address version mismatches and package resolutions

[transphorm]

Improve monorepo by addressing some dependency resolutions

BEFORE:

AFTER:

Summary by CodeRabbit

• New Features

  • Enabled analytics integration in the app.

• Chores

  • Updated development tooling, type definitions, and dependency resolutions for improved stability and compatibility.
  • Added an install/reinstall script to simplify local setup.
  • Aligned React/React Native dependency versions across SDK packages.

• Tests

  • Removed an obsolete testing library.

• Chores (CI)

  • Improved package-version checks to allow intentional differences without failing CI.

[cursor]

You have run out of free Bugbot PR reviews for this billing cycle. This will reset on September 17.

To receive reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[coderabbitai]

Note

Other AI code review bot(s) detected

CodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review.

Walkthrough

Dependency and tooling updates across the monorepo: multiple @types/node bumps, added webpack and other devDeps in SDKs, adjustments to root resolutions and scripts, Podfile addition of FirebaseAnalytics, edits to app/package.json devDeps, and enhanced package-version check script to allow intentional differences.

Changes

Cohort / File(s)	Summary
App package app/package.json, app/ios/Podfile	Removed resolutions entry mapping punycode in app/package.json; removed devDependency @testing-library/react-hooks; added devDependencies @types/node ^22.18.3, hermes-eslint ^0.19.1, prop-types ^15.8.1. Added pod "FirebaseAnalytics", :modular_headers => true to app/ios/Podfile.
Root workspace package.json	Added reinstall-app script; added resolutions for @tamagui/animations-react-native and @tamagui/toast (1.126.14); removed several prior resolutions; added resolution alias punycode: npm:punycode.js@^2.3.1.
Version-check script scripts/check-package-versions.mjs	Removed @testing-library/react-hooks from testing list; introduced const intentionallyDifferentPackages = [] and hasIntentionalDifferences; exclude intentional packages from “other” mismatches and treat intentional-only differences as non-failing in CI.
Monorepo types bump circuits/package.json, common/package.json, contracts/package.json, sdk/core/package.json, sdk/qrcode/package.json, app/package.json	Updated devDependency @types/node to ^22.18.3 across multiple packages.
SDK tooling sdk/core/package.json, sdk/qrcode/package.json	Added devDependency webpack ^5.0.0.
Mobile SDK alpha packages/mobile-sdk-alpha/package.json	Added devDependencies react and react-dom ^18.3.1; changed peerDependency react-native from ^0.76.9 to 0.76.9 (removed caret).
Contracts tooling contracts/package.json	Added devDependencies @types/node ^22.18.3 and ts-node ^10.9.2.
Minor JSON/tsconfig fix sdk/qrcode/tsconfig.json	Removed trailing comma in exclude array (formatting-only).

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor CI as CI
  participant Script as check-package-versions.mjs
  participant Repo as package.jsons
  participant Agg as Aggregator
  participant Report as Reporter

  CI->>Script: start check
  Script->>Repo: read package.json files
  Script->>Agg: identify mismatches (critical, other)
  Script->>Agg: exclude criticalPackages
  Script->>Agg: exclude intentionallyDifferentPackages
  Agg-->>Script: {critical, intentional, other}

  alt critical exist
    Script->>Report: print critical mismatches
    Script-->>CI: exit 1
  else only intentional exist
    Script->>Report: print intentional-only notice
    Script-->>CI: exit 0
  else other non-critical exist
    Script->>Report: print non-critical summary
    Script-->>CI: exit 0
  end

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Possibly related PRs

• chore: add package version mismatch check #896: prior edits to scripts/check-package-versions.mjs — directly related to the intentional-differences logic.
• chore: minor fixes across monorepo #1068: edits to root package resolutions including punycode — overlaps resolution changes.
• Clean stale ios refs and update / fix typescript config #739: changes to common/package.json @types/node — overlaps the types bump.

Suggested labels

codex

Suggested reviewers

• aaronmgdr
• remicolin
• shazarre

Poem

Dependencies sway, types climb anew,
A Podfile gets analytics to view.
Scripts learn to forgive intentional quirks,
Webpack joins builds and typings do their work.
Small changes, tidy — the monorepo grew.

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title concisely captures the PR’s primary purpose—resolving dependency version mismatches and adjusting package resolutions—which aligns with the multiple package.json updates and resolution changes described in the summary. It is specific and clear enough for a reviewer scanning PR history to understand the main change without additional detail.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch justin/address-package-dependency-warnings

---

📜 Recent review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 0312a8b and 03cc947.

⛔ Files ignored due to path filters (2)

• app/ios/Podfile.lock is excluded by !**/*.lock
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (1)

• app/package.json (2 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• app/package.json

⏰ Context from checks skipped due to timeout of 300000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

• GitHub Check: test
• GitHub Check: build-android
• GitHub Check: build-ios
• GitHub Check: e2e-ios
• GitHub Check: analyze-ios
• GitHub Check: analyze-android
• GitHub Check: run_circuit_tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 3

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

scripts/check-package-versions.mjs (1)

276-293: Workflow Node version check can false‑positive; compare majors instead of substring

Substring matching against engines.node (e.g., ">=22 <23") vs workflow "22.x" is brittle and may fail CI incorrectly. Compare major versions numerically.

Apply:

-  const expectedNodeVersion = engineValues[0];
+  const expectedNodeVersion = engineValues[0];
+  const expectedMajor = Number(String(expectedNodeVersion).match(/\d+/)?.[0]);
   const workflowNodeVersions = workflowVersions.get('workflow node-version');
   if (workflowNodeVersions) {
-    const mismatches = [...workflowNodeVersions.keys()]
-      .filter(v => {
-        const versionStr = String(v);
-        // Skip dynamic versions like ${{ env.NODE_VERSION }} - these are set from .nvmrc
-        if (
-          versionStr.includes('${{') ||
-          versionStr.includes('env.NODE_VERSION')
-        ) {
-          return false;
-        }
-        return !versionStr.includes(expectedNodeVersion);
-      })
+    const mismatches = [...workflowNodeVersions.keys()]
+      .filter(v => {
+        const versionStr = String(v).trim();
+        // Skip dynamic versions like ${{ env.NODE_VERSION }}
+        if (versionStr.includes('${{') || versionStr.includes('env.NODE_VERSION')) return false;
+        const major = Number(versionStr.match(/\d+/)?.[0]);
+        if (Number.isNaN(major) || Number.isNaN(expectedMajor)) return false;
+        return major !== expectedMajor;
+      })
       .sort();

📜 Review details

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c11c9af and a0de75d.

⛔ Files ignored due to path filters (3)

• app/Gemfile.lock is excluded by !**/*.lock
• app/ios/Podfile.lock is excluded by !**/*.lock
• yarn.lock is excluded by !**/yarn.lock, !**/*.lock

📒 Files selected for processing (8)

• app/package.json (3 hunks)
• circuits/package.json (1 hunks)
• common/package.json (1 hunks)
• package.json (0 hunks)
• packages/mobile-sdk-alpha/package.json (1 hunks)
• scripts/check-package-versions.mjs (2 hunks)
• sdk/core/package.json (2 hunks)
• sdk/qrcode/package.json (2 hunks)

💤 Files with no reviewable changes (1)

• package.json

🧰 Additional context used

📓 Path-based instructions (3)

app/package.json

📄 CodeRabbit inference engine (.cursor/rules/mobile-sdk-migration.mdc)

Expose a 'test:build' script in the app's package.json that builds deps, types, performs bundle analysis, and runs tests

Files:

• app/package.json

packages/mobile-sdk-alpha/package.json

📄 CodeRabbit inference engine (.cursor/rules/mobile-sdk-migration.mdc)

packages/mobile-sdk-alpha/package.json: Expose a 'test:build' script in the SDK's package.json that runs build, test, types, and lint
Enable tree shaking for the SDK (e.g., ensure 'sideEffects' is correctly set in package.json and exports are ESM-friendly)

Files:

• packages/mobile-sdk-alpha/package.json

packages/mobile-sdk-alpha/**/package.json

📄 CodeRabbit inference engine (packages/mobile-sdk-alpha/AGENTS.md)

packages/mobile-sdk-alpha/**/package.json: Ensure package exports are properly configured
Verify package conditions are valid (e.g., exports conditions)

Files:

• packages/mobile-sdk-alpha/package.json

🧠 Learnings (17)

📓 Common learnings

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Address CodeRabbitAI feedback and resolve security warnings during review

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Update the app to consume the mobile-sdk-alpha package and replace local modules with SDK imports

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/package.json : Enable tree shaking for the SDK (e.g., ensure 'sideEffects' is correctly set in package.json and exports are ESM-friendly)

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/package.json : Ensure package exports are properly configured

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/package.json : Expose a 'test:build' script in the SDK's package.json that runs build, test, types, and lint

Learnt from: aaronmgdr
PR: selfxyz/self#951
File: app/src/providers/authProvider.web.tsx:17-18
Timestamp: 2025-08-25T14:25:57.586Z
Learning: The selfxyz/mobile-sdk-alpha/constants/analytics import path is properly configured with SDK exports, Metro aliases, and TypeScript resolution. Import changes from @/consts/analytics to this path are part of valid analytics migration, not TypeScript resolution issues.

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/*.{ts,tsx} : Use strict TypeScript type checking across the codebase

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/technical-specification.mdc:0-0
Timestamp: 2025-08-24T18:55:07.940Z
Learning: Applies to package.json : Distribute the SDK via npm/yarn with proper package metadata

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/package.json : Verify package conditions are valid (e.g., exports conditions)

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/*.{ts,tsx} : Avoid introducing circular dependencies

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/README.md : Document new/updated SDK modules and usage in packages/mobile-sdk-alpha/README.md

📚 Learning: 2025-08-24T18:55:07.940Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/technical-specification.mdc:0-0
Timestamp: 2025-08-24T18:55:07.940Z
Learning: Use semantic versioning MAJOR.MINOR.PATCH for circuits

Applied to files:

• circuits/package.json

📚 Learning: 2025-08-29T15:30:12.210Z

Learnt from: CR
PR: selfxyz/self#0
File: app/AGENTS.md:0-0
Timestamp: 2025-08-29T15:30:12.210Z
Learning: Use Node.js 22.x and Yarn via Corepack (nvm use; corepack enable && corepack prepare yarnstable --activate)

Applied to files:

• circuits/package.json

📚 Learning: 2025-08-25T14:25:57.586Z

Learnt from: aaronmgdr
PR: selfxyz/self#951
File: app/src/providers/authProvider.web.tsx:17-18
Timestamp: 2025-08-25T14:25:57.586Z
Learning: The selfxyz/mobile-sdk-alpha/constants/analytics import path is properly configured with SDK exports, Metro aliases, and TypeScript resolution. Import changes from @/consts/analytics to this path are part of valid analytics migration, not TypeScript resolution issues.

Applied to files:

• app/package.json

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to app/jest.config.cjs : Use Jest in the app with a React Native preset configured in app/jest.config.cjs

Applied to files:

• app/package.json
• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-29T15:31:15.924Z

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/package.json : Ensure package exports are properly configured

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/package.json : Enable tree shaking for the SDK (e.g., ensure 'sideEffects' is correctly set in package.json and exports are ESM-friendly)

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-29T15:31:15.924Z

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/package.json : Verify package conditions are valid (e.g., exports conditions)

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Update the app to consume the mobile-sdk-alpha package and replace local modules with SDK imports

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-29T15:31:15.924Z

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/**/*.{ts,tsx} : Avoid introducing circular dependencies

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/src/index.ts : Re-export new SDK modules via packages/mobile-sdk-alpha/src/index.ts

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/README.md : Document new/updated SDK modules and usage in packages/mobile-sdk-alpha/README.md

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-29T15:31:15.924Z

Learnt from: CR
PR: selfxyz/self#0
File: packages/mobile-sdk-alpha/AGENTS.md:0-0
Timestamp: 2025-08-29T15:31:15.924Z
Learning: Applies to packages/mobile-sdk-alpha/{**/*.test.{ts,tsx},**/__tests__/**/*.{ts,tsx}} : Use actual imports from selfxyz/mobile-sdk-alpha in tests

Applied to files:

• packages/mobile-sdk-alpha/package.json
• scripts/check-package-versions.mjs

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/demo/** : Provide an in-SDK lightweight React Native demo under packages/mobile-sdk-alpha/demo/

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-24T18:54:04.809Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/mobile-sdk-migration.mdc:0-0
Timestamp: 2025-08-24T18:54:04.809Z
Learning: Applies to packages/mobile-sdk-alpha/package.json : Expose a 'test:build' script in the SDK's package.json that runs build, test, types, and lint

Applied to files:

• packages/mobile-sdk-alpha/package.json

📚 Learning: 2025-08-24T18:52:25.796Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursorrules:0-0
Timestamp: 2025-08-24T18:52:25.796Z
Learning: Applies to tests/src/**/*.{test,spec}.{ts,tsx,js,jsx} : Use renderHook for custom hook testing

Applied to files:

• scripts/check-package-versions.mjs

📚 Learning: 2025-08-24T18:55:07.940Z

Learnt from: CR
PR: selfxyz/self#0
File: .cursor/rules/technical-specification.mdc:0-0
Timestamp: 2025-08-24T18:55:07.940Z
Learning: Applies to package.json : Distribute the SDK via npm/yarn with proper package metadata

Applied to files:

• sdk/core/package.json

⏰ Context from checks skipped due to timeout of 300000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (7)

• GitHub Check: build-android
• GitHub Check: test
• GitHub Check: build-ios
• GitHub Check: run_circuit_tests
• GitHub Check: e2e-ios
• GitHub Check: analyze-android
• GitHub Check: analyze-ios

🔇 Additional comments (6)

common/package.json (1)

695-695: Aligns Node typings with engines

Bump to @types/node ^22.18.3 matches engines ">=22 <23". LGTM.

sdk/qrcode/package.json (1)

89-89: Node typings bump is consistent

@types/node ^22.18.3 aligns with repo engines. Good.

circuits/package.json (1)

102-102: Node typings bump is consistent

@types/node ^22.18.3 aligns with engines and other packages. Good.

packages/mobile-sdk-alpha/package.json (1)

12-12: Tree‑shaking and CI hooks look correct

sideEffects: false and test:build (build → test → types → lint) satisfy SDK packaging guidelines.

Also applies to: 64-64

sdk/core/package.json (1)

66-66: Node typings bump is consistent

@types/node ^22.18.3 aligns with engines and other workspaces.

app/package.json (1)

57-58: test:build script meets requirements

Builds deps, runs types, performs bundle analysis, then tests. Good.

[coderabbitai]

⚠️ Potential issue

Pinning react-native to an exact version will break consumers on patch releases

Switching peerDependency react-native from ^0.76.9 to 0.76.9 forces an exact match and will cause npm/yarn/pnpm conflicts for apps on 0.76.x patch updates. Keep the caret to allow patch alignment within 0.76.x.

Apply:

 "peerDependencies": {
   "react": "^18.3.1",
-  "react-native": "0.76.9",
+  "react-native": "^0.76.9",
   "tamagui": "^1.126.0"
 }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	"react-native": "0.76.9",
	"tamagui": "^1.126.0"
	},
	"react-native": "^0.76.9",
	"tamagui": "^1.126.0"
	},

🤖 Prompt for AI Agents

packages/mobile-sdk-alpha/package.json lines 98-100: the react-native
peerDependency was pinned to an exact version ("0.76.9"); change it back to a
caret range by updating the value to "^0.76.9" so consumers on 0.76.x patch
releases can resolve correctly; update the package.json entry and run a quick
install/lockfile update to ensure the change is reflected.

[coderabbitai]

⚠️ Potential issue

“Intentional differences” still counted as mismatches, causing confusing output

Packages listed in intentionallyDifferentPackages are not excluded in the “OTHER VERSION MISMATCHES” section and still flip hasOtherIssues=true. Compute hasIntentionalDifferences dynamically and skip them in the first pass to avoid noise and incorrect CI summaries.

Apply:

 // Packages that are intentionally different for technical reasons
-const intentionallyDifferentPackages = [];
+const intentionallyDifferentPackages = [];
@@
-let hasIntentionalDifferences = intentionallyDifferentPackages.length > 0;
+// Only true if at least one intentionally-different package actually has a mismatch
+let hasIntentionalDifferences = intentionallyDifferentPackages.some(pkg => {
+  const versions = depVersions.get(pkg);
+  return versions && versions.size > 1;
+});
@@
 for (const category of categories) {
   let categoryHasIssues = false;
 
   for (const pkg of category.packages) {
-    if (criticalPackages.includes(pkg)) continue; // Skip critical packages, already shown above
+    if (
+      criticalPackages.includes(pkg) ||
+      intentionallyDifferentPackages.includes(pkg)
+    ) {
+      continue; // Skip critical and intentional differences in this section
+    }
 
     const versions = depVersions.get(pkg);
     if (versions && versions.size > 1) {

Also applies to: 330-331, 344-374