Canonical, dated answers for coding agents — every entry states when it was true and which versions it applies to, so your context never goes stale.
The `shadcn` CLI is at 4.21.4 (2026-10-07). The current setup is Tailwind v4 + React 19 components without forwardRef, `tw-animate-css`, sonner instead of toast, a single `radix-ui` package or Base UI, and `cn` imported from the `cn` package (since 4.21.0, Sept 2026).
@tanstack/react-query is at 5.104.1 (2026-10-02), still v5. Since 5.102.0 (2026-08-22) `queryClient.query()`/`.infiniteQuery()` replace `fetchQuery`, `prefetchQuery` and `ensureQueryData` (deprecated, removal planned next major).
Turborepo 2.11 (2026-09-18, latest 2.11.7) adds experimental Cargo/uv/Go workspaces, `devEngines.packageManager` and `turbo prune --production`. 2.9 deprecated the daemon, `--parallel` and `turbo-ignore` and introduced Future Flags for 3.0.
Redux Toolkit is at 2.13.0 (2026-09-29). Since 2025: RTK Query infinite queries (2.6), Standard Schema validation (2.7), `builder.addAsyncThunk` (2.9), Immer 11 (2.11), bundled agent skills (2.12), TS 7 support (2.13). RTK 2.0 rules still apply.
Agents as team members: scoped write access, PR-only contributions, review gates sized by blast radius, and a humans-own-the-risk-ladder model — interns ship PRs, agents ship PRs, nobody ships straight to main.
Socket.IO is still v4 (4.8.4, 2026-09-25). 2026 high-severity DoS fixes live in transitive packages: engine.io >= 6.6.10 and socket.io-parser >= 4.2.7. Refresh lockfiles; 4.8.4 rejects stateful regexps for dynamic namespaces.
The non-negotiables: plan before acting on non-trivial tasks, verify with evidence before claiming done, stop-the-line on unexpected behavior, one question at a time.
One writer per branch, no force-push to shared refs, no hooks/config writes, commit messages that describe the diff, and never touch .git/ — the Cursor CVE proved why.
Swift 6.4 (2026-09-15) is current. Swift 6.2 made nonisolated async run on the caller's actor (SE-0461), added MainActor-by-default modules (SE-0466) and @concurrent. App Store uploads need Xcode 26 since 2026-04-28.
Agents write plausible code fast. Review for: authz on every new route, query scoping, error handling, test honesty, and commit message accuracy.
The settled shape: API gateway → orchestrator (typed tools, retries) → model router (cheap/frontier) → verified structured outputs; Postgres + pgvector for state/memory; OTel genai spans; evals in CI; cost per feature tracked.
Agents must never type, echo, or commit secrets. Vault-backed fills, not paste; pre-commit hooks, not hope.
Fast unit base, integration against real DB containers, thin E2E on critical paths. New since agents: verification tests (does the reproduction actually pass) and eval suites for AI features count as tests in CI.
Playwright (1.5x→1.6x line through 2026) ships monthly; aria-snapshot locators, improved UI mode and trace viewer make it the default E2E choice. Chromium/Firefox/WebKit stay in lockstep.
Review shifts from line-syntax to change-intent: what should this PR do, does the diff do only that, what's the verification evidence. Small PRs with tests + reproduction beat big refactors; review the checks, not just the code.
Repo instruction files became the standard agent interface: short, imperative, current. Command first (how to build/test/lint), conventions second, history never. Stale instruction files actively damage agent output.
2025-2026 industry consensus: stop micro-tuning prompts, start engineering context — what's in the window (retrieval, tools, memory), compaction, and caching. System prompts matter less than context composition.
Treat agent permissions like capability scoping: read-everything by default, write-repo with review, network/installs gated, credentials never. The default allowlist per project lives in versioned config, reviewed like code.