Update Packages

Use this workflow when updating dependencies in this repo.

Steps

1. Check the pinned package list in .ncurc.cjs. Do not upgrade packages listed there.
2. Keep the repo on Node 24. If you change Node runtime settings, update .nvmrc, engines.node, @types/node, Dockerfiles, and CI together.
3. Update manifests across the workspace:

pnpm dlx npm-check-updates -u -ws

4. Refresh the lockfile and install updated packages:

pnpm install

5. Verify the update:

pnpm test
pnpm lint

Notes

• Pin registry dependencies, devDependencies, and optionalDependencies to exact versions. Preserve supported peerDependencies ranges in public packages: peers describe consumer compatibility, not lockfile reproducibility. For example, keep the email editor's React and React DOM peers at >=19 unless its actual compatibility requirements change.
• npm-check-updates reads .ncurc.cjs, so the reject list is applied during the manifest update.
• pnpm install may also bump the root packageManager field and regenerate pnpm-lock.yaml.
• Do not run pnpm dev or pnpm build unless the user explicitly asks.
• Keep @hookform/resolvers in the .ncurc.cjs reject list and pinned to 4.1.0 while apps/web remains on zod@3.25.76. The 5.x resolver line imports zod/v4/core, which has caused local Next.js/Turbopack resolution failures even though the app code still uses Zod 3.