build(deps): refresh tooling and patch source-map-js

.github/workflows/ci.yml

@@ -52,7 +52,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          version: 11.28.0
+          version: 11.28.2
           run_install: false
 
       - name: Set up Node
@@ -83,7 +83,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          version: 11.28.0
+          version: 11.28.2
           run_install: false
 
       - name: Set up Node

.github/workflows/release.yml

@@ -4,6 +4,17 @@ on:
   push:
     tags:
       - "v*.*.*"
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: Validate the release without publishing
+        type: boolean
+        required: true
+        default: true
+      version:
+        description: Current package version to validate
+        type: string
+        required: true
 
 permissions:
   contents: read
@@ -17,8 +28,8 @@ env:
 
 jobs:
   publish:
-    name: Publish @openclaw/libterminal
-    if: github.ref_protected
+    name: Validate or publish @openclaw/libterminal
+    if: (github.event_name == 'push' && github.ref_protected) || (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main' && inputs.dry_run)
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
@@ -33,7 +44,7 @@ jobs:
       - name: Set up pnpm
         uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
-          version: 11.28.0
+          version: 11.28.2
           run_install: false
 
       - name: Set up Node
@@ -85,6 +96,7 @@ jobs:
           NODE
 
       - name: Validate release tag
+        if: github.event_name == 'push'
         env:
           RELEASE_SHA: ${{ github.sha }}
           RELEASE_TAG: ${{ github.ref_name }}
@@ -110,7 +122,21 @@ jobs:
           execFileSync("git", ["merge-base", "--is-ancestor", releaseSha, "origin/main"]);
           NODE
 
+      - name: Validate dry-run version
+        if: github.event_name == 'workflow_dispatch'
+        env:
+          EXPECTED_VERSION: ${{ inputs.version }}
+        run: |
+          node <<'NODE'
+          const { readFileSync } = require("node:fs");
+          const pkg = JSON.parse(readFileSync("package.json", "utf8"));
+          if (process.env.EXPECTED_VERSION !== pkg.version) {
+            throw new Error(`dry-run version must match package version ${pkg.version}`);
+          }
+          NODE
+
       - name: Ensure version is unpublished
+        if: github.event_name == 'push'
         run: |
           set -euo pipefail
           package_name="$(node -p "require('./package.json').name")"
@@ -135,4 +161,5 @@ jobs:
         run: pnpm run check:release
 
       - name: Publish with npm trusted publishing
+        if: github.event_name == 'push'
         run: npm publish --access public --provenance

CHANGELOG.md

@@ -4,8 +4,13 @@ All notable changes to `@openclaw/libterminal` will be documented in this file.
 
 ## 0.3.10 - Unreleased
 
+### Fixed
+
+- Update the test toolchain's transitive source-map-js dependency to 1.2.2 to fix the indexed source-map denial-of-service advisory GHSA-68fv-2mgg-jv7q.
+
 ### Changed
 
+- Update oxfmt to 0.73, oxlint to 1.88, and pnpm to the stable 11.28.2 patch, align dependency ranges with the lockfile, and add a safe manual release check for validating tooling updates without publishing. (thanks @dependabot[bot])
 - Update the GitHub App token action to 3.3.0 while preserving repository-scoped dispatch and comment permissions. (#106, thanks @dependabot[bot])
 - Update the pinned CodeQL initialization and analysis actions to 4.38.3 and the default scanner bundle to 2.27.2. (#105, thanks @dependabot[bot])
 - Update oxfmt to 0.72, oxlint to 1.87, and actions/setup-node to 7.1 while preserving the dependency cooldown and supported runtime floors. (thanks @dependabot[bot])

CONTRIBUTING.md

@@ -89,3 +89,9 @@ terminal output.
 
 Maintainers publish from a `vX.Y.Z` tag on `main` through the trusted-publishing
 workflow. Do not publish from a local machine or add an npm automation token.
+
+After changing release dependencies or tooling, run the Release workflow on
+`main` with `dry_run: true` and `version` set to the current package version.
+This validates metadata and runs the full release check without publishing.
+Manual runs require dry-run mode; publishing remains restricted to protected
+version tags.

package.json

@@ -88,18 +88,18 @@
     "ghostty-web": "0.4.0"
   },
   "devDependencies": {
-    "@playwright/test": "^1.63.0",
-    "@types/node": "^26.6.4",
+    "@playwright/test": "^1.64.0",
+    "@types/node": "^26.6.5",
     "@types/ws": "^8.18.2",
     "@typescript/native": "npm:typescript@^7.0.2",
-    "@vitest/coverage-v8": "^5.0.3",
+    "@vitest/coverage-v8": "^5.0.4",
     "node-pty": "^1.1.0",
-    "oxfmt": "^0.72.0",
-    "oxlint": "^1.86.0",
-    "oxlint-tsgolint": "^7.0.2003",
-    "tsdown": "^0.23.0",
+    "oxfmt": "^0.73.0",
+    "oxlint": "^1.88.0",
+    "oxlint-tsgolint": "^7.0.2004",
+    "tsdown": "^0.23.1",
     "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^5.0.3",
+    "vitest": "^5.0.4",
     "ws": "^8.22.0"
   },
   "peerDependencies": {
@@ -113,5 +113,5 @@
   "engines": {
     "node": "^22.18.0 || >=24.11.0"
   },
-  "packageManager": "pnpm@11.28.0"
+  "packageManager": "pnpm@11.28.2"
 }