chore: upgrade comapeo dependencies by cimigree · Pull Request #1797 · digidem/comapeo-mobile

cimigree · 2026-03-31T15:09:35Z

closes #1783
Upgrade @comapeo/core to v6.0.2 and @comapeo/core-react to v10.0.1 and @comapeo-ipc to 7.0.0

Breaking change migrations:

Replaces ClientApiProvider with the new ComapeoCoreProvider
Removes useSetUpInvitesListeners()
Updates useManyMembers() in YourTeam to pass includeLeft: true so that we have access to past collaborators
Fixes TypeScript error in useActiveArchiveServer — uses includeLeft: true so the returned type is MemberInfo[], which satisfies the isActiveArchiveServerMember type predicate
useProjectOwnRoleChangeListener() — ProjectRemovalListener did not need to change because it had projectApi.addListener separately (done earlier in anticipation by @achou11 in chore: manually set up effect for handling 'own-role-change' events #1738 )
Fixes RoleChangeEvent import to come from @comapeo/core root instead of the removed internal dist/mapeo-project subpath

Map server wiring:

Most of this code was written by Gregor in #1693 and ported over in here so that the map can load and new map files can be uploaded in the develop branch, and basically so it doesn't break!

Initializes @comapeo/map-server in the Node.js backend (app.js) and exposes it via createAppRpcServer
Adds createAppRpc on the frontend to connect to the map server over IPC, providing getMapServerBaseUrl to ComapeoCoreProvider
Replaces the old hand-rolled map hooks (useImportCustomMapFile, useRemoveCustomMapFile, useGetCustomMapInfo) with the equivalents now provided by @comapeo/core-react
Updates BackgroundMaps screen to use expo-file-system's File.pickFileAsync() and the new useImportCustomMap / useGetCustomMapInfo hooks from @comapeo/core-react

Infrastructure:

Importing from @comapeo/map-server pulls in Node.js-only code (node:assert, node:http, etc.) which breaks Metro bundling for React Native — even though only DEFAULT_MAP_ID is used from it. I have worked around this with a Metro resolveRequest redirect (with help from AI), but the real fix should be upstream and I am hoping you will know what to do.
Adds patches/expo+54.0.33.patch — extends Expo's fetch module to support uploading expo-file-system File objects directly (needed for map file upload) (Gregor wrote)
Adds src/backend/patches/typebox+1.0.81.patch — replaces Unicode property escape regexes with ASCII equivalents for compatibility with older Android JS engines (Gregor wrote
Updates jest.config.js to handle new ESM-only deps (custom-error-creator, secret-stream-http), unexported package.json subpath from @comapeo/core v6's stricter exports map, and redirects @comapeo/map-server to its constants file for the same reason as the Metro fix

…pport new map server and map code in backend. Adds patches as needed.

awana-lockfile-bot · 2026-03-31T15:11:35Z

`package-lock.json` changes

Click to toggle table visibility

Name	Previous	Current
`@augment-vir/common`	-	26.4.0
`@comapeo/core-react`	7.2.0	10.0.1
`@comapeo/core`	5.5.0	6.0.2
`@comapeo/ipc`	6.0.2	7.0.0
`@comapeo/map-server`	-	1.0.1
`@mapeo/sqlite-indexer`	-	1.0.2
`bare-events`	2.5.4	2.8.2
`better-sqlite3`	-	11.10.0
`browser-or-node`	-	2.1.1
`custom-error-creator`	-	1.1.1
`drizzle-orm`	-	1.0.0-beta.1-fd8bfcc
`events-universal`	-	1.0.1
`eventsource-client`	-	1.2.0
`eventsource-parser`	-	3.0.6
`expect-type`	-	0.15.0
`itty-router`	-	5.0.23
`map-obj`	-	5.0.2
`p-mutex`	-	0.1.0
`run-time-assertions`	-	1.5.2
`secret-stream-http`	-	1.0.1
`streamx`	2.22.0	2.25.0
`typebox`	-	1.1.10
`typed-event-target`	-	3.4.0
`wsl-utils`	-	0.1.0

awana-lockfile-bot · 2026-03-31T15:11:42Z

`src/backend/package-lock.json` changes

Click to toggle table visibility

Name	Previous	Current
`@augment-vir/common`	-	26.4.0
`@comapeo/core`	5.5.0	6.0.2
`@comapeo/ipc`	6.0.2	7.0.0
`@comapeo/map-server`	-	1.0.1
`@hyperswarm/secret-stream`	6.6.3	6.7.1
`bare-events`	2.4.2	2.8.2
`browser-or-node`	-	2.1.1
`custom-error-creator`	-	1.1.1
`eventemitter3`	5.0.1	5.0.4
`events-universal`	-	1.0.1
`expect-type`	-	0.15.0
`itty-router`	-	5.0.23
`p-mutex`	-	0.1.0
`run-time-assertions`	-	1.5.2
`secret-stream-http`	-	1.0.1
`typebox`	-	1.1.10
`typed-event-target`	-	3.4.0
`undici`	6.19.8	6.24.1
`wsl-utils`	-	0.1.0

achou11 · 2026-03-31T15:12:48Z

useProjectOwnRoleChangeListener() — ProjectRemovalListener did not need to change because it had projectApi.addListener separately (I think this is correct. Andrew, can you verify?)

yep! done in #1738 in anticipation of this breaking change :)

socket-security · 2026-03-31T15:24:38Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
npm/@comapeo/map-server@1.0.1
npm/@comapeo/ipc@6.0.2 ⏵ 7.0.0	⁺¹	⁺¹	⁺¹
npm/@comapeo/core@5.5.0 ⏵ 6.0.2		⁺¹	⁺¹

View full report

achou11

More of an initial review as I haven't had the capacity to look through some of the more complex pieces or test any of the changes on a device. Overall the changes are going in the right direction and they surfaced a couple of issues in other comapeo modules.

src/backend/src/app.js

achou11 · 2026-04-01T20:33:31Z

src/backend/package.json

+  "overrides": {
+    "@hyperswarm/secret-stream": "6.7.1"


@gmaclennan - is this override to pin to a specific version or to "upgrade" the versions used by transitive deps? just wondering if it's actually needed as opposed to updating the lockfile

achou11 · 2026-04-01T20:35:07Z

src/frontend/hooks/server/projects.ts

  projectId: string;
 }): ArchiveServerMemberInfo | undefined {
-  const {data: members} = useManyMembers({projectId});
+  const {data: members} = useManyMembers({projectId, includeLeft: true});


although the isActiveArchiveServerMember used below is doing the appropriate role-based filtering, seems like ideally this would only get active members.

Suggested change

const {data: members} = useManyMembers({projectId, includeLeft: true});

const {data: members} = useManyMembers({projectId, includeLeft: false});

src/frontend/screens/BackgroundMaps/BackgroundMaps.tsx

achou11 · 2026-04-01T20:39:35Z

src/frontend/screens/BackgroundMaps/BackgroundMaps.tsx

-            />
+      {error &&
+        /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+        (error as any).code !== 'MAP_NOT_FOUND' && (


Think you can use isHttpError from @comapeo/core-react to clean this up a bit:

Suggested change

(error as any).code !== 'MAP_NOT_FOUND' && (

isHttpError(error) && error.code !== 'MAP_NOT_FOUND' && (

@gmaclennan - i thought we had some kind of error helper so that the error.code here would narrow to known maps-related error codes. Maybe I'm confusing things with core...

I can clean up all the errors with subsequent map work in any case.

src/frontend/screens/BackgroundMaps/BackgroundMaps.tsx

src/frontend/sharedComponents/SelectDevice.tsx

achou11 · 2026-04-01T20:49:57Z

metro.config.js

    sourceExts: [...config.resolver.sourceExts, 'svg'],
    // Required for importing @comapeo/ipc and rpc-reflector without bundling the server/backend code also
    unstable_enablePackageExports: true,
+    // @comapeo/core-react imports DEFAULT_MAP_ID from the @comapeo/map-server root, which pulls in


This issue should be fixed in @comapeo/core-react@11.0.1.

I think instead of updating the metro config here, it would make more sense to create a patch file for core-react to introduce the fix. That way when you eventually upgrade to that version of core-react, the only change needed is removing the patch.

achou11 · 2026-04-01T20:51:08Z

jest.config.js

    '^@comapeo/ipc$': '<rootDir>/node_modules/@comapeo/ipc/dist/index.js',
+    '^custom-error-creator$':
+      '<rootDir>/node_modules/custom-error-creator/index.js',
+    '^@comapeo/map-server$':


assuming a patch file is introduced to fix the offending import, i think this could be updated to only affect the subpath import i.e.

Suggested change

'^@comapeo/map-server$':

'^@comapeo/map-server/constants\.js$':

…or. Adds a patch for comapeo-core-react.

socket-security · 2026-04-02T15:40:56Z

All alerts resolved. Learn more about Socket for GitHub.

This PR previously contained dependency changes with security issues that have been resolved, removed, or ignored.

View full report

cimigree · 2026-04-02T15:46:17Z

Going to address this in a separate PR to dev.

achou11

Couple of small changes needed but not much needed after that.

achou11 · 2026-04-02T16:34:16Z

src/backend/patches/typebox+1.1.10.patch

minor thing but looks like typebox version used has been updated. should just be a matter of updating the file name if you want the patch-package warning to go away:

Warning: patch-package detected a patch file version mismatch Don't worry! This is probably fine. The patch was still applied successfully. Here's the deets: Patch file created for typebox@1.0.81 applied to typebox@1.1.10 At path node_modules/typebox This warning is just to give you a heads-up. There is a small chance of breakage even though the patch was applied successfully. Make sure the package still behaves like you expect (you wrote tests, right?) and then run patch-package typebox to update the version in the patch file name and make this warning go away. --- patch-package finished with 1 warning(s).

src/frontend/hooks/server/projects.ts

achou11 · 2026-04-02T16:45:08Z

src/frontend/sharedComponents/SelectDevice.test.ts

    role: {roleId},
    deviceType,
    joinedAt: new Date().toISOString(),
-  };
+  } as MemberApi.ActiveMemberInfo;


instead of the type cast, i would suggest just adding an expect-error comment for the offending field i.e.

function mockMember( deviceId: string, roleId: MemberApi.RoleId, deviceType: 'mobile' | 'desktop' = 'mobile', ): MemberApi.ActiveMemberInfo { return { deviceId, name: `Device ${deviceId}`, role: { // @ts-expect-error Sufficient for testing purposes roleId, }, deviceType, joinedAt: new Date().toISOString(), }; }

src/frontend/sharedComponents/SelectDevice.tsx

src/frontend/screens/BackgroundMaps/BackgroundMaps.tsx

…ping issue. Tightening return type of function. Fixes typebox patch version.

cimigree · 2026-04-02T18:17:52Z

@achou11 I think I updated everything as you suggested. I did some manual testing with my two devices -- inviting to as well as adding and removing from projects, adding a server. Exchanging. Adding and removing background maps. As well as some basic stuff like creating a project, adding observations, recording audio, taking pictures. I was able to add a server and see it on the team screen but I am seemingly unable to remove it. I am just stuck in the loading space. I used this server:
'https://comapeo-mobile-e2e-01.fly.dev/'
I had to force close and then it was removed?

achou11

Great job on this! Now on to the next upgrade 😂

Regarding the remote archive removal issue, I think it's related to a bug in core-react (see digidem/comapeo-core-react#171). Would you mind trying out the changes from the PR to see if it fixes the issue? Can do so by creating an updated patch file here or creating a tarball from that PR. If you go with the patch-file approach, make sure you update both the esm and cjs dist directories in core-react, just to make sure the patch actually makes it into the bundle.

I suspect that there may be a few issues that this bug causes related to doing write operations with members. If you can verify that the fix upstream works, you can include that as part of the patch file in this PR. Then when you upgrade to latest core-react the patch file can be removed.

Alternatively, if you don't anticipate too much time happening between now and the upgrade to latest comapeo deps, you can merge this PR and then introduce release with the fix(es) shortly after. What do you think?

…ssue

achou11 · 2026-04-02T19:31:45Z

@cimigree I took it upon myself to add a commit that updates the patch file with the suspected fix. Mind trying the flow with the remote archive removal and seeing if it's fixed by this? It seemed to fix the issue for me when I tried it locally.

cimigree · 2026-04-02T19:53:02Z

@achou11 Thanks for doing the patch but I still had the same issue. It loads endlessly and then when I force close and reopen, the remote archive is gone. Anything in particular I can log or do to troubleshoot?

achou11 · 2026-04-02T19:57:29Z

@achou11 Thanks for doing the patch but I still had the same issue. It loads endlessly and then when I force close and reopen, the remote archive is gone. Anything in particular I can log or do to troubleshoot?

Hm not sure. That might be some unrelated issue. The issue I was seeing and addressing was the remote archive not disaplearing after removing succeeds. Thought the endless loading might be a related thing but maybe it's not?

achou11

Approving this to unblock you on being able to do the next upgrade. This is under the assumptions that:

The CI failure is an unrelated flake and will eventually pass if tried enough.
The issue you mentioned around the archive server is either some kind of flaky behavior.

I could be wrong about both! You would know better.

Even if the mentioned issues are regressions, might be easier to address them as follow ups as opposed to endlessly updating patches in this PR. From what I can tell, the app code changes here seem solid so issues most likely require dep upgrades (as seen with the introduced patch file for core-react).

Suspecting this is the cause of the issue with removing a remote archive highlighted in digidem/comapeo-mobile#1797. Prior to this change, all of the write hooks related to the members API invalidate `['@comapeo', 'projects', someProjectId, 'members', { includeLeft: undefined }]`, which misses the cases where a read hook internally uses a query key where `includeLeft` is a boolean value e.g. `['@comapeo', 'projects', someProjectId, 'members', { includeLeft: true }]` or `['@comapeo', 'projects', someProjectId, 'members', { includeLeft: false }]`. The proposed fix is to omit the last key fragment when `includeLeft` is undefined or unspecified, so that the write hook invalidations match `['@comapeo', 'projects', someProjectId, 'members']`, which will cover all members-related reads.

Fixes member import. Updates comapeo dependencies. Updates code to su…

dac4ce3

…pport new map server and map code in backend. Adds patches as needed.

cimigree added 2 commits March 31, 2026 11:58

Fixes for jest config and type errors.

3c32d54

Fixes import path for testing.

f3f7dc0

cimigree requested a review from achou11 March 31, 2026 16:56

achou11 requested changes Apr 1, 2026

View reviewed changes

cimigree added 3 commits April 2, 2026 11:02

Only imports active members. Adjusts test accordingly. Uses ishttperr…

f34ab69

…or. Adds a patch for comapeo-core-react.

Adds to readme for the patch.

c37f473

Removes now unnecessary checks from select device test.

4cff070

cimigree requested a review from achou11 April 2, 2026 15:46

Should not be an error message when there is no map.

bc2c126

achou11 requested changes Apr 2, 2026

View reviewed changes

cimigree added 2 commits April 2, 2026 13:40

Adds comment for file system error. Expect error for active member ty…

2784634

…ping issue. Tightening return type of function. Fixes typebox patch version.

Aligning test for background map with Figma.

50c7237

cimigree requested a review from achou11 April 2, 2026 18:18

achou11 mentioned this pull request Apr 2, 2026

fix: fix invalidation misses on members-related reads digidem/comapeo-core-react#171

Merged

achou11 reviewed Apr 2, 2026

View reviewed changes

update core-react patchfile to include fix for members invalidation i…

7098052

…ssue

achou11 approved these changes Apr 2, 2026

View reviewed changes

cimigree merged commit c457e3f into develop Apr 2, 2026
12 of 13 checks passed

cimigree deleted the chore/upgrade-dependencies branch April 2, 2026 21:01

	const {data: members} = useManyMembers({projectId, includeLeft: true});
	const {data: members} = useManyMembers({projectId, includeLeft: false});

	(error as any).code !== 'MAP_NOT_FOUND' && (
	isHttpError(error) && error.code !== 'MAP_NOT_FOUND' && (

	'^@comapeo/map-server$':
	'^@comapeo/map-server/constants\.js$':

Conversation

cimigree commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Breaking change migrations:

Map server wiring:

Infrastructure:

Uh oh!

awana-lockfile-bot bot commented Mar 31, 2026

package-lock.json changes

Uh oh!

awana-lockfile-bot bot commented Mar 31, 2026

src/backend/package-lock.json changes

Uh oh!

achou11 commented Mar 31, 2026

Uh oh!

socket-security bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

achou11 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

socket-security bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cimigree commented Apr 2, 2026

Uh oh!

achou11 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

cimigree commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

achou11 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

achou11 commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cimigree commented Apr 2, 2026

Uh oh!

achou11 commented Apr 2, 2026

Uh oh!

achou11 left a comment

cimigree commented Mar 31, 2026 •

edited

Loading

`package-lock.json` changes

`src/backend/package-lock.json` changes

socket-security bot commented Mar 31, 2026 •

edited

Loading

socket-security bot commented Apr 2, 2026 •

edited

Loading

achou11 left a comment •

edited

Loading

cimigree commented Apr 2, 2026 •

edited

Loading

achou11 left a comment •

edited

Loading

achou11 commented Apr 2, 2026 •

edited

Loading