[steipete]

What Problem This Solves

Keeps the repository's security analysis on the current CodeQL Action minor release.

User Impact

No router API, package output, or runtime requirement changes. Node 25 development installs remain supported by retaining the existing build and test dependencies.

Why This Change Was Made

Updates both SHA-pinned CodeQL steps to 4.39.0. Consolidates #66 with a changelog entry and preserves Dependabot credit. The tsdown and Vitest updates in #64 and #65 were closed because their Node engine requirements fail the documented Node 25 CI install.

Evidence

Independent Codex review found no actionable P0–P2 issues. Actionlint, YAML parsing, and git diff --check pass. The isolated Linux run passed pnpm install --frozen-lockfile && pnpm run check, including all 58 tests and tarball import validation. The PR CI matrix verifies Node 22/24 on Linux, macOS 27, and Windows, plus Node 25 on Linux.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-20T19:27:15.532014Z	b27b493	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[steipete]

Landed as 3db9a80. Post-merge CI is green on that exact commit: https://github.com/openclaw/uirouter/actions/runs/39480983186. Both CodeQL analyses also passed: https://github.com/openclaw/uirouter/actions/runs/39480983022.

Validation: pnpm install --frozen-lockfile && pnpm run check passed on an isolated Linux runner, including all 58 tests and package tarball/import validation. Local actionlint, YAML parsing, and git diff --check passed. Independent Codex review found no actionable P0–P2 findings. The PR head and merged main commit both passed the complete seven-job Node/OS matrix.

#66 is superseded; #64 and #65 were closed with their reproducible Node 25 engine failures. Security alerts remain at zero. No release was cut because Unreleased contains only CI/development-tooling maintenance.