Distillation

["67cd4c822a95c7a71573b2c9c1af43d8","8f26459b7aba7a3fb21ceed3870fce05","e95737d8285ec438e6c172d2d86dd49a","c3772ef2425cd7f7b0cdf72e95c5afcf","c9d627248046125d2b8eff07256dbfc7","b4c5d0eca7fbd292e4e2963f2a771ba1"]

<observations> Date: Jul 28, 2026 * 🟡 (12:29) Resolution data captured for 24 packages × 3 lockfiles (MAIN/PR1341/PR1342). Key versions: MAIN has @xmldom/xmldom@0.8.13, react-router-dom@7.17.0, sharp@[0.34.5, 0.35.0], vite@[6.4.3, 7.3.5], brace-expansion@[1.1.16, 2.1.2, 5.0.7], glob@13.0.6, @hono/node-server@[1.19.15, 2.0.10] * 🟡 (12:29) PR #1341 resolves: @xmldom/xmldom@0.9.10 (BROKEN — open-ended override floats past plist-compat 0.8.x), brace-expansion@2.1.3 (FORCED via blanket override `>=2.1.0 <3`), fast-uri@4.1.1, react-router-dom@7.18.1, sharp@0.35.3, vite@[6.4.3, 7.3.5], @hono/node-server@2.0.12 (1.19.x eliminated by override `>=2.0.5`), glob drops 13.x (forced to 10.4.5 via `glob@>=13.0.0: "10.4.5"`) * 🟡 (12:29) PR #1342 resolves: astro@7.1.4, vite@8.1.5 (single), vite-plugin-svgr@5.2.0 (was 3.3.0), @vitejs/plugin-react@[5.2.0, 6.0.4] (was [4.4.1, 5.2.0]), @xmldom/xmldom@0.9.10 (same break as PR1341), brace-expansion@2.1.3 (same break) * 🟡 (12:29) Assistant identified CRITICAL regressions in PR #1341: (1) @xmldom/xmldom@0.9.10 requires mimeType for parseFromString → plist@3.1.0 calls without mimeType → breaks plist parsing in app-builder-lib@26 → DMG/zip build; (2) brace-expansion@2.1.3 lacks NAMED export `expand` but minimatch@10.2.5 calls it → runtime `expand is not a function` error in build:mac. Same regression pattern as PR #1337 fix * 🟡 (12:29) Dependabot alert status analysis: PR #1341 closes #304 (@hono/node-server), #305 (svgo — already moot on main at 4.0.1), #312 (sharp), #314/#315/#316/#319 (react-router-dom) but NOT #322 (needs 8.3.0+); PR #1342 additionally closes #290/#291/#292/#293/#301/#302 (astro) * 🟡 (12:29) vite override in PR #1341 REMOVED `"vite@>=7.0.0 <7.3.5": ">=7.3.5 <8"` ceiling — vite 7.4+ and 8.x now unregulated. In PR #1342 vite override is `">=8.1.0"` open-ended — vite 9.x could float up later * 🟡 (12:29) Source code search: 27 files import `{ ReactComponent as ... }` from `.svg` files (was 28 per lore, off-by-one noted). vite-plugin-svgr config in PR #1342 vite.config.base.ts properly configures `exportType: "named"`, `namedExport: "ReactComponent"`, `include: ["**/*.svg", "**/*.svg?react"]` — matches the 27 import sites' pattern * 🟡 (12:29) vite-plugin-inspect usage audit: NO application source code imports from "vite-plugin-inspect". Only prose mentions in website docs ("Inspect Sidecar Stream", "Inspect performance traces", "Inspect performance traces and identify bottlenecks") at packages/website/src/content/docs/docs/{contribute/development,desktop-app,mcp}/*.mdx. Removal is safe — was only registered in astro.config.mjs for dev tooling (`/__inspect/` route) * 🟡 (12:29) vite.config.base.ts PR #1342 change