chore(deps): upgrade all npm dependencies to latest - #2125
Conversation
|
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
📝 WalkthroughWalkthrough
ChangesDependency refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Mesa DescriptionTL;DRUpgrades all npm dependencies in What changed?
Description generated by Mesa. Update settings |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates multiple dependency and optional dependency versions in package.json. Feedback was provided regarding a potential version mismatch issue where @openai/codex is defined with a caret range while its platform-specific optional dependencies are pinned to exact versions. Pinning @openai/codex to the exact version is recommended to prevent runtime errors.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "@oh-my-pi/pi-natives": "^17.0.5", | ||
| "@oh-my-pi/swarm-extension": "^13.17.0", | ||
| "@openai/codex": "^0.144.0", | ||
| "@openai/codex": "^0.144.6", |
There was a problem hiding this comment.
Using a caret range (^0.144.6) for @openai/codex while pinning its platform-specific optional dependencies to exact versions (e.g., npm:@openai/codex@0.144.6-darwin-arm64) can lead to version mismatches. If a new patch version of @openai/codex is released, the main package will resolve to the newer version, but the optional platform-specific packages will remain pinned to 0.144.6, potentially causing runtime errors.
To ensure consistency, pin @openai/codex to the exact version 0.144.6.
| "@openai/codex": "^0.144.6", | |
| "@openai/codex": "0.144.6", |
![indent-zero[bot]](https://avatars.githubusercontent.com/in/1426746?s=60&v=4){kind=small}
| "oxfmt": "^0.58.0", | ||
| "oxlint": "^1.73.0", | ||
| "pinchtab": "^0.14.1", | ||
| "openclaw": "^2026.7.1-2", |
There was a problem hiding this comment.
openclaw pin uses a prerelease suffix, tripping two latent issues:
-
Semver
^won't track future stable releases. Under npm semver,^X.Y.Z-<pre>only satisfies versions>=X.Y.Z-<pre>, <X.Y.Z+1that are prereleases of the sameX.Y.Z. So^2026.7.1-2will NOT match2026.7.2or2026.8.0when upstream cuts a non-prerelease build. Auto-upgrade tooling will keep proposing narrow bumps rather than tracking real releases. -
install-npm-globals.shwon't recognize it as installed. Athome-manager/modules/npm-globals/install-npm-globals.sh:263the wanted version is derived via:wanted_ver="${wanted//[^0-9.]/}"which strips the dash:
^2026.7.1-2→2026.7.12. The installed package'spackage.json.versionis2026.7.1-2, sosort -Von2026.7.12vs2026.7.1-2never reports equality and thealready installed, skippingbranch (line 271) is never taken. Result: openclaw gets reinstalled throughbun add --globalevery activation (extra network + postinstall cost + repeatedly re-hitting the bun-npm-shim purge path).
The prior pin ^2026.6.11 had no dash and didn't trigger either issue. If upstream is deliberately publishing under a -2 prerelease tag, consider either pinning exactly ("openclaw": "2026.7.1-2") so intent is explicit, or teaching the install script's version comparator to keep - (e.g. wanted_ver="${wanted#^}").
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
3 issues found and verified against the latest diff
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="package.json">
<violation number="1" location="package.json:15">
P2: This update bypasses the repository's mandatory seven-day release quarantine and records newly published packages before that review window expires, weakening the supply-chain protection for the trusted CLI dependencies. Keeping the lockfile at eligible releases, or recording an explicit policy exception and review for the early packages, would preserve the intended gate.</violation>
<violation number="2" location="package.json:30">
P2: The `omp-swarm` CLI is left outside its supported agent API range by this major bump: `@oh-my-pi/swarm-extension@13.17.0` declares a `^13` peer, but this line resolves agent 17.0.5. A swarm-extension release compatible with agent 17, or an agent version within the extension's declared range, would keep the installed toolchain consistent.</violation>
<violation number="3" location="package.json:64">
P2: The `^2026.7.1-2` range has two problems:
1. **Semver caret with a prerelease suffix is overly narrow.** Per npm semver rules, `^X.Y.Z-pre` only satisfies prereleases of the *same* `X.Y.Z` tuple — it won't match `2026.7.2` or `2026.8.0` when upstream cuts a stable release. This means future dependency-update tooling will keep proposing narrow bumps rather than naturally tracking new stable versions.
2. **The install script's version comparator misparses the dash.** In `install-npm-globals.sh` the expression `wanted_ver="${wanted//[^0-9.]/}"` strips the `-2` suffix, yielding `2026.7.12`. The installed package reports `2026.7.1-2`, so `sort -V` never finds equality and the "already installed, skipping" branch is never taken — causing `openclaw` to be reinstalled via `bun add --global` on every activation.
Consider either pinning exactly (`"openclaw": "2026.7.1-2"`) to make intent explicit, or waiting for a stable upstream release without the prerelease suffix.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| "@anthropic-ai/claude-code": "^2.1.205", | ||
| "@augmentcode/auggie": "^0.32.0", | ||
| "@biomejs/biome": "^2.5.3", | ||
| "@ampcode/cli": "^0.0.1784437277-g74ac3c", |
There was a problem hiding this comment.
P2: This update bypasses the repository's mandatory seven-day release quarantine and records newly published packages before that review window expires, weakening the supply-chain protection for the trusted CLI dependencies. Keeping the lockfile at eligible releases, or recording an explicit policy exception and review for the early packages, would preserve the intended gate.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 15:
<comment>This update bypasses the repository's mandatory seven-day release quarantine and records newly published packages before that review window expires, weakening the supply-chain protection for the trusted CLI dependencies. Keeping the lockfile at eligible releases, or recording an explicit policy exception and review for the early packages, would preserve the intended gate.</comment>
<file context>
@@ -12,86 +12,86 @@
- "@anthropic-ai/claude-code": "^2.1.205",
- "@augmentcode/auggie": "^0.32.0",
- "@biomejs/biome": "^2.5.3",
+ "@ampcode/cli": "^0.0.1784437277-g74ac3c",
+ "@anthropic-ai/claude-code": "^2.1.215",
+ "@augmentcode/auggie": "^0.33.0",
</file context>
| "@nanocollective/nanocoder": "^1.28.1", | ||
| "@oh-my-pi/pi-coding-agent": "^16.3.15", | ||
| "@oh-my-pi/pi-natives": "^16.3.15", | ||
| "@oh-my-pi/pi-coding-agent": "^17.0.5", |
There was a problem hiding this comment.
P2: The omp-swarm CLI is left outside its supported agent API range by this major bump: @oh-my-pi/swarm-extension@13.17.0 declares a ^13 peer, but this line resolves agent 17.0.5. A swarm-extension release compatible with agent 17, or an agent version within the extension's declared range, would keep the installed toolchain consistent.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 30:
<comment>The `omp-swarm` CLI is left outside its supported agent API range by this major bump: `@oh-my-pi/swarm-extension@13.17.0` declares a `^13` peer, but this line resolves agent 17.0.5. A swarm-extension release compatible with agent 17, or an agent version within the extension's declared range, would keep the installed toolchain consistent.</comment>
<file context>
@@ -12,86 +12,86 @@
"@nanocollective/nanocoder": "^1.28.1",
- "@oh-my-pi/pi-coding-agent": "^16.3.15",
- "@oh-my-pi/pi-natives": "^16.3.15",
+ "@oh-my-pi/pi-coding-agent": "^17.0.5",
+ "@oh-my-pi/pi-natives": "^17.0.5",
"@oh-my-pi/swarm-extension": "^13.17.0",
</file context>
| "oxfmt": "^0.58.0", | ||
| "oxlint": "^1.73.0", | ||
| "pinchtab": "^0.14.1", | ||
| "openclaw": "^2026.7.1-2", |
There was a problem hiding this comment.
P2: The ^2026.7.1-2 range has two problems:
-
Semver caret with a prerelease suffix is overly narrow. Per npm semver rules,
^X.Y.Z-preonly satisfies prereleases of the sameX.Y.Ztuple — it won't match2026.7.2or2026.8.0when upstream cuts a stable release. This means future dependency-update tooling will keep proposing narrow bumps rather than naturally tracking new stable versions. -
The install script's version comparator misparses the dash. In
install-npm-globals.shthe expressionwanted_ver="${wanted//[^0-9.]/}"strips the-2suffix, yielding2026.7.12. The installed package reports2026.7.1-2, sosort -Vnever finds equality and the "already installed, skipping" branch is never taken — causingopenclawto be reinstalled viabun add --globalon every activation.
Consider either pinning exactly ("openclaw": "2026.7.1-2") to make intent explicit, or waiting for a stable upstream release without the prerelease suffix.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 65:
<comment>The `^2026.7.1-2` range has two problems:
1. **Semver caret with a prerelease suffix is overly narrow.** Per npm semver rules, `^X.Y.Z-pre` only satisfies prereleases of the *same* `X.Y.Z` tuple — it won't match `2026.7.2` or `2026.8.0` when upstream cuts a stable release. This means future dependency-update tooling will keep proposing narrow bumps rather than naturally tracking new stable versions.
2. **The install script's version comparator misparses the dash.** In `install-npm-globals.sh` the expression `wanted_ver="${wanted//[^0-9.]/}"` strips the `-2` suffix, yielding `2026.7.12`. The installed package reports `2026.7.1-2`, so `sort -V` never finds equality and the "already installed, skipping" branch is never taken — causing `openclaw` to be reinstalled via `bun add --global` on every activation.
Consider either pinning exactly (`"openclaw": "2026.7.1-2"`) to make intent explicit, or waiting for a stable upstream release without the prerelease suffix.</comment>
<file context>
@@ -12,86 +12,86 @@
- "oxfmt": "^0.58.0",
- "oxlint": "^1.73.0",
- "pinchtab": "^0.14.1",
+ "openclaw": "^2026.7.1-2",
+ "oxfmt": "^0.59.0",
+ "oxlint": "^1.74.0",
</file context>
1 participant
Upgrades all npm dependencies in
package.jsonto their latest published versions, and drops@typescript/native-preview.The repo enforces a 7-day quarantine on new releases (
minimum-release-age = 604800inbunfig.toml,min-release-age=7in.npmrc). This update deliberately bypasses it viabun update --latest --minimum-release-age=0, so several packages here are newer than 7 days.Notable upgrades
@oh-my-pi/pi-coding-agent/@oh-my-pi/pi-natives16.3.15 -> 17.0.5 (major)droid0.168.2 -> 0.175.0openclaw2026.6.11 -> 2026.7.1-2deepsec2.1.2 -> 2.2.3tokscale4.3.0 -> 4.5.3@redwoodjs/agent-ci0.16.2 -> 0.17.1@anthropic-ai/claude-code2.1.205 -> 2.1.215@openai/codex0.144.0 -> 0.144.6Removal
@typescript/native-previewis dropped from bothdependenciesandtrustedDependencies. Nothing else in the repo referenced the package or itstsgobinary.Manual corrections after
bun updatebun update --latestrewrote the manifest in two ways that did not match the existing conventions, both reverted by hand:^range and pinned exact versions. Carets were restored to match the prior style.@openai/codex-*aliases fromnpm:@openai/codex@<ver>-<platform>down to a plainnpm:@openai/codex@0.144.6, which would have pulled the generic package on every platform. The-darwin-arm64/-linux-x64/-win32-*suffixes were restored at 0.144.6 (verified those tags exist on the registry).Verification
bun installreconciles cleanly against the corrected ranges. Onlypackage.jsonandbun.lockare touched.