chore(deps): bump the production-minor-and-patch group across 1 directory with 16 updates by dependabot[bot] · Pull Request #4153 · openclaw/clawhub

dependabot · 2026-10-30T16:06:14Z

Bumps the production-minor-and-patch group with 16 updates in the / directory:

Package	From	To
@openclaw/krillswitch-react	`0.0.1`	`0.0.2`
@openclaw/plugin-inspector	`0.4.3`	`0.4.5`
@react-email/render	`2.1.0`	`2.1.1`
@tanstack/react-router	`1.170.44`	`1.170.46`
@tanstack/react-start	`1.169.2`	`1.169.4`
convex	`1.46.0`	`1.48.0`
convex-helpers	`0.1.128`	`0.1.129`
h3	`2.0.2`	`2.0.8`
ignore	`7.0.12`	`7.0.14`
jose	`6.2.12`	`6.2.13`
lucide-react	`1.57.0`	`1.62.0`
mime	`4.1.1`	`4.1.2`
resend	`6.33.0`	`6.35.0`
unist-util-visit	`5.1.0`	`5.2.0`
undici	`7.30.0`	`7.30.1`
arktype	`2.2.8`	`2.2.9`

Updates @openclaw/krillswitch-react from 0.0.1 to 0.0.2

Release notes

Sourced from @openclaw/krillswitch-react's releases.

Krillswitch SDK v0.0.2

Highlights: React flags refresh after reconnecting, and inherited properties no longer interfere with evaluation or manifest defaults.

Refresh React SDK flags on event-stream connections and reconnections while retaining polling and conditional requests.

Preserve manifest defaults and ignore inherited JavaScript properties when evaluating flags, segments, and context attributes.

Verified distribution

@openclaw/krillswitch-core@0.0.2: registry tarball, published 2026-10-24T03:28:28.204Z; integrity sha512-Z5WSi5VkNNPhegobhcvdp7vJbDZR1wcSXNPcqyfS+Tngr+nfn/aSdeDBhKFcTwhKwgVcovIe3OXJe+6OJHotow==.

@openclaw/krillswitch-react@0.0.2: registry tarball, published 2026-10-24T03:29:52.774Z; integrity sha512-Tb7LgnZ6uXDAxzv/EKs3uli/6bRTmvj/gUjZzBIwcaNVSmt8/UHS8kt1VpkOW8q5ZeGrZ53NMn4krTmCZfmi1w==.

Publication workflow. Both registry tarballs match the GitHub release assets; synthetic core targeting, React exports, server evaluation, and manifest-default checks passed against the downloaded packages.

Commits

6eb82ba chore(release): prepare application 0.6.0 and SDK 0.0.2 (#166)
7d6ec50 build(deps): patch Node runtimes and refresh compatible dependencies (#161)
a5e8d12 build(deps): refresh auth, query, tests, and CodeQL
089057e build(deps): refresh packages and macOS keyring CI
6748821 fix(react): refresh flags when event streams reconnect
0d622e0 fix(eval): keep inherited properties out of flag evaluation
909c93e build(deps-dev): bump vitest from 4.1.11 to 5.0.4 (#147)
7187ea8 fix(react): normalize event stream URLs
f7f30f3 build(deps): refresh compatible dependencies and patch Undici (#87)
59f724c chore(deps): refresh workspace and CI dependencies (#85)
Additional commits viewable in compare view

Updates @openclaw/plugin-inspector from 0.4.3 to 0.4.5

Release notes

Sourced from @openclaw/plugin-inspector's releases.

plugin-inspector v0.4.5

Highlights: Prevent heap exhaustion when inspecting source hosts and keep hook validation compatible with OpenClaw’s metadata registry.

Keep inferred host exports while excluding imports used only by explicitly typed function bodies from SDK analysis, reducing source-target memory use without increasing the heap limit.

Read source-host hook names from the exhaustive metadata registry used by current OpenClaw, preserving generated-surface validation after the host removes its separate name array.

plugin-inspector v0.4.4

Highlights: Give plugin authors usable retirement advice for their selected host and retain underlying errors in failed profile diagnostics.

Only prescribe packed-target SDK retirement migrations when the selected host publicly exposes every replacement; resolve declaration exports and runtime type members without treating comments or strings as APIs. Thanks @SebTardif.

Preserve bounded process output and truncation metadata for failed runtime and import-loop profile samples so Node version footers cannot hide the underlying exception. Keep existing previews, execution limits, and successful-sample output unchanged.

Package and verification

npm 0.4.4

Registry tarball

Integrity: sha512-D4tl/HKBJYwSbxgyxgunYQe9V2VwXFLGhj+anoInZEuqy6WneCfWrCVlg7Vhibz33um0zsqCjceH/0TbflonkQ==

Release verification and publication

Signed provenance

Changelog

Sourced from @openclaw/plugin-inspector's changelog.

0.4.5 - 2026-10-26

Highlights: Prevent heap exhaustion when inspecting source hosts and keep hook validation compatible with OpenClaw’s metadata registry.

Keep inferred host exports while excluding imports used only by explicitly typed function bodies from SDK analysis, reducing source-target memory use without increasing the heap limit.

Read source-host hook names from the exhaustive metadata registry used by current OpenClaw, preserving generated-surface validation after the host removes its separate name array.

0.4.4 - 2026-10-20

Highlights: Give plugin authors usable retirement advice for their selected host and retain underlying errors in failed profile diagnostics.

Only prescribe packed-target SDK retirement migrations when the selected host publicly exposes every replacement; resolve declaration exports and runtime type members without treating comments or strings as APIs. Thanks @SebTardif.

Preserve bounded process output and truncation metadata for failed runtime and import-loop profile samples so Node version footers cannot hide the underlying exception. Keep existing previews, execution limits, and successful-sample output unchanged.

Commits

8ec7d35 chore: prepare 0.4.5 release
6531cfc fix: read source host hooks from metadata registry (#123)
fc33afc fix: trim implementation-only host type graphs (#122)
325f706 fix: generate CI with a Node patch that rejects compromised keys (#121)
c9f7110 chore: prepare 0.4.4 release (#120)
ef58dd1 ci: verify releases without publishing (#119)
b538c04 fix: qualify packed SDK retirement migrations (#117)
57eb3c8 ci: make ClawSweeper dispatch keyless (OIDC intake)
8f458e7 fix(profile): retain errors hidden by output previews (#118)
See full diff in compare view

Updates @react-email/render from 2.1.0 to 2.1.1

Release notes

Sourced from @react-email/render's releases.

@react-email/render@2.1.1

Patch Changes

f356e81: render now only loads prettier when pretty: true is used, so rendering without it no longer fails with "Failed to load external module prettier" in Next.js dev with Turbopack on Bun

Changelog

Sourced from @react-email/render's changelog.

2.1.1

Patch Changes

f356e81: render now only loads prettier when pretty: true is used, so rendering without it no longer fails with "Failed to load external module prettier" in Next.js dev with Turbopack on Bun

Commits

e0561e1 chore(root): version packages (#3791)
f356e81 fix(render): lazy-load prettier so it's only loaded when pretty is used (#3790)
See full diff in compare view

Updates @tanstack/react-router from 1.170.44 to 1.170.46

Release notes

Sourced from @tanstack/react-router's releases.

@tanstack/react-router@1.170.46

Patch Changes

#8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

#8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

Updated dependencies [32a3360]:

@tanstack/router-core@1.171.39

@tanstack/react-router@1.170.45

Patch Changes

Updated dependencies [18154b1]:

@tanstack/router-core@1.171.38

Changelog

Sourced from @tanstack/react-router's changelog.

1.170.46

Patch Changes

#8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

#8671 689a7c5 - Publish the @tanstack/react-router agent skills (react-router, compositions/router-query, lifecycle/migrate-from-react-router), which were missing from the package's files list.

Updated dependencies [32a3360]:

@tanstack/router-core@1.171.39

1.170.45

Patch Changes

Updated dependencies [18154b1]:

@tanstack/router-core@1.171.38

Commits

6b9fe6d ci: Version Packages (#8745)
32a3360 docs(skills): reference cross-package skills by intent ID (#8670)
689a7c5 fix(react-router): publish agent skills (#8671)
caaf32d ci: Version Packages (#8733)
18154b1 perf: lower manifest script preload priority (#8212)
7a06725 chore(deps): upgrade Vitest to 5 and migrate benchmarks to the bench fixture ...
See full diff in compare view

Updates @tanstack/react-start from 1.169.2 to 1.169.4

Release notes

Sourced from @tanstack/react-start's releases.

@tanstack/react-start@1.169.4

Patch Changes

#8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

Updated dependencies [32a3360, 689a7c5, ed55775, 63a886d, d9b07e8]:

@tanstack/react-router@1.170.46

@tanstack/start-client-core@1.170.39

@tanstack/start-server-core@1.169.45

@tanstack/start-plugin-core@1.171.55

@tanstack/react-start-client@1.168.44

@tanstack/react-start-rsc@0.1.65

@tanstack/react-start-server@1.167.52

@tanstack/react-start@1.169.3

Patch Changes

Updated dependencies [18154b1]:

@tanstack/start-server-core@1.169.44

@tanstack/react-router@1.170.45

@tanstack/react-start-client@1.168.43

@tanstack/react-start-rsc@0.1.64

@tanstack/react-start-server@1.167.51

@tanstack/start-client-core@1.170.38

@tanstack/start-plugin-core@1.171.54

Changelog

Sourced from @tanstack/react-start's changelog.

1.169.4

Patch Changes

#8670 32a3360 - Reference agent skills in other packages by their intent load identifier (@tanstack/<package>#<skill>) instead of relative file links that break once packages are installed.

Updated dependencies [32a3360, 689a7c5, ed55775, 63a886d, d9b07e8]:

@tanstack/react-router@1.170.46

@tanstack/start-client-core@1.170.39

@tanstack/start-server-core@1.169.45

@tanstack/start-plugin-core@1.171.55

@tanstack/react-start-client@1.168.44

@tanstack/react-start-rsc@0.1.65

@tanstack/react-start-server@1.167.52

1.169.3

Patch Changes

Updated dependencies [18154b1]:

@tanstack/start-server-core@1.169.44

@tanstack/react-router@1.170.45

@tanstack/react-start-client@1.168.43

@tanstack/react-start-rsc@0.1.64

@tanstack/react-start-server@1.167.51

@tanstack/start-client-core@1.170.38

@tanstack/start-plugin-core@1.171.54

Commits

6b9fe6d ci: Version Packages (#8745)
32a3360 docs(skills): reference cross-package skills by intent ID (#8670)
caaf32d ci: Version Packages (#8733)
See full diff in compare view

Updates convex from 1.46.0 to 1.48.0

Changelog

Sourced from convex's changelog.

1.48.0

Convex deployments can now sign their own JWTs with an internally managed key-pair. The ctx.auth.signJwt API is available in mutations. The JWTs can be verified with the public key in the JWKS hosted at ${CONVEX_CLOUD_URL}/.well-known/jwks.json.

npx convex dev --verbose and npx convex deploy --verbose no longer print environment variable values. The logged list of environment variables shows every value as <redacted>, and values of 8 or more characters are also redacted wherever else they appear in the logged push response and diff, such as auth providers that auth.config.ts builds from process.env.

When an AI agent runs npx convex env list or npx convex env default list, they now list only names by default, so secrets stay out of the agent's context. Agents are detected from the environment variables they set. Pass --include-values to print the values.

Fixed npx convex ai-files install and npx convex ai-files update reporting success and exiting 0 when the guidelines download or the agent skills install failed. They now exit with code 1.

ctx.storage.store() and ctx.storage.get() are now available in mutations, not just actions. Files stored and read in a mutation count toward its transaction limits.

1.47.0

Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always failed because dev is reserved for your default dev deployment. It now suggests a dev/my-feature reference and passes --select.

npx convex deploy now asks for confirmation before creating or changing an index on a large table, since the deploy blocks until the index is backfilled. Stage the index (staged: true) to backfill it in the background instead, or pass the new --skip-large-indexes-check flag to proceed without confirmation. That flag also covers deleting large indexes, replacing the hidden --allow-deleting-large-indexes flag, which keeps working.

The envList MCP tool now returns only environment variable names by default, so secrets stay out of the agent's context. Pass includeValues: true to get the values too, or use envGet to read a single variable.

npx convex env list and npx convex env default list have a new --include-values flag for printing values explicitly. Values are still printed by default. The docs and help text now use --include-values wherever the values are needed, like npx convex env list --include-values > .env.convex, and --names-only for just listing variables.

Added .staged() to defineTable for validating a schema change in the background instead of blocking the deploy on a scan of the table. Pass the fields to add or change, set a field to undefined to remove it, or pass a full validator. The current validator stays enforced while Convex checks existing documents and new writes against the staged one. npx convex deploy

... (truncated)

Commits

See full diff in compare view

Updates convex-helpers from 0.1.128 to 0.1.129

Changelog

Sourced from convex-helpers's changelog.

0.1.129

(fix:streams) Retry later groups after nonempty pages (#1027)

(fix:validators) Only match own keys of an object validator's fields. Thanks to @mikirejf for the fix! (#1035)

Commits

f2ede44 npm 0.1.129
1dcc570 npm 0.1.129-alpha.0
c248fba fix(build): publish TypeScript sources under src/ (#1038)
8237d3a fix(stream): retry later groups after nonempty pages (#1027)
e48f9df chore: typecheck the example Convex app with its own tsconfig (#1036)
66a908b fix(validators): only match own keys of an object validator's fields (#1035)
0fd10de Rename GitHub org references from get-convex to convex (#1033)
c24d565 test(stream): expand pagination coverage (#1026)
See full diff in compare view

Updates h3 from 2.0.2 to 2.0.8

Release notes

Sourced from h3's releases.

v2.0.8

compare changes

🩹 Fixes

rules: Let HTTPError.headers opt out of headers rule on errors (#1613)

v2.0.7

🩹 Fixes

Keep middleware-staged headers out of handler-level caches (#1608)

v2.0.6

🩹 Fixes

rules: Fill target ** for named catch-all keys (/**:name) (48d650b)

rules: Keep middleware-staged headers out of cache entries (#1606)

v2.0.5

compare changes

🩹 Fixes

cli: Harden h3 docs page handling (7150b0e)

v2.0.4

compare changes

📦 Build

Remove bundled docs and open h3.dev from h3 docs (#1602)

🏡 Chore

Update srvx (1a1f488)

v2.0.3

compare changes

🩹 Fixes

body: Match form content type case-insensitively in readBody (#1601)

static: Serve .wasm as application/wasm (#1581)

static: Match file extensions case-insensitively (#1580)

sse: Preserve empty event ids (#1590)

query: Decode valid escapes next to a malformed one (#1582)

response: Omit HEAD body for default errors (#1595)

tracing: Mount nested apps passed to use() (#1576)

cors: Make stateful origin regex checks repeatable (#1589)

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.8

compare changes

🩹 Fixes

rules: Let HTTPError.headers opt out of headers rule on errors (#1613)

❤️ Contributors

Pi0x x@pi0.io

v2.0.7

compare changes

🩹 Fixes

Keep middleware-staged headers out of handler-level caches (#1608)

❤️ Contributors

Pi0x x@pi0.io

v2.0.6

compare changes

🩹 Fixes

rules: Fill target ** for named catch-all keys (/**:name) (48d650b)

rules: Keep middleware-staged headers out of cache entries (#1606)

❤️ Contributors

Pi0x x@pi0.io

Pooya Parsa (@pi0)

v2.0.5

compare changes

🩹 Fixes

cli: Harden h3 docs page handling (7150b0e)

❤️ Contributors

Pooya Parsa pooya@pi0.io

... (truncated)

Commits

f0e1780 chore(release): v2.0.8
f90f4c8 fix(rules): let HTTPError.headers opt out of headers rule on errors (#1613)
9d70cf3 chore(release): v2.0.7
1326e74 fix: keep middleware-staged headers out of handler-level caches (#1608)
31062a0 chore(release): v2.0.6
d658815 fix(rules): keep middleware-staged headers out of cache entries (#1606)
48d650b fix(rules): fill target ** for named catch-all keys (/**:name)
b64166a chore(release): v2.0.5
7150b0e fix(cli): harden h3 docs page handling
2084eca chore(release): v2.0.4
Additional commits viewable in compare view

Updates ignore from 7.0.12 to 7.0.14

Commits

edbaa52 bump version 7.0.14
92c4cb7 test: compare checkIgnore() with git check-ignore -v line for line
c0f0de9 fix: report the last rule to match, as git check-ignore -v does
e5151b3 fix: let checkIgnore("dir/") read "//" as "/" does
6e6ce57 docs: say exactly what .checkIgnore() shares with git check-ignore -v
3c36daa fix: let "/" match every path, as "" does
8a910fc test: move [[:cntrl:]] into the fixtures, and drop a test git already covers
ed46624 test: compare the three skipped fixtures with git too
d990dc5 test: check #175's trailing run against git, through re-inclusion
8b3466b docs, test: finish #175 -- say what git does with a run of asterisks
Additional commits viewable in compare view

Updates jose from 6.2.12 to 6.2.13

Release notes

Sourced from jose's releases.

v6.2.13

Refactor

align terminology with JOSE specifications (bafcb74)

preserve underlying error causes (724ba24), closes #908

Changelog

Sourced from jose's changelog.

6.2.13 (2026-10-20)

Refactor

align terminology with JOSE specifications (bafcb74)

preserve underlying error causes (724ba24), closes #908

Commits

316b7f2 chore(release): 6.2.13
8106395 chore: bump packages
724ba24 refactor: preserve underlying error causes
b112a5e chore: bump packages
2a3a525 chore(deps-dev): bump workerd in /tap/workerd
8f540d8 chore(deps): bump the actions group with 3 updates
8d6c02b chore(deps-dev): bump electron from 44.0.0 to 44.4.5 in /tap/electron
55c959f ci: use gh run rerun for retries
5b00c64 ci: address zizmor findings and bump shared workflows
1761d7f chore: bump packages
Additional commits viewable in compare view

Updates lucide-react from 1.57.0 to 1.62.0

Release notes

Sourced from lucide-react's releases.

Version 1.62.0

What's Changed

chore(packages): Update sponsors by @ericfennis in lucide-icons/lucide#5034

ci(metadata-suggestions): Improve suggest metadata action by @ericfennis in lucide-icons/lucide#5061

chore(deps-dev): bump markdown-it from 15.0.1 to 15.0.3 by @dependabot[bot] in lucide-icons/lucide#5051

fix(build-icons): support Windows paths in dynamic imports for template and metadata by @grzdev in lucide-icons/lucide#5058

feat(docs): add OpenPanel analytics alongside Plausible by @ericfennis in lucide-icons/lucide#5063

ci(metadata-suggestions): run on every PR update with cached suggestions by @ericfennis in lucide-icons/lucide#5062

test(lucide): add tests for replaceElement and edge cases by @grzdev in lucide-icons/lucide#5059

fix(ci): prevent broken and duplicate metadata suggestions by @ericfennis in lucide-icons/lucide#5065

chore(deps-dev): bump svelte-check from 4.7.6 to 4.7.7 in the svelte-deps group by @dependabot[bot] in lucide-icons/lucide#5075

ci(icon-preview): move icon preview into a composite action on pull_request_target by @ericfennis in lucide-icons/lucide#5064

chore(deps): bump next from 16.3.8 to 16.4.1 by @dependabot[bot] in lucide-icons/lucide#5067

feat(lucide-react): add package exports for per-icon imports without changing how Node resolves the package by @huuyafwww in lucide-icons/lucide#4822

chore(deps-dev): bump vite from 8.3.2 to 8.3.3 by @dependabot[bot] in lucide-icons/lucide#5052

feat(icons): added hockey-stick icon by @joffx in lucide-icons/lucide#3779

feat(icons): added ball-wave icon by @felipeajzanetti in lucide-icons/lucide#3706

feat(icons): added emirati-dirham icon by @DrashtiC07 in lucide-icons/lucide#5045

feat(icons): added hot-air-balloon icon by @roygommer in lucide-icons/lucide#3830

feat(icons): added azerbaijani-manat icon by @karsa-mistmere in lucide-icons/lucide#5078

New Contributors

@huuyafwww made their first contribution in lucide-icons/lucide#4822

@DrashtiC07 made their first contribution in lucide-icons/lucide#5045

@roygommer made their first contribution in lucide-icons/lucide#3830

Full Changelog: lucide-icons/lucide@1.61.0...1.62.0

Version 1.61.0

What's Changed

feat(icons): added circle-chevrons-down, circle-chevrons-left, circle-chevrons-right and 1 more icons by @ypotti in lucide-icons/lucide#5025

New Contributors

@ypotti made their first contribution in lucide-icons/lucide#5025

Full Changelog: lucide-icons/lucide@1.60.0...1.61.0

Version 1.60.0

What's Changed

feat(icons): added tombstone icon by @ryck in lucide-icons/lucide#4929

feat(icons): added smartphone-user-round icon by @hitanshu-machhi in lucide-icons/lucide#4586

feat(icons): added bacon icon by @devkamani9313-lab in lucide-icons/lucide#4694

fix(site): Fix build by @ericfennis in lucide-icons/lucide#5033

chore(docs): Update icon count comparison with Feather Icons by @noahweidig in lucide-icons/lucide#5022

feat(icons): added letter-spacing icon by @madebyoz in lucide-icons/lucide#3038

chore(deps): bump the vue-deps group with 2 updates by @dependabot[bot] in lucide-icons/lucide#5027

chore(deps-dev): bump react-native from 0.87.1 to 0.88.0 in the react-native-deps group by @dependabot[bot] in lucide-icons/lucide#5030

feat(icons): added line-height icon by @madebyoz in lucide-icons/lucide#3039

chore(deps-dev): bump the svelte-deps group across 1 directory with 2 updates by @dependabot[bot] in lucide-icons/lucide#5028

chore(deps): bump the react-deps group across 1 directory with 2 updates by @dependabot[bot] in lucide-icons/lucide#5026

... (truncated)

Commits

6657faa chore(deps-dev): bump vite from 8.3.2 to 8.3.3 (#5052)
1802f33 feat(lucide-react): add package exports for per-icon imports without changing...
20aef31 chore(packages): Update sponsors (#5034)
fa238cf chore(deps): bump the react-deps group across 1 directory with 2 updates (#5026)
See full diff in compare view

Updates mime from 4.1.1 to 4.1.2

Release notes

Sourced from mime's releases.

v4.1.2

4.1.2 (2026-10-27)

Bug Fixes

isolate getAllExtensions results (#370) (44d3041)

Changelog

Sourced from mime's changelog.

4.1.2 (2026-10-27)

Bug Fixes

isolate getAllExtensions results (#370) (44d3041)

Commits

f2e2240 chore(main): release 4.1.2 (#371)
44d3041 fix: isolate getAllExtensions results (#370)
88d3086 chore: workflow for manual release
See full diff in compare view

Updates resend from 6.33.0 to 6.35.0

Release notes

Sourced from resend's releases.

v6.35.0

What's Changed

fix: make API error logging opt-in via RESEND_DEBUG by @dielduarte in resend/resend-node#1170

Full Changelog: resend/resend-node@v6.34.1...v6.35.0

v6.34.1

What's Changed

fix(inboxes): match the search and update draft types to the API by @felipefreitag in resend/resend-node#1165

Full Changelog: resend/resend-node@v6.34.0...v6.34.1

v6.34.0

What's Changed

fix(inboxes): accept plain strings for inbox label colors by @LauraBeatris in resend/resend-node#1155

feat(inboxes): type the inbox agent tone as one of the presets by @LauraBeatris in resend/resend-node#1157

fix(batch): avoid mutating the payload when rendering react emails by @jxnnyo in resend/resend-node#1136

fix(templates): preserve error response headers in publish chains by @claygeo in resend/resend-node#1135

fix: reject dot segments in request paths by @max-programming in resend/resend-node#1139

feat(inboxes): type created_at and updated_at on list and get inbox by @LauraBeatris in resend/resend-node#1160

feat(inboxes): add label endpoints, rename fields & accept email addresses by @isabellaaquino in resend/resend-node#1164

New Contributors

@jxnnyo made their first contribution in resend/resend-node#1136

@claygeo made their first contribution in resend/resend-node#1135

@max-programming made their first contribution in resend/resend-node#1139

Full Changelog: resend/resend-node@v6.33.0...v6.34.0

Commits

9285f59 fix: make API error logging opt-in via RESEND_DEBUG (#1170)
7943103 fix(inboxes): match the search and update draft types to the API (#1165)
2e3bb06 feat(inboxes): add label endpoints, rename fields & accept email addresses (#...
9edd6ed feat(inboxes): type created_at and updated_at on list and get inbox (#1160)
f765894 fix: reject dot segments in request paths (#1139)
10d66ce fix(templates): preserve error response headers in publish chains (#1135)
022286e fix(batch): avoid mutating the payload when rendering react emails (#1136)
13c7086 feat(inboxes): type the inbox agent tone as one of the presets (#1157)
e6dff37 fix(inboxes): accept plain strings for inbox label colors (#1155)
See full diff in compare view

Updates unist-util-visit from 5.1.0 to 5.2.0

Release notes

Sourced from unist-util-visit's releases.

5.2.0...
Description has been truncated

…tory with 16 updates Bumps the production-minor-and-patch group with 16 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@openclaw/krillswitch-react](https://github.com/openclaw/krillswitch/tree/HEAD/packages/react) | `0.0.1` | `0.0.2` | | [@openclaw/plugin-inspector](https://github.com/openclaw/plugin-inspector) | `0.4.3` | `0.4.5` | | [@react-email/render](https://github.com/resend/react-email/tree/HEAD/packages/render) | `2.1.0` | `2.1.1` | | [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.44` | `1.170.46` | | [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.169.2` | `1.169.4` | | [convex](https://github.com/convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.46.0` | `1.48.0` | | [convex-helpers](https://github.com/convex/convex-helpers) | `0.1.128` | `0.1.129` | | [h3](https://github.com/h3js/h3) | `2.0.2` | `2.0.8` | | [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.12` | `7.0.14` | | [jose](https://github.com/panva/jose) | `6.2.12` | `6.2.13` | | [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.57.0` | `1.62.0` | | [mime](https://github.com/broofa/mime) | `4.1.1` | `4.1.2` | | [resend](https://github.com/resend/resend-node) | `6.33.0` | `6.35.0` | | [unist-util-visit](https://github.com/syntax-tree/unist-util-visit) | `5.1.0` | `5.2.0` | | [undici](https://github.com/nodejs/undici) | `7.30.0` | `7.30.1` | | [arktype](https://github.com/arktypeio/arktype/tree/HEAD/ark/type) | `2.2.8` | `2.2.9` | Updates `@openclaw/krillswitch-react` from 0.0.1 to 0.0.2 - [Release notes](https://github.com/openclaw/krillswitch/releases) - [Changelog](https://github.com/openclaw/krillswitch/blob/main/CHANGELOG.md) - [Commits](https://github.com/openclaw/krillswitch/commits/sdk-v0.0.2/packages/react) Updates `@openclaw/plugin-inspector` from 0.4.3 to 0.4.5 - [Release notes](https://github.com/openclaw/plugin-inspector/releases) - [Changelog](https://github.com/openclaw/plugin-inspector/blob/main/CHANGELOG.md) - [Commits](openclaw/plugin-inspector@v0.4.3...v0.4.5) Updates `@react-email/render` from 2.1.0 to 2.1.1 - [Release notes](https://github.com/resend/react-email/releases) - [Changelog](https://github.com/resend/react-email/blob/canary/packages/render/CHANGELOG.md) - [Commits](https://github.com/resend/react-email/commits/@react-email/render@2.1.1/packages/render) Updates `@tanstack/react-router` from 1.170.44 to 1.170.46 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.46/packages/react-router) Updates `@tanstack/react-start` from 1.169.2 to 1.169.4 - [Release notes](https://github.com/TanStack/router/releases) - [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md) - [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.169.4/packages/react-start) Updates `convex` from 1.46.0 to 1.48.0 - [Release notes](https://github.com/convex/convex-backend/releases) - [Changelog](https://github.com/convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md) - [Commits](https://github.com/convex/convex-backend/commits/HEAD/npm-packages/convex) Updates `convex-helpers` from 0.1.128 to 0.1.129 - [Changelog](https://github.com/convex/convex-helpers/blob/main/CHANGELOG.md) - [Commits](convex/convex-helpers@npm/0.1.128...npm/0.1.129) Updates `h3` from 2.0.2 to 2.0.8 - [Release notes](https://github.com/h3js/h3/releases) - [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md) - [Commits](h3js/h3@v2.0.2...v2.0.8) Updates `ignore` from 7.0.12 to 7.0.14 - [Release notes](https://github.com/kaelzhang/node-ignore/releases) - [Commits](kaelzhang/node-ignore@7.0.12...7.0.14) Updates `jose` from 6.2.12 to 6.2.13 - [Release notes](https://github.com/panva/jose/releases) - [Changelog](https://github.com/panva/jose/blob/main/CHANGELOG.md) - [Commits](panva/jose@v6.2.12...v6.2.13) Updates `lucide-react` from 1.57.0 to 1.62.0 - [Release notes](https://github.com/lucide-icons/lucide/releases) - [Commits](https://github.com/lucide-icons/lucide/commits/1.62.0/packages/lucide-react) Updates `mime` from 4.1.1 to 4.1.2 - [Release notes](https://github.com/broofa/mime/releases) - [Changelog](https://github.com/broofa/mime/blob/main/CHANGELOG.md) - [Commits](broofa/mime@v4.1.1...v4.1.2) Updates `resend` from 6.33.0 to 6.35.0 - [Release notes](https://github.com/resend/resend-node/releases) - [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md) - [Commits](resend/resend-node@v6.33.0...v6.35.0) Updates `unist-util-visit` from 5.1.0 to 5.2.0 - [Release notes](https://github.com/syntax-tree/unist-util-visit/releases) - [Commits](syntax-tree/unist-util-visit@5.1.0...5.2.0) Updates `undici` from 7.30.0 to 7.30.1 - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v7.30.0...v7.30.1) Updates `arktype` from 2.2.8 to 2.2.9 - [Release notes](https://github.com/arktypeio/arktype/releases) - [Changelog](https://github.com/arktypeio/arktype/blob/main/ark/type/CHANGELOG.md) - [Commits](https://github.com/arktypeio/arktype/commits/arktype@2.2.9/ark/type) --- updated-dependencies: - dependency-name: "@openclaw/krillswitch-react" dependency-version: 0.0.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@openclaw/plugin-inspector" dependency-version: 0.4.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@react-email/render" dependency-version: 2.1.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@tanstack/react-router" dependency-version: 1.170.46 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: "@tanstack/react-start" dependency-version: 1.169.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: convex dependency-version: 1.48.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: convex-helpers dependency-version: 0.1.129 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: h3 dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: ignore dependency-version: 7.0.14 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: jose dependency-version: 6.2.13 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: lucide-react dependency-version: 1.62.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: mime dependency-version: 4.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: resend dependency-version: 6.35.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: unist-util-visit dependency-version: 5.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-minor-and-patch - dependency-name: undici dependency-version: 7.30.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch - dependency-name: arktype dependency-version: 2.2.9 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-10-30T16:06:17Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 30, 2026 4:08pm UTC

clawsweeper · 2026-10-30T16:06:20Z

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

clawsweeper · 2026-10-30T16:21:36Z

Codex review: needs maintainer review before merge.

What this changes

This PR updates 16 dependencies across the app and workspace packages, together with their lockfile resolutions.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The scoped refresh has strong automated validation and no identified defect; independent runtime evidence for the dependency-specific changes remains limited.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the ordinary contributor proof gate; exact-head CI exercises browser and CLI entry points, but the unrelated sorting screenshot and preview deployment status do not independently demonstrate the updated dependency behavior.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Consumers remain on dependency versions preceding upstream compatibility, diagnostic, and reliability fixes.
Reason: This follows established compatible dependency maintenance, preserves existing application defaults and supported runtime lines, and adds no public configuration or API.

Merge readiness

✅ Ready for maintainer review

Keep open: these dependency updates are absent from current main and remain useful maintenance work. No blocking findings were identified, and the exact-head static, unit, package, build, HTTP, browser, and old-CLI compatibility checks passed.

Priority: P3
Reviewed head: 804508dcdb27c03726bcfc8e3806a98e35b916e8

Before merge

None.

Findings

None.

Agent review details

How this fits together

The workspace manifests and Bun lockfile select libraries consumed by the website, Convex backend, public CLI, admin CLI, and shared validators.

flowchart TD
  A[Workspace manifests] --> B[Bun lockfile]
  B --> C[Website runtime]
  B --> D[Convex backend]
  B --> E[Public and admin CLIs]
  B --> F[Shared validators]

Technical review

Best possible solution:

Adopt the compatible dependency refresh through the existing workspace manifests and lockfile while preserving current runtime contracts.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported ClawHub bug; the pinned diff directly establishes the version changes.

Is this the best way to solve the issue?

Best-fix verdict: best for the stated refresh; updating existing manifests and resolutions avoids redundant adapters or source work, while retaining the older versions would leave the upstream fixes unadopted.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 346c867ad96a.

Provenance checked

Production dependency and workspace pins keeps the original intent (cf3788c: The prior refresh maintained supported dependency lines and security overrides while retaining Undici 7 and the CLI Node floor; local manifest history also traces earlier pins through the merged grouped update.)
Inspector scanner and CLI dependency keeps the original intent (6cc4aea: Adopt Inspector 0.4.3 to preserve Windows entrypoint and referenced-declaration inventories across scanner and CLI consumers.)
Krill feature flag dependency keeps the original intent (1643653: Use the official SDK for an opt-in, presentation-only homepage flag with hydration-safe defaults and bounded fail-open server evaluation.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

Pinned change and current-main comparison: The introduced diff changes only bun.lock and four package manifests; current main retains Inspector 0.4.3, Krill React 0.0.1, Convex 1.46.0, and the other older versions. (package.json:107, 804508dcdb27)
Exact-head validation: GitHub reports successful static, unit, packages, types-build, e2e-http, playwright-smoke, and all local-auth shards, including old-cli-publish and inspector-version, for the reviewed head. The cancelled auto-response check has a successful replacement. (.github/workflows/ci.yml:124, 804508dcdb27)
Supported dependency lines preserved: The earlier refresh deliberately retained Undici 7 and the CLI Node support floor; this PR preserves both, as well as existing security overrides and the Workpool patch. (packages/clawhub/package.json:52, cf3788c9f718)
Existing publication memory boundary preserved: The repair in fix: large plugin publishes run out of memory in the Plugin Inspector gate #3990 keeps artifact inventories out of publication and leaves them to daily scans; the dependency-only diff preserves that owner and its execution-disabled options. (convex/packageInspectorNode.ts:143, 346c867ad96a)
Consumed upstream implementation and policy: ClawHub imports pluginRoot.runCheck in its CLI and publication action, establishing the dependency contract. The 0.4.3-to-0.4.5 source comparison adds qualified retirement advice, bounded failure diagnostics, hook-registry support, and reduced source-host type traversal without removing the consumed exports; upstream policy preserves stable report fields and offline default checks. (src/openclaw-target.js, 8ec7d359fd78)
Consumed SDK contract: ClawHub directly imports the React and server SDK exports and names the SDK as the owner of evaluation and hydration. The reviewed SDK changes preserve those exports, correct inherited-property handling, and refresh optional streams after reconnect; core and React versions remain synchronized. (packages/react/src/krillswitch.tsx, 6eb82bab1edf)

Likely related people:

Peter Steinberger: Raw commit c3b6995 adds package.json:200 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c3b69959a750; files: package.json)

Review metrics

Metric	Value	Why it matters
Change scope	+115/-93 across 5 files; 0 application-source or test edits	Growth is confined to dependency manifests and generated resolutions, with no added production machinery.

Labels

Label changes:

add P3: Routine compatible dependency maintenance with no demonstrated urgent user-facing regression.
add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

P3: Routine compatible dependency maintenance with no demonstrated urgent user-facing regression.
rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 30, 2026, 12:20 PM ET / 16:20 UTC.

dependabot · 2026-11-02T14:07:21Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added the dependencies Pull requests that update a dependency file label Oct 30, 2026

dependabot Bot added the javascript Pull requests that update javascript code label Oct 30, 2026

openclaw-barnacle Bot added the needs-cli-release Requires a ClawHub CLI npm release after merge. label Oct 30, 2026

vercel Bot deployed to Preview – clawhub October 30, 2026 16:08

View deployment

dependabot Bot closed this Nov 2, 2026

dependabot Bot deleted the dependabot/bun/production-minor-and-patch-ed7d0d6dff branch November 2, 2026 14:07

Navigation Menu

Repository navigation

chore(deps): bump the production-minor-and-patch group across 1 directory with 16 updates - #4153

chore(deps): bump the production-minor-and-patch group across 1 directory with 16 updates#4153
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-ed7d0d6dff

dependabot Bot commented on behalf of github Oct 30, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented Oct 30, 2026

How this fits together

Technical review

Provenance checked

Testing

Security

Evidence

Review metrics

Labels

Rating scale

Workflow

Uh oh!

dependabot Bot commented on behalf of github Nov 2, 2026

Uh oh!

This branch was successfully deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Krillswitch SDK v0.0.2

Verified distribution

plugin-inspector v0.4.5

plugin-inspector v0.4.4

Package and verification

0.4.5 - 2026-10-26

0.4.4 - 2026-10-20

@​react-email/render@​2.1.1

Patch Changes

2.1.1

Patch Changes

@​tanstack/react-router@​1.170.46

Patch Changes

@​tanstack/react-router@​1.170.45

Patch Changes

1.170.46

Patch Changes

1.170.45

Patch Changes

@​tanstack/react-start@​1.169.4

Patch Changes

@​tanstack/react-start@​1.169.3

Patch Changes

1.169.4

Patch Changes

1.169.3

Patch Changes

1.48.0

1.47.0

0.1.129

v2.0.8

🩹 Fixes

v2.0.7

🩹 Fixes

v2.0.6

🩹 Fixes

v2.0.5

🩹 Fixes

v2.0.4

📦 Build

🏡 Chore

v2.0.3

🩹 Fixes

v2.0.8

🩹 Fixes

❤️ Contributors

v2.0.7

🩹 Fixes

❤️ Contributors

v2.0.6

🩹 Fixes

❤️ Contributors

v2.0.5

🩹 Fixes

❤️ Contributors

v6.2.13

Refactor

6.2.13 (2026-10-20)

Refactor

Version 1.62.0

What's Changed

New Contributors

Version 1.61.0

What's Changed

New Contributors

Version 1.60.0

What's Changed

v4.1.2

4.1.2 (2026-10-27)

Bug Fixes

4.1.2 (2026-10-27)

Bug Fixes

v6.35.0

What's Changed

v6.34.1

What's Changed

v6.34.0

dependabot Bot commented on behalf of github Oct 30, 2026 •

edited

Loading

`@react-email/render@2`.1.1

`@tanstack/react-router@1`.170.46

`@tanstack/react-router@1`.170.45

`@tanstack/react-start@1`.169.4

`@tanstack/react-start@1`.169.3

5.2.0...
Description has been truncated

vercel Bot commented Oct 30, 2026 •

edited

Loading

clawsweeper Bot commented Oct 30, 2026 •

edited

Loading