chore(release): react-ui 0.11.9, lang-core 0.2.6, cli 0.0.8

[ankit-thesys]

Summary

Situation — All nine @openuidev/* packages have been at parity with npm since the 2026-05-20 publish (4b663b90, #534; browser-bundle republished 2026-06-09). Since then main accumulated consumer-visible work — opt-in CSS cascade-layers support (#589/#621, re-landed as opt-in in #631), a parser correctness fix, and a security-driven dependency major — with no version bumps, so none of it is releasable.

Task — Audit every commit per package since the publish baseline, decide which packages need a release and at what semver level, cut the bumps, and verify the artifacts are publish-ready.

Action — Reviewed each package's diff against 4b663b90 and separated consumer-visible changes from internal churn (catalog migration #612/#624/#634/#645/#653, build tooling #604/#627/#628, docs/blog #638/#641/#646/#647, the LangGraph example #644). Three packages have real consumer impact and are bumped here; the rest are deliberately left alone. The @layer openui work shipped as opt-in (#631): the default stylesheets stay unlayered and byte-equivalent to 0.11.x, so this is a non-breaking release. Tarball inspection during the cascade-layer work caught a release blocker: the layer wrapper pushed Sass's UTF-8 BOM mid-stylesheet, where U+FEFF parses as an identifier and silently killed the first CSS rule (the :root theme tokens). wrapInLayer now strips it, with unit tests and a check-css-artifacts.js guard wired into prepublishOnly.

Result — Three packages ready to publish:

Package	Version	Level	Why
@openuidev/react-ui	0.11.8 → 0.11.9	patch	opt-in @layer openui is additive/non-breaking; react-syntax-highlighter 15→16
@openuidev/lang-core	0.2.5 → 0.2.6	patch	parser fix, no API change
@openuidev/cli	0.0.7 → 0.0.8	patch	build-tooling only

Not republished: react-lang / svelte-lang / vue-lang (get lang-core 0.2.6 transitively via ^0.2.5), react-headless / react-email (no consumer-visible delta), browser-bundle (0.1.1 already published 2026-06-09).

Note on the bump level: the original plan was react-ui 0.12.0 (minor), on the premise that @layer openui changed override semantics for everyone. #631 re-landed it as opt-in — the default is unchanged — so the release is non-breaking and drops to 0.11.9 (patch). The react-syntax-highlighter 15→16 dependency major rides along at patch level (public API unchanged; see the CJS/Node heads-up below).

---

Changelog

@openuidev/react-ui 0.11.9

Added — opt-in CSS cascade layers (#589, #621, #631)

Component styles still ship unlayered by default — @openuidev/react-ui/styles/index.css and the per-component ./styles/* behave exactly as in 0.11.x (./components.css is retained as an alias). New opt-in exports ship the same rules wrapped in @layer openui:

• @openuidev/react-ui/layered/styles/index.css — the full stylesheet
• @openuidev/react-ui/layered/styles/* — per component

With the layered variant, unlayered app CSS overrides OpenUI without !important or specificity hacks (.openui-button-base-primary { background: hotpink } just wins). ./defaults.css (theme tokens) and ThemeProvider's runtime style injection stay unlayered in both modes, so runtime theming always wins.

Migration: none — the default is unchanged. To opt in:

• Import @openuidev/react-ui/layered/styles/index.css instead of the unlayered stylesheet, from exactly one place (multiple import sites under chunk-splitting bundlers like Turbopack can lock the wrong layer order).
• Tailwind v4 — declare the layer order before the import:

  @layer theme, base, openui, components, utilities;
  @import "tailwindcss";
  @import "@openuidev/react-ui/layered/styles/index.css";

• Browser floor (opt-in path only): cascade layers need Chrome/Edge 99+, Firefox 97+, Safari 15.4+ (March 2022); older browsers drop the layered block and render components unstyled. The unlayered default has no such floor.

Security — react-syntax-highlighter ^15.6.1 → ^16.1.1 (#577)

Removes the DOM-clobbering-vulnerable prismjs 1.27 (CVE-2024-53382) that v15 pinned via refractor 3 — semver could never resolve a patched copy on 15.x, so the major bump is the only consumer-side fix. Affects CodeBlock and fenced code in markdown rendering; react-ui's public API is unchanged and no peer deps changed. Heads-up: refractor 5 is ESM-only, so require()-ing @openuidev/react-ui from CommonJS (CJS SSR, Jest without ESM) needs Node ≥ 20.19 / ≥ 22.12. Prism 1.27 → 1.30 grammar updates may subtly change code-block tokenization.

@openuidev/lang-core 0.2.6

Fixed — string-aware parser preprocessing (#605)

• Markdown fences (```) inside double-quoted string props no longer corrupt parsing — streaming a UI that displays a code snippet now works instead of erroring.
• // and # on continuation lines of multiline strings are no longer stripped as comments — URLs inside string props survive intact.
• Apostrophes in surrounding prose ("Here's the code:") no longer confuse fence detection.
• Applies to parse, createParser, createStreamingParser, and mergeStatements.

Migration: none. Consumers of @openuidev/react-lang / svelte-lang / vue-lang get this transitively (^0.2.5 range) on lockfile refresh — no wrapper republish needed.

@openuidev/cli 0.0.8

Maintenance release — template build scripts moved from Unix shell one-liners to cross-platform Node fs APIs (#601, #627), fixing pnpm install/build for Windows contributors. No functional changes to the published CLI; scaffolded output is identical to 0.0.7.

---

Pre-publish checklist

• Re-run pnpm build + pnpm run check:css + pnpm -r run ci on this branch now that main is merged in
• react-ui tarball spot-check: dist/styles/index.css and dist/components/index.css are unlayered (start with :root{); dist/layered/styles/index.css starts with @layer openui{ and is BOM-free; 0 BOMs across all shipped CSS files
• Published manifests contain concrete ranges, not literal catalog: — verify with the publish workflow's pinned pnpm (9.15.4); note the merge added the eslint toolchain / typescript / @types/node catalog entries (chore: centralize eslint toolchain versions with pnpm catalog #634/chore: centralize typescript version with pnpm catalog #645/chore: centralize @types/node version with pnpm catalog #653)
• Merge this PR, then dispatch the publish workflow per package: react-ui, lang-core, openui-cli

🤖 Generated with Claude Code