build(deps): bump three from 0.181.1 to 0.186.1

[dependabot]

Bumps three from 0.181.1 to 0.186.1.

Commits

• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[grzanka]

@dependabot rebase

[grzanka]

@dependabot rebase

[martastn]

Review:

!! Note on the PR description: it says 0.181.1 → 0.181.2, but the actual diff in package.json/package-lock.json on this branch is 0.181.1 → 0.183.2. Reviewed accordingly against the larger diff.

Where three is used in this repo:

• Direct import (from three) across src/ThreeEditor/*.
• three/examples/jsm/...: OrbitControls, TransformControls, RoomEnvironment, lil-gui, Line2/LineGeometry/LineMaterial, RGBELoader, TGALoader.
• Deep imports straight into three/src/math/...: generateUUID and Vector3.
• Renderer: THREE.WebGLRenderer only (no WebGPURenderer anywhere).

Checked the official migration guide (181→182, 182→183) against actual usage:

• PCFSoftShadowMap deprecation, WebGPURenderer shadow/SSR/WebGLCubeRenderTarget changes, PostProcessing→RenderPipeline, VOXLoader, MeshPostProcessingMaterial, Sky- none of these APIs/features are used in this codebase. No impact.
• THREE.Clock deprecated in favor of THREE.Timer- used in ViewportManager.js for the animation loop. Confirmed by running it that the deprecation only logs a one-time console.warn in the constructor. Fixed as part of this PR: migrated clock.getDelta() → timer.update(timestamp); timer.getDelta(), using the timestamp already provided by renderer.setAnimationLoop. Only usage site in the codebase.
• RoomEnvironment position change (this.position.y = -3.5 added, shifts the PMREM lighting look)- used in ViewportManager.js only inside case ModelViewer: of the sceneEnvironmentChanged signal handler. Verified- statically (grepped every .dispatch() call in the repo) and empirically (added a temporary log, exercised settings in the running app)- that this signal is never dispatched anywhere. Zero observable impact.

Verification performed, and its actual scope:

• All changed/deep-imported file paths (/...) exist and export the same symbols in three@0.183.2. npx tsc --noEmit- 0 errors. Caveat: true but not checkJs, and files likeViewportManager.js have no // @ts-check pragma- confirmed by injecting a bogus method call into it, which tsc did not flag. So the .ts/``.tsx files that import three directly (PropertyField.tsx, SidebarTreeList.tsx, StoreService.tsx, RemoteWorkerSimulationService.ts); it says nothing about type-correctness infiles, including the Clock→Timer fix above (verified at runtime instead).
• @types/three is pinned at ^0.177.0.
  above, since most three-touching code files described above.
• jsroot bundles its own isolated three@0.162.0- no version conflict with the top-level package.

Proposed follow-up issues (not blockers for this PR):

1. @types/three is stuck at ^0.177.0, now six versions behind three@0.183.2. Should be bumped alongside three going forward (ideally have Depp manually whenever three moves) so typedeclarations don't silently drift further from the real API.
2. Dead signal handlers: sceneEnvironmenndChanged are never dispatched anywhere in the codebase. This is why the RoomEnvironment position change in three@0.183 has zero observable effect here.
3. Deep imports from three/src/... internal paths (three/src/math/MathUtils.js, three/src/math/Vector3.js in
   SidebarTreeList.tsx / PropertyField.tnon-public API surface, which is far more likely to move/break across versions than the top-level three export. Both generateUUID and Vector3 are
   available from import ... from 'threeng to that for stability against futurethree.js bumps.
4. ViewportManager.js (and the rest of isn't type-checked by tsc at all, sincetsconfig.json has allowJs: true but no checkJs, and these files have no // @ts-check pragma. Confirmed by injecting a bogus method call that this means the Clock→Timer fix bundled in this PR (and any future three.js-API changes touching this file) get no compiler safety net.

Confirmed safe to merge

[martastn]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[Copilot]

Copilot review overview

🟡 Changes recommended

new THREE.Timer() will throw at runtime because Timer is not a top-level three export and must be imported from the addons path.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Import Timer from three addon instead of THREE.Timer · New
• PR version bump is misdocumented as a patch update · New

What changed in this PR

This PR is presented as a Dependabot dependency bump for three, but it does two things: it raises the three dependency and it modifies ViewportManager.js to switch the animation loop from THREE.Clock to THREE.Timer (the Clock replacement introduced/encouraged in newer three.js releases). It fits into the ThreeEditor viewport rendering path, which drives per-frame animation updates.

Changes:

• Bump three in package.json and package-lock.json (actual target is ^0.183.2, not 0.181.2 as the title states).
• Replace THREE.Clock with THREE.Timer in the viewport animation loop and feed the setAnimationLoop timestamp into timer.update(timestamp) before reading timer.getDelta().

File	Description
package.json	Updates the three dependency range (to ^0.183.2).
package-lock.json	Locks three to 0.183.2 with updated resolved URL/integrity.
src/​ThreeEditor/​js/​viewport/​ViewportManager.js	Swaps Clock for Timer in the animate loop; introduces new THREE.Timer() and timer.update(timestamp).

Key concerns found during review:

• new THREE.Timer() will throw at runtime: Timer is not a top-level three export (unlike Clock) and must be imported from three/examples/jsm/misc/Timer.js.
• The PR title/description says 0.181.1 → 0.181.2, but the diff bumps to 0.183.2, a minor-version change that also motivates the source edit.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[martastn]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.

[martastn]

@dependabot recreate

[martastn]

Verdict: Safe to merge (after applied fix)

Bump: three 0.181.1 → 0.186.1 (r182–r186, direct dependency). Lockfile changes only three; jsroot keeps its own three@0.162.0.

What is three.js / what changed
three.js is the WebGL 3D library behind our geometry editor: the 4 viewports, figures, camera controls, transform gizmo, click picking and clipping controls. Results plots use JSROOT's bundled copy, not this one. r182–r186 is mostly new features we don't use:

• WebGPU renderer and TSL shader work; modernized, softer shadows; more physically accurate PBR materials and PMREM
• new features: HTMLTexture, SunLight with cascaded shadows, Gaussian splats, Object3D.pivot / dispose(), new DevTools
• deprecations: Clock → Timer (r183); CommonJS build deprecated and minified builds removed (r186)
• Release notes · Migration guide

Problems found

1. CI failing: SimulationMaterial.test.ts couldn't run (SyntaxError: Cannot use import statement outside a module). r186 deprecated the CommonJS build: three.cjs is now a shim that requires three.module.js, and CRA's Jest doesn't transform ESM in node_modules. Tooling only; the app itself is unaffected.
2. New console warning: THREE.Clock: This module has been deprecated (since r183). The earlier Clock → Timer fix (abfa04e) was lost when Dependabot force-pushed this branch.

Fixes (d0a5c16)

• config-overrides.js: a Jest-only override converts three's ES modules to CommonJS and maps three → three.module.js. The production build is byte-identical with and without it.
• ViewportManager.js: THREE.Clock → THREE.Timer (re-applies abfa04e). The only delta consumer is the ViewHelper camera animation, which still runs smoothly and ends on target.

Why it's safe

• CI ✅: 38 tests passed (1 skipped), same as master. tsc, eslint and build ✅. main.js +3.7 kB gzip.
• Migration guide r181→r186 checked against our usage. The env-map/RoomEnvironment, Object3D.dispose, matrixWorldNeedsUpdate and shadow changes don't apply to us. Raycaster/Matrix4/SphereGeometry changes are float-epsilon only. No security advisories for this range.
• Side-by-side check vs master (dev + prod build), using pixel hashes of all 4 viewports, a DOM/style fingerprint and the resulting data. Covered: example load, scene tree selection, add/edit figures, ortho click picking, orbit/zoom, gizmo drag, undo/redo, clipping slider, zones/scoring/settings, export/import, converter (Pyodide), JSROOT results, light theme, narrow window. No differences found; no deprecation warnings left in the console.

[Copilot]

🔵 Needs a closer look

A three.js version jump across the r186 ESM-only boundary with bespoke Jest transform/resolution logic and runtime API changes not visible in the diff needs human verification against the full test suite and app.

1 open finding

• Update @​types/three to match the new three.js runtime · New

2 resolved since last review

• Import Timer from three addon instead of THREE.Timer
• PR version bump is misdocumented as a patch update

🧠 Review effort: Balanced

[grzanka]

@martastn looks good to me, but take a look also at #2281 (comment)