chore(deps): refresh runtime and maintenance tooling by steipete · Pull Request #197 · openclaw/clawpatch · GitHub
Skip to content

chore(deps): refresh runtime and maintenance tooling - #197

Merged
steipete merged 1 commit into
mainfrom
chore/maintenance-20260904
Sep 4, 2026
Merged

chore(deps): refresh runtime and maintenance tooling#197
steipete merged 1 commit into
mainfrom
chore/maintenance-20260904

Conversation

@steipete

@steipete steipete commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

What Problem This Solves

Refreshes Clawpatch's runtime validation dependency and development/security tooling to current compatible releases.

Why This Change Was Made

Updates Zod 4.5.2 → 4.5.4, Node typings 26.4.0 → 26.4.1, Oxfmt 0.65.0 → 0.66.0, Oxlint 1.80.0 → 1.81.0, and pnpm 11.24.0 → 11.25.0. The lockfile includes the corresponding native bindings and peer snapshots. TruffleHog's commit pin and binary version move together from 3.97.1 to 3.97.4; the upstream action definition is unchanged across those releases.

Retains Node >=22, existing dependency overrides, and the 48-hour npm release-age policy. Vitest remains at the latest 4.x release, 4.1.11; the newly released 5.0.0 migration is deferred. Other Actions and pinned toolchains were audited against current upstream metadata.

User Impact

Includes Zod's latest patch fixes and refreshes contributor and security tooling. CLI commands and supported runtime versions remain unchanged. The Unreleased changelog records the update.

Evidence

  • pnpm install --frozen-lockfile with pnpm 11.25.0
  • pnpm typecheck, pnpm lint, pnpm format:check, and pnpm build
  • pnpm test: 31 files passed; 924 tests passed, two existing skips
  • pnpm pack:smoke: installs the built package offline and maps 13 mixed-language fixture features, including three CUDA features
  • Built CLI under Node 22.0.0: init, map, status, and report all returned valid JSON; four features mapped and source ownership verified
  • pnpm audit --json: zero vulnerabilities
  • actionlint .github/workflows/secret-scan.yml and git diff --check
  • Independent complete-candidate P0–P2 review, including semantic lockfile changes: no actionable findings

@steipete
steipete requested a review from a team as a code owner September 4, 2026 09:31
@clawsweeper

clawsweeper Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

@clawsweeper clawsweeper Bot added P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. proof: sufficient Contributor real behavior proof is sufficient. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR. labels Sep 4, 2026
@clawsweeper

clawsweeper Bot commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed September 4, 2026, 5:35 AM ET / 09:35 UTC.

ClawSweeper review

What this changes

The PR updates Zod and development tooling, synchronizes the pnpm lockfile and package-manager pin, and advances the immutable TruffleHog action pin.

Merge readiness

✅ Ready for maintainer review

Keep open: the requested versions are not yet on current main, and the introduced update has no actionable correctness or security finding. Likely related people: steipete (high-confidence recent dependency and CI-tooling contributor).

Priority: P3
Reviewed head: 8d0f2d56198d812f28835a249be8f0d803b14ad4

Review scores

Measure Result What it means
Overall readiness 🐚 platinum hermit (4/6) A focused, internally consistent maintenance update with concrete post-change package and CLI validation evidence.
Proof confidence 🐚 platinum hermit (4/6) Sufficient (terminal): The changed runtime owner is Zod and the tooling owners are the package and scanner configurations; the PR supplies after-change frozen installation, build, test, offline package-smoke, and built-CLI execution results, including an observed 924 passing tests and valid JSON from four CLI commands under Node 22.0.0.
Patch quality 🦞 diamond lobster (5/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Verified Sufficient (terminal): The changed runtime owner is Zod and the tooling owners are the package and scanner configurations; the PR supplies after-change frozen installation, build, test, offline package-smoke, and built-CLI execution results, including an observed 924 passing tests and valid JSON from four CLI commands under Node 22.0.0.
Evidence reviewed 6 items Current main still needs the update: The pinned main baseline uses Zod 4.5.2, Node typings 26.4.0, Oxfmt 0.65.0, Oxlint 1.80.0, pnpm 11.24.0, and TruffleHog 3.97.1; the proposed head advances each stated target.
Manifest and lockfile are synchronized: The introduced manifest resolves Zod 4.5.4 and the lockfile importer records the same exact version alongside the corresponding updated tool packages.
Scanner pin remains immutable and version-aligned: The workflow keeps a full commit SHA for the TruffleHog action, and its comment and action input both identify version 3.97.4.
Findings None None.
Security None None.

How this fits together

Clawpatch is a TypeScript CLI that uses Zod to validate configuration and provider output; its manifest and lockfile determine the runtime and developer toolchain. The secret-scan GitHub Actions workflow uses TruffleHog to scan repository changes before they land.

flowchart LR
  Manifest[Package manifest] --> Lockfile[Resolved dependency graph]
  Lockfile --> CLI[CLI validation and build]
  PullRequest[Pull request changes] --> SecretWorkflow[Secret-scan workflow]
  SecretWorkflow --> Scanner[TruffleHog scan]
  Scanner --> SecurityChecks[Security check result]
Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Dependency update footprint 4 files; 1 runtime dependency, 3 development packages, 1 package-manager pin, and 1 action pin updated The small, coherent surface makes the manifest-to-lockfile and scanner-pin consistency auditable.
Lockfile resolution 182 added, 182 removed The lockfile churn corresponds to the declared package-version refresh rather than source-code changes.

Technical review

Best possible solution:

Land the bounded, version-aligned maintenance update once the normal required checks for this exact head complete.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates dependency and workflow versions rather than fixing a reported user-facing defect. Its supplied validation covers package installation, build, tests, packaging, and CLI execution.

Is this the best way to solve the issue?

Yes: updating the manifest, exact lockfile resolutions, package-manager pin, and immutable scanner pin together is the narrow maintainable path for this refresh.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 595d94720c5b.

Labels

Label changes:

  • add P3: This is a routine, bounded dependency and maintenance-tooling refresh with no identified user-facing regression.
  • add proof: sufficient: Contributor real behavior proof is sufficient. The changed runtime owner is Zod and the tooling owners are the package and scanner configurations; the PR supplies after-change frozen installation, build, test, offline package-smoke, and built-CLI execution results, including an observed 924 passing tests and valid JSON from four CLI commands under Node 22.0.0.
  • add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
  • add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The changed runtime owner is Zod and the tooling owners are the package and scanner configurations; the PR supplies after-change frozen installation, build, test, offline package-smoke, and built-CLI execution results, including an observed 924 passing tests and valid JSON from four CLI commands under Node 22.0.0.

Label justifications:

  • P3: This is a routine, bounded dependency and maintenance-tooling refresh with no identified user-facing regression.
  • rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🦞 diamond lobster.
  • status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The changed runtime owner is Zod and the tooling owners are the package and scanner configurations; the PR supplies after-change frozen installation, build, test, offline package-smoke, and built-CLI execution results, including an observed 924 passing tests and valid JSON from four CLI commands under Node 22.0.0.
  • proof: sufficient: Contributor real behavior proof is sufficient. The changed runtime owner is Zod and the tooling owners are the package and scanner configurations; the PR supplies after-change frozen installation, build, test, offline package-smoke, and built-CLI execution results, including an observed 924 passing tests and valid JSON from four CLI commands under Node 22.0.0.

Evidence

What I checked:

  • Current main still needs the update: The pinned main baseline uses Zod 4.5.2, Node typings 26.4.0, Oxfmt 0.65.0, Oxlint 1.80.0, pnpm 11.24.0, and TruffleHog 3.97.1; the proposed head advances each stated target. (package.json:39, 595d94720c5b)
  • Manifest and lockfile are synchronized: The introduced manifest resolves Zod 4.5.4 and the lockfile importer records the same exact version alongside the corresponding updated tool packages. (pnpm-lock.yaml:19, 8d0f2d56198d)
  • Scanner pin remains immutable and version-aligned: The workflow keeps a full commit SHA for the TruffleHog action, and its comment and action input both identify version 3.97.4. (.github/workflows/secret-scan.yml:50, 8d0f2d56198d)
  • Dependency-tooling ownership history: Recent main history shows Peter Steinberger authored the preceding dependency refreshes, including the Zod/tooling update in commit 09900a5 and CI/tooling update in commit 7666cda. (package.json:39, 09900a5edd2b)
  • Supplied behavior validation: The complete PR body reports a frozen-lockfile install, typecheck, lint, format check, build, 924 passing tests, offline package smoke coverage, and built-CLI JSON checks under Node 22.0.0. (8d0f2d56198d)
  • Introduced diff is clean and bounded: The exact one-commit introduced delta changes only the workflow, changelog, manifest, and lockfile; the diff check completed without whitespace errors. (8d0f2d56198d)

Likely related people:

  • steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

@steipete
steipete merged commit 089150a into main Sep 4, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

P3 Low-risk cleanup, docs, polish, ergonomics, or speculative feature. proof: sufficient Contributor real behavior proof is sufficient. rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. status: 👀 ready for maintainer look ClawSweeper has no concrete contributor-facing blocker left for this PR.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@steipete