Skip to content

[pull] main from tldraw:main#500

Merged
pull[bot] merged 5 commits intocode:mainfrom
tldraw:main
Apr 16, 2026
Merged

[pull] main from tldraw:main#500
pull[bot] merged 5 commits intocode:mainfrom
tldraw:main

Conversation

@pull
Copy link
Copy Markdown

@pull pull Bot commented Apr 16, 2026

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

mimecuvalo and others added 5 commits April 16, 2026 11:00
…licates (#8542)

In order to fix duplicate presence cursors appearing after login/logout,
this PR excludes the connecting session's own stale presence record from
the connect handshake response.

Closes #7756

### Root cause

When a session reconnects (e.g. after auth state changes), the server
sends all presence records in the connect response — including the
connecting client's own stale record from the previous session. Because
the server never echoes a session's own presence updates back to it
(`broadcastPatch` skips `sourceSessionId`), this stale record
permanently remains in the client's local store. If the `userId` changed
between sessions (e.g. anonymous → authenticated), the stale record
renders as a ghost cursor for "another person."

### Fix

Filter out the connecting session's `presenceId` from the initial
presence dump sent in the connect response. The client always pushes
fresh presence data immediately after connecting, so it never needs its
own record back from the server.

### Change type

- [x] `bugfix`

### Test plan

1. Open a shared file while logged out
2. Log in
3. Verify only one presence cursor appears (not two)
4. Log out and back in — still only one cursor

- [ ] Unit tests
- [ ] End to end tests

### Release notes

- Fix duplicate presence cursors appearing after login or logout in
multiplayer sessions.

### Code changes

| Section    | LOC change |
| ---------- | ---------- |
| Core code  | +8 / -1    |
In order to fix a rotation performance regression introduced by #8378
and #8451, this PR conditionally applies CSS `transform: scale()` on
shape label containers only when dynamic size is active (`scale !== 1`).
Closes #8562.

PR #8378 changed geo and note shapes to use CSS `transform: scale()` on
label containers instead of multiplying `fontSize` and `padding`
directly, fixing shadow artifacts and oversized carets at high zoom in
dynamic size mode. However, this transform was applied unconditionally —
even when `scale === 1` (the default), which forces an unnecessary
compositing layer on every shape label, causing a measurable rotation
performance regression.

The fix skips the `style` prop entirely when `scale === 1`, avoiding the
extra composite layer during rotation while preserving the shadow/caret
fix when dynamic sizing is active.

### Change type

- [x] `bugfix`

### Test plan

1. Create a canvas with many geo and note shapes (no dynamic sizing)
2. Select all and rotate — rotation should be smooth without the
compositing overhead
3. Enable dynamic size on some shapes (scale !== 1) and verify labels
still render correctly at high zoom (no shadow artifacts, no oversized
carets)
4. Add arrow labels with dynamic size and verify positioning and scaling
still work

- [ ] Unit tests
- [ ] End to end tests

### Release notes

- Fix rotation performance regression caused by unconditional CSS
transforms on shape labels

### Code changes

| Section    | LOC change |
| ---------- | ---------- |
| Core code  | +21 / -13  |
…updates (#8304)

Bumps the npm_and_yarn group with 2 updates in the / directory:
[flatted](https://github.com/WebReflection/flatted) and
[socket.io-parser](https://github.com/socketio/socket.io).
Bumps the npm_and_yarn group with 1 update in the
/.claude/skills/pr-walkthrough/video directory:
[serialize-javascript](https://github.com/yahoo/serialize-javascript).

Updates `flatted` from 3.3.3 to 3.4.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/WebReflection/flatted/commit/3bf09091c3562e17a0647bc06710dd6097079cf7"><code>3bf0909</code></a>
3.4.2</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/885ddcc33cf9657caf38c57c7be45ae1c5272802"><code>885ddcc</code></a>
fix CWE-1321</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/0bdba705d130f00892b1b8fcc80cf4cdea0631e3"><code>0bdba70</code></a>
added flatted-view to the benchmark</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/2a02dce7c641dec31194c67663f9b0b12e62da20"><code>2a02dce</code></a>
3.4.1</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/fba4e8f2e113665da275b19cd0f695f3d98e9416"><code>fba4e8f</code></a>
Merge pull request <a
href="https://redirect.github.com/WebReflection/flatted/issues/89">#89</a>
from WebReflection/python-fix</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/5fe86485e6df7f7f34a07a2a85498bd3e17384e7"><code>5fe8648</code></a>
added &quot;when in Rome&quot; also a test for PHP</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/53517adbefe724fe472b2f9ebcdb01910d0ae3f0"><code>53517ad</code></a>
some minor improvement</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/b3e2a0c387bf446435fec45ad7f05299f012346f"><code>b3e2a0c</code></a>
Fixing recursion issue in Python too</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/c4b46dbcbf782326e54ea1b65d3ebb1dc7a23fad"><code>c4b46db</code></a>
Add SECURITY.md for security policy and reporting</li>
<li><a
href="https://github.com/WebReflection/flatted/commit/f86d071e0f70de5a7d8200198824a3f07fc9c988"><code>f86d071</code></a>
Create dependabot.yml for version updates</li>
<li>Additional commits viewable in <a
href="https://github.com/WebReflection/flatted/compare/v3.3.3...v3.4.2">compare
view</a></li>
</ul>
</details>
<br />

Updates `socket.io-parser` from 4.2.4 to 4.2.6
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/socketio/socket.io/releases">socket.io-parser's
releases</a>.</em></p>
<blockquote>
<h2>socket.io-parser@4.2.6</h2>
<p>This release includes a fix for <a
href="https://github.com/socketio/socket.io/security/advisories/GHSA-677m-j7p3-52f9">CVE-2026-33151</a>.
Please upgrade as soon as possible.</p>
<h3>Bug Fixes</h3>
<ul>
<li>add a limit to the number of binary attachments (<a
href="https://github.com/socketio/socket.io/commit/b25738c416c4e32fbff62ee182afa8f6d0dacf78">b25738c</a>)</li>
</ul>
<h2>socket.io-parser@4.2.5</h2>
<p>This release contains a bump of <code>debug</code> from
<code>~4.3.1</code> to <code>~4.4.1</code>.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/socketio/socket.io/commit/522edcdbb89da5eb647abb93c73229d1e91c304f"><code>522edcd</code></a>
chore(release): socket.io-parser@4.2.6</li>
<li><a
href="https://github.com/socketio/socket.io/commit/3fff7cafa98f1ba5840475b6917c651fe841a943"><code>3fff7ca</code></a>
fix(parser): add a limit to the number of binary attachments</li>
<li><a
href="https://github.com/socketio/socket.io/commit/37aad11417d1020cf51d27a0cf90fa367efd5dc1"><code>37aad11</code></a>
fix: cleanup pending acks on timeout to prevent memory leak</li>
<li><a
href="https://github.com/socketio/socket.io/commit/ba9cd6900d0d84678623cd8e3a42165e922f3fbd"><code>ba9cd69</code></a>
revert: fix: cleanup pending acks on timeout to prevent memory leak</li>
<li><a
href="https://github.com/socketio/socket.io/commit/84c2fb78217b6375b38e0b47e0d59d7b1b8431d7"><code>84c2fb7</code></a>
chore(release): engine.io@6.6.6</li>
<li><a
href="https://github.com/socketio/socket.io/commit/07cbe1510ded7e5460cb82e026e2533e50e30eaf"><code>07cbe15</code></a>
fix(eio): add <code>@​types/ws</code> as dependency (<a
href="https://redirect.github.com/socketio/socket.io/issues/5458">#5458</a>)</li>
<li><a
href="https://github.com/socketio/socket.io/commit/44ed73f53995d35ef0c8d10df6806d5687238282"><code>44ed73f</code></a>
fix(eio): emit initial_headers and headers events in uServer (<a
href="https://redirect.github.com/socketio/socket.io/issues/5460">#5460</a>)</li>
<li><a
href="https://github.com/socketio/socket.io/commit/da04267ffc7b0903ca91f2fccb80e56246d13328"><code>da04267</code></a>
fix: cleanup pending acks on timeout to prevent memory leak (<a
href="https://redirect.github.com/socketio/socket.io/issues/5442">#5442</a>)</li>
<li><a
href="https://github.com/socketio/socket.io/commit/74599a6b9e3dbeff1a9efe46c305d5d25d6e3dd8"><code>74599a6</code></a>
fix(types): properly import http module</li>
<li><a
href="https://github.com/socketio/socket.io/commit/d48718cb675721fc1252775115592ebd1b255899"><code>d48718c</code></a>
ci: use actions/checkout@v6 and actions/setup-node@v6 (<a
href="https://redirect.github.com/socketio/socket.io/issues/5449">#5449</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/socketio/socket.io/compare/socket.io-parser@4.2.4...socket.io-parser@4.2.6">compare
view</a></li>
</ul>
</details>
<details>
<summary>Maintainer changes</summary>
<p>This version was pushed to npm by [GitHub Actions](<a
href="https://www.npmjs.com/~GitHub">https://www.npmjs.com/~GitHub</a>
Actions), a new releaser for socket.io-parser since your current
version.</p>
</details>
<br />

Removes `serialize-javascript`

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mime Čuvalo <mimecuvalo@gmail.com>
)

In order to fix the docs deployment build failure, this PR updates the
auto-link reference in `ui-components.mdx` from `PeopleMenuProps` to
`DefaultPeopleMenuProps`.

PR #8346 renamed `PeopleMenu` to `DefaultPeopleMenu` and
`PeopleMenuProps` to `DefaultPeopleMenuProps`, keeping the old names as
legacy re-export aliases. API Extractor uses the canonical declaration
name (`DefaultPeopleMenuProps`) when generating the doc model, so the
reference article is now titled `DefaultPeopleMenuProps`. However, the
doc page still referenced the old alias name `[PeopleMenuProps](?)`,
which caused the auto-link resolution in `autoLinkDocs.ts` to fail with:

```
Error: 💥 Could not find article for PeopleMenuProps (PeopleMenuProps) in /sdk-features/ui-components at line 92
```

### Change type

- [x] `bugfix`

### Test plan

1. Run `cd apps/docs && yarn fetch-api-source && yarn
create-api-markdown && yarn refresh-content` — should complete without
errors

### Release notes

- Fix docs build failure caused by stale `PeopleMenuProps` auto-link
reference

### Code changes

| Section       | LOC change |
| ------------- | ---------- |
| Documentation | +1 / -1    |
…esizeObserver loop warnings (#8574)

In order to fix intermittent `ResizeObserver loop completed with
undelivered notifications` browser warnings when hovering over toolbar
buttons, this PR removes the `attributes` and `characterData` options
from the `MutationObserver` in `OverflowingToolbar`.

The overflow recalculation (`onDomUpdate`) only needs to respond to DOM
structure changes (`childList`) and container resizes
(`ResizeObserver`). Observing `attributes` caused a feedback loop:
hovering triggered attribute changes → `onDomUpdate` set
`data-toolbar-visible` attributes → mutation observer fired again →
ResizeObserver loop warning. React-driven attribute changes (like tool
selection) already trigger recalculation via the `useLayoutEffect` that
runs after every render.

Closes #8528

### Change type

- [x] `bugfix`

### Test plan

1. Open the examples app with the default toolbar
2. Move the pointer quickly across toolbar buttons
3. Verify no `ResizeObserver loop` warnings appear in the browser
console
4. Verify toolbar overflow still works correctly when resizing the
window

### Release notes

- Fix intermittent `ResizeObserver loop` browser warnings when hovering
over toolbar buttons.

### Code changes

| Section    | LOC change |
| ---------- | ---------- |
| Core code  | +0 / -2    |
@pull pull Bot locked and limited conversation to collaborators Apr 16, 2026
@pull pull Bot added the ⤵️ pull label Apr 16, 2026
@pull pull Bot merged commit 8e9ed6b into code:main Apr 16, 2026
@pull pull Bot had a problem deploying to deploy-production April 16, 2026 15:13 Failure
@pull pull Bot had a problem deploying to deploy-staging April 16, 2026 15:13 Error
@pull pull Bot had a problem deploying to deploy-staging April 16, 2026 15:13 Error
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants