build(deps-dev): bump the development group with 2 updates

[dependabot]

Bumps the development group with 2 updates: @types/node and tsdown.

Updates @types/node from 26.6.3 to 26.6.4

Commits

• See full diff in compare view

Updates tsdown from 0.22.14 to 0.23.0

Release notes

Sourced from tsdown's releases.

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)
  • Remove deprecated skipNodeModulesBundle  -  by @​sxzz (f2a3d)
• dts:
  • Remove dts.cjsReexport option  -  by @​sxzz (9c70f)
  • Make dts.generator the only way to select generator  -  by @​sxzz (eb75f)

   🚀 Features

• Expose programmatic watch controls  -  by @​sxzz in rolldown/tsdown#1062 (96a40)
• css: Support function form for css.modules.localsConvention  -  by @​sxzz and @​lazerg (b566f)

... (truncated)

Commits

• ced9a2c chore: release v0.23.0
• f5f9ea9 docs: add Ember support guide (#1043)
• 8ac89dc chore: upgrade Vitest to v5
• 96a4098 feat: expose programmatic watch controls (#1062)
• 61718d7 chore: upgrade deps
• d04119c chore: upgrade deps
• 55f89c5 chore(deps): update pnpm to v12.1.0 (#1060)
• 946224d fix: ignore optional dependencies in type definitions
• 62f01cd chore: release v0.23.0-rc.1
• bf53f43 fix(cli): camel-case nested flag keys
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge. Reviewed October 6, 2026, 11:37 PM ET / October 7, 2026, 03:37 UTC (Revision 4).

ClawSweeper review

What this changes

Updates development Node types to 26.6.4 and the package bundler to tsdown 0.23.0, including their locked dependencies.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open: the prior Node 25 installation regression remains on the unchanged head. Current main intentionally retains compatible tooling and does not include the independent Node types update.

Priority: P2
Reviewed head: 610f8ea12799b12439f4efd71c4f8cf041f4c5c0

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The update is focused and passes the covered CI environments, but retains a definite supported-installation regression.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot is exempt from contributor runtime proof; the supplied Node 22/24 checks supplement review but do not cover the introduced Node 25 installation failure. No stored-data contract changes.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot is exempt from contributor runtime proof; the supplied Node 22/24 checks supplement review but do not cover the introduced Node 25 installation failure. No stored-data contract changes.
Evidence reviewed	8 items	Introduced dependency change: The pinned main-to-head delta changes tsdown from ^0.22.14 to ^0.23.0 and updates the Node types lock entry to 26.6.4. No router source, workflows, permissions, or scripts change. Concrete installation incompatibility: The package declares ^22.18.0 || >=24.11.0, which includes Node 25, and pnpm-workspace.yaml enables engineStrict. Both locked tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 instead require ^22.18.0 || ^24.11.0 || >=26.0.0. package.json's build script directly executes tsdown with declaration generation, establishing the relevant dependency contract. Accepted compatibility direction: GitHub confirms #48 merged. Its MEMBER-authored description explicitly preserves Node 25 development installs by retaining the tsdown 0.22 graph and records successful frozen installation and package checks on Node 25.9.0. This decision covers the current compatibility issue; no new product decision is needed.
Findings	1 actionable finding	[P1] [P1] Retain the Node 25-compatible build tool
Security	None	None.

How this fits together

The development toolchain builds the router's TypeScript source into ESM JavaScript and declarations for consumers. Dependency installation enforces Node engine requirements before contributors can build or validate the package.

flowchart LR
  A[Contributor Node version] --> C[Strict dependency installation]
  B[Locked development dependencies] --> C
  C --> D{Engine requirements satisfied}
  D --> E[Router build and declarations]
  D --> F[Installation rejected]

Loading

Before merge

• [P1] Retain the Node 25-compatible build tool (P1) - Updating tsdown also locks rolldown-plugin-dts 0.28.6; both exclude Node 25. The package still supports ^22.18.0 || >=24.11.0 and enables engineStrict, so supported Node 25 contributors can no longer run pnpm install --frozen-lockfile. Merged build(deps): refresh formatter with Node 25 support #48 and build(deps): refresh compatible tooling and CodeQL #42 explicitly preserved this compatibility. Restore the compatible bundler graph while keeping the Node types update. This remains unresolved on the previously reviewed head.
• Resolve merge risk (P1) - Merging this dependency graph makes frozen development installation fail on supported Node 25 because strict engine checks reject tsdown and its declaration generator.
• Complete next step (P2) - Restore the Node 25-compatible bundler graph while preserving the Node types update, then validate supported development installations.

Findings

• [P1] [P1] Retain the Node 25-compatible build tool — package.json:57

Agent review details

Security

None.

Review metrics

None.

Merge-risk options

Maintainer options:

1. Preserve compatible tooling (recommended)
   Retain the Node types update in a focused replacement while restoring the main branch's tsdown dependency graph.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Preserve @types/node 26.6.4, restore tsdown ^0.22.14 and its compatible locked dependency graph, keep engineStrict and the declared Node range unchanged, and validate frozen installation plus pnpm run check on Node 25 and the existing Node 22/24 matrix.

Technical review

Best possible solution:

Keep the Node types update while retaining the established Node 25-compatible bundler graph and strict engine enforcement.

Do we have a high-confidence way to reproduce the issue?

Yes, from source: frozen development installation on Node 25 encounters two incompatible dependency engine ranges under engineStrict. This review did not execute installation.

Is this the best way to solve the issue?

No: the grouped update violates the established Node support contract; preserving the compatible bundler while updating Node types is the narrow repair.

Full review comments:

• [P1] [P1] Retain the Node 25-compatible build tool — package.json:57
  Updating tsdown also locks rolldown-plugin-dts 0.28.6; both exclude Node 25. The package still supports ^22.18.0 || >=24.11.0 and enables engineStrict, so supported Node 25 contributors can no longer run pnpm install --frozen-lockfile. Merged build(deps): refresh formatter with Node 25 support #48 and build(deps): refresh compatible tooling and CodeQL #42 explicitly preserved this compatibility. Restore the compatible bundler graph while keeping the Node types update. This remains unresolved on the previously reviewed head.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against f7320e4435a3.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• remove rating: 🦪 silver shellfish: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.

Label justifications:

• P2: This is a development-tool update with a concrete installation regression limited to supported Node 25 environments.
• merge-risk: 🚨 compatibility: The introduced dependency engines reject Node 25 despite the declared support contract and the merged decision to preserve that support.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Dependabot is exempt from contributor runtime proof; the supplied Node 22/24 checks supplement review but do not cover the introduced Node 25 installation failure. No stored-data contract changes.

Evidence

Acceptance criteria:

• [P1] pnpm install --frozen-lockfile.
• [P1] pnpm run check.
• [P1] git diff --check.
• [P1] git diff --stat.
• [P1] Repeat frozen installation and pnpm run check under Node 25, Node 22.18 or newer within Node 22, and Node 24.11 or newer within Node 24.

What I checked:

• Introduced dependency change: The pinned main-to-head delta changes tsdown from ^0.22.14 to ^0.23.0 and updates the Node types lock entry to 26.6.4. No router source, workflows, permissions, or scripts change. (package.json:57, 610f8ea12799)
• Concrete installation incompatibility: The package declares ^22.18.0 || >=24.11.0, which includes Node 25, and pnpm-workspace.yaml enables engineStrict. Both locked tsdown 0.23.0 and rolldown-plugin-dts 0.28.6 instead require ^22.18.0 || ^24.11.0 || >=26.0.0. package.json's build script directly executes tsdown with declaration generation, establishing the relevant dependency contract. (pnpm-lock.yaml:1147, 610f8ea12799)
• Accepted compatibility direction: GitHub confirms build(deps): refresh formatter with Node 25 support #48 merged. Its MEMBER-authored description explicitly preserves Node 25 development installs by retaining the tsdown 0.22 graph and records successful frozen installation and package checks on Node 25.9.0. This decision covers the current compatibility issue; no new product decision is needed. (07fab057ebd5)
• Earlier compatible tooling work: GitHub confirms build(deps): refresh compatible tooling and CodeQL #42 merged. It explicitly retained tsdown 0.22.14 because tsdown 0.23 and its declaration generator exclude Node 25, and reported Node 24/25 installation and validation. (555a2aa576a6)
• Current main and release boundary: Pinned main still declares tsdown ^0.22.14; its lockfile retains tsdown 0.22.14 and rolldown-plugin-dts 0.27.14 with Node 25-compatible engines. The latest GitHub release remains v0.1.2. The requested dependency update is not already implemented on pinned main. (package.json:57, f7320e4435a3)
• Review continuity and validation coverage: The previous completed review examined the exact same head and raised the same Node 25 blocker. Supplied checks pass for Node 22 and 24 only; the CI matrix does not exercise Node 25. Installation and build commands were not executed during this read-only review. (.github/workflows/ci.yml:39, 610f8ea12799)

Likely related people:

• vincentkoc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Restore the compatible bundler graph and verify frozen installation plus the package check on Node 25.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (3 earlier review cycles)

• reviewed 2026-10-05T19:00:29.020Z sha 610f8ea :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible build tool
• reviewed 2026-10-06T16:02:04.434Z sha 610f8ea :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible build tool
• reviewed 2026-10-06T18:58:48.714Z sha 610f8ea :: blocked before merge. :: [P1] [P1] Retain the Node 25-compatible build tool

[steipete]

Thanks for the update. The compatible @types/node 26.6.4 change is included in #52.

Closing this combined update because tsdown 0.23.0 excludes Node 25, which remains supported here. A clean Node 25.9.0 install with our strict engine policy fails with ERR_PNPM_UNSUPPORTED_ENGINE for tsdown@0.23.0. We are retaining tsdown 0.22.14 and adding Node 25 CI coverage in #52.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml