Version pins — dudoxx-web-boot

The ONE pin table for this workspace (AC1.7). Canon: `~/.claude/ddx-topic-flows/VERSIONS.md` (verified 2026-10-10). Upstream check: [research/rq1-versions.md](/en/docs/research/rq1-versions) (2026-10-23). VERSIONS.md wins unless a recorded check says otherwise (00_JOB Assumption 5). `Resolved` = the version in `pnpm-lock.yaml` after the task 009 install (2026-10-23, `pnpm --filter <app> ls --depth 0`). | Package / image | Pin (minor line) | Upstream latest seen 2026-10-23 | Source | Resolved | |---|---|---|---|---| | `next` | 16.4 | 16.4.2 | VERSIONS.md `next16`; npm | 16.4.2 | | `react` / `react-dom` | 19.3 | not checked | VERSIONS.md `react19` | 19.3.1 | | `typescript` | 7.0 (ddx-web, packages); `typescript@6` alias for `nest build` only | not checked | VERSIONS.md `ts7` | web 7.0.2 · api alias 6.0.2 + `@typescript/native` 7.0.2 | | `tailwindcss` + `@tailwindcss/postcss` | 4.3 | 4.3.3 | VERSIONS.md `tw4`; npm | 4.3.3 | | `@nestjs/core` (+ common, platform) | 12.1 (floor 12.1) | 12.1.3 | VERSIONS.md `nest12`; npm | 12.2.0 (caret `^12.1.2`) | | `prisma` + `@prisma/client` | 7.10 | `@prisma/client` 7.10.0 | VERSIONS.md `prisma7`; npm. Prisma 8 is RC — do not use | 7.10.1 (ddx-api only) | | `better-auth` | 1.7 | 1.7.11 | VERSIONS.md `betterauth1`; better-auth changelog | declared `^1.7.12` (ddx-api), `^1.7.7` (ddx-web, client only) | | `@better-auth/api-key`, `@better-auth/passkey` | 1.7 | not checked | better-auth 1.7 moved both plugins out of core (ADR 0005 rows); `ddx-api/package.json` | declared `^1.7.12` (ddx-api only) | | PostgreSQL image | `postgres:18` | not checked | VERSIONS.md `pg18` | n/a (image) | | MinIO image | NO CANON — compose task pins an exact tag from a recorded registry check; never `latest` | not checked | none in VERSIONS.md (see RQ1 open item) | n/a (image) | | Node.js | 24 LTS | not checked | VERSIONS.md `node24` | host runs v26.12.0 (not changed; Prisma preinstall warns) | | pnpm | 12 | not checked | VERSIONS.md `pnpm12` (no corepack on Node ≥25) | 12.10.1 | ## Related pins (canon, used by later tasks) | Package | Pin | Source | Resolved | |---|---|---|---| | `next-intl` | 4.14 | VERSIONS.md `nextintl4` | 4.14.9 | | `zod` | 4.6 | VERSIONS.md `zod4` | 4.6.7 | | `@tanstack/react-query` | 5.104 | VERSIONS.md `tanstack5` | 5.104.5 | | `oxlint` + `oxlint-tsgolint` | 1.87 + 7 | VERSIONS.md `oxlint` | 1.89.0 + 7.0.2004 | | shadcn CLI | 4.21 | VERSIONS.md `shadcn4` | 4.22.1 | ## ADR 0005 additions — resolved (task 009) | Package | App | Range | Resolved | |---|---|---|---| | `@tanstack/react-virtual` | ddx-web | `^3.14.22` | 3.14.22 | | `recharts` | ddx-web | `^3.10.1` | 3.10.1 | | `embla-carousel-react` | ddx-web | `^8.6.0` | 8.6.0 | | `@tiptap/react` / `pm` / `starter-kit` | ddx-web | `^3.32.0` | 3.32.0 (lockstep) | | `streamdown` | ddx-web | `^2.7.1` | 2.7.1 | | `pdfjs-dist` | ddx-web | `^6.4.299` | 6.4.299 | | `@react-pdf/renderer` | ddx-web | `^4.9.0` | 4.9.0 | | `@dnd-kit/core` / `sortable` / `utilities` | ddx-web | `^6.3.1` / `^10.0.0` / `^3.2.2` | 6.3.1 / 10.0.0 / 3.2.2 | | `jose` | ddx-web | `^6.2.13` | 6.2.13 | | `@tanstack/react-table` | ddx-web | `8.21.3` exact | 8.21.3 | | `@prisma/adapter-pg` | ddx-api | `^7.10.0` | 7.10.1 | | `pg` + `@types/pg` | ddx-api | `^8.23.1` | 8.23.1 | | `@aws-sdk/client-s3` + `s3-request-presigner` | ddx-api | `^3.1156.0` | 3.1156.0 | ## Rules - `package.json` uses the caret of the minor line (e.g. `^16.4.0`). The lockfile holds the patch. - A new pin needs a VERSIONS.md row or a dated upstream URL in RQ1. Never invent a version. - A dependency outside the approved table of ADR 0005 is not allowed (invariant 8). --- Last reconciled: 2026-10-23 · task 043