@clicktap/ui 0.43.6 → 1.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,6 +1,8 @@
1
1
  # Password reveal is a toggle again, not press-and-hold
2
2
 
3
3
  **Date:** 2026-08-11
4
+ **Revised:** 2026-08-11 — consumer action now says to rename a component named for the press-and-hold
5
+ gesture (family-rpg's `HoldToRevealButton`), not only to swap its handlers.
4
6
  **Package:** `@clicktap/ui`
5
7
  **Affects:** `@clicktap/ui` — `Input` with `type="password"`.
6
8
  **Classification:** IMPROVEMENT (UX / accessibility)
@@ -66,6 +68,11 @@ Shipped in `@clicktap/ui` **0.43.6**.
66
68
  - **Rolled your own password reveal:** swap the pointer handlers back for the `onClick` toggle above,
67
69
  and add `aria-pressed` + the state-dependent `aria-label` while you are in there. The reference
68
70
  frontend also updated its one bespoke reveal (`UpdateEmailForm`) to match.
71
+ - **Rename the component if its name describes the gesture.** If you named it for press-and-hold
72
+ when you applied CTAP-1128 — family-rpg had `HoldToRevealButton` (2026-08-11) — the name now
73
+ documents behaviour the code no longer implements, in the one place nobody re-reads. Rename it
74
+ (`PasswordRevealButton`, `ShowPasswordToggle`) in the same change as the handler swap, and grep
75
+ for the old name in tests and stories.
69
76
  - **Applied the CTAP-1128 guide:** this reverses it. Nothing to un-install beyond the handler swap.
70
77
 
71
78
  ## Verify
@@ -0,0 +1,61 @@
1
+ # `next` and `@heroui/*` peer ranges are capped; `react-stately` pinned
2
+
3
+ **Date:** 2026-08-11
4
+ **Package:** `@clicktap/ui`
5
+ **Affects:** every consumer — the peer ranges are the declaration your package manager installs against.
6
+ **Classification:** COMPATIBILITY
7
+ **Breaking:** Yes for a consumer already past a ceiling. No code change; the contract narrowed.
8
+ **Ticket:** CTAP-1241
9
+
10
+ ## Summary
11
+
12
+ Three peer ranges were open-ended and are now bounded:
13
+
14
+ | Peer | Before | After |
15
+ |---|---|---|
16
+ | `next` | `>=14` | `^14.0.0` |
17
+ | `@heroui/system` | `>=2.4.18` | `^2.4.18` |
18
+ | `@heroui/theme` | `>=2.4.24` | `^2.4.24` |
19
+
20
+ A caret already carries its ceiling — `^14.0.0` *is* `>=14.0.0 <15.0.0` — so the ranges are written that
21
+ way rather than as explicit bounds. For a `0.x` dependency the equivalent is a tilde (`~0.8.0` is
22
+ `>=0.8.0 <0.9.0`), because a `0.x` minor bump is a breaking change.
23
+
24
+ An open-ended peer with `auto-install-peers=true` means **"newest major, forever"** — a standing licence
25
+ for the next `pnpm update` to move you onto a major this package has never been built against, silently.
26
+ The ceilings are the highest major this repo builds and tests against, not the next major above the
27
+ floor.
28
+
29
+ ## Also: `react-stately` is pinned to the version the app owns
30
+
31
+ `react-stately` was a `devDependency` at `^3.46.0` while `apps/frontend` pins `3.44.0`, so the family
32
+ split across workspace members — the lib resolved 3.46.0, the app 3.44.0. `react`, `react-aria` and
33
+ `react-aria-components` were all clean singletons at the same time, which is what makes this shape easy
34
+ to miss: a `grep` for duplicate `react@` in the lockfile finds nothing, and only the resolved symlinks
35
+ show the split one family member over.
36
+
37
+ It is now pinned to `3.44.0`. **Not breaking** — `react-stately` remains a peer at `^3.36.0`, and the
38
+ build already externalizes `react-stately` and `@react-stately/*`, so nothing about what you install
39
+ changes. The pin only stops the lib's own dev tree from resolving a different copy than the app's.
40
+
41
+ ## Action required (consumer)
42
+
43
+ **On Next 14 and HeroUI 2.x:** nothing.
44
+
45
+ **Past a ceiling** (Next 15/16, HeroUI 3): your install now reports an unmet peer, and fails under
46
+ `strict-peer-dependencies`. That is the intended signal — it means you are on a major nobody has
47
+ verified this package against. Either move back onto a supported major, or ask for the ceiling to be
48
+ raised deliberately once the package has been built and tested there. Raising it is a one-line change;
49
+ what is missing is the verification, not the willingness.
50
+
51
+ **Worth checking while you are here:** if you have a `react-stately` (or any `@react-*`) version pinned
52
+ in your own app, confirm it matches what `@clicktap/ui` resolves. The split above existed for a while
53
+ without symptoms, and duplicate react-aria/stately instances surface as subtle focus and overlay bugs
54
+ rather than as an error.
55
+
56
+ ## Verify
57
+
58
+ ```bash
59
+ pnpm install # no unmet-peer warning for next or @heroui/*
60
+ pnpm why react-stately # one version across every member
61
+ ```
@@ -31,5 +31,6 @@ For migrations affecting the frontend app, see [frontend migrations](../../../..
31
31
  | 2026-08-04 | [Password reveal is press-and-hold, not a toggle](./2026/08/ui-2026-08-04-password-reveal-press-and-hold.md) ⚠️ superseded | Behavioural | *None* (CTAP-1128) |
32
32
  | 2026-08-06 | [`Image` is framework-free; Next's optimizer moves to `@clicktap/ui/next`](./2026/08/ui-2026-08-06-clicktap-ui-image-next-subpath.md) ↔ | Yes (Next consumers) | *None* |
33
33
  | 2026-08-11 | [Password reveal is a toggle again, not press-and-hold](./2026/08/ui-2026-08-11-password-reveal-toggle.md) | Behavioural | Supersedes CTAP-1128 |
34
+ | 2026-08-11 | [`next` / `@heroui/*` peers capped; `react-stately` pinned](./2026/08/ui-2026-08-11-peer-ranges-capped.md) | Yes (consumers past a ceiling) | *None* |
34
35
 
35
36
  ↔ = cross-app migration (has counterpart in frontend app)
@@ -1,4 +1,14 @@
1
1
  [
2
+ {
3
+ "path": "2026/08/ui-2026-08-11-peer-ranges-capped.md",
4
+ "module": "libs/frontend-modules/ui",
5
+ "package": "@clicktap/ui",
6
+ "date": "2026-08-11",
7
+ "title": "`next` and `@heroui/*` peer ranges are capped; `react-stately` pinned",
8
+ "classification": "COMPATIBILITY",
9
+ "breaking": "Yes for a consumer already past a ceiling. No code change; the contract narrowed.",
10
+ "affects": "every consumer — the peer ranges are the declaration your package manager installs against."
11
+ },
2
12
  {
3
13
  "path": "2026/08/ui-2026-08-11-password-reveal-toggle.md",
4
14
  "module": "libs/frontend-modules/ui",
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@clicktap/ui",
3
- "version": "0.43.6",
3
+ "version": "1.0.1",
4
4
  "private": false,
5
5
  "author": "Clicktap",
6
6
  "description": "A library of React UI components and low-level hooks.",
@@ -120,11 +120,11 @@
120
120
  "graphql-request": "^6.1.0",
121
121
  "next": "14.2.35",
122
122
  "react": "18.3.1",
123
- "react-aria": "^3.46.0",
124
- "react-aria-components": "^1.15.0",
123
+ "react-aria": "3.46.0",
124
+ "react-aria-components": "1.15.1",
125
125
  "react-hook-form": "^7.71.1",
126
126
  "react-international-phone": "^4.7.0",
127
- "react-stately": "^3.46.0",
127
+ "react-stately": "3.44.0",
128
128
  "rollup-preserve-directives": "^1.1.3",
129
129
  "tailwindcss": "^4.3.3",
130
130
  "vite": "^7.3.1",
@@ -138,13 +138,13 @@
138
138
  "@heroui/accordion": "^2.2.0",
139
139
  "@heroui/badge": "^2.2.0",
140
140
  "@heroui/pagination": "^2.2.0",
141
- "@heroui/system": ">=2.4.18",
142
- "@heroui/theme": ">=2.4.24",
141
+ "@heroui/system": "^2.4.18",
142
+ "@heroui/theme": "^2.4.24",
143
143
  "@heroui/tooltip": "^2.2.0",
144
144
  "@types/react": "^18.0.0",
145
145
  "framer-motion": "^11.18.0",
146
146
  "graphql-request": "^6.1.0",
147
- "next": ">=14",
147
+ "next": "^14.0.0",
148
148
  "react": "^18.0.0",
149
149
  "react-aria": "^3.46.0",
150
150
  "react-aria-components": "^1.15.0",