Skip to content

chore(deps-dev): bump the development group with 2 updates - #77

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-577c6fd817
Closed

chore(deps-dev): bump the development group with 2 updates#77
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-577c6fd817

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the development group with 2 updates: @napi-rs/cli and @types/node.

Updates @napi-rs/cli from 3.7.4 to 3.8.0

Commits
  • 9da8723 chore(release): publish
  • 8d22196 chore(deps): update dependency oxc-parser to ^0.142.0 (#3422)
  • abc30fb build(deps): bump postcss from 8.5.17 to 8.5.23 (#3421)
  • 5542139 build(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 (#3418)
  • dc4ee8c build(deps): bump fast-uri from 3.1.3 to 3.1.4 (#3419)
  • 050d985 feat(async-runtime): drain-linger surface + lock-free scheduler internals (#3...
  • e0b8708 chore(deps): update dependency oxc-parser to ^0.141.0 (#3417)
  • fc84940 chore(deps): update actions/setup-node action to v7 (#3413)
  • ee598db build(deps): bump protobufjs from 7.6.4 to 7.6.5 (#3410)
  • e707ede chore(deps): update actions/setup-node action to v7 (#3412)
  • Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps-dev): bump the development group with 2 updates
8fe9bf6 
Bumps the development group with 2 updates: [@napi-rs/cli](https://github.com/napi-rs/napi-rs) and [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node).


Updates `@napi-rs/cli` from 3.7.4 to 3.8.0
- [Release notes](https://github.com/napi-rs/napi-rs/releases)
- [Commits](https://github.com/napi-rs/napi-rs/compare/@napi-rs/cli@3.7.4...@napi-rs/cli@3.8.0)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

---
updated-dependencies:
- dependency-name: "@napi-rs/cli"
  dependency-version: 3.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: development
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner July 30, 2026 17:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 30, 2026
@clawsweeper clawsweeper Bot added rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. labels Jul 30, 2026
@clawsweeper

clawsweeper Bot commented Jul 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex review: needs maintainer review before merge. Reviewed August 1, 2026, 8:15 PM ET / August 2, 2026, 00:15 UTC.

ClawSweeper review

What this changes

Updates the development-only N-API native-build CLI from 3.7.4 to 3.8.0 and refreshes the resolved @types/node package in pnpm-lock.yaml.

Merge readiness

⛔ Blocked until real behavior proof is added - 4 items remain

Keep this PR open for validation before merge. Current main still uses @napi-rs/cli 3.7.4, while this branch changes the frozen dependency graph used by the native release pipeline; its Node 24 Windows check is failing and the available review data does not identify the cause.

Priority: P3
Reviewed head: 8fe9bf61c2eabd1ac67c64aa1ea7f59fc38ddb53
Owner decision: Required. See Decision needed.

Review scores

Measure Result What it means
Overall readiness 🧂 unranked krab (1/6) The patch is narrow and structurally coherent, but missing real behavior proof and the unresolved Windows failure leave it below merge-ready quality.
Proof confidence 🧂 unranked krab (1/6) Needs real behavior proof before merge: The external Dependabot PR provides generated dependency metadata and CI results but no after-fix real-run evidence; add a redacted Windows terminal result or equivalent live validation before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🦐 gold shrimp (3/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: The external Dependabot PR provides generated dependency metadata and CI results but no after-fix real-run evidence; add a redacted Windows terminal result or equivalent live validation before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 5 items Current main has not adopted the update: Current main still declares @napi-rs/cli 3.7.4 and resolves @types/node 26.1.1, so the central dependency update is neither merged nor present in the latest checked-out release branch state.
The changed CLI is used by native release builds: The private native workspace invokes napi build, and the release workflow installs the frozen lockfile before invoking that command for Windows and other native targets.
PR diff is narrowly scoped but changes the resolved dependency graph: The branch changes one direct development dependency and 398 lockfile lines; its merge base is current main and git diff --check reports no whitespace errors.
Findings None None.
Security None None.

How this fits together

The development dependency set supplies TypeScript tooling and the N-API CLI that builds this package’s native bindings. CI and release prebuilds install the frozen pnpm lockfile before using that CLI to validate the package and produce platform artifacts.

flowchart LR
  A[Locked development dependencies] --> B[Frozen pnpm install]
  B --> C[Node validation]
  B --> D[N-API build CLI]
  D --> E[Native platform bindings]
  C --> F[Package validation]
  E --> G[Release artifacts]
Loading

Decision needed

Question Recommendation
Should this dependency update wait for a successful Node 24 Windows validation run, or should maintainers establish that the existing failure is unrelated to this exact lockfile update? Validate the exact head: Retrieve or rerun the Node 24 Windows job on this branch and merge only after its frozen install and package check pass.

Why: The changed tool builds release artifacts, but the available failed-check status has no diagnostic output, so it is not safe to attribute or dismiss the Windows failure automatically.

Before merge

  • Resolve merge risk (P1) - The failing Node 24 Windows check may indicate that the updated native-build CLI or its new resolved transitive graph breaks a supported development/package-validation path; the failure detail is not available in this read-only review.
  • Resolve merge risk (P1) - The PR body contains no after-fix behavior evidence from a real setup. CI is useful supplemental evidence but does not establish the contributor-facing runtime result required before merge.
  • Complete next step (P2) - A maintainer must inspect or rerun the failed Windows job before any repair path can be safely identified; the available status has no actionable failure detail.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Direct dependency update 1 direct dev-tool bump; 1 type-resolution refresh The package manifest changes only the N-API CLI, while the type package moves through the lockfile resolution.
Lockfile surface 2 files affected; 224 added, 176 removed The native CLI update replaces a substantial resolved transitive graph despite the narrow manifest edit.

Merge-risk options

Maintainer options:

  1. Confirm Windows validation before merge (recommended)
    Re-run or inspect the failed Node 24 Windows job against this exact commit and merge only after the frozen-lockfile install and pnpm check are confirmed healthy.
  2. Pause the generated update
    If the Windows failure is caused by the new CLI or cannot be diagnosed promptly, defer this Dependabot update until a compatible release is available.

Technical review

Best possible solution:

Retrieve or rerun the Node 24 Windows failure on this exact head, then merge the narrow dependency update only if the frozen install and pnpm check succeed or the failure is shown to be unrelated.

Do we have a high-confidence way to reproduce the issue?

No. The failed Node 24 Windows status is concrete, but its job log was unavailable during this read-only review, so there is no high-confidence path to reproduce or attribute the failure locally.

Is this the best way to solve the issue?

Unclear. The dependency update is narrowly scoped and follows the repository’s lockfile workflow, but resolving the Windows validation result is necessary before treating it as a safe upgrade.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ab933820c089.

Labels

Label justifications:

  • P3: This is routine development-dependency maintenance; the unresolved CI status does not by itself justify escalating user-impact priority.
  • merge-risk: 🚨 availability: The updated CLI is invoked by frozen-lockfile native release builds, and Node 24 validation on Windows currently fails for this branch.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The external Dependabot PR provides generated dependency metadata and CI results but no after-fix real-run evidence; add a redacted Windows terminal result or equivalent live validation before merge. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

  • Current main has not adopted the update: Current main still declares @napi-rs/cli 3.7.4 and resolves @types/node 26.1.1, so the central dependency update is neither merged nor present in the latest checked-out release branch state. (package.json:151, ab933820c089)
  • The changed CLI is used by native release builds: The private native workspace invokes napi build, and the release workflow installs the frozen lockfile before invoking that command for Windows and other native targets. (native/package.json:18, ab933820c089)
  • PR diff is narrowly scoped but changes the resolved dependency graph: The branch changes one direct development dependency and 398 lockfile lines; its merge base is current main and git diff --check reports no whitespace errors. (pnpm-lock.yaml:11, 8fe9bf61c2ea)
  • Windows validation remains unresolved: GitHub context reports Node 24 check (windows-latest) as failed while the corresponding macOS and Ubuntu checks and all three native checks succeed. Network access was unavailable during this review, so the failed job’s diagnostic output could not be retrieved to establish causality. (.github/workflows/ci.yml:56, 8fe9bf61c2ea)
  • Likely release-pipeline ownership trail: Repository history available locally shows Peter Steinberger as the dominant contributor across package.json, the native workspace, and the release workflow, including recent release-validation work. Deeper file history could not be loaded because this partial clone required an unavailable network fetch. (.github/workflows/release.yml:152, 0206c4b567b4)

Likely related people:

  • Peter Steinberger: Local history identifies Peter Steinberger as the most frequent contributor across the package metadata, native workspace, and release workflow, including recent release-validation work. (role: recent release-pipeline contributor; confidence: medium; commits: 0206c4b567b4, 66201c1f347a; files: package.json, .github/workflows/release.yml, native/package.json)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Provide or retrieve a redacted Node 24 Windows terminal/job result for this exact head.
  • If the PR body is updated with that proof, trigger a fresh review or ask a maintainer to comment @clawsweeper re-review if needed.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (13 earlier review cycles; latest 8 shown)
  • reviewed 2026-07-31T17:28:59.129Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-07-31T23:11:58.422Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T05:08:16.265Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T07:58:49.593Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T11:13:49.886Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T16:09:48.291Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T20:15:00.663Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
  • reviewed 2026-08-01T22:37:04.732Z sha 8fe9bf6 :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. merge-risk: 🚨 automation 🚨 Merging this PR could break CI, automerge, proof capture, label sync, or automation. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. labels Jul 30, 2026
@clawsweeper clawsweeper Bot added status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Aug 1, 2026
@steipete steipete mentioned this pull request Aug 2, 2026
Merged
@steipete

steipete commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Disposition: CLOSE as superseded by #79.

The Windows/Node 24 failure on this exact head was not caused by the dependency update: it was a one-off EPERM while opening a sidecar lock in file-lock-reentrancy.test.ts. On the same head, native checks passed on Windows, Linux, macOS, and musl; bundled-package smoke also passed on all three hosted operating systems. Current main CI is green on the unchanged lock implementation.

#79 carries the dependency work forward with @napi-rs/cli 3.8.1 (instead of 3.8.0), @types/node 26.1.2, and the complete npm/Rust/Actions freshness pass. Its local build, full tests, package check, security suite, docs build, audit, real library integration, and AutoReview are green; hosted native proof is running there.

No Dependabot branch revision is requested; this generated update is cleanly superseded.

@steipete

steipete commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Closing as superseded by #79, which landed the newer dependency set with a complete npm, Rust, native-build, packaged-consumer, and cross-platform CI proof. Full disposition and original-head analysis: #77 (comment)

@steipete steipete closed this Aug 2, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 2, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/development-577c6fd817 branch August 2, 2026 02:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code merge-risk: 🚨 availability 🚨 Merging this PR could cause crashes, hangs, restart loops, stalls, or process outages. P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete