[dependabot]

Bumps the development-minor-and-patch group with 11 updates in the / directory:

Package	From	To
@react-email/ui	6.11.2	6.11.3
@vitest/coverage-v8	5.0.4	5.0.5
convex-test	0.0.62	0.0.65
jsdom	30.1.2	30.1.3
oxfmt	0.73.0	0.75.0
oxlint	1.88.0	1.90.0
oxlint-tsgolint	7.0.2004	7.0.2005
react-email	6.11.2	6.11.3
skills	1.7.2	1.7.4
vite	8.3.4	8.3.5
vitest	5.0.4	5.0.5

Updates @react-email/ui from 6.11.2 to 6.11.3

Release notes

Sourced from @​react-email/ui's releases.

@​react-email/ui@​6.11.3

Patch Changes

• 88562d0: The compatibility check now applies --esbuild-plugins when it bundles a template that passes config, theme or utility to <Tailwind>, so templates whose imports need a plugin no longer log a build error.
• 7f545c6: Bump next to 16.4.1 so the prebuilt preview server works in projects on Next.js 16.4. Next 16.4 loads a server/preview-props.json manifest that a 16.3 build doesn't emit, so email dev failed with ENOENT when next was deduped to 16.4.

Changelog

Sourced from @​react-email/ui's changelog.

6.11.3

Patch Changes

• 88562d0: The compatibility check now applies --esbuild-plugins when it bundles a template that passes config, theme or utility to <Tailwind>, so templates whose imports need a plugin no longer log a build error.
• 7f545c6: Bump next to 16.4.1 so the prebuilt preview server works in projects on Next.js 16.4. Next 16.4 loads a server/preview-props.json manifest that a 16.3 build doesn't emit, so email dev failed with ENOENT when next was deduped to 16.4.

Commits

• e0561e1 chore(root): version packages (#3791)
• 88562d0 fix(ui): apply --esbuild-plugins when the compatibility check bundles Tailwin...
• See full diff in compare view

Updates @vitest/coverage-v8 from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• See full diff in compare view

Updates convex-test from 0.0.62 to 0.0.65

Changelog

Sourced from convex-test's changelog.

0.0.65

• Adds support for Convex mutations that call the ctx.auth.signJwt API.

0.0.64

• Update pagination restriction to match backend: components can now call .paginate and mutations can paginate multiple times.

0.0.63

• Pin Date.now(), Date(), and new Date() for each query or mutation, including nested calls and t.run. Like the Convex backend, the pinned time is at or after the transaction's snapshot timestamp and at or before the _creationTime of documents the transaction inserts. Scheduled functions still become due according to the wall clock, as in the real Convex backend. (#144)
• Enforce the 1,024-candidate limit for text search during iteration and pagination, including candidates excluded by post-search filters. Queries can stop early with .take(), smaller pages, or an early exit from iteration to stay within the limit. (#169, #171)
• Fail early when calling, scheduling, or creating a function handle for an unregistered component, with an error that explains how to register it and lists the registered components. (#164)
• Preserve a stored Blob's content type in _storage metadata. (#170)

Commits

• e6e17df 0.0.65
• ed7a5ce Support ctx.auth.signJwt in mutations (#173)
• ebcf1f7 0.0.64
• 265e5df Allow component pagination with one paginate call per query (#163)
• 5e0fc2a 0.0.63
• 9831bb9 docs: prepare changelog for 0.0.63 (#172)
• c597e3f Enforce search candidate limits in paginated queries (#171)
• fe4e0ac Fail fast with a clear error when a component isn't registered (#164)
• aace21a fix(clock): pin transaction time at or after its snapshot (#144)
• dd4d44b Enforce the search query candidate limit during iteration (#169)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by dowski-convex, a new releaser for convex-test since your current version.

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

Commits

• 058c0f5 30.1.3
• fcd1fd1 Cascade parsed longhands independently
• a3ee786 Cascade computed style properties on demand
• f42dc15 Resolve colors before caching or using currentcolor
• 074b1fb Compute background-position lengths against the final font size
• d19598c Apply style rules nested in multiple @​media rules
• 45d626c Rule out attribute selector subjects before matching
• 3ff0a5b Upgrade Undici and remove abort workarounds
• 8813bb1 Ignore CSS declarations with unparseable math functions
• 63712d8 Fix XHR credentials across redirects
• Additional commits viewable in compare view

Updates oxfmt from 0.73.0 to 0.75.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.75.0

🐛 Bug Fixes

• 5042019 formatter: Keep fill layout for array with comment after [ (#28170) (leaysgur)
• 9d37ff6 formatter: Use position-based comment checks for concise arrays (#28169) (leaysgur)
• 016c4a2 formatter: Keep a comment before } inside a JSX spread child (#28103) (vidigoat)
• 190bb1e formatter: Keep parens around an instantiation expression ending an operand through any tight parent (#28168) (leaysgur)
• a5314a1 formatter: Keep ; before in and instanceof class members (#28166) (leaysgur)
• 3a56e7c formatter: Keep closing HTML comments at the start of a line (#28064) (Cameron)
• 23d23d6 formatter_markdown: Honor range ignore inside directives (#28164) (leaysgur)
• 5f1fd3d formatter: Measure width heuristics by display width (#28098) (leaysgur)
• a5a52cf formatter: Keep parens around private in expressions (#28096) (leaysgur)
• 999496e formatter: Measure a short key by its display width (#28026) (vidigoat)
• 7e9aa44 formatter: Keep parens around a looser operand of an instantiation expression (#28025) (vidigoat)
• 6912d1f formatter: Keep an arrow signature that exactly fills the line for any body (#27989) (leaysgur)
• eb1d9f9 formatter_core: Count a flat line space in fits only when text follows (#27987) (leaysgur)

⚡ Performance

• 1ed93af data_structures: Copy short strings without a memcpy call (#27953) (leaysgur)
• 7948f0b formatter_core: Shrink FormatElement to 16B (#28012) (leaysgur)
• 788af22 formatter: Keep AstNodes on the stack, and only chain links in the arena (#27963) (leaysgur)

📚 Documentation

• 068a8ea formatter: Fix up wording (#28167) (leaysgur)
• db55461 formatter_core: Document text width divergence (#28095) (leaysgur)
• 880d229 formatter: Add vitest-test-call to known divergences (#28006) (leaysgur)

oxfmt v0.74.0

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)

... (truncated)

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 3e7f0f5 chore(oxfmt): bump prettier-plugin-astro to 1.1.2 (#28162)
• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• See full diff in compare view

Updates oxlint from 1.88.0 to 1.90.0

Release notes

Sourced from oxlint's releases.

oxlint v1.90.0

🚀 Features

• cf34678 oxlint: Export Oxlintrc type (#28132) (Sysix)
• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

🐛 Bug Fixes

• 7f3c908 linter/eslint/array-callback-return: Check callbacks passed with extra arguments (#28133) (sarankumar)
• 53be530 linter: Filter by type aware rules when looking up tsgolint rule severity (#28138) (NavpreetSSidhu)
• e0f8937 react-compiler: Compile a try whose catch is unreachable instead of panicking (#28066) (Dunqing)
• f5b625f linter/eslint/no-useless-concat: See through parenthesized expressions (#27984) (Rahul Kashyap)
• 4629bb2 linter/jest/no-conditional-expect: Check function expression callbacks (#28055) (camc314)
• 5c84098 semantic,linter: Report names with lone surrogates in enum and lint checks (#27991) (Dunqing)
• f3705a9 linter/eslint/prefer-const: Skip fixers if any declarator is reassigned (#28008) (Prince Jain)
• 4c0fa90 minifier,linter: Keep delete of constant members and later JSX keys (#27990) (Dunqing)
• 0298062 linter/arrow-body-style: Keep type assertions when adding a block body (#27978) (Yan Almeida)

oxlint v1.89.0

💥 BREAKING CHANGES

• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
• ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
• d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
• e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
• 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
• d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
• 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
• 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
• 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
• b7a1df3 linter: Mark unicorn rules as recommended (#27670) (Cam McHenry)
• c44a355 linter: Mark typescript rules as recommended from upstream (#27634) (Cam McHenry)
• 6b49dba linter: Mark eslint rules as recommended from upstream (#27632) (Cam McHenry)

🐛 Bug Fixes

• 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• 326904f linter/unicorn/no-useless-undefined: Allow undefined in React.useRef (#25027) (Chris Dokurno)
• f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (#27868) (camc314)
• 00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (#27856) (camc314)
• 9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (#27767) (camc314)
• 01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (#27769) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.90.0] - 2026-10-27

🚀 Features

• 831cdf1 oxlint: Require mininum oxlint-tsgolint version v7.0.2005 (#28118) (camc314)
• d1b00f4 linter/typescript: Implement no-unsafe-enum-assignment rule (#28117) (camc314)
• 165c91f linter/typescript/await-thenable: Support allowMixedPromiseArrays option (#28116) (camc314)

[1.89.0] - 2026-10-19

🐛 Bug Fixes

• 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)

Commits

• 9b6fff4 release(apps): oxlint v1.90.0 && oxfmt v0.75.0 (#28191)
• 831cdf1 feat(oxlint): require mininum oxlint-tsgolint version v7.0.2005 (#28118)
• d1b00f4 feat(linter/typescript): implement no-unsafe-enum-assignment rule (#28117)
• 165c91f feat(linter/typescript/await-thenable): support allowMixedPromiseArrays opt...
• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 9a424c2 fix(oxlint,oxfmt): correct Node.js TypeScript support range (#27699)
• See full diff in compare view

Updates oxlint-tsgolint from 7.0.2004 to 7.0.2005

Release notes

Sourced from oxlint-tsgolint's releases.

v7.0.2005

What's Changed

• chore(deps): update github actions by @​renovate[bot] in oxc-project/tsgolint#1273
• chore(deps): update gomod by @​renovate[bot] in oxc-project/tsgolint#1274
• chore(deps): update npm packages by @​renovate[bot] in oxc-project/tsgolint#1275
• chore(deps): update oxc-project/security-action action to v1.0.9 by @​renovate[bot] in oxc-project/tsgolint#1276
• fix(unbound-method): respect this: void on class properties by @​baevm in oxc-project/tsgolint#1277
• docs(security): inherit organization security policy by @​Boshen in oxc-project/tsgolint#1295
• chore(deps): update npm packages by @​renovate[bot] in oxc-project/tsgolint#1301
• fix(no-deprecated): avoid infinite loop on circular alias chains by @​magurotuna in oxc-project/tsgolint#1309
• feat(await-thenable): add allowMixedPromiseArrays option by @​camc314 in oxc-project/tsgolint#1307
• chore: remove update-typescript-go.yml by @​camc314 in oxc-project/tsgolint#1311
• ci: pin just version in setup and autofix by @​camc314 in oxc-project/tsgolint#1312
• fix(no-unnecessary-type-parameters): count generic type arguments by @​farnoodma in oxc-project/tsgolint#1297
• feat(no-unsafe-enum-assignment): add rule by @​camc314 in oxc-project/tsgolint#1316
• fix(require-array-sort-compare): report tuples by @​baevm in oxc-project/tsgolint#1317

New Contributors

• @​magurotuna made their first contribution in oxc-project/tsgolint#1309
• @​farnoodma made their first contribution in oxc-project/tsgolint#1297

Full Changelog: oxc-project/tsgolint@v7.0.2004...v7.0.2005

Commits

• 4ebf80f fix(require-array-sort-compare): report tuples (#1317)
• 62e97c9 feat(no-unsafe-enum-assignment): add rule (#1316)
• e649c1e fix(no-unnecessary-type-parameters): count generic type arguments (#1297)
• e333787 ci: pin just version in setup and autofix (#1312)
• bcab203 chore: remove update-typescript-go.yml (#1311)
• bb8225c feat(await-thenable): add allowMixedPromiseArrays option (#1307)
• 086f19a fix(no-deprecated): avoid infinite loop on circular alias chains (#1309)
• a180371 chore(deps): update npm packages (#1301)
• 8897346 docs(security): inherit organization security policy (#1295)
• 69698fe fix(unbound-method): respect this: void on class properties (#1277)
• Additional commits viewable in compare view

Updates react-email from 6.11.2 to 6.11.3

Release notes

Sourced from react-email's releases.

react-email@6.11.3

Patch Changes

• Updated dependencies [f356e81]
  • @​react-email/render@​2.1.1

Changelog

Sourced from react-email's changelog.

6.11.3

Patch Changes

• Updated dependencies [f356e81]
  • @​react-email/render@​2.1.1

Commits

• e0561e1 chore(root): version packages (#3791)
• See full diff in compare view

Updates skills from 1.7.2 to 1.7.4

Release notes

Sourced from skills's releases.

v1.7.4

Changelog

• Restore experimental_sync as the advertised command (#2542)

Contributors

@​quuu

v1.7.3

Changelog

• Align comments in CLI help examples (#2540)
• Promote skills sync to a stable command (#2539)
• Simplify README and split detailed documentation (#2538)
• Enable board collaboration for PR workflows (#2537)
• Show fx in the main install section (#2447)

Contributors

@​quuu

Commits

• a80e4c9 v1.7.4
• 0f57b70 Merge pull request #2542 from vercel-labs/fix/restore-experimental-sync
• 215c397 Restore experimental_sync as the advertised command
• 36f68cb v1.7.3
• 9d5b706 Merge pull request #2540 from vercel-labs/fix/help-example-alignment
• e68cdc4 Align comments in CLI help examples
• 617fc80 Merge pull request #2538 from vercel-labs/docs/readme-first-visit
• 2ad3a4b Merge pull request #2539 from vercel-labs/qua/sync-public-command
• 50bc705 Promote skills sync and fix readiness gaps
• f906c46 Simplify README and split detailed documentation
• Additional commits viewable in compare view

Updates vite from 8.3.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev:Description has been truncated

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 30, 2026 4:07pm UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR updates 11 development dependencies and their resolved Bun lockfile entries.

Example: Run the existing component-upgrade test with a frozen clock.

• Before: convex-test 0.0.62 preserves the expected 60000 ms retry delay.
• After: The upgraded transaction clock yields 59999 ms, failing the unchanged assertion.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful, narrowly scoped maintenance, but the harness upgrade leaves known unit compatibility failures.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored maintenance PR is outside the contributor proof gate; CI exercises the upgraded tooling, with the unit compatibility defect recorded separately.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Development tooling remains behind compatible upstream fixes.
Reason: The update follows the repository's existing Dependabot grouping policy and preserves application configuration and security overrides.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep open: these updates are absent from current main, and the convex-test bump introduces clock compatibility failures in the unit gate.

Priority: P3
Reviewed head: 012670fb011324f68b679c5973cf6cc8f9f3d5ed

Before merge

• Adapt the clock fixtures before upgrading convex-test (P2) - convex-test 0.0.63 introduced transaction-local time that can advance beyond a frozen wall clock after commits, and 0.0.64 retains it. Existing fixtures assume those clocks are identical: componentUpgrade.test.ts expects 60000 ms but receives 59999, skillCardClaims.test.ts receives a lease one millisecond later, and the report-expiry and catalog-observation assertions also fail. These failures are present in this head's unit annotations. Keep 0.0.62 for this group, or update the fixtures to use transaction timestamps and deliberate expiry boundaries while preserving the tested invariants.

Findings

• [P2] Adapt the clock fixtures before upgrading convex-test — package.json:178

Agent review details

How this fits together

The root dependency manifest and Bun lockfile supply the tools used to build ClawHub, preview emails, lint code, and execute frontend and Convex tests.

flowchart TD
  A[Dependency manifest] --> B[Bun lockfile]
  B --> C[Build and lint tools]
  B --> D[Vitest and convex-test]
  C --> E[Application build]
  D --> F[CI validation]

Loading

Technical review

Best possible solution:

Retain convex-test 0.0.62 in this group and upgrade it separately with transaction-clock-compatible fixtures.

Do we have a high-confidence way to reproduce the issue?

Exact-head CI records the failures, and the upstream transaction-clock implementation explains the millisecond differences and expiry-boundary failures; no local tests were run.

Is this the best way to solve the issue?

The grouped manifest-and-lockfile update is appropriately scoped, but the harness upgrade needs companion fixture changes; deferring that dependency is smaller than changing production behavior to satisfy tests.

Full review comments:

• [P2] Adapt the clock fixtures before upgrading convex-test — package.json:178
  convex-test 0.0.63 introduced transaction-local time that can advance beyond a frozen wall clock after commits, and 0.0.64 retains it. Existing fixtures assume those clocks are identical: componentUpgrade.test.ts expects 60000 ms but receives 59999, skillCardClaims.test.ts receives a lease one millisecond later, and the report-expiry and catalog-observation assertions also fail. These failures are present in this head's unit annotations. Keep 0.0.62 for this group, or update the fixtures to use transaction timestamps and deliberate expiry boundaries while preserving the tested invariants.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.97

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e726f3c5fe4d.

Provenance checked

• Development dependency versions keeps the original intent (cf3788c: The prior refresh updated supported dependency lines while preserving compiler, transport, and security-override contracts.)
• Vitest and coverage pairing keeps the original intent (da352b3: The earlier update kept Vitest and its coverage provider together; this PR updates both to 5.0.5.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• bunx vitest run convex/lib/skillCardClaims.test.ts convex/componentUpgrade.test.ts convex/searchReports.test.ts convex/skillsShCatalog.test.ts convex/packages.clawArtwork.runtime.test.ts
• bun run ci:unit
• bun run ci:static
• bun run ci:types-build

What I checked:

• Pinned change and current main: The introduced diff changes only package.json and bun.lock; current main retains convex-test 0.0.62, Vitest 5.0.4, and Vite 8.3.4. (package.json:178, 012670fb0113)
• Exact-head unit failures: The unit check failed with clock-related assertions in skillCardClaims.test.ts, componentUpgrade.test.ts, searchReports.test.ts, and skillsShCatalog.test.ts, plus a storage transaction failure in packages.clawArtwork.runtime.test.ts. The clock failures match the reviewed upstream change; the storage failure's cause remains unclassified. https://github.com/openclaw/clawhub/actions/runs/40356203199/job/121689232864. (convex/componentUpgrade.test.ts:74, 012670fb0113)
• Verified transaction-clock change: ClawHub directly executes this harness through convexTest. The upstream change pins transaction time at or after the latest snapshot, rounding nanosecond commits upward to milliseconds; its tests explicitly demonstrate a frozen wall clock producing transaction time one millisecond later. (index.ts, aace21a6ef13)
• Other validation: Static, types-build, packages, e2e-http, playwright-smoke, and claws-openclaw-contract passed on the reviewed head. Full unit logs redirected to a blocked storage host, but GitHub annotations exposed the failing assertions. (.github/workflows/ci.yml:71, 012670fb0113)
• Existing dependency intent: The repository explicitly groups development minor and patch updates. The prior refresh preserved supported compiler and transport arrangements and existing security overrides; this PR retains those boundaries. chore(deps): refresh compatible packages and patch advisories #3953. (.github/dependabot.yml:32, cf3788c9f718)
• Discussion and source identity: The fetched complete body matches supplied SHA-256 8b613cff3d462329c0a9d84acd214c52a5ba4a12e60dba86fdf8a0cf949b0b7b. Discussion contains deployment and review-status bots, with no maintainer direction or behavior proof. Earlier grouped updates chore(deps-dev): bump the development-minor-and-patch group across 1 directory with 8 updates #4033 and chore(deps-dev): bump the development-minor-and-patch group with 4 updates #3992 were closed without merging. (012670fb0113)

Likely related people:

• Patrick Erichsen: Raw commit e319df0 adds package.json:43 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: e319df076006; files: package.json)
• Peter Steinberger: Raw commit c3b6995 adds package.json:197 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c3b69959a750; files: package.json)
• Vincent Koc: Raw commit 3bfdbfc adds package.json:20 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 3bfdbfc00484; files: package.json)

Review metrics

Metric	Value	Why it matters
Change scope	2 files; +102/-100; 11 direct dependency updates	Growth is dependency metadata and transitive lockfile resolution; no application source or tests are added.

Labels

Label changes:

• add P3: Routine development-tool maintenance with no established production outage.
• add merge-risk: 🚨 automation: The upgraded Convex test clock breaks existing assertions, leaving the required unit gate failing.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: Routine development-tool maintenance with no established production outage.
• merge-risk: 🚨 automation: The upgraded Convex test clock breaks existing assertions, leaving the required unit gate failing.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 26, 2026, 12:24 PM ET / 16:24 UTC.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​convex-test@​0.0.62 ⏵ 0.0.65	-6		+1	+1
	npm/​@​vitest/​coverage-v8@​5.0.4 ⏵ 5.0.5				-1
	npm/​vitest@​5.0.4 ⏵ 5.0.5	+1		+1
	npm/​vite@​8.3.4 ⏵ 8.3.5	+1		+1
	npm/​@​react-email/​ui@​6.11.2 ⏵ 6.11.3			+1
	npm/​oxfmt@​0.73.0 ⏵ 0.75.0	-7			+2
	npm/​oxlint@​1.88.0 ⏵ 1.90.0			+1
	npm/​react-email@​6.11.2 ⏵ 6.11.3				+1
	npm/​oxlint-tsgolint@​7.0.2004 ⏵ 7.0.2005				+1
	npm/​jsdom@​30.1.2 ⏵ 30.1.3	+1		+1	-1
	npm/​skills@​1.7.2 ⏵ 1.7.4				+2

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Publisher changed: npm convex-test is now published by dowski-convex Author: dowski-convex From: package.json → npm/convex-test@0.0.65 ℹ Read more on: This package | This alert | What is unstable ownership? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Try to reduce the number of authors you depend on to reduce the risk to malicious actors gaining access to your supply chain. Packages should remove inactive collaborators with publishing rights from packages on npm. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/convex-test@0.0.65. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report