From ca2e05de229c4675f219a1d8f9007951643b65d3 Mon Sep 17 00:00:00 2001
From: Manuel Raynaud <manu@raynaud.io>
Date: Tue, 15 Sep 2026 10:48:58 +0200
Subject: [PATCH] =?UTF-8?q?=E2=AC=86=EF=B8=8F(yhub)=20align=20@y/y=20depen?=
 =?UTF-8?q?dency?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

we have to import @y/y dependency, we use it in the migration part of
the application and @y/hub is also using it. This can lead to a
situation where 2 versions of @y/y are installed, this is not something
we want.
---
 renovate.json                                 |  6 +++++
 .../__tests__/dependencies.spec.ts            | 24 +++++++++++++++++++
 src/yhub-server/package.json                  |  2 +-
 src/yhub-server/yarn.lock                     | 11 ++-------
 4 files changed, 33 insertions(+), 10 deletions(-)
 create mode 100644 src/yhub-server/__tests__/dependencies.spec.ts

diff --git a/renovate.json b/renovate.json
index a7656fc4c..30141634d 100644
--- a/renovate.json
+++ b/renovate.json
@@ -55,6 +55,12 @@
       "matchPackageNames": ["typescript"],
       "allowedVersions": "<7.0.0"
     },
+    {
+      "description": "yhub-server pins @y/y while @y/hub depends on it by range: bumped apart, they install two copies of Yjs, which breaks its constructor checks",
+      "groupName": "@y packages",
+      "matchManagers": ["npm"],
+      "matchPackageNames": ["@y/*"]
+    },
     {
       "enabled": false,
       "groupName": "ignored js dependencies",
diff --git a/src/yhub-server/__tests__/dependencies.spec.ts b/src/yhub-server/__tests__/dependencies.spec.ts
new file mode 100644
index 000000000..4283a1612
--- /dev/null
+++ b/src/yhub-server/__tests__/dependencies.spec.ts
@@ -0,0 +1,24 @@
+// The Yjs this server imports must be the very copy `@y/hub` imports. Two copies
+// in one process break Yjs' constructor checks, which it warns about at startup
+// ("Yjs was already imported"). `package.json` pins `@y/y` while `@y/hub` asks
+// for a range, so bumping one without the other makes yarn nest a second copy
+// under `@y/hub`. Renovate updates the `@y/*` packages together; this catches a
+// split however it came about. Resolved, not imported: nothing is loaded.
+
+import { createRequire } from 'node:module';
+import { describe, expect, it } from 'vitest';
+
+// resolves like `src/` does: this directory shares its node_modules
+const fromServer = createRequire(import.meta.url);
+
+describe('@y/y', () => {
+  it('is the copy @y/hub imports', () => {
+    const serverCopy = fromServer.resolve('@y/y');
+    const hubCopy = createRequire(fromServer.resolve('@y/hub')).resolve('@y/y');
+
+    expect(
+      hubCopy,
+      'two copies of @y/y are installed: pin it to the version @y/hub resolves',
+    ).toBe(serverCopy);
+  });
+});
diff --git a/src/yhub-server/package.json b/src/yhub-server/package.json
index 55c9048d8..221111c14 100644
--- a/src/yhub-server/package.json
+++ b/src/yhub-server/package.json
@@ -15,7 +15,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "3.1110.0",
     "@y/hub": "0.9.0",
-    "@y/y": "14.0.0-rc.24",
+    "@y/y": "14.0.0-rc.25",
     "jose": "6.2.8"
   },
   "devDependencies": {
diff --git a/src/yhub-server/yarn.lock b/src/yhub-server/yarn.lock
index 56fba974a..e40371c14 100644
--- a/src/yhub-server/yarn.lock
+++ b/src/yhub-server/yarn.lock
@@ -877,14 +877,7 @@
   dependencies:
     lib0 "^1.0.0-rc.1"
 
-"@y/y@14.0.0-rc.24":
-  version "14.0.0-rc.24"
-  resolved "https://registry.yarnpkg.com/@y/y/-/y-14.0.0-rc.24.tgz#8279272b767718af1303f4c22824d651978c41b1"
-  integrity sha512-E22nv/q6CWNodzU/yowxEp95TUVBTP5T63kAiJy2FpsuB5zxqfGhdW2222S4tFF9mo9UtBqg8ep7tPMJ9bZVOg==
-  dependencies:
-    lib0 "^1.0.0-rc.21"
-
-"@y/y@^14.0.0-rc.24":
+"@y/y@14.0.0-rc.25", "@y/y@^14.0.0-rc.24":
   version "14.0.0-rc.25"
   resolved "https://registry.yarnpkg.com/@y/y/-/y-14.0.0-rc.25.tgz#e5b2d825406984dc71fe65a71977ffe005ffd273"
   integrity sha512-kG61I9GLF85aNtBelJKcf6D6PhLoWUBWQ2kyTAKwOWRUnuCkzGRCp3gUdwcTB9TINtgC9w5kPAKzstNDIpwSXw==
@@ -1418,7 +1411,7 @@ levn@^0.4.1:
     prelude-ls "^1.2.1"
     type-check "~0.4.0"
 
-lib0@^1.0.0-rc.1, lib0@^1.0.0-rc.21, lib0@^1.0.0-rc.27, lib0@^1.0.0-rc.28:
+lib0@^1.0.0-rc.1, lib0@^1.0.0-rc.27, lib0@^1.0.0-rc.28:
   version "1.0.0-rc.30"
   resolved "https://registry.yarnpkg.com/lib0/-/lib0-1.0.0-rc.30.tgz#2c2aec2c91a99230891918e0a551472a6cc8052e"
   integrity sha512-WhIbHSbBMttOT3Ke/HDA5+kIf9KRDSd5L+aJMBkvJSxwqL7w7004/0X5fjXj8loBIm5PkdgSMRmlPjC2mIzuCw==