Skip to content

chore(deps): bump the production-minor-and-patch group across 1 directory with 9 updates - #4020

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-3b2761abc0
Closed

chore(deps): bump the production-minor-and-patch group across 1 directory with 9 updates#4020
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/bun/production-minor-and-patch-3b2761abc0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-minor-and-patch group with 9 updates in the / directory:

Package From To
@react-email/render 2.1.0 2.1.1
@tanstack/react-router 1.170.44 1.170.45
@tanstack/react-start 1.169.2 1.169.3
convex 1.46.0 1.47.0
h3 2.0.2 2.0.5
ignore 7.0.12 7.0.13
lucide-react 1.57.0 1.59.0
resend 6.33.0 6.34.1
undici 7.30.0 7.30.1

Updates @react-email/render from 2.1.0 to 2.1.1

Release notes

Sourced from @​react-email/render's releases.

@​react-email/render@​2.1.1

Patch Changes

  • f356e81: render now only loads prettier when pretty: true is used, so rendering without it no longer fails with "Failed to load external module prettier" in Next.js dev with Turbopack on Bun
Changelog

Sourced from @​react-email/render's changelog.

2.1.1

Patch Changes

  • f356e81: render now only loads prettier when pretty: true is used, so rendering without it no longer fails with "Failed to load external module prettier" in Next.js dev with Turbopack on Bun
Commits

Updates @tanstack/react-router from 1.170.44 to 1.170.45

Release notes

Sourced from @​tanstack/react-router's releases.

@​tanstack/react-router@​1.170.45

Patch Changes

  • Updated dependencies [18154b1]:
    • @​tanstack/router-core@​1.171.38
Changelog

Sourced from @​tanstack/react-router's changelog.

1.170.45

Patch Changes

  • Updated dependencies [18154b1]:
    • @​tanstack/router-core@​1.171.38
Commits
  • caaf32d ci: Version Packages (#8733)
  • 18154b1 perf: lower manifest script preload priority (#8212)
  • 7a06725 chore(deps): upgrade Vitest to 5 and migrate benchmarks to the bench fixture ...
  • See full diff in compare view

Updates @tanstack/react-start from 1.169.2 to 1.169.3

Release notes

Sourced from @​tanstack/react-start's releases.

@​tanstack/react-start@​1.169.3

Patch Changes

  • Updated dependencies [18154b1]:
    • @​tanstack/start-server-core@​1.169.44
    • @​tanstack/react-router@​1.170.45
    • @​tanstack/react-start-client@​1.168.43
    • @​tanstack/react-start-rsc@​0.1.64
    • @​tanstack/react-start-server@​1.167.51
    • @​tanstack/start-client-core@​1.170.38
    • @​tanstack/start-plugin-core@​1.171.54
Changelog

Sourced from @​tanstack/react-start's changelog.

1.169.3

Patch Changes

  • Updated dependencies [18154b1]:
    • @​tanstack/start-server-core@​1.169.44
    • @​tanstack/react-router@​1.170.45
    • @​tanstack/react-start-client@​1.168.43
    • @​tanstack/react-start-rsc@​0.1.64
    • @​tanstack/react-start-server@​1.167.51
    • @​tanstack/start-client-core@​1.170.38
    • @​tanstack/start-plugin-core@​1.171.54
Commits

Updates convex from 1.46.0 to 1.47.0

Changelog

Sourced from convex's changelog.

1.47.0

  • Fixed the next step printed by npx convex project create. It suggested npx convex deployment create <team>:<project>:dev --type dev, which always failed because dev is reserved for your default dev deployment. It now suggests a dev/my-feature reference and passes --select.
  • npx convex deploy now asks for confirmation before creating or changing an index on a large table, since the deploy blocks until the index is backfilled. Stage the index (staged: true) to backfill it in the background instead, or pass the new --skip-large-indexes-check flag to proceed without confirmation. That flag also covers deleting large indexes, replacing the hidden --allow-deleting-large-indexes flag, which keeps working.
  • The envList MCP tool now returns only environment variable names by default, so secrets stay out of the agent's context. Pass includeValues: true to get the values too, or use envGet to read a single variable.
  • npx convex env list and npx convex env default list have a new --include-values flag for printing values explicitly. Values are still printed by default. The docs and help text now use --include-values wherever the values are needed, like npx convex env list --include-values > .env.convex, and --names-only for just listing variables.
  • Added .staged() to defineTable for validating a schema change in the background instead of blocking the deploy on a scan of the table. Pass the fields to add or change, set a field to undefined to remove it, or pass a full validator. The current validator stays enforced while Convex checks existing documents and new writes against the staged one. npx convex deploy and npx convex deploy --dry-run report each staged table as validating, validated, or failed, and the dry-run warning about scanning large tables now suggests staging the validator. Once a staged validator is validated, moving it into defineTable deploys without scanning the table. A deploy that would discard pending or completed staged validation asks for confirmation; pass --allow-unstaging-schema to skip the prompt in CI. See https://docs.convex.dev/database/schemas#staged-validators.
  • ctx.meta.getSnapshotTs() is now public API. It returns the database timestamp of the snapshot the current function reads from, in nanoseconds, on the same clock as db.vars.commitTs. See https://docs.convex.dev/database/advanced/commit-timestamp.
  • convex/server exports getServiceUrl, which returns the base URL of a Convex-managed service such as the AI gateway, to pair with getServiceToken, along with a ServiceName type. The client no longer rejects service names it doesn't know about, so libraries can adopt new services without requiring a newer convex version.
  • Fixed the Convex MCP server stalling permanently after overlapping tool calls.
  • Fixed the error reported when a function or symbol is passed where a Convex value is expected. It now names the unsupported type and its path, like Function "[Function]" is not a supported Convex type at .cb, instead of throwing Cannot read properties of undefined (reading 'length').
  • When a push fails because an environment variable used by auth.config.ts is not set on the deployment, the CLI now prints the npx convex env set commands to run and a link to the deployment's environment variable settings.

... (truncated)

Commits

Updates h3 from 2.0.2 to 2.0.5

Release notes

Sourced from h3's releases.

v2.0.5

compare changes

🩹 Fixes

  • cli: Harden h3 docs page handling (7150b0e)

v2.0.4

compare changes

📦 Build

  • Remove bundled docs and open h3.dev from h3 docs (#1602)

🏡 Chore

v2.0.3

compare changes

🩹 Fixes

  • body: Match form content type case-insensitively in readBody (#1601)
  • static: Serve .wasm as application/wasm (#1581)
  • static: Match file extensions case-insensitively (#1580)
  • sse: Preserve empty event ids (#1590)
  • query: Decode valid escapes next to a malformed one (#1582)
  • response: Omit HEAD body for default errors (#1595)
  • tracing: Mount nested apps passed to use() (#1576)
  • cors: Make stateful origin regex checks repeatable (#1589)

📖 Documentation

  • Fix code example (#1587)
  • Fix broken section anchors (#1577)

✅ Tests

  • Accept exact loopback addresses in fingerprint checks (#1588)

❤️ Contributors

... (truncated)

Changelog

Sourced from h3's changelog.

v2.0.5

compare changes

🩹 Fixes

  • cli: Harden h3 docs page handling (7150b0e)

❤️ Contributors

v2.0.4

compare changes

📦 Build

  • Remove bundled docs and open h3.dev from h3 docs (#1602)

🏡 Chore

❤️ Contributors

v2.0.3

compare changes

🩹 Fixes

  • body: Match form content type case-insensitively in readBody (#1601)
  • static: Serve .wasm as application/wasm (#1581)
  • static: Match file extensions case-insensitively (#1580)
  • sse: Preserve empty event ids (#1590)
  • query: Decode valid escapes next to a malformed one (#1582)
  • response: Omit HEAD body for default errors (#1595)
  • tracing: Mount nested apps passed to use() (#1576)
  • cors: Make stateful origin regex checks repeatable (#1589)

📖 Documentation

  • Fix code example (#1587)
  • Fix broken section anchors (#1577)

🏡 Chore

... (truncated)

Commits
  • b64166a chore(release): v2.0.5
  • 7150b0e fix(cli): harden h3 docs page handling
  • 2084eca chore(release): v2.0.4
  • 1a1f488 chore: update srvx
  • b48b480 build: remove bundled docs and open h3.dev from h3 docs (#1602)
  • d8d726f chore(release): v2.0.3
  • badc762 fix(cors): make stateful origin regex checks repeatable (#1589)
  • d37911d chore: update deps
  • 3444ff7 fix(tracing): mount nested apps passed to use() (#1576)
  • 4ab19f7 fix(response): omit HEAD body for default errors (#1595)
  • Additional commits viewable in compare view

Updates ignore from 7.0.12 to 7.0.13

Commits
  • 4320083 bump version 7.0.13
  • 3fe0ab1 types: export TestResult, IgnoreRule, PatternParams and Pathname
  • d449c4a docs: say exactly when unignored is false although nothing is ignored
  • 5c4c3fb docs: say what a dot component in a Pathname does
  • 2d3959b refactor: drop backslash arithmetic with no reachable input
  • d13f340 tidy up how a quoted backslash compiles
  • 26b1d1a tidy up how a few characters compile
  • a8ce6f3 docs: describe the wildcard pin as it now works
  • 3ba88de Merge pull request #174 from Yuren0312/docs-issue-116-clarify-unignored
  • d132c50 docs: clarify the two meanings of {ignored: false, unignored: false} of .test()
  • Additional commits viewable in compare view

Updates lucide-react from 1.57.0 to 1.59.0

Release notes

Sourced from lucide-react's releases.

Version 1.59.0

What's Changed

Full Changelog: lucide-icons/lucide@1.58.0...1.59.0

Version 1.58.0

What's Changed

New Contributors

Full Changelog: lucide-icons/lucide@1.57.0...1.58.0

Commits

Updates resend from 6.33.0 to 6.34.1

Release notes

Sourced from resend's releases.

v6.34.1

What's Changed

Full Changelog: resend/resend-node@v6.34.0...v6.34.1

v6.34.0

What's Changed

New Contributors

Full Changelog: resend/resend-node@v6.33.0...v6.34.0

Commits
  • 7943103 fix(inboxes): match the search and update draft types to the API (#1165)
  • 2e3bb06 feat(inboxes): add label endpoints, rename fields & accept email addresses (#...
  • 9edd6ed feat(inboxes): type created_at and updated_at on list and get inbox (#1160)
  • f765894 fix: reject dot segments in request paths (#1139)
  • 10d66ce fix(templates): preserve error response headers in publish chains (#1135)
  • 022286e fix(batch): avoid mutating the payload when rendering react emails (#1136)
  • 13c7086 feat(inboxes): type the inbox agent tone as one of the presets (#1157)
  • e6dff37 fix(inboxes): accept plain strings for inbox label colors (#1155)
  • See full diff in compare view

Updates undici from 7.30.0 to 7.30.1

Release notes

Sourced from undici's releases.

v7.30.1

Security fixes

High severity

Denial of service via TLS 1.2 certificate-changing renegotiation

CVE-2026-87018 · GHSA-qrxm-fqhp-jwvm

A malicious or compromised HTTPS server could crash the Node.js process by initiating TLS 1.2 renegotiation and presenting a different, CA-trusted certificate whose hostname did not match the requested host. The resulting socket error reached an assertion in undici's HTTP/1.1 and HTTP/2 connection handling. This release handles post-connect certificate errors without terminating the process.

TLS certificate validation bypass through dropped Agent options

CVE-2026-109383 · GHSA-2m5v-pch6-74hx

Agent used a JSON-based clone for constructor options, which silently removed function-valued TLS options such as checkServerIdentity. Applications relying on custom certificate or public-key verification could therefore accept a certificate that the callback was intended to reject. This release preserves TLS options when creating per-origin dispatchers.

Cache poisoning and cross-user disclosure through cross-origin redirects

CVE-2026-109829 · GHSA-4w7w-5xrc-9h26

When an originless Agent combined redirect and shared-cache interceptors as compose(redirect(), cache()), a response from a cross-origin redirect could be stored under the original URL. This could allow persistent cache poisoning or disclosure of user-specific responses to later callers. This release verifies the response origin before caching and preserves redirect-hop cache-control policy.

Denial of service through excessive Content-Encoding values

CVE-2026-109869 · GHSA-xjj6-f33q-929c

A malicious HTTP server could crash the Node.js process by returning more than five content codings and closing the connection before sending the body. Although fetch() rejected the response, an error from an orphaned internal stream could remain unhandled. This release validates the content-encoding chain before creating the body stream and aborts oversized chains safely.

Medium severity

Denial of service through the decompress interceptor

CVE-2026-87029 · GHSA-55wc-3pg8-jfw6

An exception thrown by a downstream response handler from an asynchronous decompression callback could escape as an uncaught exception. A server could trigger this when decompress was composed with a handler such as dump with a size limit. This release converts downstream handler exceptions into per-request errors.

Subresource Integrity bypass with non-lowercase algorithm tokens

CVE-2026-109841 · GHSA-f72v-6w45-q472

fetch() treated valid mixed-case or uppercase SRI algorithm tokens, such as SHA256, as unknown and could accept a response whose body did not match the configured digest. This release normalizes algorithm tokens before validation and digest selection.

Denial of service through unbounded EventSource parser state

CVE-2026-109924 · GHSA-4qv8-2p9j-2685

A malicious Server-Sent Events endpoint could exhaust process memory by sending many tiny data: fields without completing an event, or by splitting an unfinished line across many chunks. This release bounds retained EventSource parser state, including field counts, buffered chunks, unfinished-line length, and retained field data.

Denial of service through unbounded automatic WebSocket PONG buffering

... (truncated)

Commits
  • 7507102 Bumped v7.30.1 (#6022)
  • 7d60c7b [v7.x] fix(cookies): backport #5663, #5808 and #5832 (#6019)
  • 0227d5d fix: avoid unbounded recursion in Set-Cookie attribute parser (#5757) (#5997)
  • 5394462 fix(websocket): bound automatic PONG writes under backpressure
  • 2991627 fix(eventsource): bound retained SSE parser state
  • 18bc8a1 fix(sri): accept non-lowercase algorithm tokens
  • 63cba77 fix(decompress): converge downstream handler throws to per-request errors
  • 07ded49 fix(fetch): abort excessive content encoding responses
  • b20b82a fix(cache): prevent cross-origin redirect cache confusion
  • 04cb74b fix: preserve Agent connection options
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the production-minor-and-patch group across 1 direc…
8f413a3 
…tory with 9 updates

Bumps the production-minor-and-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@react-email/render](https://github.com/resend/react-email/tree/HEAD/packages/render) | `2.1.0` | `2.1.1` |
| [@tanstack/react-router](https://github.com/TanStack/router/tree/HEAD/packages/react-router) | `1.170.44` | `1.170.45` |
| [@tanstack/react-start](https://github.com/TanStack/router/tree/HEAD/packages/react-start) | `1.169.2` | `1.169.3` |
| [convex](https://github.com/get-convex/convex-backend/tree/HEAD/npm-packages/convex) | `1.46.0` | `1.47.0` |
| [h3](https://github.com/h3js/h3) | `2.0.2` | `2.0.5` |
| [ignore](https://github.com/kaelzhang/node-ignore) | `7.0.12` | `7.0.13` |
| [lucide-react](https://github.com/lucide-icons/lucide/tree/HEAD/packages/lucide-react) | `1.57.0` | `1.59.0` |
| [resend](https://github.com/resend/resend-node) | `6.33.0` | `6.34.1` |
| [undici](https://github.com/nodejs/undici) | `7.30.0` | `7.30.1` |



Updates `@react-email/render` from 2.1.0 to 2.1.1
- [Release notes](https://github.com/resend/react-email/releases)
- [Changelog](https://github.com/resend/react-email/blob/canary/packages/render/CHANGELOG.md)
- [Commits](https://github.com/resend/react-email/commits/@react-email/render@2.1.1/packages/render)

Updates `@tanstack/react-router` from 1.170.44 to 1.170.45
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-router/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-router@1.170.45/packages/react-router)

Updates `@tanstack/react-start` from 1.169.2 to 1.169.3
- [Release notes](https://github.com/TanStack/router/releases)
- [Changelog](https://github.com/TanStack/router/blob/main/packages/react-start/CHANGELOG.md)
- [Commits](https://github.com/TanStack/router/commits/@tanstack/react-start@1.169.3/packages/react-start)

Updates `convex` from 1.46.0 to 1.47.0
- [Changelog](https://github.com/convex/convex-backend/blob/main/npm-packages/convex/CHANGELOG.md)
- [Commits](https://github.com/get-convex/convex-backend/commits/HEAD/npm-packages/convex)

Updates `h3` from 2.0.2 to 2.0.5
- [Release notes](https://github.com/h3js/h3/releases)
- [Changelog](https://github.com/h3js/h3/blob/main/CHANGELOG.md)
- [Commits](h3js/h3@v2.0.2...v2.0.5)

Updates `ignore` from 7.0.12 to 7.0.13
- [Release notes](https://github.com/kaelzhang/node-ignore/releases)
- [Commits](kaelzhang/node-ignore@7.0.12...7.0.13)

Updates `lucide-react` from 1.57.0 to 1.59.0
- [Release notes](https://github.com/lucide-icons/lucide/releases)
- [Commits](https://github.com/lucide-icons/lucide/commits/1.59.0/packages/lucide-react)

Updates `resend` from 6.33.0 to 6.34.1
- [Release notes](https://github.com/resend/resend-node/releases)
- [Changelog](https://github.com/resend/resend-node/blob/canary/CHANGELOG.md)
- [Commits](resend/resend-node@v6.33.0...v6.34.1)

Updates `undici` from 7.30.0 to 7.30.1
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v7.30.0...v7.30.1)

---
updated-dependencies:
- dependency-name: "@react-email/render"
  dependency-version: 2.1.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-router"
  dependency-version: 1.170.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: "@tanstack/react-start"
  dependency-version: 1.169.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: convex
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: h3
  dependency-version: 2.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: ignore
  dependency-version: 7.0.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
- dependency-name: lucide-react
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: resend
  dependency-version: 6.34.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-minor-and-patch
- dependency-name: undici
  dependency-version: 7.30.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 22, 2026
@vercel

vercel Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
clawhub Ready Ready Preview Oct 22, 2026 4:11pm UTC

Request Review

@clawsweeper

clawsweeper Bot commented Oct 22, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

@clawsweeper clawsweeper Bot added P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Oct 22, 2026
@clawsweeper

clawsweeper Bot commented Oct 22, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge.

What this changes

This PR updates nine dependencies and their lockfile resolutions across the app and both CLI packages.

Example: A deployment adds an unstaged index to a table with 100,000 documents.

  • Before: Convex 1.46 can proceed with the blocking backfill.
  • After: Convex 1.47 requires confirmation and rejects a noninteractive deployment unless the explicit bypass is supplied; staging the index avoids that blocking backfill.

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A focused dependency update supported by upstream source inspection and passing principal CI gates; no standalone behavioral proof is required for this bot PR.
Proof confidence 🐚 platinum hermit (4/6) This Dependabot maintenance PR is outside the ordinary contributor proof gate; current-head CI covers built CLI, HTTP, and browser entry points, while the Vercel Ready comment establishes deployment status only.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The app and CLIs remain on older dependency releases that lack upstream fixes.
Reason: The configured minor-and-patch update policy supports this scoped refresh, which preserves existing CLI compatibility constraints and security overrides.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: the dependency updates are absent from current main, include upstream security fixes, and have no concrete blocking findings.

Priority: P2
Reviewed head: 8f413a3599f041d468e623517e4b07d7fd7a2049

Before merge

None.

Findings

None.

Agent review details

How this fits together

The manifests and Bun lockfile select libraries used by the web server, Convex deployment tooling, transactional email rendering, upload filtering, and CLI HTTP transport.

flowchart TD
  A[Workspace manifests] --> B[Bun lockfile]
  B --> C[Web app and server]
  B --> D[Convex tooling and email]
  B --> E[Public and admin CLIs]
  C --> F[Browser requests]
  E --> G[Registry requests and uploads]
Loading

Technical review

Best possible solution:

Land the aligned dependency refresh through the existing validation gates while retaining the documented staged-index deployment path.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported ClawHub bug; the version changes and upstream deployment guard are directly verifiable in source.

Is this the best way to solve the issue?

This is the smallest appropriate update: changing manifests and lockfile together preserves reproducibility, while lockfile-only updates would leave fresh resolutions inconsistent.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6e6c57d1b681.

Provenance checked

  • Existing dependency versions keeps the original intent (chore(deps): refresh compatible packages and patch advisories #3953: Refresh supported dependency lines and patch advisories while retaining runtime and compiler compatibility.)
  • Security override metadata keeps the original intent (fix(deps): retain security patches during dependency resolution #3852: Keep fresh dependency resolution from restoring vulnerable versions.)
  • CLI Undici major-version boundary keeps the original intent (201713c: Avoid incompatible Undici major updates; subsequent merged maintenance explicitly retained Undici 7.)
  • Convex large-index deployment confirmation changes intended behavior with a stated reason (93243182acdc129601632fdf679cf6f2dcfffcce: Prevent unexpectedly blocking deployments on large index backfills and direct operators toward staged indexes; the PR release notes disclose this change.)

Testing

Proof path: shipped entry point.

Security

None.

Evidence

What I checked:

Likely related people:

  • Patrick Erichsen: Raw commit 39ff7db adds package.json:194 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 39ff7db30c2e; files: package.json)
  • Peter Steinberger: Raw commit c3b6995 adds package.json:197 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c3b69959a750; files: package.json)

Review metrics

Metric Value Why it matters
Change scope 4 dependency files, +50/-52; 0 application or test code changes The update stays within manifests and their generated dependency resolutions.

Labels

Label changes:

  • add P2: A useful dependency refresh with upstream security fixes, without an established urgent ClawHub incident or introduced regression.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

  • P2: A useful dependency refresh with upstream security fixes, without an established urgent ClawHub incident or introduced regression.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 22, 2026, 12:22 PM ET / 16:22 UTC.

@dependabot @github

dependabot Bot commented on behalf of github Oct 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Oct 23, 2026
@dependabot
dependabot Bot deleted the dependabot/bun/production-minor-and-patch-3b2761abc0 branch October 23, 2026 16:04

This branch was successfully deployed

1 active deployment
Preview – clawhub — 8f413a35 Deployed Oct 22, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code P2 Normal backlog priority with limited blast radius. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants