[dependabot]

Bumps the development-minor-and-patch group with 8 updates in the / directory:

Package	From	To
@react-email/ui	6.11.2	6.11.3
@vitest/coverage-v8	5.0.4	5.0.5
jsdom	30.1.2	30.1.3
oxfmt	0.73.0	0.74.0
oxlint	1.88.0	1.89.0
react-email	6.11.2	6.11.3
skills	1.7.2	1.7.4
vitest	5.0.4	5.0.5

Updates @react-email/ui from 6.11.2 to 6.11.3

Release notes

Sourced from @​react-email/ui's releases.

@​react-email/ui@​6.11.3

Patch Changes

• 88562d0: The compatibility check now applies --esbuild-plugins when it bundles a template that passes config, theme or utility to <Tailwind>, so templates whose imports need a plugin no longer log a build error.
• 7f545c6: Bump next to 16.4.1 so the prebuilt preview server works in projects on Next.js 16.4. Next 16.4 loads a server/preview-props.json manifest that a 16.3 build doesn't emit, so email dev failed with ENOENT when next was deduped to 16.4.

Changelog

Sourced from @​react-email/ui's changelog.

6.11.3

Patch Changes

• 88562d0: The compatibility check now applies --esbuild-plugins when it bundles a template that passes config, theme or utility to <Tailwind>, so templates whose imports need a plugin no longer log a build error.
• 7f545c6: Bump next to 16.4.1 so the prebuilt preview server works in projects on Next.js 16.4. Next 16.4 loads a server/preview-props.json manifest that a 16.3 build doesn't emit, so email dev failed with ENOENT when next was deduped to 16.4.

Commits

• e0561e1 chore(root): version packages (#3791)
• 88562d0 fix(ui): apply --esbuild-plugins when the compatibility check bundles Tailwin...
• See full diff in compare view

Updates @vitest/coverage-v8 from 5.0.4 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• See full diff in compare view

Updates jsdom from 30.1.2 to 30.1.3

Release notes

Sourced from jsdom's releases.

v30.1.3

• Improved performance of getComputedStyle() and computed CSS property reads, including with stylesheets containing attribute selectors. (@​scttcper, @​asamuzaK)
• Fixed slowdowns when focusing elements and running interaction tests, which regressed in v30.1.2. (@​scttcper)
• Fixed XMLHttpRequest reusing credentials supplied to xhr.open() after cross-origin redirects, including in response to authentication challenges from the destination.
• Fixed XMLHttpRequest incorrectly sending and accepting cookies after cross-origin redirects back to the document's origin when xhr.withCredentials is false.
• Fixed exceptions from malformed CSS math functions, such as calc(0px - @submenu_space), while parsing documents, stylesheets, and style declarations. (@​rnavarro)
• Fixed getComputedStyle() ignoring style rules nested inside multiple @media rules.
• Fixed CSS shorthands overwriting longhands with higher priority or specificity during style computation, including declarations containing CSS variables.
• Fixed getComputedStyle() returning unresolved or inconsistent shorthand values, including for 'background', 'border', 'flex', 'font', 'margin', and 'padding', and incorrect shorthand defaults and inheritance.
• Fixed computed background positions to resolve font-relative lengths using the final font size and handle multiple image layers correctly.
• Fixed computed 'color' values depending on property read order, including unresolved color-mix() results, which regressed in v29.0.2.
• Fixed currentcolor border colors incorrectly becoming transparent when 'color' uses light-dark() or relative color syntax.
• Fixed CSS calculations that reduce to a percentage incorrectly producing pixel values, which regressed in v30.0.0.
• Fixed numeric font weights in the 'font' shorthand incorrectly setting 'line-height'.
• Fixed selector matching involving XML namespaces, and selectors such as [data-a|=""] failing to match empty values and values beginning with -. (@​asamuzaK)

Commits

• 058c0f5 30.1.3
• fcd1fd1 Cascade parsed longhands independently
• a3ee786 Cascade computed style properties on demand
• f42dc15 Resolve colors before caching or using currentcolor
• 074b1fb Compute background-position lengths against the final font size
• d19598c Apply style rules nested in multiple @​media rules
• 45d626c Rule out attribute selector subjects before matching
• 3ff0a5b Upgrade Undici and remove abort workarounds
• 8813bb1 Ignore CSS declarations with unparseable math functions
• 63712d8 Fix XHR credentials across redirects
• Additional commits viewable in compare view

Updates oxfmt from 0.73.0 to 0.74.0

Release notes

Sourced from oxfmt's releases.

oxfmt v0.74.0

🐛 Bug Fixes

• e236de0 formatter_tests: Skip conformance spec calls with non-literal options (#27957) (leaysgur)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• a5d8184 jsdoc: Parse code spans after quotes in descriptions (#27955) (leaysgur)
• 2645d2c formatter_markdown: Treat link destinations and footnote references as opaque to code span fences (#27948) (leaysgur)
• 4d8195c formatter_yaml: Keep a root plain scalar starting with a document marker verbatim (#27947) (leaysgur)
• 529b057 formatter_core: Keep front matter verbatim when body starts with indented delimiter (#27946) (leaysgur)
• c22a9b2 formatter: Treat static block with only empty statements as empty (#27945) (leaysgur)
• d3ff3f6 formatter/jsdoc: Write descriptions as written to not close the comment (#27823) (leaysgur)
• c4c1727 formatter/sort_imports: Keep comments after the last import (#27822) (leaysgur)
• a64677e formatter: Print JSDoc embedded snippets with LF (#27821) (leaysgur)
• 2c1cc20 formatter: Keep comment only Vue bindings as-is (#27820) (leaysgur)
• 1bf236d formatter/sort_imports: Do not use comments as import source (#27819) (leaysgur)
• 52ee29d formatter_yaml: Never start col-0 line with document marker or BOM (#27818) (leaysgur)
• 81c75e7 formatter/css: Keep glued css-in-js statement placeholders glued (#27814) (leaysgur)
• a1ef7f4 formatter: Keep typecast parens in same-operator binary and arrow chain (#27812) (leaysgur)
• de110ce formatter: Keep more parens around TSInstantiationExpression (#27811) (leaysgur)
• 8b02e90 formatter_json: Reject invalid JSON instead of dropping them (#27785) (leaysgur)
• 6fe4c1b formatter: Treat lone CR in JSX text and argument blank lines (#27780) (leaysgur)
• 5605362 oxfmt: Validate editorconfig as like oxfmtrc (#27778) (leaysgur)
• 5b2acb0 formatter_core: Report error position releative to CRLF source (#27777) (leaysgur)
• c78e80e formatter_core: Report parse error positions relative to the BOM-headed source (#27776) (leaysgur)
• 3a980c9 formatter_toml: Handle BOM like other languages (#27775) (leaysgur)
• 97c9fc4 oxfmt: Handle BOM in config JSON (#27774) (leaysgur)
• 28eb4a7 oxfmt: Print trailing newline for --list-different (#27773) (leaysgur)
• d2bea21 formatter: Glue comments to an opener in empty for-head slots and array holes (#27737) (leaysgur)
• 6a95ec1 formatter: Keep comment position on holey array (#27730) (leaysgur)
• 54769da formatter: Break after dangling line comment in holey array (#27729) (leaysgur)
• 99077ef formatter_json: Reject unary expressions other than signed numbers (#27728) (leaysgur)
• 22cd4cd formatter_json: Handle holey array and comments (#27727) (leaysgur)
• 644ca1c formatter: Do not indent logical chains whose right sides all inline (#27667) (leaysgur)
• a07a0fb formatter: Wrap comment-only JSX expression container in a group (#27666) (leaysgur)

⚡ Performance

• e220293 formatter: Check only the operator suppression mark in is_quiet (#27952) (leaysgur)
• e5fdc9c formatter_core: Write into one element stack through a concrete Formatter (#27559) (leaysgur)
• a342f7e formatter: Skip comment handling for nodes with no comment near them (#27557) (leaysgur)
• d8ce750 formatter: Write string literals with swapped quotes into the arena (#27558) (Yuji Sugiura)
• 1c393c0 formatter_core: Skip scanning texts with nothing to rewrite (#27561) (leaysgur)
• 1d3ef10 formatter_core: Keep the embedded IR when nothing in it is rewritten (#27673) (leaysgur)

📚 Documentation

• 1325225 oxfmt: Update useless comment prefix (#27956) (leaysgur)
• d0dd140 formatter: Note lossy cooked round-trip in template embeds (#27944) (leaysgur)
• 8a3a6c8 oxfmt: Update stale notes on the JSDoc string-out channel and fixture origins (#27824) (leaysgur)

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• See full diff in compare view

Updates oxlint from 1.88.0 to 1.89.0

Release notes

Sourced from oxlint's releases.

oxlint v1.89.0

💥 BREAKING CHANGES

• e3c1b11 ast: [BREAKING] Preserve lone surrogates in static property names (#27095) (Dunqing)
• a0a987c ast: [BREAKING] Preserve lone surrogates in static member names (#26677) (Dunqing)

🚀 Features

• 770ada4 linter: Mark vue 3 rules as recommended (#27717) (Cam McHenry)
• ba38c1d linter: Mark react/react-hooks rules as recommended (#27701) (Cam McHenry)
• d85a3ba linter: Mark promise rules as recommended (#27693) (Cam McHenry)
• e71c88a linter: Mark node rule as recommended (#27692) (Cam McHenry)
• 7213f61 linter: Mark nextjs rules as recommended (#27691) (Cam McHenry)
• d7c6b26 linter: Mark jsx-a11y rules as recommended (#27690) (Cam McHenry)
• 199dfdc linter: Mark jsdoc rules as recommended (#27689) (Cam McHenry)
• 780bff3 linter: Mark jest/vitest rules as recommended (#27672) (Cam McHenry)
• 6ae6859 linter: Mark import rules as recommended (#27671) (Cam McHenry)
• b7a1df3 linter: Mark unicorn rules as recommended (#27670) (Cam McHenry)
• c44a355 linter: Mark typescript rules as recommended from upstream (#27634) (Cam McHenry)
• 6b49dba linter: Mark eslint rules as recommended from upstream (#27632) (Cam McHenry)

🐛 Bug Fixes

• 7c47246 linter: Check module specifiers and string values that contain lone surrogates (#26717) (Dunqing)
• 782ab6e linter: Search string values without UTF-8 conversion (#26716) (Dunqing)
• 326904f linter/unicorn/no-useless-undefined: Allow undefined in React.useRef (#25027) (Chris Dokurno)
• f9cf165 linter/unicorn/prefer-spread: Ignore super method calls (#27868) (camc314)
• 00484e1 linter/eslint/prefer-const: Report destructuring assignments inside blocks (#27856) (camc314)
• 9c35461 linter/eslint/sort-vars: Report every out-of-order declaration (#27767) (camc314)
• 01e1c5e linter/unicorn/prefer-string-replace-all: Resolve regex variables (#27769) (camc314)
• 7f474d5 linter/eslint/no-loop-func: Detect writes after the loop (#27754) (camc314)
• 4b7fea6 linter/eslint/block-scoped-var: Ignore declarations without writes (#27760) (camc314)
• 2947917 linter/eslint/no-lonely-if: Check final else blocks in else-if chains (#27759) (camc314)
• fc039b5 linter/eslint/sort-imports: Check imports after other statements (#27749) (camc314)
• 1acba97 linter/unicorn/prefer-at: Report slice index reads once (#27762) (camc314)
• 6190e26 linter/eslint/prefer-arrow-callback: Ignore functions used as conditional tests (#27533) (Anzal Husain Abidi)
• b3cdaaf linter/eslint/sort-keys: Check computed identifier names (#27748) (camc314)
• 170e608 linter/unicorn/prefer-native-coercion-functions: Check object methods and function properties (#27750) (camc314)
• 9261df7 linter/unicorn/prefer-string-raw: Check object property values (#27758) (camc314)
• ddea86b linter/eslint/prefer-template: Report separate nested concatenations (#27764) (camc314)
• 2c67197 linter/eslint/no-unused-vars: Count conditional calls in sequences as uses (#27755) (camc314)
• 7f22fa0 linter/unicorn/prefer-regexp-test: Check logical operands in boolean contexts (#27761) (camc314)
• 3c44398 linter/eslint/class-methods-use-this: Count this in parameter defaults (#27756) (camc314)
• d85923f linter/eslint/no-param-reassign: Report rest parameter writes (#27765) (camc314)
• 8ea47bb linter/unicorn/prefer-type-error: Handle parenthesized type checks (#27766) (camc314)
• e96856c linter/unicorn/catch-error-name: Check unused underscore-prefixed names (#27751) (camc314)
• d8ca399 linter/unicorn/no-array-callback-reference: Ignore callback factory calls (#27763) (camc314)
• 1267ab8 linter/eslint/max-params: Count rest parameters (#27757) (camc314)
• 9ff25c3 linter/eslint/no-useless-assignment: Report dead stores to function parameters (#27735) (camc314)
• ee5e730 linter/eslint/no-setter-return: Check setters in property descriptors (#27731) (camc314)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.89.0] - 2026-10-19

🐛 Bug Fixes

• 9a424c2 oxlint,oxfmt: Correct Node.js TypeScript support range (#27699) (camc314)

Commits

• 07ed78f release(apps): oxlint v1.89.0 && oxfmt v0.74.0 (#27961)
• 9a424c2 fix(oxlint,oxfmt): correct Node.js TypeScript support range (#27699)
• See full diff in compare view

Updates react-email from 6.11.2 to 6.11.3

Release notes

Sourced from react-email's releases.

react-email@6.11.3

Patch Changes

• Updated dependencies [f356e81]
  • @​react-email/render@​2.1.1

Changelog

Sourced from react-email's changelog.

6.11.3

Patch Changes

• Updated dependencies [f356e81]
  • @​react-email/render@​2.1.1

Commits

• e0561e1 chore(root): version packages (#3791)
• See full diff in compare view

Updates skills from 1.7.2 to 1.7.4

Release notes

Sourced from skills's releases.

v1.7.4

Changelog

• Restore experimental_sync as the advertised command (#2542)

Contributors

@​quuu

v1.7.3

Changelog

• Align comments in CLI help examples (#2540)
• Promote skills sync to a stable command (#2539)
• Simplify README and split detailed documentation (#2538)
• Enable board collaboration for PR workflows (#2537)
• Show fx in the main install section (#2447)

Contributors

@​quuu

Commits

• a80e4c9 v1.7.4
• 0f57b70 Merge pull request #2542 from vercel-labs/fix/restore-experimental-sync
• 215c397 Restore experimental_sync as the advertised command
• 36f68cb v1.7.3
• 9d5b706 Merge pull request #2540 from vercel-labs/fix/help-example-alignment
• e68cdc4 Align comments in CLI help examples
• 617fc80 Merge pull request #2538 from vercel-labs/docs/readme-first-visit
• 2ad3a4b Merge pull request #2539 from vercel-labs/qua/sync-public-command
• 50bc705 Promote skills sync and fix readiness gaps
• f906c46 Simplify README and split detailed documentation
• Additional commits viewable in compare view

Updates vitest from 5.0.4 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

• Keep vite default fs.deny with api token file  -  by @​hi-ogawa, Hiroshi Ogawa and Claude Opus 5.5 in vitest-dev/vitest#11578 (28dc1)
• Handle quoted file names in --changed  -  by @​sheremet-va in vitest-dev/vitest#11583 (14921)
• Add data to the import.meta.hot stub  -  by @​sheremet-va in vitest-dev/vitest#11590 (3a828)
• Set skip in skipIf, ignore undefined options  -  by @​sheremet-va in vitest-dev/vitest#11591 (d523a)
• Skip builtin loading in async leak detector  -  by @​sheremet-va in vitest-dev/vitest#11598 (fe86a)
• Keep the import frame in native loader errors  -  by @​sheremet-va in vitest-dev/vitest#11599 (9697b)
• Run hook cleanups when a later hook fails  -  by @​sheremet-va in vitest-dev/vitest#11605 (6c5a4)
• Release mocks of finished test files  -  by @​sheremet-va in vitest-dev/vitest#11607 (e9c3d)
• Abort all running tests on cancel  -  by @​sheremet-va in vitest-dev/vitest#11606 (6621a)
• browser:
  • Ignore synthetic pagehide events  -  by @​sheremet-va in vitest-dev/vitest#11582 (ca081)
  • Run plugin buildStart on server creation  -  by @​sheremet-va in vitest-dev/vitest#11593 (ea611)
  • Drop late connections of closed sessions  -  by @​sheremet-va in vitest-dev/vitest#11600 (f161e)
  • Wait 30s for the browser to close  -  by @​sheremet-va in vitest-dev/vitest#11601 (6498b)
  • Run global setup once with instances  -  by @​sheremet-va in vitest-dev/vitest#11596 (8dd67)
• reporter:
  • End reason &[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39);failed&[#39](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest/issues/39); on worker crash  -  by @​AriPerkkio in vitest-dev/vitest#11568 (6ae8e)

    View changes on GitHub

Commits

• 7a825db chore: release v5.0.5 (#11609)
• 6621a72 fix: abort all running tests on cancel (#11606)
• e9c3d72 fix: release mocks of finished test files (#11607)
• 8dd67c2 fix(browser): run global setup once with instances (#11596)
• 6c5a447 fix: run hook cleanups when a later hook fails (#11605)
• 9697b38 fix: keep the import frame in native loader errors (#11599)
• 6498b66 fix(browser): wait 30s for the browser to close (#11601)
• f161e6d fix(browser): drop late connections of closed sessions (#11600)
• fe86a64 fix: skip builtin loading in async leak detector (#11598)
• 6ae8e89 fix(reporter): end reason 'failed' on worker crash (#11568)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 23, 2026 4:07pm UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR updates eight development dependencies and their resolved transitive packages.

Example: Installing the repository's development tools.

• Before: Vitest and its V8 coverage provider resolve to 5.0.4.
• After: Both resolve to 5.0.5.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	Focused maintenance with passing checks and no definite code finding, held below a stronger rating by the unresolved preview runtime pairing.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; passing CI supports the tooling updates, while the preview compatibility concern is recorded separately.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Repository contributors rely on current test, lint, formatting, preview, and compatibility tooling.
Reason: The existing Dependabot configuration explicitly groups development minor and patch updates, and this PR follows that established maintenance path.

Merge readiness

⛔ Blocked before merge - 2 items remain

Keep this PR open: current main still uses the older dependency versions. No definite introduced bug was established, but the email preview dependency pairing needs a compatibility decision before merge.

Priority: P3
Reviewed head: 992a34071fc85cc15b158d9844ee20e6a91b7a42
Owner decision: Required. See Decision needed.

Decision needed

• Question: Should this update align the Next override with the new email preview build, or defer the email preview updates?
• Recommendation: Align the preview runtime: Update the Next override and lockfile to a supported patched version compatible with the new preview build, then verify the email preview.
• Why: The existing override was retained for security maintenance, while the updated prebuilt UI declares a newer runtime; the available evidence establishes the mismatch but no actual preview failure.

Before merge

• Resolve merge risk - Before merge, the dependency owner must resolve the pairing of a Next 16.4.1-built email preview application with the repository's forced Next 16.3.8 runtime; existing passing checks do not exercise email:dev.
• Resolve maintainer decision - Resolve the maintainer decision shown above before merge.

Findings

None.

Tests

• Missing end-to-end proof: The existing checks do not start email:dev and render a template using the updated UI with the retained Next override.

Agent review details

How this fits together

The root manifest and Bun lockfile supply the test runner, DOM environment, linting, formatting, email preview server, and Agent Skills compatibility CLI used by development and CI.

flowchart TD
  A[Root package manifest] --> B[Bun lockfile]
  B --> C[Test and coverage tools]
  B --> D[Lint and formatting tools]
  B --> E[Email preview server]
  B --> F[Skills compatibility CLI]
  C --> G[Repository CI]
  D --> G
  F --> G

Loading

Technical review

Best possible solution:

Retain the scoped tooling updates and use a supported email preview build/runtime pairing.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported ClawHub bug; source inspection establishes the preview version mismatch without establishing a runtime failure.

Is this the best way to solve the issue?

Best-fix verdict: the grouped manifest and lockfile update is appropriately scoped; unrelated application changes or a replacement tooling layer would add no value, while the email preview runtime pairing remains unresolved.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 16530253b5fe.

Merge-risk options

Maintainer options:

1. Align the email preview dependency pair (recommended)
   The dependency owner updates the Next override and lockfile to match the preview package's supported runtime.
2. Defer the email preview updates
   The contributor retains the existing email CLI/UI pair while keeping the other tooling updates.

Provenance checked

• Development dependency versions and security overrides keeps the original intent (cf3788c: Refresh supported dependency lines and remediate advisories while retaining compatibility boundaries and security overrides.)
• Email preview application keeps the original intent (e319df0: Provide a local preview command for the shared transactional email templates.)
• Skills CLI compatibility dependency keeps the original intent (fa653d4: Run compatibility tests against the installed real CLI without resolving packages during the test.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned changes remain absent from main: The introduced diff updates eight manifest entries plus their lockfile resolutions; the verified base retains all eight older versions. (package.json:166, 992a34071fc8)
• Checks pass for the reviewed head: Static, unit, packages, types-build, HTTP e2e, browser smoke, and local-auth checks succeeded on the reviewed head. The cancelled auto-response check supplies no evidence of a dependency-caused failure. (.github/workflows/ci.yml:33, 992a34071fc8)
• Email preview runtime remains overridden: The updated UI package declares Next 16.4.1 in bun.lock, while package.json continues to override Next to 16.3.8. The existing email:dev command runs that prebuilt preview application; template rendering tests do not start it. (package.json:204, 992a34071fc8)
• Upstream preview contract applies directly: ClawHub executes this dependency through email:dev. Its startDevServer imports Next from the installed UI location and serves the packaged application with dev:false; upstream changed the prebuilt application to Next 16.4.1 because build/runtime version differences affected preview startup. (packages/react-email/src/cli/utils/preview/start-dev-server.ts, e0561e164e9c)
• Existing dependency-maintenance intent: The merged refresh at chore(deps): refresh compatible packages and patch advisories #3953 updated supported dependency lines while retaining security overrides and separating major upgrades. This PR retains those overrides and keeps Vitest and coverage versions aligned. (package.json:178, cf3788c9f718)
• Discussion and related updates: The full body matches supplied SHA256 ec144544e9ee1d73854957fe51646f2416c72c6b20650288c227323a14d60c5d. Discussion contains deployment and review-status bot comments. Earlier overlapping updates chore(deps-dev): bump the development-minor-and-patch group with 4 updates #3992 and chore(deps-dev): bump the development-minor-and-patch group across 1 directory with 5 updates #4000 were closed unmerged, so neither establishes implementation on main.

Likely related people:

• Patrick Erichsen: Raw commit e319df0 adds package.json:43 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: e319df076006; files: package.json)
• Peter Steinberger: Raw commit 43cf413 adds package.json:149 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 43cf413d1c46; files: package.json)

Review metrics

Metric	Value	Why it matters
Patch scope	+70/-68 across 2 files; 0 application-source changes	The manifest and lockfile changes are consistent with a grouped dependency refresh.

Labels

Label changes:

• add P3: Routine development-tool maintenance with no demonstrated production regression.
• add merge-risk: 🚨 compatibility: The updated email preview package declares Next 16.4.1 while the repository forces Next 16.3.8.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.

Label justifications:

• P3: Routine development-tool maintenance with no demonstrated production regression.
• merge-risk: 🚨 compatibility: The updated email preview package declares Next 16.4.1 while the repository forces Next 16.3.8.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Resolve the email preview build/runtime pairing and verify that a real template renders through email:dev.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 23, 2026, 12:20 PM ET / 16:20 UTC.