- next 16.2.7 -> 16.2.6 in both apps. 16.2.7 regresses Turbopack dev route
matching for API routes nested below a dynamic segment (probed in the
private repo: /api/items/[id]/fork, /api/scenes/[id]/events 404 with the
router's HTML not-found; production builds unaffected; bisected
16.2.6 good / 16.2.7 bad). 16.2.6 carries all the 16.2.5/16.2.6
security fixes — only the bugfix backports are forgone.
- Remove @react-three/uikit-lucide from @pascal-app/editor dependencies:
zero imports in this repo or private-editor; dead weight in every npm
consumer's install.
- Pin @visual-json/react "latest" -> "^0.4.0" (current resolution;
"latest" in a published package's deps is unreproducible and was
inconsistent with private-editor's ^0.4.0).
- Add root override three: 0.184.0, mirroring private-editor's dedupe —
drops the nested stats-gl three@0.170.0 so the lockfile resolves a
single three (the stated single-instance invariant now holds here too).
Verified: build, check-types, biome check, 931 package tests green;
lockfile resolves one next (16.2.6) and one three (0.184.0);
oxide/lightningcss optionalDependency pins still match resolutions.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
