[pull] main from liveblocks:main

.github/workflows/docker-image.yml

@@ -55,7 +55,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3

.github/workflows/e2e-todo-list.yml

@@ -24,11 +24,11 @@ jobs:
         working-directory: examples/nextjs-todo-list
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: lts/*
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: examples/nextjs-todo-list/package-lock.json
 
@@ -38,7 +38,7 @@ jobs:
       - run: npx playwright test --retries=5
 
       - name: Upload report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: failure()
         with:
           name: todo-list-playwright-report

.github/workflows/publish-cli-tools.yml

@@ -31,7 +31,7 @@ jobs:
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.RELEASE_COMMIT_WRITE_TOKEN }}
 
@@ -65,9 +65,9 @@ jobs:
           echo "${{ steps.npm_tag.outputs.value }}"
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: "22.x"
+          node-version-file: ".nvmrc"
           registry-url: "https://registry.npmjs.org"
 
       - name: Setup git config

.github/workflows/publish-devtools.yml

@@ -31,7 +31,7 @@ jobs:
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.RELEASE_COMMIT_WRITE_TOKEN }}
 
@@ -44,10 +44,10 @@ jobs:
       - name: Validate branch
         run: test "$(git rev-parse --abbrev-ref HEAD)" == "main"
 
-      - name: Use Node.js
-        uses: actions/setup-node@v4
+      - name: Setup Node
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: "22.x"
+          node-version-file: ".nvmrc"
           cache: "npm"
           cache-dependency-path: "**/package-lock.json"
 
@@ -61,7 +61,7 @@ jobs:
 
       - name: Turbo Cache
         id: turbo-cache
-        uses: actions/cache@v4
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           key: turbo-cache-@liveblocks/devtools-bust
           path: node_modules/.cache/turbo

.github/workflows/publish-packages.yml

@@ -33,7 +33,7 @@ jobs:
           echo "$HOME/.local/bin" >> $GITHUB_PATH
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.RELEASE_COMMIT_WRITE_TOKEN }}
 
@@ -67,9 +67,9 @@ jobs:
           echo "${{ steps.npm_tag.outputs.value }}"
 
       - name: Setup Node.js environment
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: "22.21.0"
+          node-version-file: ".nvmrc"
           registry-url: "https://registry.npmjs.org"
 
       - name: Setup git config

.github/workflows/publish-python.yml

@@ -19,7 +19,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.RELEASE_COMMIT_WRITE_TOKEN }}
 

.github/workflows/tests.yml

@@ -15,7 +15,7 @@ jobs:
       changes: ${{ steps.filter.outputs.changes }}
 
     steps:
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
         id: filter
         with:
           predicate-quantifier: "every"
@@ -43,7 +43,6 @@ jobs:
 
     strategy:
       matrix:
-        node-version: [22.21.0]
         pkg:
           [
             "@liveblocks/core",
@@ -67,13 +66,13 @@ jobs:
     steps:
       - name: Checkout
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Use Node ${{ matrix.node-version }}
+      - name: Setup Node
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: "**/package-lock.json"
 
@@ -84,16 +83,15 @@ jobs:
       - name: Turbo Cache
         if: needs.check_for_code_changes.outputs.changes == 'true'
         id: turbo-cache
-        uses: actions/cache@v4
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
-          key: turbo-cache-${{ matrix.node-version }}-${{ matrix.pkg }}-bust3
+          key: turbo-cache-${{ matrix.pkg }}-bust4
           path: node_modules/.cache/turbo
-          restore-keys:
-            turbo-cache-${{ matrix.node-version }}-${{ matrix.pkg }}-bust3
+          restore-keys: turbo-cache-${{ matrix.pkg }}-bust4
 
       - name: Install Bun
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 #v2
 
       - name: Build
         if: needs.check_for_code_changes.outputs.changes == 'true'
@@ -134,10 +132,6 @@ jobs:
     needs: check_for_code_changes
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [22.21.0]
-
     timeout-minutes: 60
 
     env:
@@ -150,13 +144,13 @@ jobs:
     steps:
       - name: Checkout
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Use Node ${{ matrix.node-version }}
+      - name: Setup Node
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: "**/package-lock.json"
 
@@ -172,7 +166,7 @@ jobs:
         if: needs.check_for_code_changes.outputs.changes == 'true'
         run: npm run test -- --filter @liveblocks/next-sandbox
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: failure()
         with:
           name: playwright-report
@@ -184,10 +178,6 @@ jobs:
     needs: check_for_code_changes
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [22.21.0]
-
     timeout-minutes: 60
 
     env:
@@ -200,13 +190,13 @@ jobs:
     steps:
       - name: Checkout
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Use Node ${{ matrix.node-version }}
+      - name: Setup Node
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: "**/package-lock.json"
 
@@ -222,7 +212,7 @@ jobs:
         if: needs.check_for_code_changes.outputs.changes == 'true'
         run: npm run test -- --filter @liveblocks/next-ai-kitchen-sink
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         if: failure()
         with:
           name: ai-playwright-report
@@ -234,10 +224,6 @@ jobs:
     needs: check_for_code_changes
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [22.21.0]
-
     timeout-minutes: 60
 
     env:
@@ -251,13 +237,13 @@ jobs:
     steps:
       - name: Checkout
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Use Node ${{ matrix.node-version }}
+      - name: Setup Node
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: "**/package-lock.json"
 
@@ -274,28 +260,24 @@ jobs:
     needs: check_for_code_changes
     runs-on: ubuntu-latest
 
-    strategy:
-      matrix:
-        node-version: [22.21.0]
-
     timeout-minutes: 60
 
     steps:
       - name: Checkout
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - name: Use Node ${{ matrix.node-version }}
+      - name: Setup Node
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
         with:
-          node-version: ${{ matrix.node-version }}
+          node-version-file: ".nvmrc"
           cache: npm
           cache-dependency-path: "**/package-lock.json"
 
       - name: Install Bun
         if: needs.check_for_code_changes.outputs.changes == 'true'
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 #v2
 
       - name: Install dependencies
         if: needs.check_for_code_changes.outputs.changes == 'true'
@@ -314,7 +296,7 @@ jobs:
       pull-requests: read
 
     steps:
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
         id: filter
         with:
           filters: |
@@ -326,7 +308,7 @@ jobs:
 
       - name: Checkout
         if: steps.filter.outputs.python_sdk == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install uv
         if: steps.filter.outputs.python_sdk == 'true'
@@ -359,7 +341,7 @@ jobs:
       pull-requests: write
 
     steps:
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4
         id: filter
         with:
           filters: |
@@ -369,7 +351,7 @@ jobs:
 
       - name: Checkout
         if: steps.filter.outputs.python_sdk == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Install uv
         if: steps.filter.outputs.python_sdk == 'true'

.gitignore

@@ -5,6 +5,7 @@
 .plasmo/
 .svelte-kit/
 .turbo/
+.vitest-typecheck/
 .vercel/
 .vim/
 .vscode/

.nvmrc

@@ -1 +1 @@
-v22.21.0
+v24.14.1

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## vNEXT (not yet released)
 
+### `@liveblocks/emails`
+
+- Add missing peer dependency declarations for `yjs` and `y-prosemirror`.
+
 ## v3.18.2
 
 ### `@liveblocks/client`

CLAUDE.md

@@ -32,6 +32,13 @@ When running scripts, use `npx turbo`, not `npm`.
 - Use Σ-suffix for variables storing Signals (MutableSignal, Signal,
   DerivedSignal, etc)
 
+# Dependencies
+
+- When adding new peerDependencies, pin them to major version ranges initially
+  (e.g. `"^13"` for yjs, `"^1"` for y-prosemirror, `"^18 || ^19"` for react).
+  Widen after verification. To support multiple major versions, use
+  `"^1 || ^2"`.
+
 # Code quality
 
 - Never use `as` casts blindly -- explain the type issue and let me decide. If