Bump plugin-bones to c05c13e (CMU paint z-fight fix + LGS phase 0) - #714
Conversation
- CMU block faces bury 5mm inside the drawn wall planes: kills the painted-CMU flicker reported on prod (any painted material was z-fighting the coplanar block faces). Verified: 0-diff camera orbits both wall modes; x-ray look unchanged at working distance. - LGS Phase 0 (light-gauge steel foundation): cited AISI profile catalog + additive spec fields + pure resolution module — inert for all existing scenes (baseline byte-identical). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 681722b. Configure here.
| "@pascal-app/nodes": ["@pascal-app/nodes@workspace:packages/nodes"], | ||
|
|
||
| "@pascal-app/plugin-bones": ["@pascal-app/plugin-bones@github:pascalorg/plugin-bones#5c2650e", { "peerDependencies": { "@pascal-app/core": ">=0.9.1 <1", "@pascal-app/editor": ">=0.9.1 <1", "@pascal-app/viewer": ">=0.9.1 <1", "@react-three/fiber": "^9", "react": "^18 || ^19", "three": "^0.185", "zod": "^4", "zustand": "^5" } }, "pascalorg-plugin-bones-5c2650e", "sha512-yzr+QfPb1vYb9n3lVq0weih2Nzv/Ve2IcTt3WskTzFhXRanYdfz3F+n9BtgnKxrzhsALNbkp3ltZVlqJyXCGgg=="], | ||
| "@pascal-app/plugin-bones": ["@pascal-app/plugin-bones@github:pascalorg/plugin-bones#c05c13e", { "peerDependencies": { "@pascal-app/core": ">=0.9.1 <1", "@pascal-app/editor": ">=0.9.1 <1", "@pascal-app/viewer": ">=0.9.1 <1", "@react-three/fiber": "^9", "react": "^18 || ^19", "three": "^0.185", "zod": "^4", "zustand": "^5" } }, "pascalorg-plugin-bones-c05c13e"], |
There was a problem hiding this comment.
Lockfile drops GitHub integrity hashes
Medium Severity
This pin bump removes the trailing sha512 integrity field from @pascal-app/plugin-bones and also strips it from unchanged GitHub deps (@mint/pascal-plugin, @pascal-app/plugin-streetscape, @pascal-app/plugin-trees). Those hashes verify GitHub tarball bytes on re-download (Bun’s fix for GHSA-pfwx-36v6-832x). With --frozen-lockfile in CI/Docker, the missing pins will not auto-heal, so install-time tamper checks stay disabled for those packages.
Additional Locations (2)
Reviewed by Cursor Bugbot for commit 681722b. Configure here.
1 participant
Community plugin pin bump.
CMU_FACE_BURY), killing the reported prod flicker when any material is painted on a CMU wall (opaque painted host faces were exactly coplanar with the block faces). Visual QA: 0-diff camera orbits across both wall modes, white + brick paint, hover-preview clean; X-ray appearance unchanged at working distance. Thin walls floor at t/2 with an honest flag.framingSystem/lgsMachinespec fields (absent round-trips absent), pure resolution module consumed by nothing yet. Inert for all existing scenes: master-baseline recapture byte-identical.Plugin suite: 1783 tests, 0 fail; tsc clean. Adversarially verified (skeptic + blueprint examiner + browser visual QA per change).
🤖 Generated with Claude Code
Note
Low Risk
Dependency pin only; visual/geometry behavior lives in the external plugin, with no auth, data, or editor-app logic changes.
Overview
Pins
@pascal-app/plugin-bonestoc05c13eso the editor picks up the CMU paint z-fight fix (block faces buried 5mm so painted walls no longer flicker) and inert LGS Phase 0 spec fields.No app code changes; lockfile also drops integrity hashes on a few Git plugin entries as a side effect of the bump.
Reviewed by Cursor Bugbot for commit 681722b. Bugbot is set up for automated code reviews on this repo. Configure here.