build(deps): update development dependencies and pnpm action

[dependabot]

Summary

• Update @types/node from 25.9.2 to 25.9.3.
• Update oxfmt from 0.54.0 to 0.55.0.
• Update oxlint from 1.69.0 to 1.70.0.
• Update vitest from 4.1.8 to 4.1.9.
• Update pnpm/action-setup from 6.0.8 to 6.0.9 in the Crabbox hydration workflow.
• Regenerate pnpm-lock.yaml so every advertised direct dependency resolves to the updated version.

Validation

• pnpm install --frozen-lockfile
• pnpm format:check
• pnpm typecheck
• pnpm lint
• pnpm test - 16 files passed; 826 tests passed, 1 skipped
• pnpm build
• pnpm outdated --format json - {}
• Structured Codex autoreview: clean, no accepted/actionable findings

[clawsweeper]

Codex review: needs changes before merge. Reviewed June 15, 2026, 12:23 PM ET / 16:23 UTC.

Summary
This Dependabot branch updates package.json for oxfmt 0.55.0 and refreshes lockfile entries for @types/node 25.9.3, oxfmt 0.55.0, and related transitive packages.

Reproducibility: yes. for the PR defect: compare the PR body and commit metadata against the diff; the advertised Vitest 4.1.9 bump is absent and the lockfile still resolves vitest@4.1.8.

Review metrics: 1 noteworthy metric.

• Dependency update completeness: 3 claimed, 2 actually resolved. The PR metadata claims @types/node, oxfmt, and Vitest updates, but the diff only resolves the first two direct updates.

Merge readiness
Overall: 🦪 silver shellfish
Proof: 🌊 off-meta tidepool
Patch quality: 🦪 silver shellfish
Result: blocked by patch quality or review findings.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• Regenerate or recreate the dependency update so Vitest resolves to 4.1.9, then rerun the normal validation checks.

Risk before merge

• [P1] Merging as-is would record a grouped Vitest patch update in the PR history while frozen pnpm installs continue to use Vitest 4.1.8.

Maintainer options:

1. Regenerate the dependency state (recommended)
   Update the PR branch or recreate the Dependabot group so the manifest and lockfile actually resolve all three advertised dependency versions before merge.
2. Pause this grouped update
   If the grouped update cannot be regenerated cleanly, close or recreate it rather than merging a dependency PR whose metadata and lockfile disagree.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Regenerate the Dependabot dependency update so package.json/pnpm-lock.yaml actually resolve @types/node 25.9.3, oxfmt 0.55.0, and vitest 4.1.9. Keep the patch limited to package.json and pnpm-lock.yaml, do not edit CHANGELOG.md or dist/, and run pnpm format:check, pnpm typecheck, pnpm lint, pnpm test, and pnpm build.

Next step before merge

• [P2] The blocker is a narrow dependency-state repair: make the lockfile and manifest actually include the advertised Vitest 4.1.9 update or recreate the Dependabot group.

Security
Cleared: No concrete security or supply-chain regression was found; the diff is limited to devDependency and lockfile updates, and GitHub dependency review plus secret scanning passed.

Review findings

• [P2] Regenerate the lockfile so Vitest is actually updated — pnpm-lock.yaml:29

Review details

Best possible solution:

Regenerate or recreate the Dependabot group so package.json and pnpm-lock.yaml consistently resolve @types/node 25.9.3, oxfmt 0.55.0, and Vitest 4.1.9, then merge after normal validation.

Do we have a high-confidence way to reproduce the issue?

Yes for the PR defect: compare the PR body and commit metadata against the diff; the advertised Vitest 4.1.9 bump is absent and the lockfile still resolves vitest@4.1.8.

Is this the best way to solve the issue?

No: a grouped Dependabot dependency refresh is the right narrow path, but this branch needs the Vitest 4.1.9 resolution corrected before it is merge-ready.

Full review comments:

• [P2] Regenerate the lockfile so Vitest is actually updated — pnpm-lock.yaml:29
  The PR body and commit metadata claim vitest moves from 4.1.8 to 4.1.9, but the added lockfile line still resolves vitest@4.1.8 and package.json keeps ^4.1.8. That leaves frozen installs on the old test runner while recording the grouped update as complete.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.92

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against a4b5efd0981a.

Label changes

Label changes:

• add merge-risk: 🚨 other: The PR can merge with green CI while leaving the lockfile inconsistent with the advertised grouped dependency update.

Label justifications:

• P3: This is routine dev-dependency maintenance with low user-facing blast radius, even though it should be corrected before merge.
• merge-risk: 🚨 other: The PR can merge with green CI while leaving the lockfile inconsistent with the advertised grouped dependency update.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Not applicable because this is a Dependabot bot dependency PR, so the external contributor real-behavior proof gate does not apply.

Evidence reviewed

Acceptance criteria:

• [P1] pnpm format:check.
• [P1] pnpm typecheck.
• [P1] pnpm lint.
• [P1] pnpm test.
• [P1] pnpm build.

What I checked:

• AGENTS.md read fully: Repository guidance was read in full; the pnpm validation commands and generated-output guidance apply to this dependency PR review. (AGENTS.md:1, a4b5efd0981a)
• PR diff leaves Vitest at 4.1.8: The PR diff updates @types/node and oxfmt lockfile resolutions, but the changed Vitest importer line still resolves vitest 4.1.8 rather than the advertised 4.1.9. (pnpm-lock.yaml:29, 9023cd64a74c)
• Current main still has old dependency state: Current main has @types/node ^25.9.2, oxfmt ^0.54.0, and vitest ^4.1.8 in package.json, so the requested dependency update is not already implemented on main. (package.json:37, a4b5efd0981a)
• Current main lockfile still resolves old versions: Current main resolves @types/node 25.9.2, oxfmt 0.54.0, and vitest 4.1.8 in pnpm-lock.yaml. (pnpm-lock.yaml:15, a4b5efd0981a)
• No canonical replacement found: GitHub search found no other issue or PR tracking the same @types/node 25.9.3, oxfmt 0.55.0, or Vitest 4.1.9 update in this repository.
• Dependency manifest history: Blame and -S history for package.json and pnpm-lock.yaml point to Peter Steinberger as the current-main contributor around the dependency manifest and lockfile area. (package.json:37, 17944c1e97b1)

Likely related people:

• Peter Steinberger: Blame and history show Peter introduced and recently maintained the package manifest and lockfile state on current main. (role: recent area contributor; confidence: high; commits: 17944c1e97b1, a4b5efd0981a; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

@clawsweeper re-review

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Command router queued. I will update this comment with the next step.

[steipete]

Landed after repairing the incomplete grouped update and expanding it to all currently outdated project/tool dependencies.

Verification:

• pnpm install --frozen-lockfile: passed with the repository-declared pnpm 11.1.2.
• pnpm format:check, pnpm typecheck, pnpm lint, pnpm test, and pnpm build: passed locally.
• Local tests: 16 files passed; 826 tests passed, 1 skipped.
• pnpm outdated --format json: {}.
• Structured Codex autoreview: clean; no accepted/actionable findings.
• PR CI: test/build/package smoke, dependency review, CodeQL, and both verified-secret scans passed.

Landed commit: ce9e83eceecc9a2949ab264526a38d596bd108be.