Skip to content

v0.118.1 — v0.118.0's leftovers, and a web build that fits its heap

Merged 2026-10-05 (120a0c3b, tagged v0.118.1) — a hotfix built on version/0.118.1. Pushed; CI green.

A hotfix on version/0.118.1. v0.118.0 merged through GitHub (PR #79) rather than the squash-and-tag flow, and its first CI run on main failed before anything deployed. This release gets it to production and finishes what the merge skipped.

  • [x] Release bookkeeping v0.118.0 skipped:
    • Its notes move to docs/help/changelog/v0.118.0.md, with a line under Released.
    • The roadmap no longer calls it in flight, and the near-term table gains its row.
    • handoff-v0.118.0/, the resume guide for the machine switch, is deleted. Its README said to delete it before the merge.
    • Its tag, v0.118.0, goes on ac26eae2.
  • [x] CI's web build gets the 6 GB heap the deploy builds have.
    • lint-and-test died in pnpm build:apps with "JavaScript heap out of memory" while rendering chunks. The bundle grew from 10,795 modules to 10,838, past Node's default ~2 GB. The deploy jobs already had --max-old-space-size=6144 (v0.107.2), but this step and the e2e rebuild did not.
    • Done: Build apps and End-to-end smoke tests (whose playwright.config.ts rebuilds apps/web) in ci.yml set NODE_OPTIONS: --max-old-space-size=6144. Reproduced locally: vite build at 2 GB dies the same way; at 6 GB it builds, peaking at 2.5 GB resident.
      • ciWebBuildHeap.test.ts splits every workflow into steps and holds each one that builds apps/web (build:apps, --filter @purple-cat/web run build, test:e2e) to the 6 GB heap. It also checks that it still finds all five.
  • [x] The last of the publishing machinery in the in-repo modules.
    • v0.118.0's M.5 notes say no platformRef was left to drop, but dnd5e's package.json still had "platformRef": "v0.107.0", and three comments still justified code by it.
    • Done: dnd5e 0.21.1 drops platformRef from its purple-cat-module block. Nothing read it after the publish job went. The comments in core/buffs.ts and client/sheet/bits.tsx now say the structural typing was for the old published platform. The code is unchanged: it still works, and importing the shared types instead is an optional cleanup. v0.118.0's notes carry the correction.
      • Also: scripts/fix-system8-hp-bar.sql names the system8 fixture at modules/system8/, not in vtt-modules.
  • [x] A script to retire the module-checkout secrets.
    • MODULES_TOKEN_PCG and MODULES_TOKEN_KENJURA are no longer read by any workflow (M.4).
    • The org's PKG_TOKEN stays, because genai's publish still reads it. The vtt-modules and system5 publish jobs that also read it are gone.
    • Done: scripts/secrets/retire-modules-tokens.sh lists the repository's secrets and reads every workflow on its default branch through gh api. It refuses if any still reads one of the two (secrets.<NAME>; a mention in a comment does not count). It is a dry run unless given --yes, deletes only the ones present, and ends by reminding you to revoke the PATs themselves, which deleting the secret does not do. Dry-run against the real repository: both present, no readers.
      • retire-modules-tokens.test.sh runs it against a stub gh (dry run, --yes, a reader, a comment-only mention, one already gone, none, a bad argument). shellTests.test.ts runs it in the gate.
      • infra/envs/nonprod/README.md points at it.
      • Not scripted: narrowing PKG_TOKEN to genai. Changing an org secret's visibility can need its value re-entered, so that is left to the owner.
  • Sibling repositories, merged outside this repo (fast-forwards of the branches M.5 pushed; nothing is published or tagged). Pushing each main is the owner's call:
    • vtt-modules main → 341822a (Repository 0.3.0, vtt-assets alone). The repo-wide v0.3.0 tag is historical and already taken, and only <module>/v* tags publish, so it gets no tag.
    • system5 main → 57b189c (the module moved to the platform). Its docs deploy runs on push and does not read module/.