Pin shared Yjs stack across client and server for lockstep bumps - #23783
Open
myabc wants to merge 4 commits into
Open
Pin shared Yjs stack across client and server for lockstep bumps#23783myabc wants to merge 4 commits into
myabc wants to merge 4 commits into
Conversation
Uses `directories` rather than repeated `directory` entries, so one Dependabot update config scans multiple manifests.
Adds a `hocuspocus` group so `@hocuspocus/server` and `extension-logger` bump together in the extension directory's PR. Client (`@hocuspocus/provider`, frontend) and server still land in separate PRs — Dependabot can't lockstep differently-named packages across directories; the #23755 skew guard covers that.
Reorders the existing group definitions A–Z for easier scanning; no behavior change.
`yjs` and `y-protocols` reach both the collab client (`/frontend`) and server (the extension) transitively via BlockNote, not via the `@hocuspocus/*` packages themselves. Declaring them as direct deps lets Dependabot track them, and the new `yjs` group uses `group-by: dependency-name` to merge each into one cross-directory PR — keeping the shared CRDT/sync layer aligned across both artifacts.
myabc
added
ci
dependencies
Contributor
There was a problem hiding this comment.
Pull request overview
This PR ensures the shared Yjs CRDT/sync layer (yjs + y-protocols) is explicitly tracked in both the collaboration client (frontend) and the collaboration server extension (extensions/op-blocknote-hocuspocus), enabling Dependabot to propose lockstep updates across both artifacts.
Changes:
- Add
yjsandy-protocolsas direct dependencies infrontendandop-blocknote-hocuspocus. - Update both
package-lock.jsonfiles to reflect these dependencies as direct deps. - Extend
.github/dependabot.ymlwith ayjsgroup usinggroup-by: dependency-nameto merge cross-directory updates per dependency.
Reviewed changes
Copilot reviewed 3 out of 5 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| frontend/package.json | Adds yjs and y-protocols as direct dependencies for the client. |
| frontend/package-lock.json | Records yjs and y-protocols as direct deps in the frontend lockfile. |
| extensions/op-blocknote-hocuspocus/package.json | Adds yjs and y-protocols as direct dependencies for the server extension. |
| extensions/op-blocknote-hocuspocus/package-lock.json | Records yjs and y-protocols as direct deps in the extension lockfile. |
| .github/dependabot.yml | Introduces a yjs group using group-by: dependency-name to generate cross-directory update PRs. |
Files not reviewed (2)
- extensions/op-blocknote-hocuspocus/package-lock.json: Generated file
- frontend/package-lock.json: Generated file
Base automatically changed from
housekeeping/dependabot-hocuspocus-groups
to
dev
June 23, 2026 06:30
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
This PR is based off #23782
Ticket
Stacked on #23782 · Related: #23755
What are you trying to accomplish?
Follow-up to #23782. Keeps the shared Yjs layer (
yjs+y-protocols) aligned between the collaboration client (/frontend) and server (/extensions/op-blocknote-hocuspocus), which is the layer both artifacts actually serialize to each other.Both reach
yjs/y-protocolstransitively via BlockNote — not via the@hocuspocus/*packages, which only sharelib0/@hocuspocus/common(andcommonis locked to the hocuspocus major, so it can't be pinned independently). The packages are declared as direct deps in both manifests so Dependabot tracks them, and a newyjsgroup usesgroup-by: dependency-nameto merge each into a single cross-directory PR instead of one per directory.What approach did you choose and why?
group-by: dependency-nameonly merges a dependency of the same name across directories — which is exactly the case here onceyjs/y-protocolsare direct deps in both manifests. This is distinct from #23782's@hocuspocus/*grouping, which can't span directories (different names).Caveats reviewers should weigh:
@hocuspocus/*packages themselves — those still bump in separate PRs.group-byis still beta and has been reported to fall back to per-directory PRs; the runtime version-skew guard in hocuspocus: Add provider/server wire-protocol integration test with CI version-skew guard #23755 remains the real compatibility safety net.Merge checklist