[dependabot]

Refresh ClawHub's supported dependency lines and remove 11 of the 12 advisory records reported by the baseline audit. This updates React/TanStack/Radix, email tooling, CLI MIME handling, Oxc and test tooling, and patches the existing DOMPurify, Next.js preview, and shell-quote overrides plus source-map-js. The convex-test update also needs its component-upgrade test wrapper to preserve the new generic registration return type.

The CLI retains Node >=22 and Undici 7, and the existing compiler arrangement is unchanged. Mermaid 12 (#3954), OIDC 4 (#3955), and the newer Nitro beta remain separate work. The remaining low KaTeX advisory comes through Mermaid 11; no audit ignore was added and no incompatible KaTeX override was forced.

Validation:

• bun run ci:static passed, including formatting, type-aware lint and all configured Knip passes.
• bun run ci:types-build and bunx tsc -p convex/tsconfig.json --noEmit passed, including schema/CLI TypeScript checks and the production build.
• The initial bun run ci:unit passed 7,755 tests with 11 failures in six files. All 131 tests in those six files passed when rerun with two workers and temporary folders outside the checkout; the failures were timeouts/cascades and fixture environment effects. The component-upgrade test also passed independently.
• CLI source tests passed after rerunning the two affected fixture files outside the checkout (140 tests); the other 28 files had already passed. All 22 built-CLI tests passed. Admin verification passed (131 source tests, typecheck, and the packed-package artifact test).
• Independent Codex review through P3 found no actionable findings.

No production deployment or package publication is part of this PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 15, 2026 6:39am UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates direct Zod to 4.6.6 and resolves three TanStack dependencies to Zod 4.6.7.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The scoped patch has no identified defects and passes broad CI; evidence remains source and automated validation rather than direct observation of the changed validation behavior.
Proof confidence	🦐 gold shrimp (3/6)	This Dependabot maintenance PR is outside the ordinary contributor proof gate; exact-head CI supports compatibility, while preview readiness alone does not prove scanner or classifier behavior.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes
User problem: No specific user failure is reported; this keeps the validation dependency current.
Reason: The configured dependency maintenance policy supports this narrow patch update, and the inspected consumers preserve their accepted inputs.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: current main still uses Zod 4.6.5, and the dependency update has no identified blocking findings.

Priority: P3
Reviewed head: eae9781ab151e875c1da77e4a4d38f4cb613e39a

Before merge

None.

Findings

None.

Agent review details

How this fits together

Zod validates scanner reports and search-classification output, while TanStack uses it for tooling configuration; validated values feed existing backend and build paths.

flowchart TD
  A[Dependency manifest and lockfile] --> B[Zod]
  B --> C[Scanner report validation]
  B --> D[Search output validation]
  B --> E[TanStack tooling]
  C --> F[Existing backend records]
  D --> F

Loading

Technical review

Best possible solution:

Land the scoped dependency update through the existing dependency maintenance path.

Do we have a high-confidence way to reproduce the issue?

This PR reports no ClawHub defect requiring reproduction; inspection verifies the dependency versions and upstream changes without executing target code.

Is this the best way to solve the issue?

Updating the manifest and lockfile is the appropriate maintenance approach; vendoring the upstream fix or adding application workarounds would introduce unnecessary parallel ownership.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6a58bbfafae4.

Provenance checked

• Direct Zod version and lockfile resolution keeps the original intent (911211f: chore(deps): bump the production-minor-and-patch group across 1 directory with 41 updates #3950 advanced the production dependency group to current versions, including Zod 4.6.5.)
• TanStack nested Zod resolutions keeps the original intent (58865c4: feat: deploy staging branch to isolated ClawHub staging #3877 updated TanStack Start for its security patch; the new Zod resolutions satisfy the existing ^4.5.4 dependency ranges.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

• Introduced dependency changes: The pinned introduction diff changes only package.json and bun.lock: direct Zod becomes 4.6.6, with three nested 4.6.7 resolutions. (package.json:160, eae9781ab151)
• Update remains absent from main: The reviewed main manifest pins Zod 4.6.5; the all-state title search found no separate Zod update owning this change. (package.json:160, 6a58bbfafae4)
• Existing dependency-update direction: Dependabot configuration already requests production patch updates, and chore(deps): bump the production-minor-and-patch group across 1 directory with 41 updates #3950 merged the preceding dependency group update containing Zod 4.6.5. (.github/dependabot.yml, 911211fc6cc6)
• Concrete dependency consumers: Endor findings and search-classification rows use bounded Zod arrays; neither uses element transforms or refinements whose execution the upstream size gate would suppress on valid input. (convex/lib/endorAnalysis.ts:9, eae9781ab151)
• Upstream runtime contract: The consumed dependency changes record typing and rejects oversized arrays, maps, and sets before parsing elements; upstream regression tests cover that behavior. Version 4.6.7 adds only version and lockfile changes beyond 4.6.6. (packages/zod/src/v4/core/schemas.ts, 9c219833c3a3)
• Supply-chain checks: Both lockfile integrity values match npm metadata, which declares no install lifecycle hooks. The release disclosure at https://github.com/colinhacks/zod/releases/tag/v4.6.6 says the malicious commits were unpublished; GitHub confirms the rewritten release commit and its disclosed provenance predecessor have the identical tree 67baa8ff8a4500af08caea054afafcdbc26266b3. (284243fb0d65)

Review metrics

Metric	Value	Why it matters
Patch scope	2 dependency files, +9/-3 lines, no application code or tests	Growth consists of three nested dependency resolutions rather than a new implementation.

Labels

Label changes:

• add P3: Routine patch dependency maintenance with passing validation and no demonstrated urgent user regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine patch dependency maintenance with passing validation and no demonstrated urgent user regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 14, 2026, 5:08 PM ET / 21:08 UTC.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​radix-ui/​react-label@​2.1.16 ⏵ 2.1.17				+1
	npm/​@​radix-ui/​react-separator@​1.1.16 ⏵ 1.2.0				+1
	npm/​@​radix-ui/​react-slot@​1.4.0 ⏵ 1.5.0	+1		+1	+1
	npm/​@​radix-ui/​react-avatar@​1.2.7 ⏵ 1.3.1	+1		+1	+4
	npm/​@​radix-ui/​react-toggle-group@​1.1.20 ⏵ 1.2.1			+1	+1
	npm/​@​radix-ui/​react-dropdown-menu@​2.1.25 ⏵ 2.2.1			+1	+1
	npm/​@​radix-ui/​react-dialog@​1.2.0 ⏵ 1.3.1			+1	+1
	npm/​@​radix-ui/​react-popover@​1.2.0 ⏵ 1.3.1	+1		+1	+1
	npm/​@​radix-ui/​react-tooltip@​1.3.0 ⏵ 1.4.1			+1	+1
	npm/​@​radix-ui/​react-select@​2.3.8 ⏵ 2.4.1	+1		+1	+1
	npm/​convex-test@​0.0.61 ⏵ 0.0.62	+1		+1	+1
	npm/​@​vitest/​coverage-v8@​5.0.3 ⏵ 5.0.4			+1	-1
	npm/​vitest@​5.0.3 ⏵ 5.0.4			+1
	npm/​mime@​4.1.0 ⏵ 4.1.1			+1	-6
	npm/​lucide-react@​1.55.0 ⏵ 1.57.0	+1		+1	+1
	npm/​react@​19.3.0 ⏵ 19.3.1
	npm/​@​vercel/​oidc@​3.8.4 ⏵ 3.8.10				+2
	npm/​@​react-email/​ui@​6.11.1 ⏵ 6.11.2				+1
	npm/​@​tanstack/​react-router@​1.170.42 ⏵ 1.170.44				+2
	npm/​@​tanstack/​react-start@​1.168.61 ⏵ 1.169.2				+1
	npm/​oxfmt@​0.72.0 ⏵ 0.73.0			+1	+1
	npm/​react-dom@​19.3.0 ⏵ 19.3.1	-3		-3
	npm/​oxlint@​1.87.0 ⏵ 1.88.0	+1		+1	+2
	npm/​react-email@​6.11.1 ⏵ 6.11.2	+1		+1	+1
	npm/​zod@​4.6.5 ⏵ 4.6.7
	npm/​mermaid@​11.16.1 ⏵ 11.17.2	+1		+1
	npm/​resend@​6.32.1 ⏵ 6.33.0				+1
	npm/​@​playwright/​test@​1.64.0 ⏵ 1.64.1

View full report