[vincentkoc]

What Problem This Solves

Updates the formatter and linter while preserving supported Node 25 development installs.

User Impact

Contributors receive oxfmt 0.73.0 and oxlint 1.88.0 with the existing Node support and strict engine checks. The router API and runtime output contract are unchanged.

Why This Change Was Made

This preserves Dependabot's original update commit from #60. Its branch does not allow maintainer edits, so this replacement restores tsdown 0.22.14 and the complete compatible bundler/declaration dependency graph while retaining the formatter and linter updates. The newer tsdown and declaration generator explicitly exclude Node 25, causing the original PR's installation failure.

Retaining Node 25 follows the existing maintainer decision: #58 (comment). This addresses both original ClawSweeper before-merge items: restore the compatible graph and preserve its recorded intent. Thanks @dependabot.

Evidence

• Original Node 25 failure: https://github.com/openclaw/uirouter/actions/runs/38789535300/job/116610202143. Main's corresponding check passes.
• Official old/new formatter, linter, bundler, and declaration-generator archives were independently verified against npm SHA-512 integrity and their lock entries.
• All 170 package blocks and 170 snapshot blocks outside the formatter/linter families are byte-identical to supported main; the 40 formatter/linter blocks in each section come from Dependabot's lockfile.
• git diff --check passes. Source and tests are unchanged; production/test LOC delta is 0/0.
• All seven exact-head CI lanes pass: Node 22/24 on Linux, macOS and Windows, plus Node 25 on Linux. Node 25 frozen installation and full pnpm run check pass with 58 tests across 9 files: https://github.com/openclaw/uirouter/actions/runs/38915743087/job/117022617073.
• CodeQL passes on this same head: https://github.com/openclaw/uirouter/actions/runs/38916574131.
• Independent full-branch P0–P3 autoreview: scoped-clean, exit 0, no findings. Exact-head ClawSweeper review also has no findings or before-merge items: build(deps-dev): update formatter and linter with Node 25 support #61 (comment).
• Workflow follow-up: CodeQL skips drafts and does not subscribe to ready_for_review; its existing workflow was dispatched once on this branch to provide the missing analysis. No workflow changes are included.

Related: #60

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[vincentkoc]

@clawsweeper re-review

The replacement preserves the original Dependabot commit and addresses both before-merge items from #60: restore the complete Node 25-compatible build/declaration graph and retain the recorded maintainer intent. Please review exact head f1b9a3f0609fc2caf0eff95f472d6ce95cf2f260; existing full CI is running.

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: A newer review tuple already exists; this stale result was superseded.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38917459257
• Updated: 2026-10-16T14:39:17.730Z

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates oxfmt to 0.73.0 and locked oxlint to 1.88.0 while retaining main’s compatible build dependency graph.

Example: A contributor installs development dependencies on Node 25 with pnpm install --frozen-lockfile.

• Before: Main installs oxfmt 0.72.0 and oxlint 1.87.0 with tsdown 0.22.14.
• After: This PR installs oxfmt 0.73.0 and oxlint 1.88.0 while preserving tsdown 0.22.14 and successful Node 25 installation.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, correct maintenance update supported by complete lockfile comparison and passing exact-head compatibility CI.
Proof confidence	🐚 platinum hermit (4/6)	This maintainer-authored development dependency PR is outside the ordinary contributor proof gate; exact-head CI supports frozen installation and the full package check across all seven supported lanes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors need current formatter and linter fixes without losing supported Node 25 development installs.
Reason: The maintainer-authored replacement follows an explicit compatibility decision and established tooling maintenance practice.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: it preserves the approved Node 25 tooling contract, introduces useful dependency updates absent from main, and has no actionable findings; all seven exact-head package CI jobs pass.

Priority: P3
Reviewed head: f1b9a3f0609fc2caf0eff95f472d6ce95cf2f260

Before merge

None.

Findings

None.

Agent review details

How this fits together

These development dependencies format, lint, and compile router source into ESM and TypeScript declarations; they add no router runtime dependencies.

flowchart LR
  A[Contributor or CI] --> B[pnpm frozen install]
  B --> C[Strict engine checks]
  C --> D[Formatter and linter]
  C --> E[Bundler and declaration generator]
  E --> F[Packed router package]

Loading

Technical review

Best possible solution:

Retain this focused formatter/linter update with main’s complete Node 25-compatible build graph.

Do we have a high-confidence way to reproduce the issue?

This is maintenance rather than a current-main bug; source comparison and exact-head CI establish that the replacement preserves supported Node 25 installation.

Is this the best way to solve the issue?

The narrow update follows recorded maintainer direction and avoids the incompatible bundler upgrade in the original Dependabot proposal.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 251c5f19a107.

Provenance checked

• Formatter and linter versions keeps the original intent (292a54d: build(deps): refresh compatible tooling and Node setup #55 refreshed development tooling while retaining supported Node versions.)
• Bundler and declaration-generator compatibility keeps the original intent (07fab05: build(deps): refresh formatter with Node 25 support #48 preserved the compatible build graph; the explicit decision at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment) reaffirmed Node 25 support.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned introduction: The introduced diff changes only CHANGELOG.md, package.json, and pnpm-lock.yaml; main still contains the older formatter and linter versions. (package.json:54, f1b9a3f0609f)
• Complete compatible graph retained: Read-only block comparison verified that all 170 package blocks and 170 snapshot blocks outside the formatter/linter families match main; the 40 updated family blocks in each section match the original Dependabot commit. (pnpm-lock.yaml:26, f1b9a3f0609f)
• Maintainer compatibility decision: Vincent Koc explicitly retained Node 25 support and tsdown 0.22.14 at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment); this replacement follows that decision and credits the original Dependabot contribution from build(deps-dev): bump the development group with 3 updates #60. (package.json:57, f1b9a3f0609f)
• Exact-head CI: All seven package jobs pass on Node 22/24 across Linux, macOS, and Windows, plus Node 25 on Linux. The Node 25 job confirms successful frozen installation and Check: https://github.com/openclaw/uirouter/actions/runs/38915743087/job/117022617073. Workflow lint also passes; CodeQL is skipped. (.github/workflows/ci.yml:65, f1b9a3f0609f)
• Supply-chain metadata: Registry metadata for the old and new formatter/linter versions matches their lockfile integrity values, retains Node ^20.19.0 || >=22.12.0, and declares no package scripts; registry configuration, workflow permissions, and build scripts are unchanged. (pnpm-lock.yaml:1023, f1b9a3f0609f)
• Policy and validation: The complete root AGENTS.md was applied; all changed paths are root files and no maintainer-notes directory exists. The changelog records the update, git diff --check passes, and the checkout remains clean. No target code, tests, or additional reviewer was run. (AGENTS.md:1, f1b9a3f0609f)

Likely related people:

• Vincent Koc: Raw commit cd289d3 adds CHANGELOG.md:5 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: cd289d3d3d30; files: CHANGELOG.md)
• Peter Steinberger: Raw commit 292a54d adds package.json:55 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 292a54dcf5d4; files: package.json)

Review metrics

Metric	Value	Why it matters
Production and test changes	Production +0/-0; tests +0/-0	The update stays within dependency metadata and one changelog entry.
Lockfile scope	170 unchanged non-tool blocks per section; 40 updated tool blocks per section	The complete build graph is preserved without unrelated dependency churn.

Root-cause cluster

Relationship: canonical
Canonical: #61
Summary: This PR preserves the original update commit while repairing its Node 25-incompatible build graph.

Members:

• superseded: build(deps-dev): bump the development group with 3 updates #60 - This replacement carries its formatter/linter updates and restores the compatible bundler and declaration-generator dependencies.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• add P3: This is routine development-tool maintenance with passing compatibility checks and no router runtime change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: This is routine development-tool maintenance with passing compatibility checks and no router runtime change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 16, 2026, 10:31 AM ET / 14:31 UTC.