chore(deps-dev): bump the development group with 2 updates

[dependabot]

Bumps the development group with 2 updates: @napi-rs/cli and @types/node.

Updates @napi-rs/cli from 3.7.4 to 3.8.0

Commits

• 9da8723 chore(release): publish
• 8d22196 chore(deps): update dependency oxc-parser to ^0.142.0 (#3422)
• abc30fb build(deps): bump postcss from 8.5.17 to 8.5.23 (#3421)
• 5542139 build(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 (#3418)
• dc4ee8c build(deps): bump fast-uri from 3.1.3 to 3.1.4 (#3419)
• 050d985 feat(async-runtime): drain-linger surface + lock-free scheduler internals (#3...
• e0b8708 chore(deps): update dependency oxc-parser to ^0.141.0 (#3417)
• fc84940 chore(deps): update actions/setup-node action to v7 (#3413)
• ee598db build(deps): bump protobufjs from 7.6.4 to 7.6.5 (#3410)
• e707ede chore(deps): update actions/setup-node action to v7 (#3412)
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 31, 2026, 5:34 AM ET / 09:34 UTC.

ClawSweeper review

What this changes

The branch upgrades the direct development dependency @napi-rs/cli from 3.7.4 to 3.8.0, refreshes the resolved @types/node package from 26.1.1 to 26.1.2, and updates pnpm-lock.yaml accordingly.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this PR open for maintainer triage. The requested development-toolchain update is narrow and has no discrete code defect in the supplied diff, but the Node 24 Windows check failed while the corresponding macOS and Ubuntu checks passed; that failure needs diagnosis before merge.

Priority: P3
Reviewed head: 8fe9bf61c2eabd1ac67c64aa1ea7f59fc38ddb53

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The patch is scoped and mechanically consistent with its stated dependency updates, but the failed Windows Node 24 validation prevents a higher-confidence merge rating.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot development-tooling update is evaluated through its repository CI matrix rather than external-contributor runtime media; the unresolved Windows CI failure remains the needed validation evidence.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot development-tooling update is evaluated through its repository CI matrix rather than external-contributor runtime media; the unresolved Windows CI failure remains the needed validation evidence.
Evidence reviewed	4 items	Narrow dependency declaration change: The PR changes the direct development-tooling version of @napi-rs/cli from 3.7.4 to 3.8.0; it does not change the runtime dependency section or filesystem-safety implementation. Resolved graph changes match the declared update: The lockfile updates the importer to @napi-rs/cli@3.8.0 and @types/node@26.1.2, with the expected transitive resolution churn for a pnpm lockfile. Cross-platform validation is not uniformly green: The supplied check results show Node 24 check (windows-latest) failed, while the Node 24 macOS and Ubuntu checks and the Windows Node 22 check succeeded. This leaves a platform-specific validation question for the updated development-toolchain graph.
Findings	None	None.
Security	None	None.

How this fits together

@openclaw/fs-safe uses a native Node.js build toolchain to package and validate filesystem-safety primitives across supported operating systems. The manifest and pnpm lockfile select that toolchain, which CI then exercises through native builds and Node-version checks.

flowchart LR
  A[Development dependency manifest] --> B[pnpm lockfile resolution]
  B --> C[Native build tooling]
  C --> D[Cross-platform CI checks]
  D --> E[Filesystem-safety package artifacts]

Loading

Before merge

• Resolve merge risk (P1) - Merging with the unresolved Node 24 Windows failure could leave the repository unable to validate its supported Windows development path against the updated native build-toolchain resolution.
• Complete next step (P2) - A maintainer needs the failed Windows Node 24 job diagnostics before merge; the supplied evidence does not establish a narrow repository repair or a safe automated change.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed dependency surface	2 direct development packages; 2 files affected	The patch is limited to the manifest and generated pnpm resolution graph.
Platform validation split	1 reported failure: Node 24 Windows; Node 24 macOS and Ubuntu passed	The only reported failing validation is isolated to a supported OS and Node-version combination.

Merge-risk options

Maintainer options:

1. Resolve Windows validation first (recommended)
   Obtain the failed Node 24 Windows job diagnostics and merge only after the failure is shown to be infrastructure-only or the updated dependency graph passes that job.
2. Pause this Dependabot update
   Leave the branch open or recreate it if the Windows failure cannot be confidently attributed without changing the resolved development-toolchain graph.

Technical review

Best possible solution:

Inspect the failing Windows Node 24 job, then either document a runner-only cause or update/recreate the dependency resolution until the same cross-platform validation path is green.

Do we have a high-confidence way to reproduce the issue?

Unclear: the supplied check data establishes a failed Windows Node 24 CI run, but it does not include sufficient job diagnostics to reproduce or attribute that failure to the dependency update.

Is this the best way to solve the issue?

No, not yet: accepting an unexamined platform-specific CI failure is not the safest path; the narrow maintainable solution is to diagnose the Windows failure and retain the normal pnpm-managed resolution.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ab933820c089.

Labels

Label justifications:

• P3: This is routine development dependency maintenance with no demonstrated runtime behavior change.
• merge-risk: 🚨 automation: The updated development-toolchain resolution has an unresolved failure in the repository’s Windows Node 24 CI validation.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot development-tooling update is evaluated through its repository CI matrix rather than external-contributor runtime media; the unresolved Windows CI failure remains the needed validation evidence.

Evidence

What I checked:

• Narrow dependency declaration change: The PR changes the direct development-tooling version of @napi-rs/cli from 3.7.4 to 3.8.0; it does not change the runtime dependency section or filesystem-safety implementation. (package.json:151, 8fe9bf61c2ea)
• Resolved graph changes match the declared update: The lockfile updates the importer to @napi-rs/cli@3.8.0 and @types/node@26.1.2, with the expected transitive resolution churn for a pnpm lockfile. (pnpm-lock.yaml:9, 8fe9bf61c2ea)
• Cross-platform validation is not uniformly green: The supplied check results show Node 24 check (windows-latest) failed, while the Node 24 macOS and Ubuntu checks and the Windows Node 22 check succeeded. This leaves a platform-specific validation question for the updated development-toolchain graph. (8fe9bf61c2ea)
• Repository policy requires conservative cross-platform validation: The repository policy identifies filesystem and package changes as security-sensitive, requires use of repository scripts, and calls for relevant validation before handoff; this makes the failed Windows validation material to merge readiness. (AGENTS.md:1, ab933820c089)

Likely related people:

• Unknown: The supplied context identifies the Dependabot branch but contains no reliable current-main blame or feature-history attribution for the manifest and CI workflow; assigning the bot or an unrelated contributor as an owner would be misleading. (role: development-toolchain history owner not established; confidence: low; files: package.json, pnpm-lock.yaml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Inspect the failed Windows Node 24 job output and identify whether the failure is runner-specific or resolution-specific.
• Recreate or adjust the Dependabot update if the Windows failure is caused by the new development-toolchain graph.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (4 earlier review cycles)

• reviewed 2026-07-30T17:28:37.341Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-30T22:08:27.022Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-30T23:13:50.149Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T06:31:47.893Z sha 8fe9bf6 :: needs maintainer review before merge. :: none