build(deps): refresh eligible review tooling

[dependabot]

What Problem This Solves

Refreshes development dependencies within the repository's 48-hour release-age policy: Node 22 typings 22.20.5, Vitest and V8 coverage 5.0.3, Vite 8.3.2, and pnpm 11.28.4.

User Impact

Development and CI use the eligible patch releases while the published CLI keeps its Node 22 floor. No CLI behavior or package-version change.

Why This Change Was Made

Keeps the Vitest and coverage versions aligned, includes Vitest's upstream fix for pnpm trust-downgrade installation failures, and keeps the Crabbox hydration pnpm pin aligned with the package manager. Newer Oxfmt, Oxlint, and Vite releases remain deferred by the cooldown. Thanks @dependabot[bot] for the original dependency update.

Evidence

On an isolated AWS Linux runner with Node 24.19.0 and pnpm 11.28.4, the full gate passed: frozen install, typecheck, lint, formatting, V8 coverage (50 files; 964 tests passed, 2 platform skips), build, and packaged CLI smoke (13 mapped features, including 3 CUDA features).

pnpm install --frozen-lockfile && pnpm typecheck && pnpm lint && pnpm format:check && pnpm test:coverage && pnpm build && pnpm pack:smoke

Independent Codex autoreview completed with no actionable P0–P2 findings. GitHub Actions provides the final Node 22/24/26 and Windows checks on the updated PR head.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed October 7, 2026, 12:36 AM ET / 04:36 UTC (Revision 6).

ClawSweeper review

What this changes

Updates the development lockfile to Node typings 22.20.5 and matching Vitest and V8 coverage packages 5.0.3, including their transitive dependencies.

Merge readiness

✅ Ready for maintainer review

Keep open: these updates remain absent from current main and the latest release. The pinned diff has no actionable correctness or security finding, and no additional merge blocker remains.

Priority: P3
Reviewed head: 72527127dcd2b2136d7f6b5c04854b7fec54a360

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, coherent dependency update with passing validation and no supported blocking finding.
Proof confidence	🌊 off-meta tidepool	Not applicable: Dependabot’s development-lockfile update is exempt from contributor runtime proof; passing CI is supplemental validation. No persisted application data contract changes.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Dependabot’s development-lockfile update is exempt from contributor runtime proof; passing CI is supplemental validation. No persisted application data contract changes.
Evidence reviewed	7 items	Pinned introduction reviewed: The complete introduced diff changes only pnpm-lock.yaml: development dependency resolutions, matching Vitest peer references, and the upstream why-is-node-running pin. Production dependencies, scripts, configuration, and application source are unchanged. Still useful on current main: Main still locks Node typings 22.20.4 and Vitest/coverage 5.0.2. The live branch endpoint confirms main remains b8565de; the latest release endpoint reports v0.8.2. This update has not been incorporated. Repository policy and validation: Read the full root AGENTS.md; no applicable nested policy or maintainer notes were found. Node typings stay on major 22, versions satisfy unchanged package ranges, and Vitest/coverage remain aligned. Existing CI covers frozen installation, typechecking, lint, formatting, coverage, build, package smoke, Windows execution, and Node 22/24 compatibility; supplied checks passed. No tests or builds were run during this read-only review.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch’s development tooling uses Node typings to check TypeScript and Vitest to run tests and measure coverage. The lockfile selects the package versions installed by contributors and CI.

flowchart LR
  A[Development dependency ranges] --> B[Locked package versions]
  B --> C[Development and CI install]
  C --> D[Type checking]
  C --> E[Tests and coverage]
  D --> F[Validation results]
  E --> F

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

None.

Technical review

Best possible solution:

Retain the existing development-tooling contract while adopting these coordinated patch releases through the normal dependency-update path.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates development dependencies rather than reporting a reproducible application bug.

Is this the best way to solve the issue?

Yes: the lockfile-only update preserves declared ranges and the Node 22 typing floor while keeping Vitest and coverage versions synchronized.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against b8565de5bb68.

Labels

Label changes:

No label changes.

Label justifications:

• P3: This is a routine development-only patch update with no identified user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot’s development-lockfile update is exempt from contributor runtime proof; passing CI is supplemental validation. No persisted application data contract changes.

Evidence

What I checked:

• Pinned introduction reviewed: The complete introduced diff changes only pnpm-lock.yaml: development dependency resolutions, matching Vitest peer references, and the upstream why-is-node-running pin. Production dependencies, scripts, configuration, and application source are unchanged. (pnpm-lock.yaml:24, 72527127dcd2)
• Still useful on current main: Main still locks Node typings 22.20.4 and Vitest/coverage 5.0.2. The live branch endpoint confirms main remains b8565de; the latest release endpoint reports v0.8.2. This update has not been incorporated. (pnpm-lock.yaml:24, b8565de5bb68)
• Repository policy and validation: Read the full root AGENTS.md; no applicable nested policy or maintainer notes were found. Node typings stay on major 22, versions satisfy unchanged package ranges, and Vitest/coverage remain aligned. Existing CI covers frozen installation, typechecking, lint, formatting, coverage, build, package smoke, Windows execution, and Node 22/24 compatibility; supplied checks passed. No tests or builds were run during this read-only review. (AGENTS.md:13, 72527127dcd2)
• Published dependency contract: Read official npm metadata for Vitest, coverage-v8, mocker, and spy 5.0.3. Their integrity values match the introduced lockfile; coverage requires Vitest 5.0.3, and Vitest explicitly depends on why-is-node-running 3.2.1. Repository metadata verifies vitest-dev/vitest ownership. No install lifecycle hook was present in the inspected metadata. The target’s package scripts and vitest.config.ts directly consume these packages.
• Node typings provenance: Official npm metadata identifies DefinitelyTyped/DefinitelyTyped, types/node, as the source of @types/node 22.20.5. Its integrity matches the lockfile and its undici-types dependency remains compatible. All three direct updates were published more than 48 hours before this PR, satisfying the target’s minimumReleaseAge setting.
• Area history and routing: Current-main path history shows repeated tooling maintenance by Peter Steinberger. GitHub commit metadata identifies steipete as author of the earlier matching V8 coverage integration. Some historical blobs could not be read locally; the GitHub commit endpoint supplied the relevant patches instead. No feature-introduction claim is inferred from file-touch history. (vitest.config.ts:8, 0885c9372069)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-10-05T16:10:09.618Z sha 7252712 :: needs maintainer review before merge. :: none
• reviewed 2026-10-05T22:59:38.048Z sha 7252712 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T05:31:14.016Z sha 7252712 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T08:38:31.982Z sha 7252712 :: needs maintainer review before merge. :: none
• reviewed 2026-10-06T19:26:44.435Z sha 7252712 :: needs maintainer review before merge. :: none