[dependabot]

Update oxfmt to 0.73, oxlint to 1.88, and the maintained pnpm line to 11.28.2. Align the other development dependency ranges with the already-tested lockfile versions, preserving the two-day release cooldown and supported Node.js floors.

A full dependency audit also reproduced GHSA-68fv-2mgg-jv7q in source-map-js 1.2.1 through PostCSS. Refresh that transitive dependency to 1.2.2; the final audit reports no known vulnerabilities.

The release workflow previously supported tag pushes only. Add a main-only manual dry run that validates the current package version and runs the complete release check. Manual runs cannot publish; protected version-tag pushes retain the existing publication path. The package version remains 0.3.9.

Validation: pnpm install --frozen-lockfile, pnpm run check:release (140 unit tests, nine browser tests, build, format, typecheck, lint and package checks), and pnpm audit pass on a Linux Crabbox lease. Coverage passed (84.84% statements, 85.36% lines). Workflow actionlint and independent P0–P3 autoreview also pass. The lease was stopped after validation.

Includes the formatter/linter update from @dependabot[bot].

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR upgrades oxfmt from 0.72.0 to 0.73.0 and locked oxlint from 1.87.0 to 1.88.0.

Example: A contributor installs dependencies with the committed lockfile.

• Before: Formatting uses oxfmt 0.72.0 and linting uses oxlint 1.87.0.
• After: Formatting uses oxfmt 0.73.0 and linting uses oxlint 1.88.0.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused dependency maintenance with successful validation and one minor repository-policy finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored development dependency update is outside the ordinary contributor proof gate; existing CI validation supports compatibility without being claimed as live behavioral proof.
Patch quality	🐚 platinum hermit (4/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors use older formatter and linter releases despite newer maintenance releases being available.
Reason: The update follows the existing grouped dependency policy and preserves the established toolchain boundaries.

Merge readiness

⛔ Needs changes before merge - 1 item remains

This PR updates tooling still older on main; the dependency changes look sound, with one small changelog-policy fix before merge.

Priority: P3
Reviewed head: e5b65ac11ad1af25d02a0abea45ae0de9912f2ea

Before merge

• [P3] Document the tooling upgrade under Unreleased (P3) - The formatter and linter versions used by contributor and CI commands change, but CHANGELOG.md still records only the previous oxfmt 0.72/oxlint 1.87 refresh. AGENTS.md lines 68–69 require an Unreleased entry for operational changes. Add a short entry naming oxfmt 0.73.0 and oxlint 1.88.0 so the documented toolchain changes match this upgrade.

Findings

• [P3] [P3] Document the tooling upgrade under Unreleased — package.json:97

Agent review details

How this fits together

The development toolchain consumes repository files through formatter and linter CLIs and produces formatting and diagnostic results.

flowchart LR
  A[Package manifest] --> C[pnpm installation]
  B[Dependency lockfile] --> C
  C --> D[oxfmt and oxlint]
  E[Repository files] --> D
  D --> F[Formatting and lint results]

Loading

Technical review

Best possible solution:

Land the focused tooling upgrade with a short Unreleased changelog entry.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a bug report; the pinned diff establishes the exact version changes.

Is this the best way to solve the issue?

Updating the existing dependencies and lockfile is appropriately scoped and preserves the repository's runtime floors, pnpm version, and dependency cooldown.

Full review comments:

• [P3] [P3] Document the tooling upgrade under Unreleased — package.json:97
  The formatter and linter versions used by contributor and CI commands change, but CHANGELOG.md still records only the previous oxfmt 0.72/oxlint 1.87 refresh. AGENTS.md lines 68–69 require an Unreleased entry for operational changes. Add a short entry naming oxfmt 0.73.0 and oxlint 1.88.0 so the documented toolchain changes match this upgrade.
  Confidence: 0.9

Overall correctness: patch is correct
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against eb48e7089aac.

Provenance checked

• Formatter and linter dependency baseline keeps the original intent (d029be0: The previous refresh updated formatting and lint tooling while retaining runtime support, pnpm 11, and the two-day cooldown.)

Security

None.

Evidence

Acceptance criteria:

• pnpm run format:check
• git diff --check

What I checked:

• Pinned change and main baseline: The introduced diff changes only package.json and pnpm-lock.yaml; main retains oxfmt 0.72.0 and locked oxlint 1.87.0. (package.json:97, e5b65ac11ad1)
• Applicable changelog policy: AGENTS.md requires an Unreleased entry for operational changes; CHANGELOG.md documents the previous formatter/linter refresh but this PR adds no entry for the new versions. (AGENTS.md:68, e5b65ac11ad1)
• Validation of the reviewed revision: All 13 check runs succeeded for the reviewed head, including seven platform/runtime checks executing pnpm check and the browser smoke job. (.github/workflows/ci.yml:77, e5b65ac11ad1)
• Toolchain history and prior intent: Feature-history searches and main blame identify Peter Steinberger's repeated toolchain refreshes and Vincent Koc's validation work. The prior refresh at build(deps): refresh formatter, lint, and Node setup #103 preserved runtime floors, pnpm 11, and the dependency cooldown. Historical git show --stat encountered unavailable objects; current blobs, scoped history searches, blame, and the prior PR remained readable. (package.json:97, eb48e7089aac)
• Complete discussion and body identity: The omitted body remainder and both comments were read through REST; they contain dependency notes and review-status messages, without additional behavioral proof or owner decisions. The fetched body matches supplied SHA-256 514f3923d728dda2f744c25a38f62e0fdef04ee2aca164636400d52f2623e8c8. (e5b65ac11ad1)
• Upstream package compatibility: The repository executes these packages through its formatting and lint scripts. Tagged upstream manifests retain compatible Node engines and the existing executable names; oxlint accepts the locked oxlint-tsgolint 7.0.2004, and oxfmt's added Astro compiler peer is optional. (npm/oxfmt/package.json, 6941b4ed45ea)

Likely related people:

• Vincent Koc: Raw commit 412f2fc adds package.json:70 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: 412f2fc8ea33; files: package.json)

Labels

Label changes:

• add P3: Routine development-tool maintenance with passing validation and a small documentation omission.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P3: Routine development-tool maintenance with passing validation and a small documentation omission.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 15, 2026, 1:29 PM ET / 17:29 UTC.