Skip to content

chore(deps): bump the production-minor-and-patch group across 1 directory with 16 updates - #3693

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-69f38d4e16
Closed

chore(deps): bump the production-minor-and-patch group across 1 directory with 16 updates#3693
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-69f38d4e16

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-and-patch group with 16 updates in the / directory:

Package From To
@openclaw/plugin-inspector 0.3.23 0.3.25
@tanstack/react-router 1.170.29 1.170.35
@tanstack/react-start 1.168.46 1.168.52
@vercel/oidc 3.8.4 3.8.7
convex 1.44.0 1.45.0
convex-helpers 0.1.123 0.1.124
ignore 7.0.6 7.0.9
jose 6.2.9 6.2.12
lucide-react 1.31.0 1.45.0
react 19.2.8 19.3.0
react-dom 19.2.8 19.3.0
resend 6.20.0 6.27.0
zod 4.4.3 4.6.2
undici 7.29.0 7.29.1
@clack/prompts 1.7.0 1.8.0
p-retry 8.0.0 8.0.1

Updates @openclaw/plugin-inspector from 0.3.23 to 0.3.25

Release notes

Sourced from @​openclaw/plugin-inspector's releases.

plugin-inspector v0.3.25

Fixed

  • Invoke each synthetic Gateway method once, including registrations with options, and validate its first emitted response's JSON wire representation instead of treating any nonthrowing callback as successful. Preserve explicit response authority, returned-payload fallback, deferred replies within the existing deadline, and accepted-only initial responses.
  • Bound synthetic callback waits and cancellation, stop dependent probes after a timeout, and supervise CLI capture plus retained callbacks in one child. Validate report shape and counts before delivery while preserving complete failed-row reports, bounded plugin output, and in-process callback identity. Thanks @​SebTardif.
  • Run registerService start, stop, and dispose probes serially so teardown cannot overlap startup.
  • Bound real-SDK CLI capture in an owned child, including stalled imports, busy registration, and retained timers. Give in-process capture a finite 30-second default deadline while preserving caller runtime and handler identity; arbitrary in-process JavaScript cannot be forcibly canceled. Thanks @​SebTardif.
  • Capture and synthetically probe compiled CommonJS plugins with generated SDK mocks, including lazy require() calls, and discover their SDK source references. CommonJS mocking requires Node.js 22.15+ synchronous module hooks; the package engine and existing ESM/TypeScript capture remain unchanged.
  • Bound mock-SDK capture and profile child lifetimes, output, and process sampling; clean owned POSIX descendants through stdio close and keep timeout/cancellation outcomes unsuccessful. Flush complete capture JSON before exiting despite retained plugin timers. Thanks @​SebTardif.
  • Profile the default import-loop capture runner directly so its timeout also owns plugin execution. Validate fresh, bounded capture artifacts; RSS/CPU and wall-time measurements now exclude the intermediate CLI wrapper and are not directly comparable with historical profiles.
  • Bound OpenClaw npm metadata and tarball downloads with a deadline through response-body reads, reject oversized responses, and release failed downloads. Resolve latest and beta through the small npm dist-tags endpoint before fetching exact-version metadata, keeping the 16 MiB metadata limit usable.
  • Capture plugins that bind api.runtime.modelAuth during registration with credential-free defaults; auth acquisition remains an explicit synthetic failure.
  • Report absent build output and missing entrypoints before SDK alias blockers in cold-import readiness, preserving build-required totals and all remediation evidence.
  • Recognize board widget content kinds, memory prompt preparation, transcript source providers, worker providers, and MCP server connection resolvers as metadata-only synthetic probes without invoking runtime callbacks.

plugin-inspector v0.3.24

Fixed

  • Recognize compiled CommonJS plugin factory calls when checking expected channel registrations, preserving source references and excluding factory values passed to wrappers.
  • Classify widget presenters as metadata-only synthetic probes without invoking presentation callbacks.

Verification

  • npm package 0.3.24 · registry tarball
  • Successful release workflow, source 92db8c57e1d5544c522c7c882a33be1ad4e253b9.
  • Registry signatures and provenance verified for this package, tag, workflow, source commit, and run attempt. The complete uncompressed package archive matches the locally tested candidate.
  • Tarball SHA-256: 292232b5c2aa34a73ef110333a14240ec07b53a730be1d2d62cb4c76441e9404
  • Integrity: sha512-g74+lsc3vSinAKbaqlsSvsaWvzkFv71ZVWOzXp4uFDisR1g9fiv/HvoKQI3uenlV0aJr/oD+FZukTs/jyXlr/A==
Changelog

Sourced from @​openclaw/plugin-inspector's changelog.

0.3.25 - 2026-09-09

Fixed

  • Invoke each synthetic Gateway method once, including registrations with options, and validate its first emitted response's JSON wire representation instead of treating any nonthrowing callback as successful. Preserve explicit response authority, returned-payload fallback, deferred replies within the existing deadline, and accepted-only initial responses.
  • Bound synthetic callback waits and cancellation, stop dependent probes after a timeout, and supervise CLI capture plus retained callbacks in one child. Validate report shape and counts before delivery while preserving complete failed-row reports, bounded plugin output, and in-process callback identity. Thanks @​SebTardif.
  • Run registerService start, stop, and dispose probes serially so teardown cannot overlap startup.
  • Bound real-SDK CLI capture in an owned child, including stalled imports, busy registration, and retained timers. Give in-process capture a finite 30-second default deadline while preserving caller runtime and handler identity; arbitrary in-process JavaScript cannot be forcibly canceled. Thanks @​SebTardif.
  • Capture and synthetically probe compiled CommonJS plugins with generated SDK mocks, including lazy require() calls, and discover their SDK source references. CommonJS mocking requires Node.js 22.15+ synchronous module hooks; the package engine and existing ESM/TypeScript capture remain unchanged.
  • Bound mock-SDK capture and profile child lifetimes, output, and process sampling; clean owned POSIX descendants through stdio close and keep timeout/cancellation outcomes unsuccessful. Flush complete capture JSON before exiting despite retained plugin timers. Thanks @​SebTardif.
  • Profile the default import-loop capture runner directly so its timeout also owns plugin execution. Validate fresh, bounded capture artifacts; RSS/CPU and wall-time measurements now exclude the intermediate CLI wrapper and are not directly comparable with historical profiles.
  • Bound OpenClaw npm metadata and tarball downloads with a deadline through response-body reads, reject oversized responses, and release failed downloads. Resolve latest and beta through the small npm dist-tags endpoint before fetching exact-version metadata, keeping the 16 MiB metadata limit usable.
  • Capture plugins that bind api.runtime.modelAuth during registration with credential-free defaults; auth acquisition remains an explicit synthetic failure.
  • Report absent build output and missing entrypoints before SDK alias blockers in cold-import readiness, preserving build-required totals and all remediation evidence.
  • Recognize board widget content kinds, memory prompt preparation, transcript source providers, worker providers, and MCP server connection resolvers as metadata-only synthetic probes without invoking runtime callbacks.

0.3.24 - 2026-08-31

Fixed

  • Recognize compiled CommonJS plugin factory calls when checking expected channel registrations, preserving source references and excluding factory values passed to wrappers.
  • Classify widget presenters as metadata-only synthetic probes without invoking presentation callbacks.
Commits
  • 2e21b3b chore(release): prepare plugin-inspector 0.3.25 (#75)
  • 3a03b8d fix: report truthful synthetic Gateway responses (#74)
  • dc2bdb3 fix: timeout synthetic probe invoke (#62)
  • 340f18e fix: run registration lifecycle probes serially (#61)
  • 7cbdafa fix: bound stalled real-SDK capture and runtime checks (#68)
  • 3ecd6a5 fix: capture compiled CommonJS plugins with SDK mocks (#73)
  • f5e66bb fix: time out hung capture and profile child processes (#59)
  • 98751f9 fix: abort hung OpenClaw target version fetches (#69)
  • c740fac fix: recognize metadata-only OpenClaw registrars in synthetic probes (#72)
  • d582ff8 fix: report absent entrypoints before SDK alias blockers (#71)
  • Additional commits viewable in compare view

Updates @tanstack/react-router from 1.170.29 to 1.170.35

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.35

Patch Changes

  • #7824 8c43c71 - Upgrade TanStack Store to 0.11 and migrate router subscriptions to useSelector, preserving selector comparisons and Vue subscription cleanup.

@​tanstack/react-router@​1.170.34

Patch Changes

  • #8279 aee42c6 - Avoid allocating event-handler arrays and wrapper functions for links without user-supplied event handlers.

  • #8308 9c1871c - Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.

    Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.

    Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.

    Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.

    Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.

  • #8311 9aec5a7 - React Links resolve state props without temporary class-name arrays or unnecessary style copies.

  • Updated dependencies [f9836f1, 9c1871c, 9871c06, 0654c0a]:

    • @​tanstack/router-core@​1.171.29
    • @​tanstack/history@​1.162.3
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.35

Patch Changes

  • #7824 8c43c71 - Upgrade TanStack Store to 0.11 and migrate router subscriptions to useSelector, preserving selector comparisons and Vue subscription cleanup.

1.170.34

Patch Changes

  • #8279 aee42c6 - Avoid allocating event-handler arrays and wrapper functions for links without user-supplied event handlers.

  • #8308 9c1871c - Validate navigation and redirect destinations, keep ambiguous relative URLs on the current origin, and constrain prerender requests and output paths. Prevent redirect headers from appearing in serialized server function response bodies.

    Preserve native form HTTP redirects, route error handling and masks for document redirects, and per-navigation destinations for shared loader redirects. Avoid redundant origin parsing and reduce link styling and server-rendering work. Configured origins must already be normalized.

    Keep blocked-link inactive props consistent during React hydration, honor explicit redirect Location headers before checking route options, and refresh Vue link state when destinations become internal. Reuse the protocol-relative URL check while parsing redirect schemes once.

    Reduce React link bundle size by sharing pathname comparisons, state-prop selection, and element creation.

    Share normalized pathname comparisons in Solid and Vue links to reduce bundle size.

  • #8311 9aec5a7 - React Links resolve state props without temporary class-name arrays or unnecessary style copies.

  • Updated dependencies [f9836f1, 9c1871c, 9871c06, 0654c0a]:

    • @​tanstack/router-core@​1.171.29
    • @​tanstack/history@​1.162.3

1.170.33

Patch Changes

  • #8165 2f20c00 - Exclude structural descendants below error and not-found boundaries from route lifecycle callbacks. Preserve lifecycle membership through invalidation, hydration, background reloads, and superseded navigation publication.

  • #8209 28a5e45 - Preserve falsy thrown values in React and Vue error boundaries. Type React and Vue boundary error components and onCatch callbacks as unknown. Solid boundary errors remain typed as Error; SSR now wraps non-Error loader errors to match Solid’s native boundary behavior, preserving the original value in cause. Router state and loader onError values are unchanged.

    When upgrading React or Vue, narrow boundary errors (for example, with error instanceof Error) before reading message or stack. ErrorComponentProps<TError> remains available for values narrowed to a specific error type. Route onError types are unchanged.

  • #8161 f0b5eda - Retain successful not-found matches as terminal shared boundaries during client navigation, preserving route context while the destination loads.

  • #8251 0497cae - Use URL.canParse for absolute URL checks in links, navigation, redirects, and build configuration. Preserve a URL constructor fallback for older browsers.

  • #8169 0caf6b9 - Fix route-scoped useMatch, useSearch, and useParams APIs to forward the shouldThrow option and preserve optional return types when shouldThrow: false.

  • #8257 cf166d1 - Fix repeated innerHTML writes for unchanged styles and data scripts during React re-renders. This prevents unnecessary CSS parsing and Trusted Types errors during client navigation.

  • Updated dependencies [edf0e16, 2f20c00, 28a5e45, 08eff50, 216c0c4, 2f91503, f0b5eda, 50eafca, 0497cae, ee28348, 9035abc, c18e690]:

    • @​tanstack/router-core@​1.171.28
    • @​tanstack/history@​1.162.2

... (truncated)

Commits

Updates @tanstack/react-start from 1.168.46 to 1.168.52

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.168.52

Patch Changes

  • Updated dependencies [8c43c71, d914b08]:
    • @​tanstack/react-router@​1.170.35
    • @​tanstack/start-server-core@​1.169.34
    • @​tanstack/react-start-client@​1.168.33
    • @​tanstack/react-start-rsc@​0.1.51
    • @​tanstack/react-start-server@​1.167.40
    • @​tanstack/start-plugin-core@​1.171.42

@​tanstack/react-start@​1.168.51

Patch Changes

  • Updated dependencies [aee42c6, 49bcd4d, 9c1871c, 9aec5a7, 919c397]:
    • @​tanstack/react-router@​1.170.34
    • @​tanstack/router-utils@​1.162.3
    • @​tanstack/start-plugin-core@​1.171.41
    • @​tanstack/start-server-core@​1.169.33
    • @​tanstack/react-start-client@​1.168.32
    • @​tanstack/react-start-rsc@​0.1.50
    • @​tanstack/react-start-server@​1.167.39
    • @​tanstack/start-client-core@​1.170.29
Changelog

Sourced from @​tanstack/react-start's changelog.

1.168.52

Patch Changes

  • Updated dependencies [8c43c71, d914b08]:
    • @​tanstack/react-router@​1.170.35
    • @​tanstack/start-server-core@​1.169.34
    • @​tanstack/react-start-client@​1.168.33
    • @​tanstack/react-start-rsc@​0.1.51
    • @​tanstack/react-start-server@​1.167.40
    • @​tanstack/start-plugin-core@​1.171.42

1.168.51

Patch Changes

  • Updated dependencies [aee42c6, 49bcd4d, 9c1871c, 9aec5a7, 919c397]:
    • @​tanstack/react-router@​1.170.34
    • @​tanstack/router-utils@​1.162.3
    • @​tanstack/start-plugin-core@​1.171.41
    • @​tanstack/start-server-core@​1.169.33
    • @​tanstack/react-start-client@​1.168.32
    • @​tanstack/react-start-rsc@​0.1.50
    • @​tanstack/react-start-server@​1.167.39
    • @​tanstack/start-client-core@​1.170.29

1.168.50

Patch Changes

1.168.49

Patch Changes

  • Updated dependencies [cb281d7, a0041bb]:
    • @​tanstack/react-router@​1.170.32
    • @​tanstack/start-plugin-core@​1.171.39
    • @​tanstack/react-start-client@​1.168.30
    • @​tanstack/react-start-rsc@​0.1.48
    • @​tanstack/react-start-server@​1.167.37
    • @​tanstack/start-client-core@​1.170.27

... (truncated)

Commits

Updates @vercel/oidc from 3.8.4 to 3.8.7

Changelog

Sourced from @​vercel/oidc's changelog.

@​vercel/oidc

3.8.5

Patch Changes

  • Updated dependencies [7a3a2ef]
    • @​vercel/cli-config@​0.2.4
Commits

Updates convex from 1.44.0 to 1.45.0

Changelog

Sourced from convex's changelog.

1.45.0

  • Local deployments now upgrade to a new backend version in place, instead of going through a snapshot export and import. Upgrades no longer depend on the size of your local data, and no longer prompt about transferring it.
  • The Convex MCP server (npx convex mcp) now supports the stateless MCP protocol (2026-07-28 MCP specification).
  • Added a new getServiceToken function that generates service tokens for first-party Convex services. This will be used by the upcoming Convex AI gateway.
  • Improved the error message when npx convex export fails because a snapshot export is already in progress.
Commits

Updates convex-helpers from 0.1.123 to 0.1.124

Changelog

Sourced from convex-helpers's changelog.

0.1.124

  • validate now normalizes system table ids (e.g. v.id("_storage")) with db.system.normalizeId instead of throwing when passed a real db.
Commits

Updates ignore from 7.0.6 to 7.0.9

Release notes

Sourced from ignore's releases.

7.0.8

PATCH Brings pattern matching closer to git:

  • PATCH A backslash now makes the next character a literal, exactly as git does: \* matches a literal * rather than acting as a wildcard, \? matches a literal ?, and \d, \b, \/ and the like are the plain characters instead of regular-expression escapes.
  • PATCH Only a trailing run of spaces is stripped from a pattern — never tabs or other whitespace — and a line of only tabs is treated as a pattern rather than a blank line, matching git.

An upgrade is recommended for all dependents.

Commits
  • 821765e #166: bump version 7.0.9
  • e00d35e Merge pull request #167 from bentbrain/fix-bom-blank-line
  • 9b6481f fix(ignore): reject BOM-only blank lines before compilation
  • 20b802a bump version 7.0.8
  • 0414358 build: require 100% coverage of index.js as an explicit gate
  • 968aee6 compat: check compatibility by running old versions' test suites
  • 8e46220 build: run the compatibility gate as part of npm test
  • 6e81fb2 tidy up how wildcards compile
  • ea3d5eb fix: a backslash quotes the next character, and only spaces are trimmed
  • 01cfbbb docs: document the known, deliberate differences from git
  • Additional commits viewable in compare view

Updates jose from 6.2.9 to 6.2.12

Release notes

Sourced from jose's releases.

v6.2.12

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

v6.2.11

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

v6.2.10

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)
  • jwt: prevent replacing protected headers (ae07d09)
  • jwt: reject invalid duration inputs (282f9aa)
  • jwt: validate builder claim values (ea03f83)

... (truncated)

Changelog

Sourced from jose's changelog.

6.2.12 (2026-09-05)

Documentation

  • clarify and shorten public API guidance (be62530)

Refactor

  • simplify JWS and JWE operation cores (92e9640)

Performance

  • avoid copying AES-GCM output (6925d43)
  • deduplicate pending jwks key imports (bf5138b)
  • encode single-signature JWS input once (7bc9a33)
  • normalize General JWE shared headers once (78637bd)
  • normalize jwks selection metadata once (fd3ae3f)
  • use native encoding for larger ASCII strings (b23a6f3)

6.2.11 (2026-09-04)

Documentation

  • render subpath indexes as tables (94589ee)
  • shorten API index descriptions (681482f)

Refactor

  • model JWE key management modes (e01dda6)
  • types: reduce declaration repetition (55b970f)

6.2.10 (2026-08-21)

Fixes

  • jose: consume serialization members once (9bee285)
  • jose: reject empty protected and JWE AAD members (8da4145)
  • jose: validate serialized header values (b711d8f)
  • jwe: conceal invalid decrypted CEK lengths (41fafe0)
  • jwe: enforce AES-GCM tag boundaries (9a5b744)
  • jwe: validate explicit encryption parameters (7a02697)
  • jwk: accept empty octet-sequence keys (3f871e7)
  • jwk: normalize key resolution inputs (f54ee7b)
  • jwks: enforce verification key metadata (f9ba510)
  • jwks: order overlapping remote reloads (9a1a913)
  • jwks: reject invalid remote duration values (7bdb9e5)
  • jwk: validate ext and key_ops parameters (4d91c37)
  • jws: reject mixed payload encoding modes (dc69713)
  • jws: validate unencoded payload strings (541f282)
  • jwt: enforce explicit verification policies (b347182)

... (truncated)

Commits
  • 505a55b chore(release): 6.2.12
  • 7bc9a33 perf: encode single-signature JWS input once
  • 78637bd perf: normalize General JWE shared headers once
  • bf5138b perf: deduplicate pending jwks key imports
  • b23a6f3 perf: use native encoding for larger ASCII strings
  • fd3ae3f perf: normalize jwks selection metadata once
  • 6925d43 perf: avoid copying AES-GCM output
  • be62530 docs: clarify and shorten public API guidance
  • 1b41312 build: preserve README when generation fails
  • 0b51829 build: check tree-shaking for every public binding
  • Additional commits viewable in compare view

Updates lucide-react from 1.31.0 to 1.45.0

Release notes

Sourced from lucide-react's releases.

Version 1.45.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.44.0...1.45.0

Version 1.44.0

What's Changed

@dependabot
chore(deps): bump the production-minor-and-patch group across 1 direc…
30c09da 
…tory with 16 updates

Bumps the production-minor-and-patch group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@openclaw/plugin-inspector](https://github.com/openclaw/plugin-inspector) | `0.3.23` | `0.3.25` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.29` | `1.170.35` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.168.46` | `1.168.52` |
| [@vercel/oidc](https://github.com/vercel/vercel/tree/HEAD/packages/oidc) | `3.8.4` | `3.8.7` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.44.0` | `1.45.0` |
| [convex-helpers](https://github.com/get-convex/convex-helpers/tree/HEAD/packages/convex-helpers) | `0.1.123` | `0.1.124` |
| [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.6` | `7.0.9` |
| [jose](https://github.com/panva/jose) | `6.2.9` | `6.2.12` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.31.0` | `1.45.0` |
| [react](https://github.com/react/react/tree/HEAD/packages/react) | `19.2.8` | `19.3.0` |
| [react-dom](https://github.com/react/react/tree/HEAD/packages/react-dom) | `19.2.8` | `19.3.0` |
| [resend](https://github.com/resend/resend-node) | `6.20.0` | `6.27.0` |
| [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.6.2` |
| [undici](https://github.com/nodejs/undici) | `7.29.0` | `7.29.1` |
| [@clack/prompts](https://github.com/bombshell-dev/clack/tree/HEAD/packages/prompts) | `1.7.0` | `1.8.0` |
| [p-retry](https://github.com/sindresorhus/p-retry) | `8.0.0` | `8.0.1` |



Updates `@openclaw/plugin-inspector` from 0.3.23 to 0.3.25
- [Release notes](https://github.com/openclaw/plugin-inspector/releases)
- [Changelog](https://github.com/openclaw/plugin-inspector/blob/main/CHANGELOG.md)
- [Commits](openclaw/plugin-inspector@v0.3.23...v0.3.25)

Updates `@tanstack/react-router` from 1.170.29 to 1.170.35
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.35/packages/react-router)

Updates `@tanstack/react-start` from 1.168.46 to 1.168.52
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.168.52/packages/react-start)

Updates `@vercel/oidc` from 3.8.4 to 3.8.7
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/oidc/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/@vercel/next@3.8.7/packages/oidc)

Updates `convex` from 1.44.0 to 1.45.0
- [Release notes](https://github.com/get-convex/convex-backend/releases)
- [Changelog](https://github.com/get-convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `convex-helpers` from 0.1.123 to 0.1.124
- [Changelog](https://github.com/get-convex/convex-helpers/blob/main/packages/convex-helpers/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-helpers/commits/npm/0.1.124/packages/convex-helpers)

Updates `ignore` from 7.0.6 to 7.0.9
- [Release notes](https://github.com/kaelzhang/node-ignore/releases)
- [Commits](kaelzhang/node-ignore@7.0.6...7.0.9)

Updates `jose` from 6.2.9 to 6.2.12
- [Release notes](https://github.com/panva/jose/releases)
- [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md)
- [Commits](panva/jose@v6.2.9...v6.2.12)

Updates `lucide-react` from 1.31.0 to 1.45.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.45.0/packages/lucide-react)

Updates `react` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react)

Updates `react-dom` from 19.2.8 to 19.3.0
- [Release notes](https://github.com/react/react/releases)
- [Changelog](https://github.com/react/react/blob/main/CHANGELOG.md)
- [Commits](https://github.com/react/react/commits/v19.3.0/packages/react-dom)

Updates `resend` from 6.20.0 to 6.27.0
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.20.0...v6.27.0)

Updates `zod` from 4.4.3 to 4.6.2
- [Release notes](https://github.com/colinhacks/zod/releases)
- [Commits](colinhacks/zod@v4.4.3...v4.6.2)

Updates `undici` from 7.29.0 to 7.29.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.29.0...v7.29.1)

Updates `@clack/prompts` from 1.7.0 to 1.8.0
- [Release notes](https://github.com/bombshell-dev/clack/releases)
- [Changelog](https://github.com/bombshell-dev/clack/blob/main/packages/prompts/CHANGELOG.md)
- [Commits](https://github.com/bombshell-dev/clack/commits/@clack/prompts@1.8.0/packages/prompts)

Updates `p-retry` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/sindresorhus/p-retry/releases)
- [Commits](sindresorhus/p-retry@v8.0.0...v8.0.1)

---
updated-dependencies:
- dependency-name: "@openclaw/plugin-inspector"
  dependency-version: 0.3.25
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.168.52
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@vercel/oidc"
  dependency-version: 3.8.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: convex
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: convex-helpers
  dependency-version: 0.1.124
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: ignore
  dependency-version: 7.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: jose
  dependency-version: 6.2.12
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.45.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: react
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: react-dom
  dependency-version: 19.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: resend
  dependency-version: 6.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: zod
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: undici
  dependency-version: 7.29.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@clack/prompts"
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: p-retry
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 14, 2026
@clawsweeper

clawsweeper Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@vercel

vercel Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clawhub Ready Ready Preview Sep 14, 2026 4:11pm UTC

Request Review

@openclaw-barnacle openclaw-barnacle Bot added the needs-cli-release Requires a ClawHub CLI npm release after merge. label Sep 14, 2026
@blacksmith-sh

blacksmith-sh Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Found 53 test failures on Blacksmith runners:

Failures

Test View Logs
[chromium] › e2e/
ci-smoke.pw.test.ts:25:1 › signed-out publish entry renders ──────────────────		 View Logs
[chromium] › e2e/
ci-smoke.pw.test.ts:6:1 › public navigation routes render without runtime errors 		View Logs
[chromium] › e2e/local-auth/
delete-account-resources.pw.test.ts:233:1 › users can permanently delete their account
and personal publisher resources 		View Logs
[chromium] › e2e/local-auth/
delete-org-resources.pw.test.ts:183:1 › org owners can delete an org and hide its skill
s and plugins 		View Logs
[chromium] › e2e/local-auth/
malicious-skill-ban-flow.pw.test.ts:102:1 › malicious prepublication retries keep the c
lean latest visible 		View Logs
[chromium] › e2e/local-auth/
old-cli-publish-compat.pw.test.ts:218:1 › released CLI publishes skills and plugins onl
y after both security checks pass 		View Logs
[chromium] › e2e/local-auth/
skill-star-sync.pw.test.ts:72:1 › bookmarking a skill survives refresh with the synchro
nized count 		View Logs
[chromium] › e2e/
public-routes-smoke.pw.test.ts:239:3 › public route renders: home ────────────		 View Logs
[chromium] › e2e/
public-routes-smoke.pw.test.ts:239:3 › public route renders: official browse ─		 View Logs
[chromium] › e2e/
public-routes-smoke.pw.test.ts:239:3 › public route renders: plugin detail ──		 View Logs

...and 43 more test failures. View all on Blacksmith

Fix with [code]smith
Need help on this PR? Tag @codesmith-bot with what you need.

@clawsweeper

clawsweeper Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Codex review: blocked before merge. Reviewed September 14, 2026, 12:13 PM ET / 16:13 UTC.

ClawSweeper review

What this changes

Updates production dependencies for the ClawHub website and both CLIs, along with React types and the Bun lockfile.

Merge readiness

⛔ Blocked before merge - 3 items remain

The dependency updates remain useful and are not implemented on main. One concrete version-resolution mismatch needs repair; the reported browser failures do not yet establish a dependency regression.

Priority: P2
Reviewed head: 30c09dacda6be5ca060994206d0f39c8c4782769

Review scores

Measure Result What it means
Overall readiness 🦐 gold shrimp (3/6) The update is focused and useful, but its Undici declarations and actual workspace resolution disagree.
Proof confidence 🌊 off-meta tidepool Not applicable: This Dependabot dependency-maintenance PR is exempt from contributor setup proof; the ready preview does not itself prove runtime compatibility, and no material authority change requiring exceptional proof was established.
Patch quality 🦐 gold shrimp (3/6) 1 actionable review finding remain.

Verification

Check Result Evidence
Real behavior Not applicable Not applicable: This Dependabot dependency-maintenance PR is exempt from contributor setup proof; the ready preview does not itself prove runtime compatibility, and no material authority change requiring exceptional proof was established.
Evidence reviewed 7 items Verified introduced changes: The pinned parent-to-head diff changes only three package manifests and bun.lock: 110 additions and 88 deletions. Main retains the previous dependency versions.
Undici upgrade remains overridden: The root declaration and both CLI manifests now request 7.29.1, but package.json:206 and bun.lock:189 retain the 7.29.0 override; bun.lock:1947 still resolves undici@7.29.0.
Authoritative override contract: Bun’s documentation states that root overrides determine installed dependency versions, including workspace dependencies. This contract directly applies to the changed manifests and retained override. See Bun overrides documentation; its source link verifies ownership as oven-sh/bun.
Findings 1 actionable finding [P2] [P2] Update the Undici override alongside its dependency declarations
Security None None.

How this fits together

ClawHub’s dependency manifests supply the libraries used by its website, backend tooling, and published command-line clients. The root Bun override controls workspace resolution, while published CLI manifests declare dependencies for downstream installations.

flowchart TD
  A[Dependency updates] --> B[Workspace manifests]
  B --> C[Bun overrides and lockfile]
  C --> D[Website and repository validation]
  B --> E[Published CLI manifests]
  E --> F[User CLI installations]
Loading

Before merge

  • [P2] Update the Undici override alongside its dependency declarations (P2) - The new 7.29.1 declarations are overridden by overrides.undici: "7.29.0" at line 206, and bun.lock still resolves undici@7.29.0. Workspace installs therefore do not receive this advertised update, while standalone installations of the published CLIs request 7.29.1. Update the root override and regenerate the lockfile so repository validation exercises the same version that the CLI manifests ship.
  • Resolve merge risk (P1) - The browser-test failures remain unexplained because their detailed logs were unavailable; no causal link to a particular upgrade was established.
  • Complete next step (P2) - Update the root Undici override to 7.29.1 and regenerate the lockfile so both CLI packages are validated against their declared version.

Findings

  • [P2] [P2] Update the Undici override alongside its dependency declarations — package.json:188
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Patch size +110/-88 across 4 files All changes are confined to dependency manifests and the lockfile.
Source growth production code +0, tests +0 The update adds no application implementation or test code.

Merge-risk options

Maintainer options:

  1. Decide the mitigation before merge
    Keep workspace resolution and published CLI dependency declarations aligned on Undici 7.29.1 while preserving the existing override strategy.
  2. Pause or close
    Do not merge this PR until maintainers decide whether the risk is worth taking.

Technical review

Best possible solution:

Keep workspace resolution and published CLI dependency declarations aligned on Undici 7.29.1 while preserving the existing override strategy.

Do we have a high-confidence way to reproduce the issue?

Yes, for the version mismatch: the introduced manifests request 7.29.1 while the authoritative override and resolved lock entry retain 7.29.0; no install or runtime reproduction was executed.

Is this the best way to solve the issue?

The grouped update is appropriate, but incomplete. Updating the existing override is narrower than removing it or changing CLI transport code.

Full review comments:

  • [P2] [P2] Update the Undici override alongside its dependency declarations — package.json:188
    The new 7.29.1 declarations are overridden by overrides.undici: "7.29.0" at line 206, and bun.lock still resolves undici@7.29.0. Workspace installs therefore do not receive this advertised update, while standalone installations of the published CLIs request 7.29.1. Update the root override and regenerate the lockfile so repository validation exercises the same version that the CLI manifests ship.
    Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.96

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 8c2de6c506bb.

Labels

Label changes:

  • add P2: The dependency update has a bounded version-resolution defect without evidence of an urgent user-facing regression.
  • add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.

Label justifications:

  • P2: The dependency update has a bounded version-resolution defect without evidence of an urgent user-facing regression.
  • rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.

Evidence

Acceptance criteria:

  • [P1] bun run ci:static.
  • [P1] bun run ci:unit.
  • [P1] bun run ci:packages.
  • [P1] bun run ci:types-build.
  • [P1] bun run ci:e2e-http.

What I checked:

  • Verified introduced changes: The pinned parent-to-head diff changes only three package manifests and bun.lock: 110 additions and 88 deletions. Main retains the previous dependency versions. (package.json:106, 30c09dacda6b)
  • Undici upgrade remains overridden: The root declaration and both CLI manifests now request 7.29.1, but package.json:206 and bun.lock:189 retain the 7.29.0 override; bun.lock:1947 still resolves undici@7.29.0. (package.json:188, 30c09dacda6b)
  • Authoritative override contract: Bun’s documentation states that root overrides determine installed dependency versions, including workspace dependencies. This contract directly applies to the changed manifests and retained override. See Bun overrides documentation; its source link verifies ownership as oven-sh/bun. (docs/pm/overrides.mdx)
  • CLI runtime dependency boundary: The HTTP client imports Undici directly. Both CLI build scripts compile TypeScript without bundling dependencies, so published manifests remain responsible for downstream dependency installation. (packages/clawhub/src/http.ts:6, 30c09dacda6b)
  • Release and necessity check: The latest release remains v0.23.3, published August 4, 2026. Its CLI manifest uses Undici 7.29.0 and Plugin Inspector 0.3.20, so it does not contain these updates. (packages/clawhub/package.json, 87ca030c30f3)
  • Discussion, body identity, and validation limits: The fetched full body matched captured SHA-256 1edb97d074f789fe5f477e17232038e71230cdf9a81adea5cd99bb7317b1ce30. Its release-note text was inspected. Vercel reports a ready preview; GitHub reports browser failures, but annotations contain only exit code 1. Fetching the moderation job log was blocked at the Azure log-storage host, preventing causal diagnosis. The prepared screenshot belongs to the unrelated historical typecheck PR and shows Convex 1.31.5. (30c09dacda6b)

Likely related people:

  • Patrick-Erichsen: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Align the Undici override and lockfile with 7.29.1, then validate both CLI packages against that resolution.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@dependabot @github

dependabot Bot commented on behalf of github Sep 14, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 14, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/production-minor-and-patch-69f38d4e16 branch September 14, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code needs-cli-release Requires a ClawHub CLI npm release after merge.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants