build(deps-dev): bump the development group with 3 updates

[dependabot]

Bumps the development group with 3 updates: oxfmt, oxlint and tsdown.

Updates oxfmt from 0.70.0 to 0.71.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.71.0

🚀 Features

• e0b1f9f oxfmt: Bump bundled Prettier version to 3.9.9 (#27002) (leaysgur)
• 342527d oxfmt: Bump bundled Prettier version to 3.9.8 (#26999) (leaysgur)

🐛 Bug Fixes

• eeba1db formatter: Skip test-call layout when arguments have comments (#27119) (leaysgur)
• 1f7b8ad oxfmt: Allow repeated CLI calls in the same process (#27051) (Liang)
• 7bcb807 formatter_markdown: Keep blank line between HTML and nested list (#27112) (leaysgur)
• 10b10c5 formatter: Keep comments around = on their side and line (#27041) (leaysgur)
• 9aad365 formatter: Keep comments deferred before an assignment operator (#26997) (waltu)
• 8fbddb1 formatter/jsdoc: More alignment with original plugin (#27039) (leaysgur)
• 50be18e formatter: Keep trailing spaces on normal block comments (#27037) (leaysgur)
• 56d1880 formatter: Nestle adjacent block comments (#27036) (leaysgur)
• 3be5d94 formatter: Treat /*** comments as JSDoc (#27035) (leaysgur)
• cd45f71 formatter: Keep trailing double spaces on JSDoc lines (#26861) (John Costa)
• fd695f4 formatter_markdown: Fix more mismatches found in ecosystem-ci repos (#27003) (leaysgur)
• 4e77d59 formatter_markdown: Keep a math span after a kept line break from opening a block (#27001) (leaysgur)
• 584b8b0 formatter_markdown: Keep a shape line after a multi-line inline node or link title (#27000) (leaysgur)
• b939645 formatter_markdown: Keep a line break before an inline liquid tag under preserve (#26998) (leaysgur)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• f158bff chore(deps): update npm packages (#26865)
• See full diff in compare view

Updates oxlint from 1.85.0 to 1.86.0

Release notes

Sourced from oxlint's releases.

oxlint v1.86.0

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

🐛 Bug Fixes

• 8306aa4 linter/typescript/no-unnecessary-parameter-property-assignment: Account for parameter property reassignment (#26955) (camc314)
• 42dfbb5 linter/eslint/one-var: Keep declare when splitting declarations (#27081) (Cheolhee Lee)
• 2ba7e33 linter/eslint/require-await: Count await using as an await (#27080) (Cheolhee Lee)
• 611e4ed linter/plugins: Include executing selectors in JS plugin rule timings (#27111) (overlookmotel)
• 2cac66f react-compiler: Handle recursive function expressions (#26796) (Brennan Butler)
• e996e6c react-compiler: Treat zero-argument new Date as impure (#26894) (Boshen)
• 571cfa3 oxlint: Skip type-aware lint rules in type-check-only mode (#27076) (camc314)
• d0b2462 oxlint: Skip undefined children in CFG walker (#27075) (camc314)
• 5186328 parser: Handle HTML comment values (#22933) (Boshen)
• 0b630e8 linter/typescript/unified-signatures: Align rule with upstream (#26956) (camc314)
• ebb22f1 linter/node/no-exports-assign: Change category from style to suspicious (#26555) (Bartok)
• cce28a0 linter/import/no-duplicates: Distinguish import attributes (#26936) (camc314)
• feb733b linter/unicorn/prefer-spread: Stop checking string split calls (#26935) (camc314)
• 929e154 linter/eslint/no-unused-vars: Honor ignore patterns inside array rest bindings (#26923) (camc314)
• 5bdb9b8 linter/eslint/no-unused-vars: Recognize consumed update expressions (#26782) (camc314)
• 5c05bef linter/eslint/prefer-const: Ignore embedded assignments (#26920) (camc314)

⚡ Performance

• ded4c29 linter/eslint/no-unused-vars: Skip sequence checks when absent (#26921) (camc314)

Changelog

Sourced from oxlint's changelog.

[1.86.0] - 2026-09-28

🚀 Features

• 9d80eed linter/react/only-export-components: Support allowCompoundComponents (#27117) (Kuroda Kayn)
• e05b155 linter: Add typescript/no-generated-empty-object-type (#26958) (camc314)

[1.82.0] - 2026-09-07

🚀 Features

• 6a0e19c linter/eslint/no-unmodified-loop-condition: Support checkConditionalExpressions option (#26249) (camc314)

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

... (truncated)

Commits

• 2ae2939 release(apps): oxlint v1.86.0 && oxfmt v0.71.0 (#27132)
• 9d80eed feat(linter/react/only-export-components): support allowCompoundComponents ...
• e05b155 feat(linter): add typescript/no-generated-empty-object-type (#26958)
• 88a0096 chore(oxlint): require tsgolint 7.0.2003 (#27021)
• See full diff in compare view

Updates tsdown from 0.22.14 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in rolldown/tsdown#1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)

... (truncated)

Commits

• ced9a2c chore: release v0.23.0
• f5f9ea9 docs: add Ember support guide (#1043)
• 8ac89dc chore: upgrade Vitest to v5
• 96a4098 feat: expose programmatic watch controls (#1062)
• 61718d7 chore: upgrade deps
• d04119c chore: upgrade deps
• 55f89c5 chore(deps): update pnpm to v12.1.0 (#1060)
• 946224d fix: ignore optional dependencies in type definitions
• 62f01cd chore: release v0.23.0-rc.1
• bf53f43 fix(cli): camel-case nested flag keys
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 1, 2026, 8:04 AM ET / 12:04 UTC (Revision 2).

ClawSweeper review

What this changes

Updates the development formatter, linter, and bundler versions and refreshes their transitive dependencies in the pnpm lockfile.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

The updates are still distinct from main, but the bundler upgrade breaks supported Node 25 development installs and contradicts the previously merged compatibility decision.

Priority: P2
Reviewed head: 2c43316892dd138fdd2b75943c0a61a6655ead93

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The scoped tooling refresh has useful validation but retains a concrete supported-install regression.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot-authored tooling updates are exempt from contributor runtime proof; the passing build and package-import checks are supplemental validation and do not cover Node 25 installation. No stored-data contract changes.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot-authored tooling updates are exempt from contributor runtime proof; the passing build and package-import checks are supplemental validation and do not cover Node 25 installation. No stored-data contract changes.
Evidence reviewed	9 items	Introduced dependency upgrade: The pinned main-to-head diff changes oxfmt to ^0.71.0 and tsdown to ^0.23.0; the lockfile resolves oxlint 1.86.0. Main still retains the earlier versions, so the complete update is not already implemented. Supported installation contract: The package declares Node ^22.18.0 || >=24.11.0, including Node 25. pnpm-workspace.yaml enables engineStrict, and CONTRIBUTING.md explicitly states that dependency engine checks are enforced. Incompatible resolved engines: Both tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 require ^22.18.0 || ^24.11.0 || >=26.0.0, excluding Node 25. The newly resolved mandatory development dependencies therefore conflict with the enforced installation contract.
Findings	1 actionable finding	[P1] [P1] Preserve the Node 25-compatible bundler dependency graph
Security	None	None.

How this fits together

The router package's development tools format and lint source, then build JavaScript and TypeScript declarations. Package validation checks the resulting archive and imports it as a consumer would.

flowchart TD
  A[Source and package metadata] --> B[Development dependencies]
  B --> C[Node engine validation]
  C --> D[Format and lint]
  C --> E[Build JavaScript and declarations]
  E --> F[Package and import validation]

Loading

Before merge

• [P1] Preserve the Node 25-compatible bundler dependency graph (P1) - On Node 25, pnpm install --frozen-lockfile rejects tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 because their engines exclude Node 25 and pnpm-workspace.yaml enables engineStrict. The package still declares support for Node 25, and build(deps): refresh compatible tooling and CodeQL #42 explicitly retained tsdown 0.22.14 for this reason. Restore that compatible graph while keeping the formatter/linter updates. This concern was missed in the earlier review; the relevant dependency and strict-engine settings are unchanged.
• Resolve merge risk (P1) - Merging the bundler update makes frozen development installs fail on supported Node 25; passing Node 22/24 CI does not cover that failure.
• Complete next step (P2) - Restore the Node 25-compatible bundler dependency graph and validate supported development installs before merge.

Findings

• [P1] [P1] Preserve the Node 25-compatible bundler dependency graph — package.json:57

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Installation validation	6 passing Node 22/24 combinations; 0 Node 25 combinations	The existing matrix omits the supported Node version excluded by the upgraded bundler.

Merge-risk options

Maintainer options:

1. Retain the compatible bundler (recommended)
   Restore tsdown 0.22.14 and its main-branch dependency graph, retaining the formatter and linter updates.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Restore tsdown ^0.22.14 and its compatible main-branch transitive dependency graph while preserving the oxfmt and oxlint updates; verify frozen installation and the full package check on Node 25 as well as the existing Node 22/24 matrix.

Technical review

Best possible solution:

Preserve the established Node 25 installation contract while landing compatible formatter and linter updates.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: a frozen pnpm install on Node 25 encounters mandatory dependencies whose engine ranges exclude it while engineStrict is enabled. This review did not execute that installation.

Is this the best way to solve the issue?

No. Retaining the already approved compatible bundler graph is the narrow repair; changing the supported Node range would require a separate explicit compatibility decision.

Full review comments:

• [P1] [P1] Preserve the Node 25-compatible bundler dependency graph — package.json:57
  On Node 25, pnpm install --frozen-lockfile rejects tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 because their engines exclude Node 25 and pnpm-workspace.yaml enables engineStrict. The package still declares support for Node 25, and build(deps): refresh compatible tooling and CodeQL #42 explicitly retained tsdown 0.22.14 for this reason. Restore that compatible graph while keeping the formatter/linter updates. This concern was missed in the earlier review; the relevant dependency and strict-engine settings are unchanged.
  Confidence: 0.99
  Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against cd289d3d3d30.

Labels

Label changes:

• add P2: This routine tooling update introduces a bounded development-install compatibility failure.
• add merge-risk: 🚨 compatibility: The upgraded bundler and declaration generator exclude Node 25 despite the repository's declared and previously validated support.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot-authored tooling updates are exempt from contributor runtime proof; the passing build and package-import checks are supplemental validation and do not cover Node 25 installation. No stored-data contract changes.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.
• remove P3: Current review triage priority is P2, so this older priority label is no longer current.

Label justifications:

• P2: This routine tooling update introduces a bounded development-install compatibility failure.
• merge-risk: 🚨 compatibility: The upgraded bundler and declaration generator exclude Node 25 despite the repository's declared and previously validated support.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot-authored tooling updates are exempt from contributor runtime proof; the passing build and package-import checks are supplemental validation and do not cover Node 25 installation. No stored-data contract changes.

Evidence

Acceptance criteria:

• [P1] pnpm install --frozen-lockfile.
• [P1] pnpm run check.
• [P1] git diff --check.
• [P1] git diff --stat.

What I checked:

• Introduced dependency upgrade: The pinned main-to-head diff changes oxfmt to ^0.71.0 and tsdown to ^0.23.0; the lockfile resolves oxlint 1.86.0. Main still retains the earlier versions, so the complete update is not already implemented. (package.json:57, 2c43316892dd)
• Supported installation contract: The package declares Node ^22.18.0 || >=24.11.0, including Node 25. pnpm-workspace.yaml enables engineStrict, and CONTRIBUTING.md explicitly states that dependency engine checks are enforced. (pnpm-workspace.yaml:1, 2c43316892dd)
• Incompatible resolved engines: Both tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 require ^22.18.0 || ^24.11.0 || >=26.0.0, excluding Node 25. The newly resolved mandatory development dependencies therefore conflict with the enforced installation contract. (pnpm-lock.yaml:1123, 2c43316892dd)
• Prior compatibility decision: Merged build(deps): refresh compatible tooling and CodeQL #42 explicitly retained tsdown 0.22.14 because version 0.23 excludes Node 25 and conflicts with strict dependency checks. It reports successful Node 24 and 25 validation. Merged build(deps): refresh lint tools and restore engine checks #37 independently documents the same boundary. These decisions preserve Node 25; they do not accept its removal. (555a2aa576a6)
• Authoritative dependency contract: The upstream v0.23.0 package metadata confirms the Node engine range excludes Node 25. This contract applies directly because package.json invokes tsdown for build and prepack. (package.json, ced9a2c7f3a7)
• Review continuity: GitHub's comparison against the previously reviewed head shows only the package version changed in package.json; pnpm-lock.yaml and pnpm-workspace.yaml are unchanged. The Node 25 concern was equally visible previously and is acknowledged as a late finding. (package.json:57, 2c43316892dd)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Restore the Node 25-compatible tsdown dependency graph and verify frozen installation plus the full package check on Node 25.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-09-30T19:03:05.935Z sha ce1fbf7 :: needs maintainer review before merge. :: none

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The item is closed; no stale verdict was published.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/36860990137
• Updated: 2026-10-01T12:19:52.840Z

[vincentkoc]

Superseded by #48, which landed the compatible formatter update while retaining the Node 25-compatible tsdown 0.22 graph. Exact-head Node 22/24 CI, Node 25 frozen install/full check/package validation, and ClawSweeper were green.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml