build(deps-dev): bump oxlint to 1.86.0

[dependabot]

What Problem This Solves

The grouped development-tool update included tsdown@0.23.0, which explicitly drops Node 25 even though UIRouter declares Node 25 support and uses strict engine checks.

Why This Change Was Made

Keep Dependabot's oxlint@1.86.0 lock refresh while restoring tsdown@0.22.14 and its Node 25-compatible dependency graph. This changes development tooling only; it does not change the router runtime or package output contract.

User Impact

Contributors retain the supported Node 25 development path while receiving the newer linter. No release is required.

Evidence

• Node 25.9.0: pnpm install --frozen-lockfile and pnpm run check passed with tsdown@0.22.14; 58 tests passed.
• Node 22.22.3: forced frozen reinstall and pnpm run check passed; 58 tests passed.
• Node 24.21.0: forced frozen reinstall and pnpm run check passed; 58 tests passed.
• git diff --check passed.
• AutoReview found no P0/P1 issues in the staged candidate.

The pre-fix Node 25 frozen install and full check also completed despite the locked package declaring an incompatible engine range. The repair follows the dependency's explicit engine contract rather than relying on that pnpm enforcement quirk.

ClawSweeper rank-up move addressed: the compatible bundler graph is restored and frozen installation plus the full package check were verified on Node 25.

Dependabot remains credited as the pull request author and co-author of the maintainer repair commit.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 3, 2026, 12:36 AM ET / 04:36 UTC (Revision 6).

ClawSweeper review

What this changes

Updates the locked development linter to oxlint 1.86.0 and refreshes compatible bundler dependencies while retaining tsdown 0.22.14.

Merge readiness

✅ Ready for maintainer review

The prior Node 25 compatibility blocker is resolved, and no actionable defect remains. This PR is still useful because main and the latest release retain oxlint 1.85.0.

Priority: P3
Reviewed head: 03a20ecc5a8ab0bd9e2f56c6a59dddb6fcbd2a48

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused tooling refresh with the prior blocker repaired, compatible dependency metadata, and successful exact-head validation.
Proof confidence	🌊 off-meta tidepool	Not applicable: The ordinary contributor proof gate is exempt for this bot-authored tooling PR. The maintainer reports real frozen installations and full checks on Node 22, 24, and 25, and exact-head CI exercises linting, building, and package import validation; no stored-data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: The ordinary contributor proof gate is exempt for this bot-authored tooling PR. The maintainer reports real frozen installations and full checks on Node 22, 24, and 25, and exact-head CI exercises linting, building, and package import validation; no stored-data contract changes.
Evidence reviewed	9 items	Complete introduced change: The pinned main-to-head diff changes only pnpm-lock.yaml: oxlint becomes 1.86.0; tsdown remains 0.22.14 and rolldown-plugin-dts remains 0.27.14. Bundler transitive updates include rolldown 1.2.11, ansis 4.4.0, and tinyexec 1.3.1. Package requirements, runtime source, workflows, and public exports are unchanged. Prior finding resolved: The repair commit replaces tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 with versions whose engine ranges include Node 25. This addresses the retained finding and rank-up move. The maintainer reports successful frozen installation and the complete package check on Node 25.9.0, with additional Node 22/24 verification: #49 (comment). Current main and release still use older linter: Current main locks oxlint 1.85.0. The latest published release, v0.1.2, also locks 1.85.0, so neither already contains this update. Related merged work preserved Node 25 support but did not perform this linter upgrade.
Findings	None	None.
Security	None	None.

How this fits together

UIRouter’s development tools lint TypeScript source and build the published router package. The lockfile selects the tool versions used by contributor installations and CI.

flowchart TD
  A[Package requirements] --> B[Frozen dependency installation]
  C[Locked tool versions] --> B
  B --> D[TypeScript linting]
  B --> E[Package build]
  D --> F[Quality checks]
  E --> F

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the compatible Node support contract while adopting the verified development-tool refresh.

Do we have a high-confidence way to reproduce the issue?

Not applicable to the remaining dependency refresh; source inspection confirms the prior incompatible engine declarations were removed, and the maintainer reports successful Node 25 installation and checks.

Is this the best way to solve the issue?

Yes. Retaining the compatible bundler versions while refreshing supported tooling preserves the established Node contract without changing router APIs.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 07fab057ebd5.

Labels

Label changes:

• add P3: This is a routine development-tool refresh with the previous compatibility blocker repaired and no router runtime change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor proof gate is exempt for this bot-authored tooling PR. The maintainer reports real frozen installations and full checks on Node 22, 24, and 25, and exact-head CI exercises linting, building, and package import validation; no stored-data contract changes.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.
• remove P2: Current review triage priority is P3, so this older priority label is no longer current.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.

Label justifications:

• P3: This is a routine development-tool refresh with the previous compatibility blocker repaired and no router runtime change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: The ordinary contributor proof gate is exempt for this bot-authored tooling PR. The maintainer reports real frozen installations and full checks on Node 22, 24, and 25, and exact-head CI exercises linting, building, and package import validation; no stored-data contract changes.

Evidence

What I checked:

• Complete introduced change: The pinned main-to-head diff changes only pnpm-lock.yaml: oxlint becomes 1.86.0; tsdown remains 0.22.14 and rolldown-plugin-dts remains 0.27.14. Bundler transitive updates include rolldown 1.2.11, ansis 4.4.0, and tinyexec 1.3.1. Package requirements, runtime source, workflows, and public exports are unchanged. (pnpm-lock.yaml:22, 03a20ecc5a8a)
• Prior finding resolved: The repair commit replaces tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 with versions whose engine ranges include Node 25. This addresses the retained finding and rank-up move. The maintainer reports successful frozen installation and the complete package check on Node 25.9.0, with additional Node 22/24 verification: build(deps-dev): bump oxlint to 1.86.0 #49 (comment). (pnpm-lock.yaml:1118, 03a20ecc5a8a)
• Current main and release still use older linter: Current main locks oxlint 1.85.0. The latest published release, v0.1.2, also locks 1.85.0, so neither already contains this update. Related merged work preserved Node 25 support but did not perform this linter upgrade. (pnpm-lock.yaml:22, 07fab057ebd5)
• Release check: GitHub identifies v0.1.2 as the latest published release, dated 2026-10-01. Its lockfile was inspected through the GitHub contents API and retains oxlint 1.85.0. (pnpm-lock.yaml:22, cd289d3d3d30)
• Exact-head verification: All 12 returned check runs succeeded at the pinned head, including six Node 22/24 checks across Linux, macOS, and Windows. The CI workflow runs frozen installation and pnpm run check, which includes build and packed-package validation. Reviewer-side execution was intentionally omitted under the read-only contract. (.github/workflows/ci.yml:66, 03a20ecc5a8a)
• Linter registry contract: Registry metadata at https://registry.npmjs.org/oxlint/1.86.0 identifies oxc-project/oxc as the source repository. Its integrity matches the lockfile, its Node range includes Node 25, and its oxlint-tsgolint minimum is satisfied by the retained 7.0.2003. The affirmative dependency signal is package.json’s production lint command executing oxlint.

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-10-01T19:04:57.503Z sha 0d1b68c :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible bundler graph
• reviewed 2026-10-02T04:34:12.637Z sha 0d1b68c :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible bundler graph
• reviewed 2026-10-02T14:11:57.595Z sha 0d1b68c :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible bundler graph
• reviewed 2026-10-02T18:58:42.327Z sha 0d1b68c :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible bundler graph
• reviewed 2026-10-03T00:00:31.527Z sha 0d1b68c :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible bundler graph

[vincentkoc]

@clawsweeper re-review

The Node 25-compatible tsdown@0.22.14 graph is restored while retaining oxlint@1.86.0. Frozen install and the full package check passed locally on Node 25.9.0; exact-head CI is green on the repository's Node 22/24 Linux, macOS, and Windows matrix.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The item is closed; no stale verdict was published.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/37097302588
• Updated: 2026-10-03T04:40:24.273Z