Migrate standalone to Theia 1.75.0

[peterhnm]

Problem

The grouped dependency PR #1545 updates Theia from 1.74.1 to 1.75.0, but this release needs a standalone migration.

• @theia/scm-extra was retired at 1.74.1; there is no 1.75.0 release. Keeping it retains 13 old Theia package versions, including core/editor/SCM, beside the new stack.
• Theia 1.75 removes Webpack support and uses esbuild. This app retains webpack.config.js and Webpack-oriented dependencies/documentation. The configuration itself is only a generated-config wrapper, but the new bundler and packaging need validation.
• React/React DOM and their type peer ranges must remain compatible with the chosen Theia version.

Acceptance criteria

• Remove @theia/scm-extra and validate its replacement: SCM history graph in @theia/scm and per-file history in @theia/timeline.
• Align all direct/transitive Theia packages at 1.75.0, without the retained 1.74.1 dependency subtree.
• Migrate the standalone build to esbuild; remove obsolete Webpack configuration/dependencies and update build/cleanup scripts and documentation as appropriate.
• Update the existing architecture decision record for the standalone build, following the repository's living-topic ADR guidance.
• Pass standalone-extension tests and test:security, preserving Theia/Lumino patches and archive-extraction protections.
• Build and package the standalone application successfully.
• Smoke-test BPMN/DMN opening, editing, saving, theme switching, editor detach/restore, SCM history, and Timeline; check console/runtime errors.
• Revisit React/React DOM 19.3.0 and include it only after these standalone build and smoke checks pass.
• Repeat supply-chain checks for newly resolved versions and distinguish inherited advisories from newly introduced ones.

React validation gap from the safe-update split

A clean isolated checkout was tested with Theia 1.74.1 and React/React DOM 19.3.0. The root build, standalone-extension compilation, and all 15 standalone security tests passed. The standalone build failed twice during Electron 42.3.0 installation with ENOENT: node_modules/electron/dist/version, before the app could launch. Therefore desktop smoke testing was not completed, and React is excluded from the safe-update PR. This is a validation gap, not evidence of a React regression.

The standalone-extension test suite initially hit Node 24's experimental localStorage behavior in Theia's nls.ts. Running with NODE_OPTIONS=--no-experimental-webstorage passed the suite.

References

• Original grouped update: chore(deps): bump the npm-minor-patch group across 1 directory with 27 updates #1545
• Theia 1.75 migration guide
• scm-extra retirement notice

Safe-update split: #1557 (knip and lint-staged only; React deferred).

[github-actions]

Thanks for opening this, @peterhnm! 🙏

A maintainer will triage this and decide together with you whether it fits the project before any implementation starts. We've added the needs-triage label; once we've looked at it we'll either mark it accepted (green light to implement) or explain why we won't pursue it.

Please hold off on opening a pull request until this issue is accepted. We review the idea first, on its own merits — code that already exists shouldn't tip that decision. PRs whose linked issue isn't accepted are put on hold and not reviewed.

Would you like to implement this yourself once it's accepted? Just say so here — otherwise a maintainer or another contributor may pick it up.

Used an AI assistant to draft this? That's fine — but please make sure you've read and stand behind every word; you're accountable for the content. See AI-Assisted Contributions.