Skip to content

merge: upstream 100 commits#313

Open
github-actions[bot] wants to merge 101 commits into
masterfrom
merge/upstream
Open

merge: upstream 100 commits#313
github-actions[bot] wants to merge 101 commits into
masterfrom
merge/upstream

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

@github-actions github-actions Bot commented May 4, 2026

Upstream Merge

100 new commits from plasmicapp/plasmic master.

Review using the Files Changed tab. The commit list includes upstream history.

Conflicts to resolve

git fetch origin merge/upstream
git checkout merge/upstream
# Resolve conflicts, then:
git push origin merge/upstream

Conflicted files:

plasmicpkgs-dev/package.json
platform/canvas-packages/package.json
platform/canvas-packages/yarn.lock
platform/loader-bundle-env/package.json
platform/loader-bundle-env/yarn.lock
platform/wab/package.json
platform/wab/src/wab/server/loader/gen-code-bundle.ts
platform/wab/src/wab/server/loader/gen-html-bundle.ts
platform/wab/src/wab/server/routes/loader.ts
platform/wab/src/wab/server/util/apm-util.ts
platform/wab/src/wab/server/util/s3-util.ts
platform/wab/src/wab/server/workers/prefill-cloudfront.ts
platform/wab/src/wab/shared/urls.ts
platform/wab/yarn.lock
yarn.lock

Before merging

See Upstream Merge Runbook.

  • Conflicts resolved (if any)
  • EP integrity tests pass
  • yarn.lock regenerated for modified package.json
  • CI triggered (close/reopen PR to trigger checks)
  • Merge with "Create a merge commit" — do NOT squash

sampullman and others added 29 commits April 28, 2026 03:06
GitOrigin-RevId: 94e25c0ea7431f3ce71d7fd63e8d42141ae5506e
GitOrigin-RevId: 41fbc3889b46cf8091bfa1fd2f2420128eb69b36
* feat: Highlight advanced props

* refactor / feedback

GitOrigin-RevId: 9edeb0b183b9fd6b373fd34a2e5cc27046d47426
GitOrigin-RevId: 68a5104052a763fd2c26fe4594fcd2e25a3cf54a
GitOrigin-RevId: 2f0f105d5b68cde85f24d6cacd93403dc92ad08f
GitOrigin-RevId: a845a88dda6b07356a3f321bf96d1c957653695f
GitOrigin-RevId: 3a101dcff4b6b5f6ce7db7752de7ac2c9901ab70
GitOrigin-RevId: a28317aef02a2eb91feb92387f2d0399cdbae87e
GitOrigin-RevId: fb745d5933efe7bfbbdb86d5e21383c51efcc73f
GitOrigin-RevId: 17782c920adf9f475363e16224f6f997b0d52154
Upgraded minor and patch versions across all platform workspaces.

Skipped version upgrades will be documented in a separate PR.

GitOrigin-RevId: a209f961d539ef5e67a72607eff1a7f74e038009
GitOrigin-RevId: 3fa1e141dd7097621f0de65f1fc610062248d23b
…(#2713)

@octokit/app bumped 16.1.1 -> 16.1.2 and @octokit/auth-unauthenticated
bumped 7.0.2 -> 7.0.3; rename patch files to silence version mismatch
warnings on yarn install.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 8eb7d2aa0b8aa95e78238e83466edf147bbd6970
@ai-sdk/react bumped from 3.0.80 to 3.0.170 as a transitive dependency of
@ai-sdk/google-vertex v4. In that range, addToolOutput changed its return
type from Promise<void> to void | PromiseLike<void>. Widening spawn's
parameter type accommodates this without forcing every call site to cast.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: cebf1df3da538c25819eb5d24c3100927f7de897
GitOrigin-RevId: 0e2dbc3d49d6dd874fa88fedc881de96fc42e8e9
…events (#2712)

BaseAnalytics.track() was not passing this.baseEventProperties to
mergeProperties, so properties like `production` and `host` set via
appendBaseEventProperties were never included in events sent to PostHog
(server-side).

mergeSane (lodash mergeWith) mutates the first argument in place. All
call sites pass class members as the first argument, so each call would
permanently accumulate properties from subsequent calls. Merge into a
fresh {} instead.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 96f0f681abbce3f2f5e9b7079342f9785b84ea5d
Upgrade devDependency ranges across all `packages/` workspaces.

## devDependency ranges narrowed to latest

**packages/cli**
- `@babel/core` ^7.12.3 → ^7.29.0
- `@babel/generator` ^7.12.1 → ^7.29.1
- `@babel/parser` ^7.12.3 → ^7.29.2
- `@babel/preset-typescript` ^7.12.1 → ^7.28.5
- `@babel/traverse` ^7.12.1 → ^7.29.0
- `@babel/types` ^7.23.0 → ^7.29.0
- `@types/babel__core` ^7.20.3 → ^7.20.5
- `@types/babel__generator` ^7.6.6 → ^7.27.0
- `@types/babel__traverse` ^7.20.3 → ^7.28.0
- `@types/cli-progress` ^3.11.0 → ^3.11.6
- `@types/lodash` ^4.14.157 → ^4.17.24
- `@types/semver` ^7.3.1 → ^7.7.1
- `@types/tmp` ^0.2.0 → ^0.2.6
- `esbuild` 0.17.18 → 0.27.7
- `lodash` ^4.17.19 → ^4.18.1
- `prettier` ^3.6.2 → ^3.8.3
- `semver` ^7.3.2 → ^7.7.4
- `socket.io-client` ^4.1.2 → ^4.8.3
- `tmp` ^0.2.1 → ^0.2.5
- `ts-jest` ^29.1.1 → ^29.4.9
- `tsx` ^4.20.6 → ^4.21.0
- `utility-types` ^3.10.0 → ^3.11.0
- `winston` ^3.3.3 → ^3.19.0

**packages/create-plasmic-app**
- `@types/lodash` ^4.14.168 → ^4.17.24
- `@types/semver` ^7.3.5 → ^7.7.1
- `tsx` ^4.20.6 → ^4.21.0

**packages/host**
- `@rollup/plugin-json` ^6.0.0 → ^6.1.0
- `@types/classnames` ^2.3.0 → ^2.3.4
- `rollup-plugin-banner2` ^1.2.2 → ^1.3.1

**packages/loader-react**
- `@types/pascalcase` ^1.0.0 → ^1.0.3

**packages/nextjs-app-router**
- `@types/yargs` ^17.0.32 → ^17.0.35

**packages/react-web**
- `@babel/core` ^7.14.6 → ^7.29.0
- `@babel/preset-env` ^7.22.15 → ^7.29.2
- `@babel/preset-react` ^7.22.15 → ^7.28.5
- `@babel/preset-typescript` ^7.22.15 → ^7.28.5
- `@rollup/plugin-json` ^6.0.0 → ^6.1.0
- `@types/classnames` ^2.3.1 → ^2.3.4
- `@types/clone` ^2.1.1 → ^2.1.4
- `@types/dlv` ^1.1.2 → ^1.1.5

**packages/react-web-runtime**
- `rollup` ^4.1.4 → ^4.60.2

## Lockfile deduplication

- Ran `yarn-deduplicate --strategy fewer` after install — reduced from 729 to 470 duplicate entries vs master
- Manually preserved two lockfile entries that dedup would incorrectly merge:
  - `@types/react@*` kept at 18.x (merging up to 19.x breaks `plasmicpkgs/react-slick` build — TS2786)
  - `@testing-library/user-event@^14.4.0` kept at 14.6.x (merging down to 14.5.2 breaks react-aria storybook focus tests)

## Skipped

- `react-aria` / `@react-aria/*` / `@react-stately/*` / `@react-types/*` — blocked by PLA-12485 (focus regression on overlay dismiss)

GitOrigin-RevId: 34942a8d48b026e372fe772a77752283cef420cf
 - @plasmicapp/cli@0.1.361
 - create-plasmic-app@0.0.142
 - @plasmicapp/data-sources@1.0.3
 - @plasmicapp/host@2.0.2
 - @plasmicapp/loader-gatsby@2.0.3
 - @plasmicapp/loader-nextjs@2.0.3
 - @plasmicapp/loader-react@2.0.3
 - @plasmicapp/nextjs-app-router@1.0.23
 - @plasmicapp/react-web@1.0.3
 - @plasmicapp/react-web-runtime@1.0.3
 - plasmicpkgs-dev@0.0.62
 - @plasmicpkgs/airtable@0.0.259
 - @plasmicpkgs/antd@2.0.167
 - @plasmicpkgs/antd5@0.0.340
 - @plasmicpkgs/plasmic-chakra-ui@0.0.75
 - @plasmicpkgs/cms@0.0.22
 - @plasmicpkgs/commerce@0.0.243
 - @plasmicpkgs/commerce-commercetools@0.0.193
 - @plasmicpkgs/commerce-local@0.0.243
 - @plasmicpkgs/commerce-saleor@0.0.207
 - @plasmicpkgs/commerce-shopify@0.0.251
 - @plasmicpkgs/commerce-swell@0.0.253
 - @plasmicpkgs/contentful@0.0.17
 - @plasmicpkgs/dnd-kit@0.0.22
 - @plasmicpkgs/fetch@0.0.35
 - @plasmicpkgs/framer-motion@0.0.243
 - @plasmicpkgs/plasmic-google-maps@0.0.24
 - @plasmicpkgs/graphql@0.0.29
 - @plasmicpkgs/plasmic-keen-slider@0.0.88
 - @plasmicpkgs/lottie-react@0.0.237
 - @plasmicpkgs/plasmic-mailchimp@0.0.22
 - @plasmicpkgs/plasmic-basic-components@0.0.274
 - @plasmicpkgs/plasmic-calendly@0.0.91
 - @plasmicpkgs/plasmic-cms@0.0.313
 - @plasmicpkgs/plasmic-content-stack@0.0.199
 - @plasmicpkgs/plasmic-contentful@0.0.193
 - @plasmicpkgs/plasmic-embed-css@0.1.229
 - @plasmicpkgs/plasmic-eventbrite@0.0.77
 - @plasmicpkgs/plasmic-giphy@0.0.77
 - @plasmicpkgs/plasmic-graphcms@0.0.216
 - @plasmicpkgs/plasmic-hubspot@0.0.89
 - @plasmicpkgs/plasmic-intercom@0.0.22
 - @plasmicpkgs/plasmic-link-preview@1.0.147
 - @plasmicpkgs/plasmic-nav@0.0.215
 - @plasmicpkgs/plasmic-pigeon-maps@0.0.77
 - @plasmicpkgs/plasmic-query@0.0.264
 - @plasmicpkgs/plasmic-rich-components@1.0.246
 - @plasmicpkgs/plasmic-sanity-io@1.0.224
 - @plasmicpkgs/plasmic-soundcloud@0.0.89
 - @plasmicpkgs/plasmic-strapi@0.1.201
 - @plasmicpkgs/plasmic-tabs@0.0.86
 - @plasmicpkgs/plasmic-typeform@0.0.89
 - @plasmicpkgs/plasmic-wordpress@0.0.171
 - @plasmicpkgs/plasmic-wordpress-graphql@0.0.161
 - @plasmicpkgs/plasmic-yotpo@0.0.88
 - @plasmicpkgs/radix-ui@0.0.103
 - @plasmicpkgs/react-aria@0.0.177
 - @plasmicpkgs/react-audio-player@0.0.72
 - @plasmicpkgs/react-awesome-reveal@3.8.247
 - @plasmicpkgs/react-chartjs-2@1.0.155
 - @plasmicpkgs/react-parallax-tilt@0.0.245
 - @plasmicpkgs/react-quill@1.0.108
 - @plasmicpkgs/react-scroll-parallax@0.0.254
 - @plasmicpkgs/react-slick@0.0.266
 - @plasmicpkgs/react-twitter-widgets@0.0.243
 - @plasmicpkgs/react-youtube@7.13.249
 - @plasmicpkgs/rive@0.0.31
 - @plasmicpkgs/plasmic-spotify@0.0.22
 - @plasmicpkgs/strapi@0.0.20
 - @plasmicpkgs/tiptap@0.0.28
 - @plasmicpkgs/vanilla-cookieconsent@0.0.21
 - @plasmicpkgs/wordpress@0.0.21

GitOrigin-RevId: f110feb3414bdfdcbd84167e91a951f8dcd4dd60
GitOrigin-RevId: be922d505cb61d4f6df699d002b4a3ba7540e0a3
Resolves critical/moderate audit vulnerabilities:
- handlebars: JS injection via AST type confusion (CVE, patch >=4.7.9)
- protobufjs: arbitrary code execution (patch >=7.5.5) - via posthog-js opentelemetry chain

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 29c254c6d581dd53094239218f0356e1a1c1ba2e
* fix: Choice prop codegen when options use object form

* test: wabToTsType

GitOrigin-RevId: 4b7d5bff4f86adc6f3917ecf1cd7a03e0af01a81
GitOrigin-RevId: 7e53e05781d6af6873315d1ad4eb4776e2e00697
GitOrigin-RevId: 13aad22bce0f9357d55549ead01d8b6df8d8733d
 - plasmicpkgs-dev@0.0.63
 - @plasmicpkgs/fetch@0.0.36
 - @plasmicpkgs/graphql@0.0.30

GitOrigin-RevId: a9a1f69ead8f2aebcc4e9b5a63c040c271a92252
GitOrigin-RevId: 643a9d8dfb2d09c8a2c1bd5178ad47683220e0a4
Adds a `loader_bundle_cache_total` Prometheus counter that tracks S3
bundle cache hits and misses, labeled by source ("prefill" vs "live"),
so we can measure how often a live CDN request triggers an esbuild
run vs being served from a prefilled S3 cache.

Adds cache miss log message with the cache key.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
GitOrigin-RevId: 29dd37be14bd3bab0922875ff51bf3f49b95a3b9
GitOrigin-RevId: 26a99ab7a4b47a43145712b8b0e4b68f8d7db9e8
GitOrigin-RevId: 8765cdc08085347514c193d541654af29c24d15a
GitOrigin-RevId: d781fb8e8a177f3cf7c58d0b632642c94c9bdebc
sampullman and others added 28 commits May 13, 2026 08:20
GitOrigin-RevId: c5c3a70d38788e105d963729c68164a4f94efdc7
GitOrigin-RevId: 5c4b98bfcafcd858849daf4695825acffbce19f1
GitOrigin-RevId: 83a656814c66a6424432cd51fffc5a67cd942d95
 - @plasmicapp/data-sources@1.0.6
 - @plasmicapp/host@2.0.3
 - @plasmicapp/loader-gatsby@2.0.5
 - @plasmicapp/loader-nextjs@2.0.4
 - @plasmicapp/loader-react@2.0.4
 - @plasmicapp/react-web@1.0.7
 - @plasmicapp/react-web-runtime@1.0.7
 - plasmicpkgs-dev@0.0.64
 - @plasmicpkgs/airtable@0.0.260
 - @plasmicpkgs/antd@2.0.168
 - @plasmicpkgs/antd5@0.0.344
 - @plasmicpkgs/plasmic-chakra-ui@0.0.76
 - @plasmicpkgs/cms@0.0.23
 - @plasmicpkgs/commerce@0.0.244
 - @plasmicpkgs/commerce-commercetools@0.0.194
 - @plasmicpkgs/commerce-local@0.0.244
 - @plasmicpkgs/commerce-saleor@0.0.208
 - @plasmicpkgs/commerce-shopify@0.0.252
 - @plasmicpkgs/commerce-swell@0.0.254
 - @plasmicpkgs/contentful@0.0.18
 - @plasmicpkgs/dnd-kit@0.0.23
 - @plasmicpkgs/fetch@0.0.37
 - @plasmicpkgs/framer-motion@0.0.244
 - @plasmicpkgs/plasmic-google-maps@0.0.25
 - @plasmicpkgs/graphql@0.0.31
 - @plasmicpkgs/plasmic-keen-slider@0.0.89
 - @plasmicpkgs/lottie-react@0.0.238
 - @plasmicpkgs/plasmic-mailchimp@0.0.23
 - @plasmicpkgs/plasmic-basic-components@0.0.275
 - @plasmicpkgs/plasmic-calendly@0.0.92
 - @plasmicpkgs/plasmic-cms@0.0.314
 - @plasmicpkgs/plasmic-content-stack@0.0.200
 - @plasmicpkgs/plasmic-contentful@0.0.194
 - @plasmicpkgs/plasmic-embed-css@0.1.230
 - @plasmicpkgs/plasmic-eventbrite@0.0.78
 - @plasmicpkgs/plasmic-giphy@0.0.78
 - @plasmicpkgs/plasmic-graphcms@0.0.217
 - @plasmicpkgs/plasmic-hubspot@0.0.90
 - @plasmicpkgs/plasmic-intercom@0.0.23
 - @plasmicpkgs/plasmic-link-preview@1.0.150
 - @plasmicpkgs/plasmic-nav@0.0.216
 - @plasmicpkgs/plasmic-pigeon-maps@0.0.78
 - @plasmicpkgs/plasmic-query@0.0.265
 - @plasmicpkgs/plasmic-rich-components@1.0.249
 - @plasmicpkgs/plasmic-sanity-io@1.0.225
 - @plasmicpkgs/plasmic-soundcloud@0.0.90
 - @plasmicpkgs/plasmic-strapi@0.1.202
 - @plasmicpkgs/plasmic-tabs@0.0.87
 - @plasmicpkgs/plasmic-typeform@0.0.90
 - @plasmicpkgs/plasmic-wordpress@0.0.172
 - @plasmicpkgs/plasmic-wordpress-graphql@0.0.162
 - @plasmicpkgs/plasmic-yotpo@0.0.89
 - @plasmicpkgs/radix-ui@0.0.104
 - @plasmicpkgs/react-aria@0.0.178
 - @plasmicpkgs/react-audio-player@0.0.73
 - @plasmicpkgs/react-awesome-reveal@3.8.248
 - @plasmicpkgs/react-chartjs-2@1.0.156
 - @plasmicpkgs/react-parallax-tilt@0.0.246
 - @plasmicpkgs/react-quill@1.0.109
 - @plasmicpkgs/react-scroll-parallax@0.0.255
 - @plasmicpkgs/react-slick@0.0.267
 - @plasmicpkgs/react-twitter-widgets@0.0.244
 - @plasmicpkgs/react-youtube@7.13.250
 - @plasmicpkgs/rive@0.0.32
 - @plasmicpkgs/plasmic-spotify@0.0.23
 - @plasmicpkgs/strapi@0.0.21
 - @plasmicpkgs/tiptap@0.0.31
 - @plasmicpkgs/vanilla-cookieconsent@0.0.22
 - @plasmicpkgs/wordpress@0.0.22

GitOrigin-RevId: c6d493ab33d8d50e512a6b0995aa882c8500d897
GitOrigin-RevId: 8b3a5e82aa643a19a5ca68ffc3543aba69be173a
* feat(copilot): add support for creating component, variantGroups and variants in copilot

* refactor: move the batch operations responsbility from client operatioins to tool functions

* refactor(add-component): requested changes

* fix(copilot-tools): createComponent undo logic

* fix(create-variant): add check to ensure standalone variant group only have single variant

* chore: assert truthy values in the create-component.spec.ts

GitOrigin-RevId: 28fa8d21d6e80a3971f37a8c8028b1ce4d5336cc
* chore(gh-action): update github workflow to v24

https://linear.app/plasmic/issue/PLA-12951/update-github-push-actions-before-june-2

* Update actions: checkout, cache, create-pr, setup-node

* fix: workflow env and pr create idempotency

---------

Co-authored-by: Sam Pullman <sampullman@gmail.com>
GitOrigin-RevId: 7d1088608db410aeea249f969d5ce074610e1ba9
- Adds $state support to server queries (SSR): codegen serializes stateSpecs in the query tree and filters $q/$props/$ctx/$state to declared deps so cache keys aren't invalidated by unrelated query resolutions.
- Replaces brittle $ctx/$props/$state change detection with a simpler "compare resolved args, reset if changed" model.
- Refactors serializeServerQuery into serializeCustomCode + serializeCustomFunctionExpr; tightens $StateSpec type to match react-web.
- Modifies custom code query codegen to explicitly list each dollar dependency.

GitOrigin-RevId: f8805b89239aa0904c8c0b28e4ce8670952ff940
 - @plasmicapp/data-sources@1.0.7
 - @plasmicapp/react-web@1.0.8
 - @plasmicapp/react-web-runtime@1.0.8
 - @plasmicpkgs/antd5@0.0.345
 - @plasmicpkgs/plasmic-link-preview@1.0.151
 - @plasmicpkgs/plasmic-rich-components@1.0.250
 - @plasmicpkgs/react-aria@0.0.179
 - @plasmicpkgs/tiptap@0.0.32

GitOrigin-RevId: 9b61e0f3ae3424690b98ea05cfc6c3a470f32f39
GitOrigin-RevId: 135928f9f7b708eaa5586ddcfbc703ef87c7cfb5
GitOrigin-RevId: 31bd41a283c30a77d39b04aafdf2a663112ef945
* feat(copilot): add tools to manage StyleTokens and it's varianted values

* refactor(variants): make component optional in getAllVariantsForTpl

* refactor(tools-token): only allow changing MutableTokens for now

* chore: address TS error with discriminated union

* chore: revert consideration of discriminated union type for getAllVariantsForTpl

GitOrigin-RevId: bdbed8e1b18e75bc3a9064cee5cf43e6e1921aa3
GitOrigin-RevId: 031481eb85a1cf51c2dc024baea76f39fac92d16
* fix: use create-next-app's --example flag

* fix: log unsupported template flag for tanstack

GitOrigin-RevId: 93325d45cbc25ef4e43a1544e4e5c3d15ab2479d
* fix: [RSC] Query builder - not all operations are implemented

* refactor

* refactor: reword

GitOrigin-RevId: a920406355b41adbca6d2d7cfef0739a26be04e7
 - create-plasmic-app@0.0.146

GitOrigin-RevId: 829025b05d0421d275395c51c54a434cedf8a176
…er component (#2785)

* fix: nextjs app-codegen template for plasmic-host

* chore: run-cpa

* feedback

GitOrigin-RevId: 00066e2332e92da2cc39e1473283f1e921f97519
GitOrigin-RevId: f3095ebe9539589be2094e3e22e116d82f208f82
…ut (#2780)

Mirrors the mini-cache fix (PR #2779) for wab, codegen, socket-server,
and integrations-cms. All four share runExpressApp in server-common.ts.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
GitOrigin-RevId: f109f9543f75a95566dcbe1533b72399a2f0c18c
 - create-plasmic-app@0.0.147

GitOrigin-RevId: 2e811068a089e1c86ca9213174860726042db0a9
update packages to trigger ci

GitOrigin-RevId: 5cb158a48d13649637610326acd2296009d5475f
GitOrigin-RevId: 681fb8d89a1a08531738850f616f40fc232cce61
 - @plasmicpkgs/plasmic-rich-components@1.0.251

GitOrigin-RevId: 2c59c9333440f11f21802699c20687b6cd2e983b
GitOrigin-RevId: 0156c3e18cd8716d40d59d100adf591d83fa083e
GitOrigin-RevId: 3ecc66013fc67787f440f273fb60e1a20345ba69
GitOrigin-RevId: 9ed58da9cbf87dad8eeabf4de501fb6e74744803
GitOrigin-RevId: 0c770feed9d5e86836bf8e2dabd3448db818ef53
@github-actions github-actions Bot changed the title merge: upstream 54 commits merge: upstream 100 commits May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants