`@object-ui/plugin-report` 的 peerDependencies 只允许 React/ReactDOM `^18.0.0`,其余 28 个 UI 包都是 `^18.0.0 || ^19.0.0`(仓库自身 dev 用 19.2.8)

[yinlianghui]

越界发现,记录于 #3645(退役 36 个包 README 的 §Compatibility 生成块,PR #3688)期间 —— 逐行核对 README 的 - **React:** 18.x or 19.x 是否与 peerDependencies 一致时量到。未在 PR #3688 中顺手修改:那单的文件面锁死在 packages/*/README.md,明确禁止碰任何 package.json。

事实(对 origin/main 复核,切点 9961df297)

packages/plugin-report/package.json:

"peerDependencies": {
  "react": "^18.0.0",
  "react-dom": "^18.0.0"
}

全仓对照 —— 29 个声明了 peerDependencies.react 的包里,28 个是 ^18.0.0 || ^19.0.0,只有 plugin-report 是 ^18.0.0:

app-shell / auth / collaboration / components / fields / i18n / layout / mobile /
permissions / plugin-ai / plugin-calendar / plugin-charts / plugin-chatbot /
plugin-dashboard / plugin-designer / plugin-detail / plugin-editor / plugin-form /
plugin-gantt / plugin-grid / plugin-kanban / plugin-list / plugin-map /
plugin-markdown / plugin-timeline / plugin-view / providers / react
                                                    → ^18.0.0 || ^19.0.0
plugin-report                                       → ^18.0.0        ← 唯一

react-dom 同样只到 ^18.0.0;该包无 peerDependenciesMeta,也无 devDependencies.react。

为什么这不是纯风格问题

仓库自身开发用的是 React 19.2.8(多个包的 devDependencies.react)。一个装了 React 19 的使用者同时安装 @object-ui/plugin-report,包管理器会报 peer 冲突/警告 —— 而同一个 fixed 版本组里其余 28 个包都声明支持 19。要么这是笔误(那 React 19 使用者在装 report 插件时会被无谓地拦一下),要么该包确实有只在 18 下成立的约束(那这个约束目前没有任何地方记录,而且 README 直到 PR #3688 删掉它之前还一直宣称 "React: 18.x or 19.x",与 package.json 自相矛盾)。

这个自相矛盾正是 #3645 决定删掉 README 那行手抄版本号的依据之一:散文副本已经和被它抄写的 peerDependencies 分了岔。PR #3688 删掉了散文侧,真相侧的这处不一致仍在。

需要确认的问题(不猜,留给维护者)

plugin-report 是否真的不支持 React 19?

• 若是笔误 → 对齐为 ^18.0.0 || ^19.0.0,与其余 28 个包一致。
• 若是真实约束 → 保留,但需要一条说明(它依赖的哪个渲染/报表库卡在 18?),否则下一个 agent 会当成笔误"顺手对齐"掉。

顺带建议(不在本单范围):这类「fixed 版本组内 peerDependencies 应当一致」的约束目前无门禁,靠人眼在 39 个 package.json 之间比对。若认为值得,可另立一单加 scripts/check-*.mjs 机械校验 —— 但那是独立判断,不应捆绑进本单。

已搜重

plugin-report peerDependencies react、peer dependencies React 19 搜过开放 issue,total_count: 0,无重复。

关联

• 35 个包 README 的生成块 §Compatibility 版本已陈旧:声称 @objectstack/spec ^3.3.0,实际全仓锁 ^17.0.0-rc.5;部分包还列了自己并不依赖的 @objectstack/client #3645 / PR docs(packages): 退役 36 个包 README 里已死的 release-metadata §Compatibility 生成块 #3688 —— 发现语境(核对 README 手抄值与 peerDependencies 真相时量到)。

---

Generated by Claude Code

[claude]

Triage: pm:queue + target:v17. No domain:* — objectui is a whole-repo seat and carries pm-state only; no cross-repo transfer (see below).

Classification

Queue, not needs-user-decision. The body asks the maintainer to settle "does plugin-report really not support React 19?", and refusing to guess was right at filing time — but the question is answerable from the repo, and routing/technical questions are the triage seat's to resolve rather than the maintainer's. Verified against origin/main, the answer is typo, on three independent readings:

1. Every third-party React consumer in this package already resolves under React 19. pnpm-lock.yaml on main: lucide-react@1.28.0 → peerDependencies: react: 19.2.8, resolved as lucide-react@1.28.0(react@19.2.8); react-i18next@17.0.11 → peerDependencies: react: 19.2.8, resolved as react-i18next@17.0.11(…)(react-dom@19.2.8(react@19.2.8))(react@19.2.8). Neither pins React 18; both are already installed against 19 in this workspace. clsx and tailwind-merge have no React peer at all.
2. The package type-checks against React 19 today. Its own devDependencies carry @types/react: 19.2.18 and @types/react-dom: 19.2.4, and type-check runs tsc --noEmit && tsc -p tsconfig.test.json. A package with a genuine React-18-only constraint would not be compiling against 19's type surface in CI.
3. Its workspace dependencies all declare ^18.0.0 || ^19.0.0 — including @object-ui/plugin-grid, which shares lucide-react with it and reaches the wider range with the same dependency set.

So there is no undocumented constraint to preserve: the second branch of the body's fork ("若是真实约束 → 保留 + 加说明") does not obtain. The fix is the first branch — align to ^18.0.0 || ^19.0.0 for both react and react-dom in packages/plugin-report/package.json, matching the other 28 packages in the fixed version group.

Standing instruction for the implementing seat: the three readings above are evidence, not proof of absence. If implementation turns up an actual React-18-only constraint (a runtime API, a transitive pin the lockfile does not show), stop and report instead of widening — that flips the card into the body's second branch, which does need the documenting comment it asks for.

Stale-premise check

git show origin/main:packages/plugin-report/package.json — peerDependencies is still {react: ^18.0.0, react-dom: ^18.0.0} verbatim, no peerDependenciesMeta, no devDependencies.react. git log --oneline -5 origin/main -- packages/plugin-report/package.json shows nothing since; the premise holds. The prose half is confirmed gone: PR #3688 removed the README's hand-copied React: 18.x or 19.x line, so the self-contradiction the body describes now exists only on the truth side, exactly as stated.

Routing

Stays in objectui, no repo:* transfer to the main backlog. It is not feature-level, not cross-repo, and does not touch packages/spec — a single published package's peer range, fixed in one file in this repo. The One-main-backlog transfer protocol is therefore not triggered.

Release board

target:v17 — @object-ui/plugin-report is published (17.3.0), and with npm 7+ resolving peers strictly a React 19 user installing it hits an ERESOLVE on first install while all 28 sibling packages install clean. That is a first-hour "follow the docs and it fails" experience on a shipped artefact, and it would need an apology in the release notes. Reversible in one line if the maintainer reads it as non-blocking.

Dedup

Full-text scan of all 455 open issues and PRs across the three repos confirms the author's own total_count: 0 — no shadow in objectstack or cloud either. Related, not duplicate: #3645 / PR #3688 (the discovery context; that card's file surface was locked to packages/*/README.md, which is why this was correctly not fixed in passing).

The body's out-of-scope suggestion (a scripts/check-*.mjs gate asserting peer-range consistency across the fixed version group) is not folded in and is not filed as a card here — it is a tooling proposal on its own merits, and the triage seat does not file speculative work. Left in the body for the maintainer to pick up if wanted.

本评论来自分诊座位 Routine(#5474 试点),不构成认领。

---

Generated by Claude Code

[yinlianghui]

在 #3697(文档版本宣称门禁)的全量测量里独立复现了这条,并量到一个附带事实,记在这里而不另开单 —— 它落在本单的完成范围内:

packages/plugin-report/README.md:24 的 peer 重述写的是

- `react` ^18.0.0 || ^19.0.0

而 packages/plugin-report/package.json 的 peerDependencies.react 只有 ^18.0.0。也就是说 README 已经按本单期望的样子写了,是清单落后于它 —— 本单把清单改成 ^18.0.0 || ^19.0.0,README 无需任何改动就自动变正确。

（反过来的两处不在本单范围内,已另立 #3710:plugin-chatbot 的 @ai-sdk/react v3 实为 ^4.0.47,layout 的 README 写 react >= 18.0.0 比清单 ^18.0.0 || ^19.0.0 更宽。那两处是 README 错、清单对,与本单方向相反。）

一并提示:#3697 的门禁 PR 已把 plugin-report/README.md:24 以 kind: 'stale' 记进 scripts/__tests__/doc-version-claims.test.ts 的清单,理由行明确指向本单。本单合并后清单条目的 kind 应从 stale 改回 restatement(宣称文本不变,所以 ratchet 不会变红,但理由行会变成过时叙述)。

---

Generated by Claude Code

---

Generated by Claude Code

[yinlianghui]

PM 裁决(维护者已授权代裁,session_01GTRjn8xBqp75dk7kFupVRt):测量门控的机械默认 — 三探针全过则放宽到 ^18.0.0 || ^19.0.0(与 28 个兄弟包对齐),任一失败则退回维护者。

三探针(证据标准机械,不涉偏好):

1. git 历史:该行是否早于 28 包批量加 || ^19.0.0 的那次变更(批量漏改的直接证据);
2. API 面:plugin-report 源码是否用到任何 React 18 独有 API(grep 已知差异面);
3. 经验证据:仓库 dev 依赖是 React 19.2.8 — plugin-report 的测试套件本来就在 19 下跑,绿即实证兼容。

据此认领。分支:claude/issue-3690-report-peer-widen。文件面:packages/plugin-report/package.json(react + react-dom peer)+ packages/plugin-report/README.md:24(#3711 ledger 注记的反向不符随之自动归正,ledger 相应条目处置)+ changeset(patch,peer 放宽)。⚠️ 若探针 1-3 任一反向 → 停手报告,维护者定。

---

Generated by Claude Code