[dependabot]

Bumps the development group with 1 update: tsdown.

Updates tsdown from 0.22.14 to 0.23.1

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

• Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)
• entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)
• pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)

... (truncated)

Commits

• 6493257 chore: release v0.23.1
• ba6acb9 chore: upgrade deps
• 6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)
• eb40c95 chore: declare package side effects
• f9c95d0 chore: align pnpm workspace settings
• e64bde4 chore: configure pnpm via devEngines
• 83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)
• 1745223 fix(entry): honor custom root for object entry (#1072)
• 9655dcb chore: upgrade deps
• 30da631 docs: correct default value of minify
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades tsdown from 0.22.14 to 0.23.1 and refreshes its transitive build dependencies.

Example: A contributor runs pnpm install --frozen-lockfile on Node 25.

• Before: The compatible tsdown 0.22.14 dependency graph installs successfully.
• After: The updated graph excludes Node 25, and the PR's Node 25 CI job fails during installation.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The dependency update breaks a supported installation path and contradicts recorded compatibility direction.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the contributor proof gate; exact-head CI exercises installation and package checks, with Node 25 failing before the checks run.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: No
User problem: Contributors benefit from maintained build tooling, but this update prevents supported Node 25 development installs.
Reason: No repository-specific need for this upgrade outweighs the compatibility regression, and prior maintainer direction explicitly preserves Node 25.

Regression provenance

Possible regression — suspected (reviewed change). No predecessor PR is attributed.

Merge readiness

⛔ Blocked before merge - 3 items remain

This PR breaks supported Node 25 development installs and reverses an explicit compatibility decision; repository policy does not permit automatic closure of this unimplemented update.

Priority: P2
Reviewed head: ded9d652c628204646e43f6cce1941ea88c3efaa

Before merge

• Preserve the Node 25-compatible bundler dependency graph (P1) - The package still supports Node ^22.18.0 || >=24.11.0 and enables strict engine checks, but this upgrade locks tsdown 0.23.1 and rolldown-plugin-dts 0.28.8 to ^22.18.0 || ^24.11.0 || >=26.0.0. A contributor installing on Node 25 therefore receives an unsupported dependency graph; the exact-head Node 25 CI job fails during installation while main passes. Restore tsdown 0.22.14 and its compatible lockfile graph rather than dropping Node support or disabling engine enforcement, consistent with build(deps): refresh compatible tooling and Node setup #55.
• Product: not worth merging - No repository-specific need for this upgrade outweighs the compatibility regression, and prior maintainer direction explicitly preserves Node 25.
• Explain or restore the original intent of tsdown version and declaration-generator graph - f4138d1: The toolchain refresh established tsdown 0.22.14; later merged build(deps): refresh compatible tooling and Node setup #55 explicitly retained it to preserve supported Node 25 installations.

Findings

• [P1] Preserve the Node 25-compatible bundler dependency graph — package.json:57

Provenance

• tsdown version and declaration-generator graph changes intended behavior without addressing why it exists (f4138d1: The toolchain refresh established tsdown 0.22.14; later merged build(deps): refresh compatible tooling and Node setup #55 explicitly retained it to preserve supported Node 25 installations.)

Agent review details

How this fits together

tsdown consumes the router's TypeScript entry point and produces the ESM bundle and declarations used by package validation and publication.

flowchart LR
  A[Contributor checkout] --> B[pnpm frozen install]
  B --> C[Dependency engine checks]
  C --> D[tsdown build]
  D --> E[ESM and declarations]
  E --> F[Package import validation]

Loading

Technical review

Best possible solution:

Retain the compatible tsdown 0.22.14 graph until an upgrade preserves the repository's declared Node support.

Do we have a high-confidence way to reproduce the issue?

The PR's locked engine ranges exclude Node 25, its installation job fails, and the corresponding main job passes; no local target code was executed.

Is this the best way to solve the issue?

This upgrade conflicts with the established compatibility contract; restoring the existing dependency graph is safer than narrowing supported Node versions or disabling engine enforcement.

Full review comments:

• [P1] Preserve the Node 25-compatible bundler dependency graph — package.json:57
  The package still supports Node ^22.18.0 || >=24.11.0 and enables strict engine checks, but this upgrade locks tsdown 0.23.1 and rolldown-plugin-dts 0.28.8 to ^22.18.0 || ^24.11.0 || >=26.0.0. A contributor installing on Node 25 therefore receives an unsupported dependency graph; the exact-head Node 25 CI job fails during installation while main passes. Restore tsdown 0.22.14 and its compatible lockfile graph rather than dropping Node support or disabling engine enforcement, consistent with build(deps): refresh compatible tooling and Node setup #55.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 251c5f19a107.

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced dependency change: The pinned introduction diff changes tsdown to ^0.23.1; current main still specifies ^0.22.14. (package.json:57, ded9d652c628)
• Incompatible engine contract: The locked tsdown 0.23.1 and rolldown-plugin-dts 0.28.8 engine ranges exclude Node 25, while package.json and README retain Node ^22.18.0 || >=24.11.0 and pnpm-workspace.yaml enables engineStrict. (pnpm-lock.yaml:1057, ded9d652c628)
• Recorded compatibility decision: Maintainer-authored build(deps): refresh compatible tooling and Node setup #55 deliberately retained tsdown 0.22.14 and its declaration-generator graph to preserve supported Node 25 installations; build(deps-dev): bump oxlint to 1.86.0 #49 records the same repair. (package.json:57, 292a54dcf5d4)
• Installation failure at reviewed head: https://github.com/openclaw/uirouter/actions/runs/38639697120/job/116111768953 fails at Install dependencies and skips Check. The Node 25 job on the pinned main revision succeeds: https://github.com/openclaw/uirouter/actions/runs/38514120090/job/115688959761. (.github/workflows/ci.yml:65, ded9d652c628)
• Feature history and policy: The full root AGENTS.md was applied; no nested policy or maintainer-notes directory exists for these root files. Toolchain history shows repeated compatibility work by Peter Steinberger and Vincent Koc, and CODEOWNERS routes package changes to openclaw-secops. (AGENTS.md:1, 251c5f19a107)
• Inspection limits: Job logs redirected to a blocked artifact host, so their exact error text was unavailable; job-step metadata and the engine mismatch were independently verified. A CODEOWNERS blame attempt encountered an unavailable historical blob. Neither limitation changes the compatibility finding. (ded9d652c628)

Labels

Label changes:

• add P2: The proposed update breaks a supported contributor installation path, with no change to the shipped router runtime.
• add merge-risk: 🚨 compatibility: tsdown and its declaration generator exclude Node 25 despite the package's retained support contract and strict engine checks.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: The proposed update breaks a supported contributor installation path, with no change to the shipped router runtime.
• merge-risk: 🚨 compatibility: tsdown and its declaration generator exclude Node 25 despite the package's retained support contract and strict engine checks.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 14, 2026, 5:34 PM ET / 21:34 UTC.

[vincentkoc]

Closing this repeated incompatible upgrade at reviewed head ded9d652c628204646e43f6cce1941ea88c3efaa. Current main still supports Node ^22.18.0 || >=24.11.0, enables engineStrict, and explicitly tests Node 25. tsdown@0.23.1 requires ^22.18.0 || ^24.11.0 || >=26.0.0, excluding that supported runtime; the exact-head Node 25 installation fails: https://github.com/openclaw/uirouter/actions/runs/38639697120/job/116111768953.

This retains the established Node 25-compatible tsdown@0.22.14 graph, consistent with the prior maintainer repair: #49 (comment). Reconsider when the upstream engine range supports Node 25 or the repository deliberately changes its runtime contract. No runtime-policy or engine-check changes are being landed. Thanks to Dependabot for the update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml