Skip to content

chore(deps): bump the production-minor-and-patch group across 1 directory with 15 updates - #3686

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-8d6730c1e2
Closed

chore(deps): bump the production-minor-and-patch group across 1 directory with 15 updates#3686
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-8d6730c1e2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-and-patch group with 15 updates in the / directory:

Package From To
@openclaw/plugin-inspector 0.3.23 0.3.24
@tanstack/react-router 1.170.29 1.170.33
@tanstack/react-start 1.168.46 1.168.50
@vercel/oidc 3.8.4 3.8.5
convex 1.44.0 1.45.0
convex-helpers 0.1.123 0.1.124
ignore 7.0.6 7.0.9
jose 6.2.9 6.2.12
lucide-react 1.31.0 1.43.0
mermaid 11.16.1 11.17.2
resend 6.20.0 6.26.0
zod 4.4.3 4.5.4
undici 7.29.0 7.29.1
@clack/prompts 1.7.0 1.8.0
p-retry 8.0.0 8.0.1

Updates @openclaw/plugin-inspector from 0.3.23 to 0.3.24

Release notes

Sourced from @​openclaw/plugin-inspector's releases.

plugin-inspector v0.3.24

Fixed

  • Recognize compiled CommonJS plugin factory calls when checking expected channel registrations, preserving source references and excluding factory values passed to wrappers.
  • Classify widget presenters as metadata-only synthetic probes without invoking presentation callbacks.

Verification

  • npm package 0.3.24 · registry tarball
  • Successful release workflow, source 92db8c57e1d5544c522c7c882a33be1ad4e253b9.
  • Registry signatures and provenance verified for this package, tag, workflow, source commit, and run attempt. The complete uncompressed package archive matches the locally tested candidate.
  • Tarball SHA-256: 292232b5c2aa34a73ef110333a14240ec07b53a730be1d2d62cb4c76441e9404
  • Integrity: sha512-g74+lsc3vSinAKbaqlsSvsaWvzkFv71ZVWOzXp4uFDisR1g9fiv/HvoKQI3uenlV0aJr/oD+FZukTs/jyXlr/A==
Changelog

Sourced from @​openclaw/plugin-inspector's changelog.

0.3.24 - 2026-08-31

Fixed

  • Recognize compiled CommonJS plugin factory calls when checking expected channel registrations, preserving source references and excluding factory values passed to wrappers.
  • Classify widget presenters as metadata-only synthetic probes without invoking presentation callbacks.
Commits
  • 92db8c5 chore: prepare plugin-inspector 0.3.24 (#67)
  • 2c7629c fix: recognize compiled factories and classify widget presenters (#66)
  • 1bc3080 chore(deps): refresh Crabbox pnpm to 12.1.0 (#65)
  • See full diff in compare view

Updates @tanstack/react-router from 1.170.29 to 1.170.33

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2

1.170.32

Patch Changes

1.170.31

Patch Changes

  • Updated dependencies [3e016ac]:
    • @​tanstack/router-core@​1.171.26

1.170.30

Patch Changes

  • #8084 5d3785d - preserve pending UI across retained routes

  • #8068 f75cada - direct export of CatchBoundary class component, remove function wrapper

  • Updated dependencies [5d3785d, 63d2cc9]:

    • @​tanstack/router-core@​1.171.25
Commits
  • a58e01c ci: Version Packages (#8182)
  • 08eff50 fix(router-core): fix dangling references in published declarations (#8207)
  • cf166d1 fix(react-router): avoid rewriting unchanged head assets (#8257)
  • 07b3bc9 test(react-router): cover pending and not-found context (#8243)
  • 2f20c00 fix(router-core): skip lifecycle callbacks below fallback boundaries (#8165)
  • 0497cae perf(router): use URL.canParse for absolute URL checks (#8251)
  • 28a5e45 fix(router): handle unknown error boundary values (#8209)
  • f0b5eda fix(router-core): retain not-found boundary during navigation (#8161)
  • 0caf6b9 fix: preserve shouldThrow in route-scoped hooks (#8169)
  • a5a5bac ci: Version Packages (#8133)
  • Additional commits viewable in compare view

Updates @tanstack/react-start from 1.168.46 to 1.168.50

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.168.50

Patch Changes

Changelog

Sourced from @​tanstack/react-start's changelog.

1.168.50

Patch Changes

1.168.49

Patch Changes

  • Updated dependencies [cb281d7, a0041bb]:
    • @​tanstack/react-router@​1.170.32
    • @​tanstack/start-plugin-core@​1.171.39
    • @​tanstack/react-start-client@​1.168.30
    • @​tanstack/react-start-rsc@​0.1.48
    • @​tanstack/react-start-server@​1.167.37
    • @​tanstack/start-client-core@​1.170.27
    • @​tanstack/start-server-core@​1.169.31

1.168.48

Patch Changes

  • Updated dependencies []:
    • @​tanstack/react-router@​1.170.31
    • @​tanstack/react-start-client@​1.168.29
    • @​tanstack/react-start-rsc@​0.1.47
    • @​tanstack/react-start-server@​1.167.36
    • @​tanstack/start-client-core@​1.170.26
    • @​tanstack/start-plugin-core@​1.171.38
    • @​tanstack/start-server-core@​1.169.30

1.168.47

Patch Changes

  • Updated dependencies [5d3785d, f75cada]:
    • @​tanstack/react-router@​1.170.30
    • @​tanstack/react-start-client@​1.168.28
    • @​tanstack/react-start-rsc@​0.1.46
    • @​tanstack/react-start-server@​1.167.35
    • @​tanstack/start-client-core@​1.170.25
    • @​tanstack/start-plugin-core@​1.171.37

... (truncated)

Commits

Updates @vercel/oidc from 3.8.4 to 3.8.5

Changelog

Sourced from @​vercel/oidc's changelog.

3.8.5

Patch Changes

  • Updated dependencies [7a3a2ef]
    • @​vercel/cli-config@​0.2.4
Commits

Updates convex from 1.44.0 to 1.45.0

Changelog

Sourced from convex's changelog.

1.45.0

  • Local deployments now upgrade to a new backend version in place, instead of going through a snapshot export and import. Upgrades no longer depend on the size of your local data, and no longer prompt about transferring it.
  • The Convex MCP server (npx convex mcp) now supports the stateless MCP protocol (2026-07-28 MCP specification).
  • Added a new getServiceToken function that generates service tokens for first-party Convex services. This will be used by the upcoming Convex AI gateway.
  • Improved the error message when npx convex export fails because a snapshot export is already in progress.
Commits

Updates convex-helpers from 0.1.123 to 0.1.124

Changelog

Sourced from convex-helpers's changelog.

0.1.124

  • validate now normalizes system table ids (e.g. v.id("_storage")) with db.system.normalizeId instead of throwing when passed a real db.
Commits

Updates ignore from 7.0.6 to 7.0.9

Release notes

Sourced from ignore's releases.

7.0.8

PATCH Brings pattern matching closer to git:

  • PATCH A backslash now makes the next character a literal, exactly as git does: \* matches a literal * rather than acting as a wildcard, \? matches a literal ?, and \d, \b, \/ and the like are the plain characters instead of regular-expression escapes.
  • PATCH Only a trailing run of spaces is stripped from a pattern — never tabs or other whitespace — and a line of only tabs is treated as a pattern rather than a blank line, matching git.

An upgrade is recommended for all dependents.

Commits
  • 821765e #166: bump version 7.0.9
  • e00d35e Merge pull request #167 from bentbrain/fix-bom-blank-line
  • 9b6481f fix(ignore): reject BOM-only blank lines before compilation
  • 20b802a bump version 7.0.8
  • 0414358 build: require 100% coverage of index.js as an explicit gate
  • 968aee6 compat: check compatibility by running old versions' test suites
  • 8e46220 build: run the compatibility gate as part of npm test
  • 6e81fb2 tidy up how wildcards compile
  • ea3d5eb fix: a backslash quotes the next character, and only spaces are trimmed
  • 01cfbbb docs: document the known, deliberate differences from git
  • Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.43.0

Release notes

Sourced from lucide-react's releases.

Version 1.43.0

What's Changed

Full Changelog: lucide-icons/lucide@1.42.0...1.43.0

Version 1.42.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.41.0...1.42.0

Version 1.41.0

What's Changed

... (truncated)

Commits
  • 94e4cb9 chore(dependencies): Update dependencies (#4806)
  • 99d25bd feat(packages): extract icon build logic into @lucide/shared (#4409)
  • 75b5516 chore(dev): upgrade ESLint to latest compatible stack (v10) (#4378)
  • See full diff in compare view

Updates mermaid from 11.16.1 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

  • #8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

mermaid@11.17.1

Patch Changes

  • #8092 31ce60a Thanks @​pbrolin47! - fix(c4): wrap element labels to c4.width again

    C4 element labels (System, Container, Component, Person and their _Ext variants) stopped wrapping in 11.17.0, so long descriptions rendered on one unbroken line and the shape grew sideways well past the configured c4.width. The unified-shapes label helper gated wrapping on the root-level wrap option, which has no schema default and is therefore undefined; it now gates on c4.wrap (default true), which is what the legacy renderer used.

  • #8088 c66200b Thanks @​ashishjain0512! - fix: neo-look arrowheads and crow's-foot markers no longer fall back to default theme colours/stroke widths on the first render with layout: elk. State diagram arrowheads stayed dark on dark themes, and ER / requirement markers were drawn at the default stroke width, because markers were created from the layout package's own bundled copy of mermaid, whose config had not been initialized yet.

  • #8079 281cd7b Thanks @​ashishjain0512! - fix(class): class diagram relation markers (composition, aggregation, extension, dependency, lollipop) no longer scale with the edge stroke width, so they stay outside the class box boundary in themes that set strokeWidth: 2 (redux, redux-dark, redux-color, redux-dark-color, neo, neo-dark) with the default classic look.

mermaid@11.17.0

Minor Changes

@dependabot
chore(deps): bump the production-minor-and-patch group across 1 direc…
496913c 
…tory with 15 updates

Bumps the production-minor-and-patch group with 15 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@openclaw/plugin-inspector](https://github.com/openclaw/plugin-inspector) | `0.3.23` | `0.3.24` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.29` | `1.170.33` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.46` | `1.168.50` |
| [@vercel/oidc](https://github.com/vercel/vercel/tree/HEAD/packages/oidc) | `3.8.4` | `3.8.5` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.44.0` | `1.45.0` |
| [convex-helpers](https://github.com/get-convex/convex-helpers/tree/HEAD/packages/convex-helpers) | `0.1.123` | `0.1.124` |
| [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.6` | `7.0.9` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.43.0` |
| [mermaid](https://github.com/mermaid-js/mermaid) | `11.16.1` | `11.17.2` |
| [resend](https://github.com/resend/resend-node) | `6.20.0` | `6.26.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.4` |
| [undici](https://github.com/nodejs/undici) | `7.29.0` | `7.29.1` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.0` |
| [p-retry](https://github.com/sindresorhus/p-retry) | `8.0.0` | `8.0.1` |



Updates `@openclaw/plugin-inspector` from 0.3.23 to 0.3.24
- [Release notes](https://github.com/openclaw/plugin-inspector/releases)
- [Changelog](https://github.com/openclaw/plugin-inspector/blob/main/CHANGELOG.md)
- [Commits](openclaw/plugin-inspector@v0.3.23...v0.3.24)

Updates `@tanstack/react-router` from 1.170.29 to 1.170.33
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.33/packages/react-router)

Updates `@tanstack/react-start` from 1.168.46 to 1.168.50
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.50/packages/react-start)

Updates `@vercel/oidc` from 3.8.4 to 3.8.5
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/oidc/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/frameworks@3.8.5/packages/oidc)

Updates `convex` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/get-convex/convex-backend/releases)
- [Changelog](https://github.com/get-convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `convex-helpers` from 0.1.123 to 0.1.124
- [Changelog](https://github.com/get-convex/convex-helpers/blob/main/packages/convex-helpers/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-helpers/commits/npm/0.1.124/packages/convex-helpers)

Updates `ignore` from 7.0.6 to 7.0.9
- [Release notes](https://github.com/kaelzhang/node-ignore/releases)
- [Commits](kaelzhang/node-ignore@7.0.6...7.0.9)

Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.9...v6.2.12)

Updates `lucide-react` from 1.31.0 to 1.43.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.43.0/packages/lucide-react)

Updates `mermaid` from 11.16.1 to 11.17.2
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.16.1...mermaid@11.17.2)

Updates `resend` from 6.20.0 to 6.26.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.20.0...v6.26.0)

Updates `zod` from 4.4.3 to 4.5.4
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.5.4)

Updates `undici` from 7.29.0 to 7.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.0...v7.29.1)

Updates `@clack/prompts` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.0/packages/prompts)

Updates `p-retry` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/sindresorhus/p-retry/releases)
- [Commits](sindresorhus/p-retry@v8.0.0...v8.0.1)

---
updated-dependencies:
- dependency-name: "@openclaw/plugin-inspector"
  dependency-version: 0.3.24
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.33
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.168.50
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@vercel/oidc"
  dependency-version: 3.8.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: convex
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: convex-helpers
  dependency-version: 0.1.124
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: ignore
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: mermaid
  dependency-version: 11.17.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: resend
  dependency-version: 6.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: zod
  dependency-version: 4.5.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: undici
  dependency-version: 7.29.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@clack/prompts"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: p-retry
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 11, 2026
@clawsweeper

clawsweeper Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@vercel

vercel Bot commented Sep 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clawhub Ready Ready Preview Sep 11, 2026 4:11pm UTC

Request Review

@openclaw-barnacle openclaw-barnacle Bot added the needs-cli-release Requires a ClawHub CLI npm release after merge. label Sep 11, 2026
@clawsweeper clawsweeper Bot added P2 Normal backlog priority with limited blast radius. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action. labels Sep 11, 2026
@clawsweeper

clawsweeper Bot commented Sep 11, 2026

Copy link
Copy Markdown
Contributor

Codex review: blocked before merge. Reviewed September 11, 2026, 12:08 PM ET / 16:08 UTC.

ClawSweeper review

What this changes

Updates 15 dependencies across the ClawHub app, public CLI, and admin CLI, along with their Bun lockfile resolutions.

Regression provenance

Possible regression — probable (reviewed change; failure trace). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 6 items remain

Keep open: the dependency updates remain useful, but the branch introduces a CLI compilation failure and two dependency-pin inconsistencies with bounded repairs.

Priority: P2
Reviewed head: 496913c7ef11a2e17c970d1cbae659c4bdd758c0

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) Useful, focused maintenance with three concrete integration defects that can be repaired without replacing the branch.
Proof confidence 🌊 off-meta tidepool Not applicable: The ordinary contributor-proof gate is exempt for this Dependabot update; no material authority change requiring the exception was established. CI failure evidence supports the findings but does not prove successful upgraded runtime behavior.
Patch quality 🦐 gold shrimp (3/6) 3 actionable review findings remain.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: The ordinary contributor-proof gate is exempt for this Dependabot update; no material authority change requiring the exception was established. CI failure evidence supports the findings but does not prove successful upgraded runtime behavior.
Evidence reviewed 9 items Introduced scope: The verified base-to-head delta contains only three package manifests and bun.lock: 82 additions and 72 deletions. The original head directly parents the reviewed main revision.
CLI failure on the reviewed head: The e2e-http check reports TS2339 and TS7006 at syncHelpers.ts:152 while building the CLI. selectToUpload calls picked.map after isCancel; the CLI build invokes TypeScript and exits with its failure status.
Upstream cancellation type changed: The directly imported prompt dependency changes isCancel from narrowing all symbols to narrowing only CANCEL_SYMBOL, while multi-select still returns Promise<Value[] | symbol>. This explains the remaining symbol type in ClawHub. The prompts 1.8.0 tag resolves to the recorded upstream commit.
Findings 3 actionable findings [P1] Adapt the sync prompt consumer before upgrading Clack
[P2] Preserve the Convex version required by remote UI proof
[P2] Update the Undici override alongside its dependency pins
Security None None.

How this fits together

ClawHub’s dependency manifests supply the libraries used by its website, backend, package validation, and command-line tools. The same installation also supplies tooling for isolated browser-proof environments.

flowchart TD
  A[Dependency manifests] --> B[Bun lockfile and overrides]
  B --> C[Website and backend]
  B --> D[Public and admin CLIs]
  B --> E[Browser proof tooling]
  D --> F[Compile and package]
  E --> G[Check pinned backend CLI]
  G --> H[Isolated browser proof]
Loading

Before merge

  • Adapt the sync prompt consumer before upgrading Clack (P1) - Clack 1.8.0 narrows isCancel to its unique cancellation symbol, while multiselect still returns Value[] | symbol. Consequently, selectToUpload retains a possible symbol at picked.map() in syncHelpers.ts:152. The reviewed head's e2e-http annotations confirm TS2339/TS7006, preventing the CLI build. Add safe array narrowing that preserves cancellation behavior, or defer this upgrade.
  • Preserve the Convex version required by remote UI proof (P2) - Remote proof lanes install this lockfile and load the wrapper's installed Convex CLI. scripts/ui-proof-backend.mjs:519 explicitly accepts only 1.44.0, so installing 1.45.0 makes those lanes fail before backend startup. Retain the verified version here, or separately validate and update the complete pinned proof-toolchain contract without removing its guard.
  • Update the Undici override alongside its dependency pins (P2) - The new 7.29.1 declarations remain overridden by package.json:206, and the committed lockfile still resolves undici@7.29.0. This leaves the advertised update unapplied in the workspace and validates a different version from the published CLI dependency. Align the override and regenerate the lockfile.
  • Resolve merge risk (P1) - Remote browser-proof lanes will stop before backend startup when their newly installed Convex CLI fails the unchanged exact-version check.
  • Resolve merge risk (P1) - The complete updated dependency set has not been validated in this read-only review; the observed CLI build failure prevents treating existing checks as successful integration evidence.
  • Complete next step (P2) - Repair Clack result narrowing, retain the verified Convex toolchain, and align the Undici override before rerunning the required validation gates.

Findings

  • [P1] Adapt the sync prompt consumer before upgrading Clack — packages/clawhub/package.json:40
  • [P2] Preserve the Convex version required by remote UI proof — package.json:129
  • [P2] Update the Undici override alongside its dependency pins — package.json:188
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Diff size +82/-72 across 4 files All changes are dependency declarations or lockfile records; no consumer adaptations accompany the upgrades.

Merge-risk options

Maintainer options:

  1. Preserve the verified proof toolchain (recommended)
    Defer the Convex bump from this batch while repairing Clack integration and Undici resolution.
  2. Upgrade the proof toolchain separately
    Carry Convex 1.45.0 in a focused follow-up with verified backend compatibility, isolation behavior, and local-upgrade coverage.
Copy recommended automerge instruction 
@clawsweeper automerge

Special instructions:
Retain Convex 1.44.0 and regenerate the lockfile without weakening the proof runner's exact-version or isolation checks; repair Clack cancellation narrowing and align the Undici override with 7.29.1, then run the package and integration gates.

Technical review

Best possible solution:

Keep the dependency refresh scoped, preserve the verified Convex proof toolchain, restore safe prompt-result narrowing, and align Undici’s effective resolution with its manifests.

Do we have a high-confidence way to reproduce the issue?

Yes: head-specific CI records the CLI compilation failure, and source establishes the proof-runner and Undici pin mismatches. No local tests or runtime commands were executed.

Is this the best way to solve the issue?

The manifest-and-lockfile approach is appropriate, but this batch needs consumer compatibility repairs; deferring Convex is safer than casually changing the verified proof-runtime pin.

Full review comments:

  • [P1] Adapt the sync prompt consumer before upgrading Clack — packages/clawhub/package.json:40
    Clack 1.8.0 narrows isCancel to its unique cancellation symbol, while multiselect still returns Value[] | symbol. Consequently, selectToUpload retains a possible symbol at picked.map() in syncHelpers.ts:152. The reviewed head's e2e-http annotations confirm TS2339/TS7006, preventing the CLI build. Add safe array narrowing that preserves cancellation behavior, or defer this upgrade.
    Confidence: 0.99
  • [P2] Preserve the Convex version required by remote UI proof — package.json:129
    Remote proof lanes install this lockfile and load the wrapper's installed Convex CLI. scripts/ui-proof-backend.mjs:519 explicitly accepts only 1.44.0, so installing 1.45.0 makes those lanes fail before backend startup. Retain the verified version here, or separately validate and update the complete pinned proof-toolchain contract without removing its guard.
    Confidence: 0.99
  • [P2] Update the Undici override alongside its dependency pins — package.json:188
    The new 7.29.1 declarations remain overridden by package.json:206, and the committed lockfile still resolves undici@7.29.0. This leaves the advertised update unapplied in the workspace and validates a different version from the published CLI dependency. Align the override and regenerate the lockfile.
    Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cbfee7343ddc.

Labels

Label changes:

  • add P2: This is a useful dependency-maintenance batch with bounded integration defects, not an established production outage.
  • add merge-risk: 🚨 automation: Installing Convex 1.45.0 makes the remote proof bootstrap fail its retained 1.44.0 version guard.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
  • add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The ordinary contributor-proof gate is exempt for this Dependabot update; no material authority change requiring the exception was established. CI failure evidence supports the findings but does not prove successful upgraded runtime behavior.

Label justifications:

  • P2: This is a useful dependency-maintenance batch with bounded integration defects, not an established production outage.
  • merge-risk: 🚨 automation: Installing Convex 1.45.0 makes the remote proof bootstrap fail its retained 1.44.0 version guard.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
  • status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: The ordinary contributor-proof gate is exempt for this Dependabot update; no material authority change requiring the exception was established. CI failure evidence supports the findings but does not prove successful upgraded runtime behavior.

Evidence

Acceptance criteria:

  • [P1] bun run ci:static.
  • [P1] bunx vitest run packages/clawhub/src/cli/commands/sync.test.ts.
  • [P1] bun run ci:unit.
  • [P1] bun run ci:packages.
  • [P1] bun run ci:types-build.

What I checked:

  • Introduced scope: The verified base-to-head delta contains only three package manifests and bun.lock: 82 additions and 72 deletions. The original head directly parents the reviewed main revision. (package.json:106, 496913c7ef11)
  • CLI failure on the reviewed head: The e2e-http check reports TS2339 and TS7006 at syncHelpers.ts:152 while building the CLI. selectToUpload calls picked.map after isCancel; the CLI build invokes TypeScript and exits with its failure status. (packages/clawhub/src/cli/commands/syncHelpers.ts:152, 496913c7ef11)
  • Upstream cancellation type changed: The directly imported prompt dependency changes isCancel from narrowing all symbols to narrowing only CANCEL_SYMBOL, while multi-select still returns Promise<Value[] | symbol>. This explains the remaining symbol type in ClawHub. The prompts 1.8.0 tag resolves to the recorded upstream commit. (packages/core/src/utils/index.ts:17, de1ef162ee8e)
  • Remote proof version mismatch: Remote lanes install the wrapper’s frozen lockfile and use its node_modules/convex/bin/main.js. The helper rejects every version except 1.44.0 before backend startup, while this PR installs 1.45.0. specs/ui-proof.md documents the exact pin and isolation requirements; the adjacent test explicitly covers version rejection. (scripts/ui-proof-backend.mjs:519, 496913c7ef11)
  • Undici update is overridden: All three dependency declarations request 7.29.1, but package.json:206 and bun.lock:189 retain the 7.29.0 override, and bun.lock:1951 still resolves undici@7.29.0. Workspace validation therefore does not exercise the version requested by the published CLI manifest. (package.json:188, 496913c7ef11)
  • Still necessary on main and release: The reviewed main manifest retains the older dependency versions. The v0.23.3 CLI manifest also retains Clack 1.7.0, ignore 7.0.6, p-retry 8.0.0, and Undici 7.29.0. No supplied related item establishes a merged replacement; several extracted references actually belong to upstream dependency repositories. (packages/clawhub/package.json:40, 87ca030c30f3)

Likely related people:

  • Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Restore CLI compilation while preserving prompt cancellation behavior.
  • Keep the verified Convex proof version or validate a separate toolchain upgrade.
  • Align Undici resolutions and pass the package, type/build, and HTTP integration gates.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 14, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/production-minor-and-patch-8d6730c1e2 branch September 14, 2026 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. needs-cli-release Requires a ClawHub CLI npm release after merge. P2 Normal backlog priority with limited blast radius. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: ⏳ waiting on author ClawSweeper has contributor-facing work open and is waiting for author action.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants