Skip to content

chore(deps-dev): bump the development-minor-and-patch group across 1 directory with 13 updates - #3625

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/development-minor-and-patch-1c99a0725d
Open

chore(deps-dev): bump the development-minor-and-patch group across 1 directory with 13 updates#3625
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/development-minor-and-patch-1c99a0725d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development-minor-and-patch group with 13 updates in the / directory:

Package From To
@playwright/test 1.62.1 1.63.0
@react-email/ui 6.9.2 6.9.3
@tanstack/devtools-vite 0.8.3 0.8.5
@testing-library/react 16.3.2 16.3.3
@types/node 26.2.0 26.5.0
@types/react-dom 19.2.4 19.2.7
@vitejs/plugin-react 6.0.5 6.1.1
convex-test 0.0.55 0.0.56
oxfmt 0.63.0 0.67.0
oxlint 1.78.0 1.82.0
react-email 6.9.2 6.9.3
skills 1.5.20 1.5.25
vite 8.2.1 8.2.2

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits
  • 1b025d7 chore: mark v1.63.0 (#42569)
  • 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
  • 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
  • e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
  • 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
  • 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
  • 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
  • 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
  • 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
  • bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
  • Additional commits viewable in compare view

Updates @react-email/ui from 6.9.2 to 6.9.3

Release notes

Sourced from @​react-email/ui's releases.

@​react-email/ui@​6.9.3

Patch Changes

  • 1378365: Keep the sidebar scroll position, its collapsed state, and open folders when you switch emails.
Changelog

Sourced from @​react-email/ui's changelog.

6.9.3

Patch Changes

  • 1378365: Keep the sidebar scroll position, its collapsed state, and open folders when you switch emails.
Commits

Updates @tanstack/devtools-vite from 0.8.3 to 0.8.5

Release notes

Sourced from @​tanstack/devtools-vite's releases.

@​tanstack/devtools-vite@​0.8.5

Patch Changes

  • Updated dependencies [d337857]:
    • @​tanstack/devtools-bundler-core@​0.1.3

@​tanstack/devtools-vite@​0.8.4

Patch Changes

  • Updated dependencies [2df2e04]:
    • @​tanstack/devtools-event-bus@​0.4.3
    • @​tanstack/devtools-bundler-core@​0.1.2
Changelog

Sourced from @​tanstack/devtools-vite's changelog.

0.8.5

Patch Changes

  • Updated dependencies [d337857]:
    • @​tanstack/devtools-bundler-core@​0.1.3

0.8.4

Patch Changes

  • Updated dependencies [2df2e04]:
    • @​tanstack/devtools-event-bus@​0.4.3
    • @​tanstack/devtools-bundler-core@​0.1.2
Commits

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

  • Avoid act() re-entrant when dispatching events (#1468) (20ce75f)
Commits

Updates @types/node from 26.2.0 to 26.5.0

Commits

Updates @types/react-dom from 19.2.4 to 19.2.7

Commits

Updates @vitejs/plugin-react from 6.0.5 to 6.1.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:

npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits
  • 04cac50 release: plugin-react@6.1.1 (#1440)
  • 82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
  • 397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
  • 61006e6 fix(deps): update all non-major dependencies (#1433)
  • e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
  • fb2d6f3 fix(deps): update all non-major dependencies (#1427)
  • 39b3173 release: plugin-react@6.1.0 (#1428)
  • f1340b0 feat(react): add native React Compiler support (#1419)
  • 9ab698e fix(deps): update all non-major dependencies (#1375)
  • See full diff in compare view

Updates convex-test from 0.0.55 to 0.0.56

Changelog

Sourced from convex-test's changelog.

0.0.56

  • Document the second parameter to finishAllScheduledFunctions
Commits

Updates oxfmt from 0.63.0 to 0.67.0

Changelog

Sourced from oxfmt's changelog.

[0.67.0] - 2026-09-07

🛡️ Security

  • 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

[0.64.0] - 2026-08-18

🚀 Features

  • c07fe7c oxfmt: Support experimentalOperatorPosition (#25643) (leaysgur)

📚 Documentation

  • fed6681 oxfmt: Skip expanding overrides options (#25572) (leaysgur)

[0.62.0] - 2026-08-03

🐛 Bug Fixes

  • e6e584b oxfmt: Type jsdoc. enum options (#25008) (leaysgur)

[0.59.0] - 2026-07-13

🐛 Bug Fixes

  • 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#24286) (leaysgur)

[0.55.0] - 2026-06-15

🚀 Features

  • 9a2788b linter/unicorn: Implement prefer-export-from rule (#22935) (AliceLanniste)

[0.54.0] - 2026-06-08

📚 Documentation

  • dadafe3 oxlint, oxfmt: Mention migrate skills in npm READMEs (#22965) (Boshen)
  • f88961a oxfmt: Annotate each config option with supported languages (#22953) (leaysgur)

[0.52.0] - 2026-05-26

🚀 Features

  • 16b8058 oxfmt: Support vite-plus/resolveConfig for vite.config.ts (#22454) (leaysgur)

[0.50.0] - 2026-05-15

🐛 Bug Fixes

... (truncated)

Commits

Updates oxlint from 1.78.0 to 1.82.0

Release notes

Sourced from oxlint's releases.

oxlint v1.82.0 & oxfmt v0.67.0

Table of Contents

Oxlint v1.82.0

💥 BREAKING CHANGES

  • 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

🐛 Bug Fixes

  • aa38ddf linter/unicorn/numeric-separators-style: Correct schema defaults (#26393) (camc314)
  • 562dd14 jsx-a11y/anchor-has-content: Allow anchors passed as custom component props (#26360) (Mikhail Baev)
  • 253cdb2 linter/eslint/id-length: Exempt TS interface/type-literal members with never (#26310) (Pearce Ropion)
  • 8c7ea76 ast_visit: Account for trimmed source offsets (#26223) (Cameron)
  • 5f9cffc linter/typescript/no-explicit-any: Fix rest parameter to unknown[] (#26279) (camc314)
  • 4de9fa3 linter/react/jsx-no-literals: Check nested JSX expression literals (#26253) (camc314)
  • 07851b9 parser: Fix debug assert failure when lexer error with tokens enabled (#26229) (overlookmotel)
  • 9cee146 oxlint/lsp: Don't try to parse fix message, always fallback (#26204) (Sysix)
  • a662c40 linter/eslint/no-useless-assignment: Handle destructuring assignments (#25925) (camc314)
  • 304bd9a linter/eslint/no-array-constructor: Handle ASI hazards in fixer (#26166) (Hamody We)
  • b41bb35 linter: Qualify rules in rules output (#26250) (camc314)
  • 895c685 linter/typescript/no-extraneous-class: Avoid deleting class expressions (#26231) (camc314)
  • 4ba33c8 linter/eslint/no-unused-vars: Handle stored arrow references (#26225) (camc314)

🛡️ Security

  • 9a612d5 deps: Update npm packages (#26178) (renovate[bot])

Oxfmt v0.67.0

💥 BREAKING CHANGES

  • 66744f0 parser: [BREAKING] Rename panicked to fatal_error in ParserReturn (#26382) (overlookmotel)
  • 2c9a947 parser: [BREAKING] Reduce MAX_LEN to 256 bytes below u32::MAX (#26352) (overlookmotel)

🚀 Features

  • 68e12ab formatter_css: Follow the oxc-css-parser's acceptance line (#26337) (leaysgur)

🐛 Bug Fixes

  • f7acdc0 formatter: Treat a JSDoc cast target as opaque in chain layouts (#26375) (leaysgur)
  • 104061b formatter: Keep JSDoc cast parens with a comment inside them (#26374) (leaysgur)
  • 3d00a76 formatter_css: Keep comment inside important and simple-vars colon (#26370) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.82.0] - 2026-09-07

🚀 Features

  • 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

  • d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

  • 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

  • 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
  • aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
  • 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
  • beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
  • 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
  • 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
  • 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)
Commits
  • b4da00b release(apps): oxlint v1.82.0 && oxfmt v0.67.0 (#26384)
  • aa38ddf fix(linter/unicorn/numeric-separators-style): correct schema defaults (#26393)
  • 6a0e19c feat(linter/eslint/no-unmodified-loop-condition): support `checkConditionalEx...
  • 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
  • d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
  • 63bc313 chore(npm): update funding URL (#26066)
  • 97e99b8 release(apps): oxlint v1.80.0 && oxfmt v0.65.0 (#26045)
  • 0db127c release(apps): oxlint v1.79.0 && oxfmt v0.64.0 (#25866)
  • 228e8e0 fix(linter): resolve inactive React compiler rules (#25830)
  • aa49d86 fix(linter): allow spread rule options in config types (#25675)
  • Additional commits viewable in compare view

Updates react-email from 6.9.2 to 6.9.3

Changelog

Sourced from react-email's changelog.

6.9.3

Commits

Updates skills from 1.5.20 to 1.5.25

Release notes

Sourced from skills's releases.

v1.5.25

Changelog

  • fix: fall back when skill snapshots omit files (#2069)
  • AGENTS.md: outdated source files listed (#2063)
  • fix(remove): only offer directories that hold a SKILL.md (#2055)
  • fix: treat Droid as a universal agent to stop duplicate skill definitions (#2012)
  • fix: point Kilo Code at .agents/skills and ~/.kilo/skills (#2011)
  • feat: add fx agent support (#2006)
  • feat: add Sarvam Code agent support (#2004)
  • fix(add): exit non-zero when install prompts cannot run without a TTY (#1991)

Contributors

@​0thernet,@​doanbactam @​dylanpulver,@​ecki @​pproenca,@​pushkar-sarvam

v1.5.24

Changelog

  • fix(update): migrate relocated skill paths (#2124)
  • feat: support installing skills pinned to a commit SHA (#1439)

Contributors

@​AvdLee,@​mollux

v1.5.23

Changelog

  • Add Select All control to skill picker (#1999)
  • fix: fail scoped well-known installs instead of falling back to the root index (#1990)
  • fix: refuse remove --all when specific skills are named (#1964)
  • fix: don't delete a skill from the same repo pinned to a different ref (#1953)
  • fix: bypass blob snapshots for explicit refs (#1934)
  • Fix internal skill filtering for well-known sources (#1921)
  • fix: exclude internal skills from --skill '*' wildcard (#1909)
  • feat: add Posit Assistant agent support (#1885)
  • fix: remove obsolete OpenClaw use warning (#1858)
  • fix: secure private repository authentication (#1857)

Contributors

@​GeorgijGrigoriev,@​Osamaali313 @​Patrick-Erichsen,@​dylanpulver @​fenfenxu,@​hcjmartin @​initred,@​quuu @​statik

v1.5.22

Changelog

  • fix: discover skills nested under two categories (#1866)
  • fix(update): normalize GitHub shorthand for project deletion checks (#1865)
  • fix: preserve locked GitHub host during updates (#1837)

... (truncated)

Commits
  • 7ffbeb9 v1.5.25
  • 3c24bb9 chore: bring a little calm to the agent picker
  • 213de5a Merge pull request #2006 from doanbactam/feat/add-fx-agent
  • 8c8d766 Merge pull request #2069 from 0thernet/codex/fallback-incomplete-snapshot
  • f00c1a1 Merge pull request #2012 from dylanpulver/fix/droid-universal-skills-dir
  • 38ee3f9 Merge pull request #1991 from dylanpulver/fix/no-tty-exit-code
  • 8db8fc5 Merge pull request #2011 from dylanpulver/fix/kilo-agents-skills-dir
  • 4cb0197 Merge remote-tracking branch 'origin/main' into HEAD
  • c9f2d0e Merge pull request #2004 from pushkar-sarvam/feat/sarvam-code-agent
  • 2e35067 Merge pull request #2055 from pproenca/fix/remove-scans-non-skill-directories
  • Additional commits viewable in compare view

Updates vite from 8.2.1 to 8.2.2

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.2

Please refer to CHANGELOG.md for details.

v8.2.2

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.2 (2026-08-20)

Features

  • deps: widen @vitejs/devtools peer range to v0.5.0 (#23302) (495d9ff)

Bug Fixes

  • bundled-dev: handle lazy request error (#23291) (3ba026d)
  • bundled-dev: hot update through circular imports instead of reloading (#23259) (3dbddef)
  • config: resolve sourcemap paths against sourcemap location (#23239) (05a003e)
  • css: don't pass empty targets to lightningcss (#23295) (2804636)
  • define: fix match escaped dots to support $-prefixed define keys (#23249) (dcf88bd)
  • deps: update all non-major dependencies (#23217) (ba958bd)
  • deps: update rolldown-related dependencies (#23218) (83ecb2c)
  • module-runner: exclude completed modules from in-flight cycle detection (fix #22999) (#23009) (d9b10a9)
  • optimizer: close custom extension analysis bundles (#23207) (8fb7675)
  • reduce Windows 8.3-short-name detection false-positives (#23066) (02cffa9)
  • respect resolve.preserveSymlinks when resolving root (fix #23197) (#23198) (8413052)
  • ssr: rewrite computed key of destructing parameter (#23307) (9db0b61)
  • vite: update outdated upstream file links in license comments (#23285) (c0f2fc6)

Documentation

Miscellaneous Chores

Code Refactoring

  • use JSON import attributes instead of readFileSync in constants (#23258) (1d9fa39)
  • use named regex constants over inline literals (#22964) (5c1c6c6)

Tests

  • define: close rolldown bundler after generate (#23231) (b4d66fe)
  • module-runner: add TLA circular import case (#23299) (4a261f2)
  • module-runner: simplify server-hmr tests (#23300) (599b44b)
  • ssr: add destructing assignment case for moduleRunnerTransform (#23308) (cb77e2a)

Build System

  • use JSON import attributes instead of readFIleSync in rolldown configs (#23251) (d615bcd)
Commits
  • de1111a release: v8.2.2
  • cb77e2a test(ssr): add destructing assignment case for moduleRunnerTransform (#23308)
  • 9db0b61 fix(ssr): rewrite computed key of destructing parameter (#23307)
  • 8413052 fix: respect resolve.preserveSymlinks when resolving root (fix #23197) (#23...
  • 05a003e fix(config): resolve sourcemap paths against sourcemap location (#23239)
  • 495d9ff feat(deps): widen @vitejs/devtools peer range to v0.5.0 (#23302)
  • 1d9fa39 refactor: use JSON import attributes instead of readFileSync in constants (#2...
  • 2804636 fix(css): don't pass empty targets to lightningcss (#23295)
  • 599b44b test(module-runner): simplify server-hmr tests (#23300)
  • 4a261f2 test(module-runner): add TLA circular import case (#23299)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 8, 2026
@clawsweeper

clawsweeper Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@vercel

vercel Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clawhub Ready Ready Preview Sep 11, 2026 4:14pm UTC

Request Review

@clawsweeper clawsweeper Bot added P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 8, 2026
@clawsweeper

clawsweeper Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed September 11, 2026, 12:09 PM ET / 16:09 UTC (Revision 7).

ClawSweeper review

What this changes

Updates 13 development dependencies, synchronizes Node.js types across both CLI workspaces, and refreshes the Bun lockfile.

Merge readiness

✅ Ready for maintainer review

Keep open: the dependency updates remain absent from pinned main and the latest release. No blocking findings emerged from the introduced diff.

Priority: P3
Reviewed head: d2193601c086431707a2dcbd8dcb994aa23fdc42

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A focused dependency update with consistent manifests, substantial passing validation, and no identified blocking defect.
Proof confidence 🌊 off-meta tidepool Not applicable: This Dependabot maintenance PR is exempt from contributor runtime proof; existing build, browser, and real skills CLI checks provide supplemental validation.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This Dependabot maintenance PR is exempt from contributor runtime proof; existing build, browser, and real skills CLI checks provide supplemental validation.
Evidence reviewed 8 items Introduced scope and continued necessity: The verified base-to-head comparison changes only three package manifests and bun.lock. Main retains the older versions; runtime dependencies, scripts, security overrides, and application source are unchanged.
Release comparison: The supplied latest release, v0.23.3, also uses older development dependencies, including Vite 8.1.5 and Playwright 1.61.1. These updates are not already supplied by that release.
Exact-head validation: GitHub REST confirms the pinned head remains open and mergeable. Static, unit, types-build, packages, e2e-http, and playwright-smoke checks passed; several local-auth browser shards were still running. No local builds or tests were executed in this read-only review.
Findings None None.
Security None None.

How this fits together

ClawHub’s development toolchain builds the web application, checks TypeScript, and runs browser, backend, and CLI tests. Workspace manifests and the Bun lockfile select the tools used locally and in CI.

flowchart TD
  A[Workspace manifests] --> C[Frozen Bun installation]
  B[Dependency lockfile] --> C
  C --> D[Web application build]
  C --> E[Type and static checks]
  C --> F[Browser and CLI tests]
  D --> G[Build artifacts and validation results]
  E --> G
  F --> G
Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Diff size +141/-105 across 4 files All changes are confined to dependency manifests and their lockfile.
Source growth Production +0/-0; tests +0/-0 The update adds no application or test implementation.

Technical review

Best possible solution:

Retain the grouped manifest-and-lockfile update using the existing frozen-install, build, and compatibility gates.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance rather than a reported behavior defect.

Is this the best way to solve the issue?

Yes: synchronized manifests and a refreshed lockfile follow the configured development dependency group; splitting the updates is unnecessary without an isolated incompatibility.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cbfee7343ddc.

Labels

Label justifications:

  • P3: Routine development dependency maintenance with no demonstrated urgent user-facing regression.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot maintenance PR is exempt from contributor runtime proof; existing build, browser, and real skills CLI checks provide supplemental validation.

Evidence

What I checked:

  • Introduced scope and continued necessity: The verified base-to-head comparison changes only three package manifests and bun.lock. Main retains the older versions; runtime dependencies, scripts, security overrides, and application source are unchanged. (package.json:164, d2193601c086)
  • Release comparison: The supplied latest release, v0.23.3, also uses older development dependencies, including Vite 8.1.5 and Playwright 1.61.1. These updates are not already supplied by that release. (package.json, 87ca030c30f3)
  • Exact-head validation: GitHub REST confirms the pinned head remains open and mergeable. Static, unit, types-build, packages, e2e-http, and playwright-smoke checks passed; several local-auth browser shards were still running. No local builds or tests were executed in this read-only review. (d2193601c086)
  • Build and installation contracts: Read package scripts, Vite configuration, CI, and the setup-bun action. CI installs the frozen lockfile and installs matching Playwright browsers. The existing Agent Skills compatibility test resolves and executes the installed skills CLI, covering the bumped dependency through the HTTP test lane. (e2e/agent-skills-discovery.e2e.test.ts:18, d2193601c086)
  • Upstream compiler option remains opt-in: Dependency inspection applies because ClawHub imports the updated React plugin in vite.config.ts. Its upstream changelog requires explicitly enabling the new compiler option; ClawHub continues calling viteReact() without it. (packages/plugin-react/CHANGELOG.md:15)
  • Discussion and review continuity: Retrieved the remaining body text and confirmed its SHA-256 matches the captured source, 6fe6c1876a3dd049c27f50367b4efdf9d083367a5ec1eca34a3282e1d4166a6a. It contains dependency release notes. The prior completed review reports no findings or published rank-up moves; live reviews are empty. Earlier-head comparison was unavailable, so no unchanged-code attribution is asserted. Prepared screenshots concern unrelated historical moderation reports, not this update. (d2193601c086)

Likely related people:

  • Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)
  • reviewed 2026-09-08T16:13:45.984Z sha d4a4c79 :: needs maintainer review before merge. :: none
  • reviewed 2026-09-08T19:56:57.288Z sha cfc727a :: needs maintainer review before merge. :: none
  • reviewed 2026-09-09T04:13:27.331Z sha 3ac4c9d :: needs maintainer review before merge. :: none
  • reviewed 2026-09-09T11:41:48.352Z sha 3ac4c9d :: needs maintainer review before merge. :: none
  • reviewed 2026-09-09T16:10:58.116Z sha ae5f0fc :: needs maintainer review before merge. :: none
  • reviewed 2026-09-10T16:10:36.080Z sha 2e3e5b2 :: needs maintainer review before merge. :: none

@dependabot
dependabot Bot force-pushed the dependabot/bun/development-minor-and-patch-1c99a0725d branch from d4a4c79 to cfc727a Compare September 8, 2026 19:52
@dependabot
dependabot Bot force-pushed the dependabot/bun/development-minor-and-patch-1c99a0725d branch from cfc727a to 3ac4c9d Compare September 9, 2026 04:09
@dependabot
dependabot Bot force-pushed the dependabot/bun/development-minor-and-patch-1c99a0725d branch from 3ac4c9d to ae5f0fc Compare September 9, 2026 16:06
@dependabot
dependabot Bot force-pushed the dependabot/bun/development-minor-and-patch-1c99a0725d branch from ae5f0fc to 2e3e5b2 Compare September 10, 2026 16:05
@dependabot
chore(deps-dev): bump the development-minor-and-patch group across 1 …
d219360 
…directory with 13 updates

Bumps the development-minor-and-patch group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.62.1` | `1.63.0` |
| [@react-email/ui](https://github.com/resend/react-email/tree/HEAD/packages/ui) | `6.9.2` | `6.9.3` |
| [@tanstack/devtools-vite](https://github.com/TanStack/devtools/tree/HEAD/packages/devtools-vite) | `0.8.3` | `0.8.5` |
| [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.2` | `16.3.3` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.5.0` |
| [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.4` | `19.2.7` |
| [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` |
| [convex-test](https://github.com/get-convex/convex-test) | `0.0.55` | `0.0.56` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.63.0` | `0.67.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.78.0` | `1.82.0` |
| [react-email](https://github.com/resend/react-email/tree/HEAD/packages/react-email) | `6.9.2` | `6.9.3` |
| [skills](https://github.com/vercel-labs/skills) | `1.5.20` | `1.5.25` |
| [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.1` | `8.2.2` |



Updates `@playwright/test` from 1.62.1 to 1.63.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.62.1...v1.63.0)

Updates `@react-email/ui` from 6.9.2 to 6.9.3
- [Release notes](https://github.com/resend/react-email/releases)
- [Changelog](https://github.com/resend/react-email/blob/canary/packages/ui/CHANGELOG.md)
- [Commits](https://github.com/resend/react-email/commits/@react-email/ui@6.9.3/packages/ui)

Updates `@tanstack/devtools-vite` from 0.8.3 to 0.8.5
- [Release notes](https://github.com/TanStack/devtools/releases)
- [Changelog](https://github.com/TanStack/devtools/blob/main/packages/devtools-vite/CHANGELOG.md)
- [Commits](https://github.com/TanStack/devtools/commits/@tanstack/devtools-vite@0.8.5/packages/devtools-vite)

Updates `@testing-library/react` from 16.3.2 to 16.3.3
- [Release notes](https://github.com/testing-library/react-testing-library/releases)
- [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md)
- [Commits](testing-library/react-testing-library@v16.3.2...v16.3.3)

Updates `@types/node` from 26.2.0 to 26.5.0
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `@types/react-dom` from 19.2.4 to 19.2.7
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom)

Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1
- [Release notes](https://github.com/vitejs/vite-plugin-react/releases)
- [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react)

Updates `convex-test` from 0.0.55 to 0.0.56
- [Changelog](https://github.com/get-convex/convex-test/blob/main/CHANGELOG.md)
- [Commits](get-convex/convex-test@v0.0.55...v0.0.56)

Updates `oxfmt` from 0.63.0 to 0.67.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.67.0/npm/oxfmt)

Updates `oxlint` from 1.78.0 to 1.82.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.82.0/npm/oxlint)

Updates `react-email` from 6.9.2 to 6.9.3
- [Release notes](https://github.com/resend/react-email/releases)
- [Changelog](https://github.com/resend/react-email/blob/canary/packages/react-email/CHANGELOG.md)
- [Commits](https://github.com/resend/react-email/commits/react-email@6.9.3/packages/react-email)

Updates `skills` from 1.5.20 to 1.5.25
- [Release notes](https://github.com/vercel-labs/skills/releases)
- [Commits](vercel-labs/skills@v1.5.20...v1.5.25)

Updates `vite` from 8.2.1 to 8.2.2
- [Release notes](https://github.com/vitejs/vite/releases)
- [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md)
- [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.63.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: "@react-email/ui"
  dependency-version: 6.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: "@tanstack/devtools-vite"
  dependency-version: 0.8.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: "@testing-library/react"
  dependency-version: 16.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: "@types/node"
  dependency-version: 26.4.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: "@types/react-dom"
  dependency-version: 19.2.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: "@vitejs/plugin-react"
  dependency-version: 6.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: convex-test
  dependency-version: 0.0.56
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: oxfmt
  dependency-version: 0.66.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: oxlint
  dependency-version: 1.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development-minor-and-patch
- dependency-name: react-email
  dependency-version: 6.9.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: skills
  dependency-version: 1.5.23
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
- dependency-name: vite
  dependency-version: 8.2.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/bun/development-minor-and-patch-1c99a0725d branch from 2e3e5b2 to d219360 Compare September 11, 2026 16:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code P3 Low-priority cleanup, docs, polish, ergonomics, or speculative work. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants