocol/sdk, the CLI's postcss and the docsite's monaco-editor, which keep main's.
• apps/docsite/scripts/generate-playground-types.mjs: matches LucideIcon icon declarations.
• internal/stylex-capabilities/*, AGENTS.md: StyleX 0.19.1.
• pnpm-workspace.yaml catalog: StyleX 0.19.1 (three packages), @testing-library/react 16.3.3, prettier 3.9.10, esbuild 0.28.2. vite stays.
• pnpm-lock.yaml: regenerated with pnpm 11.10.0, then deduplicated (pnpm dedupe --lockfile-only).
• .changeset/production-dependency-floors-1108.md: [fix] patch for the build package, the CLI and the seven themes.

Evidence

• A frozen-lockfile install passes, and so does the build package's build.
• DateInput.test.tsx and layerClickBoundary.test.tsx: 164 passed.
• source-variants.test.mjs: 6 passed.
• scan.test.mjs passes, and check:changesets passes.
• The core typecheck (all four programs) passes.
• The typecheck, the docsite build and every suite run in this pull request's CI.
• CI impact: no job, runner or trigger changes.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
astryx	Error		Nov 10, 2026 12:13pm UTC

[astracat-bot]

AI review status for this pull request.

Review status	Updated
🟡 Reviewed (for maintainers only)	Nov 10, 2026, 12:29 PM UTC

[github-actions]

PR Analysis Report

🔎 Preview · 9733b3a

❌ The preview failed to build; see Vercel's comment.

Package size:

• @astryxdesign/cli 3.56 MB packed (+12 B); no new dependencies
• @astryxdesign/theme-butter 48.9 kB packed (−1 B); no new dependencies
• @astryxdesign/theme-neutral 40.7 kB packed (−2 B); no new dependencies

API changes: none in this pull request

Committed API report behind this build: cli 36 rows, core 36 rows; run pnpm api:report.

Wide change (shared styles: packages/themes/butter/package.json, packages/themes/chocolate/package.json, packages/themes/gothic/package.json, and 4 more): add ci:run-visual, ci:run-a11y or ci:run-rtl to run them.

Current run: CI concluded failure; parts of this report may be missing.

---

_{Generated by PR Enrichment workflow | View full report}

[astracat-bot]

Requesting changes: CI's first full run on this head fails in lint, the Node suite and the docsite build, and four fixes clear it.

• Miss: apps/docsite/scripts/generate-playground-types.mjs:243 only matches react.ForwardRefExoticComponent declarations, but lucide-react 1.66.0 declares its icons as LucideIcon, so the playground types every icon as any and playground-scope.test.ts fails docsite-build and docsite-test: match both forms, for example /^declare const (\w+): (?:react\.ForwardRefExoticComponent|LucideIcon\b)/gm.
• internal/stylex-capabilities/capabilities.json and CAPABILITIES.md still record StyleX 0.19.0, so internal/stylex-capabilities/scan.test.mjs fails against the installed 0.19.1: run node internal/stylex-capabilities/scan.mjs and commit the result.
• The changeset credits no contributor, so pnpm check:changesets fails lint: add @cixzhang on its own line after the body.
• packages/cli/package.json publishes postcss: ^8.5.32, but the workspace override postcss: ^8.5.23 keeps the repository on 8.5.25, so the floor the changeset says the CLI needs is never installed or tested: raise the override to ^8.5.32 and regenerate the lockfile, or keep the CLI at ^8.5.23 and drop postcss from the changeset.

The changeset could also name @stylexjs/babel-plugin 0.19.1, which the published CLI now requires through the catalog.

[Automated review]

[astracat-bot]

Approved. The dependency floors stay within the release-compatibility rules (no peer range changes, every supported combination keeps working), and this update fixes all four items from the last review: the playground's lucide icon types, the StyleX capability registry, the changeset credit and the CLI's postcss floor. CI passes; one Layer entrance proof in pr-interaction (5/5) failed on its first attempt and passed on re-run.

• Non-blocking: internal/vibe-tests/package.json raises postcss to ^8.5.32, but the workspace override keeps the repository on 8.5.25. That is the same reason the CLI stays on ^8.5.23.

[Automated review]

[astracat-bot]

Non-blocking: the workspace override postcss: ^8.5.23 in pnpm-workspace.yaml replaces this range, so the lockfile keeps vibe-tests on postcss 8.5.25 and ^8.5.32 is never installed here. That is the reason the CLI stays on ^8.5.23; keep ^8.5.23 here too, or raise the override.

[astracat-bot]

Requesting changes: the merge with main regenerated pnpm-lock.yaml without deduplicating it, so this head installs two StyleX and two @testing-library/dom copies again. Running pnpm dedupe --lockfile-only and committing the lockfile should clear all four items below.

• pnpm-lock.yaml resolves @stylexjs/stylex 0.19.0 for Core, Charts, Lab and Richtext and @stylexjs/babel-plugin and @stylexjs/unplugin 0.19.0 for @astryxdesign/build, beside 0.19.1 everywhere else, so CI typecheck fails in @astryxdesign/cli and apps/storybook with "Two different types with this name exist" for StyleXClassNameTag.
• Regression: internal/stylex-capabilities/capabilities.json records 0.19.1 while Core now installs 0.19.0, so internal/stylex-capabilities/scan.test.mjs fails ("expected '0.19.1' to be '0.19.0'").
• Core's @testing-library/react now resolves @testing-library/dom 10.4.1 beside the 10.4.2 that the root's @testing-library/user-event uses, and three DateInput tests and three layerClickBoundary tests fail (158 of 164 pass, against all 164 on the base).
• Regression: the title, the body ("one copy each of StyleX, React and @testing-library/dom", "164 of 164") and the merge commit message ("keeps the same versions as the pull request's own lockfile") no longer describe this head, so dedupe until they hold or reword them.

Non-blocking: internal/vibe-tests/package.json still raises postcss to ^8.5.32 under the workspace's ^8.5.23 override.

[Automated review]

[astracat-bot]

The regenerated lockfile resolves the build package's StyleX peers to 0.19.0 here, and Core, Charts, Lab and Richtext to @stylexjs/stylex 0.19.0 (Core's importer, line 889), beside the catalog's 0.19.1. The previous head resolved every StyleX package to 0.19.1. With two copies, CI typecheck fails in @astryxdesign/cli and apps/storybook ("Two different types with this name exist" for StyleXClassNameTag). The same regeneration also left Core on @testing-library/dom 10.4.1 (line 929), which fails six DateInput and layerClickBoundary tests. Run pnpm dedupe --lockfile-only and commit the result.

[astracat-bot]

Regression: the registry records 0.19.1, but after the merge Core resolves @stylexjs/stylex 0.19.0, so scan.test.mjs:26 fails (expected '0.19.1' to be '0.19.0'). Deduplicating the lockfile brings Core back to 0.19.1 and makes this line correct again; the file itself needs no edit.