[dependabot]

What Problem This Solves

The proposed tsdown 0.23 update prevents contributors on supported Node 25 from installing the development toolchain. The older locked test-server dependencies also carry security advisories.

User Impact

Node 25 remains supported for development, with no router API or runtime behavior changes. The package retains zero runtime dependencies.

Why This Change Was Made

Keep tsdown on its compatible 0.22 line and Vitest on 4.x, while updating the formatter, linter, compatible test patch, pnpm 11, and security-fixed transitive dependencies. Explicit patched Vite selection prevents unsafe automatic peer resolution. Document and encode the existing Node 25 compatibility hold in Dependabot version updates. Thanks @dependabot for the original tooling PR.

Evidence

Reproduced the original frozen-install failure with Node 25.9.0 (ERR_PNPM_UNSUPPORTED_ENGINE for tsdown 0.23.1). The repaired graph passes frozen installation and pnpm run check on the same runtime, including all 58 tests and package pack/import validation. The audit reports zero advisories, down from seven, and workflow YAML parses successfully. Final independent Codex P0–P2 review is clean; the full Node/platform CI matrix must pass before merge.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR updates oxfmt to 0.74.0, oxlint to 1.89.0, and tsdown to 0.23.1 with their locked dependencies.

Example: A contributor installs development dependencies on Node 25 with pnpm install --frozen-lockfile.

• Before: Main retains the Node 25-compatible tsdown 0.22.14 graph, and its Node 25 CI job passes.
• After: The PR selects tsdown 0.23.1 and rolldown-plugin-dts 0.28.8, whose engine ranges exclude Node 25; dependency installation fails before checks run.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	Useful dependency maintenance, but the current patch breaks a supported development installation and contradicts an established compatibility decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; existing installation and package-check jobs exercise the changed toolchain, including the failing Node 25 installation.
Patch quality	🧂 unranked krab (1/6)	1 actionable review finding remain.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors benefit from current formatting and linting fixes while retaining supported development environments.
Reason: A compatible tooling refresh has established maintainer support; preserving Node 25 requires a mechanical repair rather than another product decision.

Merge readiness

⛔ Needs changes before merge - 2 items remain

Keep this PR open for a focused repair: the formatter and linter updates are useful, but the bundled tsdown upgrade breaks supported Node 25 installations and reverses a recorded maintainer decision.

Priority: P2
Reviewed head: 762764d146d5b4b796e158540c2a28ecf415f916

Before merge

• [P1] Restore the Node 25-compatible tsdown dependency graph (P1) - Node 25 satisfies this package's declared engine range and is explicitly covered by CI, but tsdown 0.23.1 and its locked rolldown-plugin-dts 0.28.8 both require ^22.18.0 || ^24.11.0 || >=26.0.0. With engineStrict enabled, pnpm install --frozen-lockfile fails before contributors can build or run checks; the exact-head Node 25 job already fails at dependency installation. Restore tsdown ^0.22.14 and the compatible locked graph while retaining the formatter/linter updates, consistent with build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment) and build(deps-dev): update formatter and linter with Node 25 support #61.
• Explain or restore the original intent of Build-tool engine compatibility - build(deps-dev): update formatter and linter with Node 25 support #61: Retain tsdown 0.22.14 and its declaration graph so strict installs continue working on Node 25, following the explicit decision in build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment).

Findings

• [P1] [P1] Restore the Node 25-compatible tsdown dependency graph — package.json:57

Provenance

• Build-tool engine compatibility changes intended behavior without addressing why it exists (build(deps-dev): update formatter and linter with Node 25 support #61: Retain tsdown 0.22.14 and its declaration graph so strict installs continue working on Node 25, following the explicit decision in build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment).)

Tests

• Missing end-to-end proof: The existing Node 25 frozen-install and full-check lane must pass after restoring the compatible dependency graph.

Agent review details

How this fits together

The development toolchain formats and lints repository files and builds router source into the published ESM package and declarations.

flowchart LR
  A[Package manifest and lockfile] --> B[pnpm installation]
  B --> C[Formatter and linter]
  B --> D[tsdown and declaration generator]
  E[Router TypeScript source] --> D
  D --> F[Published ESM and declarations]

Loading

Technical review

Best possible solution:

Retain the formatter and linter updates while restoring main's tsdown 0.22.14 and compatible bundler/declaration graph.

Do we have a high-confidence way to reproduce the issue?

The locked engine ranges exclude Node 25 under engineStrict, and exact-head CI confirms installation failure while main passes; no local execution was performed.

Is this the best way to solve the issue?

The compatible formatter and linter refresh is appropriate, but the tsdown upgrade should be removed in accordance with the existing maintainer decision.

Full review comments:

• [P1] [P1] Restore the Node 25-compatible tsdown dependency graph — package.json:57
  Node 25 satisfies this package's declared engine range and is explicitly covered by CI, but tsdown 0.23.1 and its locked rolldown-plugin-dts 0.28.8 both require ^22.18.0 || ^24.11.0 || >=26.0.0. With engineStrict enabled, pnpm install --frozen-lockfile fails before contributors can build or run checks; the exact-head Node 25 job already fails at dependency installation. Restore tsdown ^0.22.14 and the compatible locked graph while retaining the formatter/linter updates, consistent with build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment) and build(deps-dev): update formatter and linter with Node 25 support #61.
  Confidence: 1

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 3db9a80449c1.

Provenance checked

• Formatter and linter refresh keeps the original intent (build(deps-dev): update formatter and linter with Node 25 support #61: Refresh development tools without changing the router API, runtime requirements, or package output contract.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

Acceptance criteria:

• Node 25: pnpm install --frozen-lockfile
• Node 25: pnpm run check
• Existing Node 22/24 CI matrix: frozen installation and pnpm run check
• git diff --check

What I checked:

• Introduced incompatible dependency graph: The pinned introduction diff changes tsdown from ^0.22.14 to ^0.23.1 and locks rolldown-plugin-dts 0.28.8; both new engine ranges exclude Node 25. (package.json:57, 762764d146d5)
• Supported installation contract: The manifest and README support ^22.18.0 || >=24.11.0, pnpm-workspace.yaml enables engineStrict, and CI explicitly includes Node 25. (package.json:62, 3db9a80449c1)
• Exact-head installation failure: The Node 25 job fails at Install dependencies and skips Check: https://github.com/openclaw/uirouter/actions/runs/39656922828/job/119419537345. Main's corresponding job passes: https://github.com/openclaw/uirouter/actions/runs/39480983186/job/118829165190. (762764d146d5)
• Recorded maintainer direction: vincentkoc explicitly retained Node 25 support and the compatible tsdown graph, with reconsideration contingent on upstream support or a deliberate runtime-policy change: build(deps-dev): bump tsdown from 0.22.14 to 0.23.1 in the development group #58 (comment). The merged repair at build(deps-dev): update formatter and linter with Node 25 support #61 follows that decision. (package.json:57, f33fdcbe0f8c)
• Feature-history ownership: Toolchain history includes repeated compatibility repairs by Vincent Koc and Peter Steinberger, including build(deps-dev): update formatter and linter with Node 25 support #61 and build(deps): refresh compatible tooling and Node setup #55; current-main blame confirms their authored manifest lines. (package.json:54, 3db9a80449c1)
• Review policy and inspection limits: The complete root AGENTS.md was applied; no .agents directory exists. Historical git show encountered unavailable promisor objects, and the job-log redirect was blocked by the network allowlist; current blobs, blame, REST job steps, and maintainer discussion independently establish the defect. No installs or tests were run, and the checkout remains clean. (AGENTS.md, 762764d146d5)

Likely related people:

• Peter Steinberger: Raw commit 292a54d adds package.json:55 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 292a54dcf5d4; files: package.json)

Labels

Label changes:

• add P2: This is normal development-tool maintenance with an installation regression confined to the proposed dependency graph.
• add merge-risk: 🚨 compatibility: Merging the current graph prevents strict dependency installation on the repository's explicitly supported Node 25 runtime.
• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: This is normal development-tool maintenance with an installation regression confined to the proposed dependency graph.
• merge-risk: 🚨 compatibility: Merging the current graph prevents strict dependency installation on the repository's explicitly supported Node 25 runtime.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 21, 2026, 3:52 PM ET / 19:52 UTC.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	vitest@​4.1.11 ⏵ 4.1.12
	vite@​8.1.0 ⏵ 8.3.5	+1	+21	+1
	oxfmt@​0.73.0 ⏵ 0.74.0	-7
	oxlint@​1.88.0 ⏵ 1.89.0	+1		+1

View full report

[steipete]

Merged as c21eaef. The repaired PR passed every Node/platform job, including Node 25; post-merge CI and CodeQL also passed: https://github.com/openclaw/uirouter/actions/runs/39947077628. The current-version 0.1.2 release dry run passed without publishing: https://github.com/openclaw/uirouter/actions/runs/39947078445.

Reproduction: Node 25.9.0 rejected the original tsdown 0.23.1 dependency graph under strict engine checks. The repaired graph passes frozen pnpm installation, all 58 tests, build/type/lint/format checks, packed-package import validation, and a zero-finding dependency audit on that same runtime. Final independent P0–P2 review is clean.

Existing Node 25 support is preserved and documented, incompatible automated tsdown/Vitest upgrades are held, and seven development-tool advisories are resolved. No router API/runtime changes, release, tag, or package-version bump. Cloud lease stopped; task worktree removed; main clean.