build(deps-dev): update Node types and oxlint type-aware checks

[dependabot]

Updates the compatible development dependencies: @types/node 26.6.4 → 26.6.5 and oxlint-tsgolint 7.0.2003 → 7.0.2004.

Retains tsdown 0.22.14 and its existing dependency graph. tsdown 0.23.1 requires Node ^22.18 || ^24.11 || >=26, so it rejects this project’s supported Node 25 CI lane during frozen installation. The supported runtime matrix and strict engine checks remain unchanged. Revisit the tsdown update when its engine contract supports this lane or the project explicitly changes its supported Node versions.

Validation: fresh exact-head CI must pass across Node 22/24 on Linux, macOS and Windows, plus Node 25 on Linux; each lane performs frozen install, lint, formatting, checks, tests and build. No release or publication is part of this update.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates locked Node types to 26.6.5 and oxlint-tsgolint to 7.0.2004 while retaining tsdown 0.22.14.

Example: A contributor installs the locked development tools.

• Before: The install selects @types/node 26.6.4 and oxlint-tsgolint 7.0.2003.
• After: The install selects @types/node 26.6.5 and oxlint-tsgolint 7.0.2004, with Node 25-compatible tsdown unchanged.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency refresh with the previous compatibility defect fixed, passing exact-head checks, and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored development dependency update is outside the ordinary contributor proof gate; exact-head CI supports installation and toolchain compatibility without constituting shipped router behavior proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors use older patch releases of Node declarations and type-aware lint tooling.
Reason: The update is narrowly scoped and preserves the development compatibility contract established by prior merged tooling refreshes.

Merge readiness

✅ Ready for maintainer review

This PR remains useful: main retains the older dependencies, the previous Node 25 blocker is fixed, and exact-head CI passes with no actionable findings.

Priority: P3
Reviewed head: dd8b29930056f4f8b57e3280f2c920256e0ee225

Before merge

None.

Findings

None.

Agent review details

How this fits together

The lockfile selects development tools used to typecheck, lint, build, and validate the standalone router package.

flowchart LR
  A[Package dependency ranges] --> B[PNPM lockfile]
  B --> C[Frozen development install]
  C --> D[Typecheck and lint]
  C --> E[Build and package validation]

Loading

Technical review

Best possible solution:

Land the compatible lockfile refresh while preserving the supported Node range and existing bundler graph.

Do we have a high-confidence way to reproduce the issue?

The earlier Node 25 failure no longer applies to this head: the incompatible bundler upgrade is absent and exact-head frozen installation succeeds.

Is this the best way to solve the issue?

The narrowed lockfile update follows the established compatibility approach and avoids changing supported runtimes or router behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 2c8ca576fe4e.

Provenance checked

• Development tooling and supported Node installations keeps the original intent (build(deps): refresh compatible tooling and Node setup #55: Refresh compatible tooling while retaining tsdown 0.22.14 because newer releases exclude supported Node 25 installations.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Verified PR scope: The complete pinned introduction diff changes only the lockfile: Node types, oxlint-tsgolint, its platform packages, and corresponding dependency references; tsdown remains 0.22.14. (pnpm-lock.yaml:11, dd8b29930056)
• Not implemented on main: Current main still locks @types/node 26.6.4 and oxlint-tsgolint 7.0.2003. (pnpm-lock.yaml:11, 2c8ca576fe4e)
• Previous blocker resolved: The corrected head retains the established bundler graph. The exact-head Node 25 job passes both frozen installation and the full package check: https://github.com/openclaw/uirouter/actions/runs/38512680553/job/115684520811. (pnpm-lock.yaml:26, dd8b29930056)
• Exact-head validation: All 13 checks succeed, including Node 22/24 across Linux, macOS, and Windows, Node 25 on Linux, workflow lint, and CodeQL. (.github/workflows/ci.yml, dd8b29930056)
• Compatibility intent and ownership: Merged build(deps): refresh compatible tooling and Node setup #55 retains tsdown 0.22.14 for Node 25; build(deps): refresh Node types and cover Node 25 installs #52 establishes that CI contract, and build(deps): refresh formatter with Node 25 support #48 applies the same compatibility approach. Scoped history shows repeated tooling work by Peter Steinberger and Vincent Koc. Historical blob-dependent comparisons and blame encountered unavailable promisor objects; current blobs, commit diffs, and GitHub PR bodies establish the relevant intent. (pnpm-lock.yaml:26, 292a54dcf5d4)
• Repository policy and clean checkout: The complete root AGENTS.md was applied; no maintainer-notes directory exists. The patch has no runtime, public API, or release-facing change requiring documentation updates. Diff whitespace checks pass and the checkout remains clean; no target code or tests were executed. (AGENTS.md, dd8b29930056)

Likely related people:

• Peter Steinberger: Raw commit 292a54d adds pnpm-lock.yaml:19 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 292a54dcf5d4; files: pnpm-lock.yaml)

Review metrics

Metric	Value	Why it matters
Change scope	Lockfile +45/-45; production source +0/-0; tests +0/-0	The changes are dependency resolution updates without production code growth.

Labels

Label changes:

• add P3: This is a compatible development-tool patch refresh with no router behavior change or remaining installation regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.
• remove status: ⏳ waiting on author: Current PR status label is status: 👀 ready for maintainer look.
• remove P2: Current review triage priority is P3, so this older priority label is no longer current.
• remove rating: 🧂 unranked krab: Current PR rating is rating: 🐚 platinum hermit, so this older rating label is no longer current.
• remove merge-risk: 🚨 compatibility: Current PR review selected no merge-risk labels.

Label justifications:

• P3: This is a compatible development-tool patch refresh with no router behavior change or remaining installation regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (2 earlier review cycles)

• reviewed 2026-10-14T00:47:30.753Z sha 1b61f14 :: needs changes before merge. :: [P1] Restore the Node 25-compatible tsdown dependency graph
• reviewed 2026-10-14T03:02:59.972Z sha 1b61f14 :: needs changes before merge. :: [P1] Restore the Node 25-compatible tsdown dependency graph

Reviewed October 14, 2026, 12:46 AM ET / 04:46 UTC (Revision 3).