[dependabot]

Bumps the development group with 1 update: tsdown.

Updates tsdown from 0.23.2 to 0.23.3

Release notes

Sourced from tsdown's releases.

v0.23.3

   🐞 Bug Fixes

• Downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support  -  by @​sxzz and @​sxzzbot in rolldown/tsdown#1107 (0344c)

    View changes on GitHub

Commits

• 53638e8 chore: release v0.23.3
• 0344c4f fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Updates the locked tsdown version from 0.23.2 to 0.23.3 and its declaration plugin from 0.29.0-beta.2 to 0.28.8.

Example: A developer installs the repository with pnpm install --frozen-lockfile.

• Before: The build uses tsdown 0.23.2 with rolldown-plugin-dts 0.29.0-beta.2.
• After: The build uses tsdown 0.23.3 with rolldown-plugin-dts 0.28.8.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, apparently correct maintenance update supported by current-head build and browser CI; independent live-behavior evidence is absent and is not required for this bot PR.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the contributor proof gate; passing build and browser CI support compatibility without constituting separate live-behavior proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Build tooling should receive compatible upstream patch corrections without changing the library's public behavior.
Reason: This follows the established automated dependency-maintenance direction, restores the upstream-supported declaration plugin, and introduces no new public API or setting.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the focused dependency update is absent from reviewed main, matches the upstream patch release, and has passing checks with no actionable defect found.

Priority: P3
Reviewed head: 505d6b7059893468e1a8c5c75176a97cd68dd6d5

Before merge

None.

Findings

None.

Agent review details

How this fits together

The development build runs tsdown over TypeScript entry points to produce the JavaScript and declaration files consumed through the package exports.

flowchart LR
  A[pnpm lockfile] --> B[Build tool versions]
  B --> C[tsdown]
  D[TypeScript entry points] --> C
  C --> E[JavaScript bundles]
  C --> F[Type declarations]
  E --> G[Package consumers]
  F --> G

Loading

Technical review

Best possible solution:

Land the focused lockfile update through the normal dependency review workflow.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance; the upstream TypeScript 7.0 failure does not establish a target-repository bug because its declaration build uses TypeScript 6.

Is this the best way to solve the issue?

The generated lockfile update is the smallest appropriate change within the existing dependency range and follows the upstream patch correction.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against ee424e450dd6.

Provenance checked

• tsdown and declaration-plugin lockfile resolution keeps the original intent (7a94649: The prior merged tooling refresh selected tsdown 0.23.2 and compatible transitive dependencies while retaining the dependency cooldown and supported runtime floors; this patch follows the subsequent upstream correction.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Pinned introduced change: The complete introduced diff changes only pnpm-lock.yaml; reviewed main still resolves tsdown 0.23.2, while this PR resolves 0.23.3 within the existing ^0.23.2 range. (pnpm-lock.yaml:44, 505d6b705989)
• Build integration and compatibility: The build executes tsdown with --dts, using the TypeScript 6 alias; the update preserves Node engine ranges, pnpm 11.28.4, runtime dependencies, and dependency build permissions. (package.json:74, 505d6b705989)
• Upstream patch rationale: The verified upstream release and fix: downgrade rolldown-plugin-dts to 0.28 to restore TypeScript 7.0 support rolldown/tsdown#1107 explain the declaration-plugin downgrade as restoring TypeScript 7.0 support; the target executes this dependency, making its build contract relevant, although the target currently supplies TypeScript 6. (pnpm-workspace.yaml, 0344c4fd239b)
• Release cooldown: Version 0.23.3 was published on 2026-10-27, more than two days before this PR was opened, consistent with the target repository's cooldown. (53638e8d1ddf)
• Current-head validation: Checks for the reviewed head include successful Node 22 and 24 checks on Linux, macOS, and Windows, Node 26 on Linux, and Ghostty browser smoke; no failing checks were reported. (.github/workflows/ci.yml, 505d6b705989)
• Prior tooling direction and ownership: build(deps): refresh terminal build and lint tooling #118 introduced tsdown 0.23.2 as a tooling refresh preserving the cooldown and runtime floors; earlier history shows repeated tooling work by Peter Steinberger. (pnpm-lock.yaml:44, 7a94649de488)

Labels

Label changes:

• add P3: This is a development-tool patch update with passing compatibility checks and no demonstrated current user-facing failure.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is a development-tool patch update with passing compatibility checks and no demonstrated current user-facing failure.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 30, 2026, 1:27 PM ET / 17:27 UTC.