[dependabot]

Bumps the development group with 1 update: tsdown.

Updates tsdown from 0.22.14 to 0.23.1

Release notes

Sourced from tsdown's releases.

v0.23.1

   🐞 Bug Fixes

• Preserve false tsconfig option  -  by @​Masutayunikon in rolldown/tsdown#1065 (407f8)
• entry: Honor custom root for object entry  -  by @​giaBaoJS in rolldown/tsdown#1072 (17452)
• pkg: Pack tarball inside npm publish --dry-run  -  by @​giaBaoJS in rolldown/tsdown#1076 (83f0c)

    View changes on GitHub

v0.23.0

   🧭 Migration Guide

Most users can upgrade directly. Before upgrading, run one final build with tsdown@0.22.14 and resolve all deprecation warnings.

• config:
  • bundle: false → unbundle: true; bundle: true can be removed
  • outExtension → outExtensions
  • publicDir / --public-dir → copy / --copy
  • removeNodeProtocol: true → nodeProtocol: 'strip'
  • injectStyle → css.inject
• deps:
  • inlineOnly / deps.onlyAllowBundle → deps.onlyBundle
  • skipNodeModulesBundle: true → deps.neverBundle: true
  • resolveDepSubpath now defaults to false; set it to true to preserve the previous behavior
• dts:
  • rolldown-plugin-dts was upgraded from 0.27.13 to 0.28.5
  • dts.oxc: true → dts.generator: 'oxc'
  • dts.tsgo: true → dts.generator: 'tsgo'; oxc and tsgo objects now only configure their respective generators
  • dts.volarPlugins → dts.customLanguages; rename each language's create hook to createVolarPlugins
  • Custom languages, including vue, now throw when combined with an incompatible generator
  • dts.cjsReexport was removed; dual-format builds now generate CJS declarations in a separate pass
• attw:
  • The default profile changed from strict to esm-only; set profile: 'strict' to preserve the previous checks
• programmatic API:
  • build() now returns { bundles, watch }; replace const bundles = await build() with const { bundles } = await build()
• requirements:
  • Node.js 25 is no longer supported; use ^22.18.0, ^24.11.0, or >=26.0.0
  • rolldown-plugin-dts now requires Rolldown 1.2.x
  • Legacy types and typesVersions fallbacks were removed; use TypeScript's bundler, node16, or nodenext module resolution

   🚨 Breaking Changes

• Drop support for Node.js 25  -  by @​sxzz (26950)
• Remove deprecated tsup compatibility options  -  by @​sxzz (50766)
• Drop types and typesVersionsfields  -  by @​sxzz (be3ea)
• attw:
  • Change default profile to esm-only  -  by @​sxzz (9b3cf)
• deps:
  • Remove deprecated deps.onlyAllowBundle  -  by @​sxzz (30c55)
  • Disable resolveDepSubpath by default  -  by @​sxzz (d300f)

... (truncated)

Commits

• 6493257 chore: release v0.23.1
• ba6acb9 chore: upgrade deps
• 6cbfec7 chore(deps): update dependency unplugin-vue to v8 (#1090)
• eb40c95 chore: declare package side effects
• f9c95d0 chore: align pnpm workspace settings
• e64bde4 chore: configure pnpm via devEngines
• 83f0c57 fix(pkg): pack tarball inside npm publish --dry-run (#1076)
• 1745223 fix(entry): honor custom root for object entry (#1072)
• 9655dcb chore: upgrade deps
• 30da631 docs: correct default value of minify
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades tsdown from 0.22.14 to 0.23.1 and refreshes its locked build dependencies.

Example: A contributor installs development dependencies on Node 25.

• Before: The retained tsdown 0.22.14 dependency graph supports Node 25.
• After: The new bundler and declaration generator exclude Node 25, and the Node 25 CI installation fails.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The update breaks supported Node 25 installs and reverses a verified maintainer compatibility decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; available installation CI demonstrates the compatibility failure rather than a successful upgrade.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: No
User problem: Contributors receive newer build tooling through routine dependency maintenance.
Reason: The update removes a supported development environment without a demonstrated repository-specific benefit, contrary to explicit maintainer direction.

Merge readiness

⛔ Blocked before merge - 3 items remain

This PR breaks supported Node 25 development installs and reverses an explicit maintainer decision to retain compatible tooling; repository policy does not permit auto-closing this incompatible upgrade.

Priority: P2
Reviewed head: 2c245bc3bb3993f48b44d71a1201d638214ab245

Before merge

• Preserve the Node 25-compatible build dependency graph (P1) - On Node 25, the declared package engine accepts the runtime, but tsdown 0.23.1 and rolldown-plugin-dts 0.28.8 both require ^22.18.0 || ^24.11.0 || >=26.0.0. With engineStrict enabled, contributors cannot install the development dependencies; the exact-head Node 25 CI job fails at installation and skips the package check. Restore tsdown 0.22.14 and its complete compatible lockfile graph, consistent with the maintainer decision at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment).
• Product: not worth merging - The update removes a supported development environment without a demonstrated repository-specific benefit, contrary to explicit maintainer direction.
• Explain or restore the original intent of tsdown version and declaration-generator dependency graph - f4138d1: The version originated in a tooling refresh; subsequent merged repairs deliberately retained it to preserve Node 25 support, including build(deps): refresh compatible tooling and Node setup #55 and build(deps-dev): update formatter and linter with Node 25 support #61.

Findings

• [P1] Preserve the Node 25-compatible build dependency graph — package.json:57

Provenance

• tsdown version and declaration-generator dependency graph changes intended behavior without addressing why it exists (f4138d1: The version originated in a tooling refresh; subsequent merged repairs deliberately retained it to preserve Node 25 support, including build(deps): refresh compatible tooling and Node setup #55 and build(deps-dev): update formatter and linter with Node 25 support #61.)

Tests

• Missing end-to-end proof: The changed graph has no successful Node 25 frozen installation and package check; the supplied CI shows installation failure.

Agent review details

How this fits together

tsdown consumes the router's TypeScript entry point during build and prepack, producing the ESM bundle and declarations distributed to consumers.

flowchart LR
  A[Contributor or CI] --> B[Frozen dependency install]
  B --> C[Strict engine validation]
  C --> D[tsdown build]
  D --> E[ESM and declarations]
  E --> F[Package import validation]

Loading

Technical review

Best possible solution:

Retain the complete tsdown 0.22.14 graph until an upgrade supports the repository's existing Node contract.

Do we have a high-confidence way to reproduce the issue?

The changed lockfile excludes Node 25 under engineStrict, and exact-head CI independently fails during Node 25 installation; no local reproduction was run.

Is this the best way to solve the issue?

This upgrade is unsuitable under the current support contract and contradicts the recorded decision to retain compatible build tooling.

Full review comments:

• [P1] Preserve the Node 25-compatible build dependency graph — package.json:57
  On Node 25, the declared package engine accepts the runtime, but tsdown 0.23.1 and rolldown-plugin-dts 0.28.8 both require ^22.18.0 || ^24.11.0 || >=26.0.0. With engineStrict enabled, contributors cannot install the development dependencies; the exact-head Node 25 CI job fails at installation and skips the package check. Restore tsdown 0.22.14 and its complete compatible lockfile graph, consistent with the maintainer decision at build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment).
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3b2fb01297a5.

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced compatibility regression: The pinned introduction diff changes tsdown to ^0.23.1; its locked engine range and rolldown-plugin-dts 0.28.8 both exclude Node 25. (pnpm-lock.yaml:1060, 2c245bc3bb39)
• Current main retains Node 25 support: Main declares Node ^22.18.0 || >=24.11.0, enables engineStrict, explicitly checks Node 25, and retains tsdown ^0.22.14; the default branch remains at the supplied base. (package.json:62, 3b2fb01297a5)
• Exact-head installation failure: The Node 25 job fails at Install dependencies and skips Check, while all six Node 22/24 package-check lanes pass: https://github.com/openclaw/uirouter/actions/runs/39306592880/job/118245147283. Raw logs redirect to a blocked artifact host, so the precise error text was not inspected. (.github/workflows/ci.yml:65, 2c245bc3bb39)
• Explicit maintainer direction: Member vincentkoc rejected the same 0.23.1 upgrade and directed reconsideration only when upstream supports Node 25 or this repository deliberately changes its runtime contract: build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment).
• Feature history and retained intent: The merged tooling repairs at build(deps): refresh compatible tooling and Node setup #55 and build(deps-dev): update formatter and linter with Node 25 support #61 deliberately preserve the complete Node 25-compatible bundler graph. History identifies Peter Steinberger and Vincent Koc as recurring contributors to this compatibility boundary. (package.json:57, 292a54dcf5d4)
• Read-only review limits: The complete root AGENTS.md was applied; no .agents maintainer notes or simplification skill exist. One historical CHANGELOG.md blame encountered a missing blob; dependency-file history and linked maintainer discussion establish intent independently. No target code ran, git diff --check passed, and the checkout remained clean. (AGENTS.md, 2c245bc3bb39)

Likely related people:

• Peter Steinberger: Raw commit 292a54d adds package.json:55 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 292a54dcf5d4; files: package.json)
• Vincent Koc: Raw commit f33fdcb adds package.json:54 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: f33fdcbe0f8c; files: package.json)

Root-cause cluster

Relationship: same_root_cause
Canonical: #58
Summary: The same tsdown 0.23.1 engine incompatibility was previously reviewed and explicitly rejected.

Members:

• canonical: build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 - The maintainer discussion establishes the Node 25 compatibility decision for this exact dependency upgrade.
• same_root_cause: build(deps-dev): update formatter and linter with Node 25 support #61 - The merged repair restores the complete compatible graph after the newer bundler and declaration generator caused Node 25 installation failure.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• add P2: The proposed maintenance update breaks a supported contributor environment but has not reached main.
• add merge-risk: 🚨 compatibility: The new dependency engines exclude Node 25 despite the package's retained support contract.
• add merge-risk: 🚨 automation: The dependency change prevents installation in the existing Node 25 CI lane before package checks can execute.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: The proposed maintenance update breaks a supported contributor environment but has not reached main.
• merge-risk: 🚨 compatibility: The new dependency engines exclude Node 25 despite the package's retained support contract.
• merge-risk: 🚨 automation: The dependency change prevents installation in the existing Node 25 CI lane before package checks can execute.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 19, 2026, 3:09 PM ET / 19:09 UTC.

[steipete]

Closing because tsdown 0.23.1 drops this repository's documented Node 25 development support. The Node 25 CI job reproduces ERR_PNPM_UNSUPPORTED_ENGINE during the frozen install: tsdown requires ^22.18.0 || ^24.11.0 || >=26.0.0, but CI uses Node 25.9.0.

Proof: https://github.com/openclaw/uirouter/actions/runs/39306592880/job/118245147283

Retaining tsdown 0.22.14 and its compatible declaration-generator graph. This update can be reconsidered when upstream supports the declared range or the repository deliberately changes that range. Thanks for the update.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml