Distillation

["00135a50d30f5076ebc6245819e6a760","f3fbe429fd5cf672046bce2b431421ce","f1a6a6f231b8369cd16f606292aeb59b","6814b1d980dcc7821682950b38008173","a7d14e1f5530ae7a6d6499d131054939","e37b98cc0794566b714c2f31dbe05435","5ff5f32da248d0f5d91b5c8fc4135cf2","1fde7ede6c799be08abd08010bb8bfef","10ddcd446009e02b5d829258cf3df771","07569963048614f2a47956afec9f37e4","c16191c6cda768fca63d0e790c7a6cf1","22852e70fb13aa0c7912be0610936f05","526802ab25019140f52ee40a2bf8a557","34ee18be4224a0f80656d583f1ff20b5","d224dbfd18886123b022b8da3b42d97f","42784faeb22941f074b8aa69392630f2","889621bce4908564beb8a1dd7830ad19","1c7e9a422c902cf10ead9e1429f3f352","0ee347ce1b530330cceb49a30a6f33b2","dc608ed53b1bb639f7101da4c7ef305b","672f145f7d2453ad40a2683ad04f8d59","ade0c04cc87033eda872ca416b4d9da3","e14d533e366be79b027f26e1df77b95b","9dadc88e0f4fbd365e4194500c4bd955"]

<observations> Date: Jul 28, 2026 * 🟡 (12:34) Agent inspected vite-plugin-svgr@5.2.0 source: DEFAULT include is `**/*.svg?react` (NOT `**/*.svg`); uses `createFilter` from `@rollup/pluginutils@^5.3.0`; peer dependency vite ">=3.0.0". Plugin code dynamically imports @svgr/core + @svgr/plugin-jsx, then conditionally uses `transformWithOxc` (when `this.meta.rolldownVersion != null`) or `transformWithEsbuild` for JSX transformation * 🟡 (12:34) Agent inspected @svgr/plugin-jsx@8.1.0: jsxPlugin forwards `config.exportType` and `config.namedExport` (line 88-89 are the option-passthrough, not defaults) into `svgPresetOptions` for `@svgr/babel-preset`. Plugin-jsx supports jsxRuntime: "classic" | "classic-preact" | "automatic" | null — defaults to "classic" with `import React from 'react'`. Pnpm catalog has @svgr/core@^8.1.0, @svgr/plugin-jsx@^8.1.0 * 🟡 (12:34) Agent verified vite-plugin-svgr@5 config in PR #1342 is sound: (1) include pattern `["**/*.svg", "**/*.svg?react"]` correctly covers both bare .svg and ?react suffixed imports, (2) svgrOptions.exportType: "named" + namedExport: "ReactComponent" passes through @svgr/plugin-jsx → @svgr/babel-preset to produce `export const ReactComponent = (props) => ...` matching existing `import { ReactComponent as X } from "./foo.svg"` in .tsx files, (3) jsxRuntime defaults to "classic" which requires `import React from 'react'` to be in scope — this is already true in the codebase * 🟡 (12:34) Agent enumerated PR #1341 expected Dependabot closures (21 total): tar (#297, #298, #299, #300, #321 = 5), shell-quote (#296), js-yaml (#295), fast-uri (#311, #313 = 2), postcss (#320), react-router (#314, #315, #316, #319 = 4), builder-util-runtime (#318), app-builder-lib (#317), sharp (#312), @hono/node-server (#304), body-parser (#303), svgo (#305), brace-expansion (#323). PR title claims 22 — off by 1 (likely #298/#300 counted twice since both have range ≤7.5.17 patched=7.5.18) * 🟡 (12:34) Agent identified 6 Dependabot alerts NOT closed by PR #1341: #322 react-router (≥7.12.0 <8.3.0 — UNRESOLVABLE per .lore.md note, no 8.x exists yet), #290/#291/#292/#293/#301/#302 astro (need direct bump to >=7.1.0; PR #1341 keeps astro at 6.4.8). PR #1342 expected to close all 6 astro alerts by bumping astro to >=7.1.0 (resolves to 7.1.4) * 🟡 (12:34) Agent confirmed CRITICAL REGRESSION #1: @xmldom/xmldom 0.9.10 in lockfile breaks plist@3.1.0 → app-builder-lib@26.15.7 chain (build:mac). PR #1337's previous fix used override `">=0.8.13 <0.9"`; PR #1341 removes the ceiling and re-introduces the bug. No open Dependabot alert on @xmldom/xmldom exists (alert was previously closed), but runtime breakage persists * 🟡 (12:35) Agent discovered CRITICAL REGRESSION #2: lockfile snapshot shows pnpm override for brace-expansion `>=2.1.0 <3` forces minimatch@10.2.5 to resolve brace-expansion to 2.1.3 (recorded in lockfile at line ~12935). But minimatch@10.2.5 source line 157 calls `brace_expansion_1.expand(pattern, { max: options.braceExpandMax })` — and `expand` does NOT exist in brace-exp