Epic Stack catch-up: tracking

[cursor]

Goal

Catch up the Epic Stack template packages on dev (staging), then promote to main when ready. One package per PR into dev, not main.

Workflow

1. Branch from origin/dev (not main, not stale updater PR P/patn dev stack updater #21).
2. Implement one child issue; respect each issue's Files allowed / Do not lists.
3. PR into dev → staging deploy (patn-dev-stack-staging) → human smoke (homepage, login, notes, dashboard).
4. Close child issue after staging smoke passes.
5. Production: merge dev → main when ready (package 1 alone is OK for prod; packages 5–7 should stay on staging longer).

Keep list (do not bump in unrelated PRs)

• vite, vitest, @vitejs/plugin-react, vite-tsconfig-paths
• express, @sentry/*
• @prisma/client, prisma, litefs-js
• Routing migration (react-router v6 → v7) — separate epic, not these catch-up issues

Implementation order

Order	Issue	Title	Notes
1	#24	React Router 7.18+ CVE	Merged PR #31 → dev. Staging was blocked until #33. Smoke after this dev deploy.
1b	#33	Cache Playwright browsers in CI	Merged PR #37 → dev. Cache + 1.51 collection shims (SVG stub, NODE_OPTIONS=--no-experimental-strip-types). Remove shims when Playwright is bumped in #29.
2	#25	Sentry hidden maps + event filters	Next after staging smoke of #24+#33
3	#26	Small bugfix batch
4	#27	LiteFS 2 + multi-region cache + asset fallthrough
5	#28	Server index.ts / drop server-build / Express 5
6	#29	Vite 7 + Vitest 4 + remaining majors	Includes Playwright 1.51 → 1.58; delete #33 collection shims
7	#30	react-router-auto-routes + dashboard+ rename	Separate from package bumps

Non-blocking: #34 — research/improve catch-up skill. Skill PR #35 still open — merge when convenient.

Already done in #24 (do not redo)

• Loader test args: url + pattern where required
• Info typegen removal → Route.ComponentProps loader/action data
• Do not restore build.external: ['**/*.svg'] (that caused Unknown file extension ".svg")

Already done in #33 (do not redo)

• Versioned Playwright browser cache in .github/workflows/deploy.yml
• 15-minute install timeout on cache miss; install-deps chromium on hit
• tests/svg-import-stub.cjs + PW_TEST_SOURCE_TRANSFORM on the test step (Playwright 1.51)
• NODE_OPTIONS=--no-experimental-strip-types on the test step (Node 22.18 vs Playwright 1.51)

Agent resources

• Skill: PR Add Epic Stack catch-up skill for Cloud Agents #35 → .cursor/skills/epic-stack-catch-up/SKILL.md (merge when convenient)
• Rule: .cursor/rules/epic-stack-catch-up.mdc (always-on pointer)

Rules for agents

• Do not start Epic Stack catch-up 2/7: Sentry hidden maps + event filters #25–Epic Stack catch-up 7/7: react-router-auto-routes + dashboard+ rename #30 until staging smoke of the current dev (RR CVE + Playwright CI) passes.
• Do not use PR P/patn dev stack updater #21 as base.
• If an issue says "Files allowed", do not edit outside that list unless compile/tests require it (document extras in PR).
• Verify versions in package.json / lockfile — do not assume template versions from memory.
• Do not pull all of Epic Stack catch-up 6/7: Vite 7 + Vitest 4 + remaining majors #29 forward just to get Playwright 1.58. If collection shims become painful, a Playwright-only bump can be a split of Epic Stack catch-up 6/7: Vite 7 + Vitest 4 + remaining majors #29 — ask first.

[goodeats]

Status update after #24 merge

• Epic Stack catch-up 1/7: React Router 7.18+ CVE bump #24 / PR Bump React Router to 7.18.2 for __manifest DoS CVEs #31 is on dev. Lint, typecheck, and vitest were green. Staging deploy did not run: Playwright collection failed with Unknown file extension ".svg" (No tests found). Browser install on that run actually succeeded (~25s); the hang is still worth fixing, but SVG collection is the current hard blocker.
• Catch-up CI: cache Playwright browsers (unblocks staging deploys) #33 is in progress: PR Cache Playwright browsers in CI (#33) #37 (cache Playwright browsers + ESM SVG stub for collection).
• Do not start Epic Stack catch-up 2/7: Sentry hidden maps + event filters #25 until Cache Playwright browsers in CI (#33) #37 is merged to dev.
• Skill PR Add Epic Stack catch-up skill for Cloud Agents #35 is still open — merge when convenient.

[goodeats]

#33 / PR #37 merged to dev. Current dev = RR CVE (#24) + Playwright CI cache (#33). Next package is #25 after staging smoke. Skill PR #35 still open.