Skip to content

build(deps): bump the dependencies group across 1 directory with 9 updates - #346

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-dba9b9df09
Open

build(deps): bump the dependencies group across 1 directory with 9 updates#346
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/dependencies-dba9b9df09

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 31, 2026

Copy link
Copy Markdown
Contributor

Bumps the dependencies group with 9 updates in the / directory:

Package From To
@modelcontextprotocol/sdk 1.29.0 1.30.0
chalk 5.6.2 6.0.0
openai 6.48.0 7.0.0
@types/node 26.1.1 26.1.2
devtools-protocol 0.0.1666840 0.0.1669207
es-toolkit 1.49.0 1.50.0
oxfmt 0.60.0 0.61.0
oxlint 1.75.0 1.76.0
puppeteer-core 25.3.0 25.4.0

Updates @modelcontextprotocol/sdk from 1.29.0 to 1.30.0

Release notes

Sourced from @​modelcontextprotocol/sdk's releases.

1.30.0

What's Changed

New Contributors

Full Changelog: modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0

Commits
  • 2d889f2 chore: bump version to 1.30.0 (#2563)
  • e3f3daa Fix SSE keep-alive timer lifecycle in Streamable HTTP server transport (v1.x)...
  • bb5a718 fix(deps): widen @​hono/node-server past GHSA-frvp-7c67-39w9 (#2549)
  • 1dad263 fix: send SSE keep-alive comment frames from Streamable HTTP server transport...
  • 69749aa Validate Content-Type by parsed media type instead of substring match (v1.x) ...
  • 369513d fix: support Zod 3.25 method literals (#2368)
  • e7ee57c v1 stdio buffer limit (#2239)
  • c36e1ef Add end-to-end test suite (#2167)
  • bf1e022 chore(ci): switch publish to OIDC trusted publishing (#1839)
  • 9edbab7 fix(server): prioritize zod issues and format them (#1503)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​modelcontextprotocol/sdk since your current version.


Updates chalk from 5.6.2 to 6.0.0

Release notes

Sourced from chalk's releases.

v6.0.0

Breaking

  • Require Node.js 22 8a94e0e

Improvements

  • Add underline styles and underline colors (#689) 4c304dd
  • Improve performance 5729845 fa5cff2

Fixes

  • Treat a numeric FORCE_COLOR as an exact level (#688) e912931
  • Downsample ansi256() and bgAnsi256() to 16 colors at level 1 (#687) ff549c5

chalk/chalk@v5.6.2...v6.0.0

Commits

Updates openai from 6.48.0 to 7.0.0

Release notes

Sourced from openai's releases.

v7.0.0

7.0.0 (2026-07-27)

Full Changelog: v6.49.0...v7.0.0

⚠ BREAKING CHANGES

  • require Node.js 22 and codify version support (#2026)

Features

  • require Node.js 22 and codify version support (#2026) (9185cdd)

Build System

  • deps: bump fast-uri in /ecosystem-tests/ts-browser-webpack (#2027) (c6a46b8)
  • deps: bump fast-uri in /ecosystem-tests/vercel-edge (#2024) (8e775cf)
  • deps: bump next from 15.5.20 to 15.5.21 (#2025) (09f0b5e)

v6.49.0

6.49.0 (2026-07-23)

Full Changelog: v6.48.0...v6.49.0

Features

  • api: accept None for prompt_cache_key/safety_identifier (c54a7f3)
  • api: add support for spend_limit admin apis (e8238b0)
  • helpers: add standard schema support (#1997) (4ced1a8)
  • helpers: add zod realtime function helper (#1996) (ee59911)
  • stlc: configurable CI runner and private-production-repo support in workflow templates (967a66b)
  • zod: support schema definitions (#1993) (eb04567)

Bug Fixes

  • address code scanning findings (#2007) (2706888)
  • address remaining Dependabot alerts (#2005) (6ab3428)
  • azure: normalize endpoint trailing slashes (#1995) (39a15b4)
  • ci: restore explicit TypeScript SDK runner selection (fe79401)
  • runTools: sanitize replayed messages (#1990) (a60cc25)
  • stream: handle audio completion markers (#1991) (bd86817)
  • zod: escape schema definition refs before strict validation (bff2b10)
  • zod: infer parsed tool callback arguments (#1992) (83cdb79)
  • zod: preserve schema types while escaping refs (cb7e195)

Chores

... (truncated)

Changelog

Sourced from openai's changelog.

7.0.0 (2026-07-27)

Full Changelog: v6.49.0...v7.0.0

⚠ BREAKING CHANGES

  • require Node.js 22 and codify version support (#2026)

Features

  • require Node.js 22 and codify version support (#2026) (9185cdd)

Build System

  • deps: bump fast-uri in /ecosystem-tests/ts-browser-webpack (#2027) (c6a46b8)
  • deps: bump fast-uri in /ecosystem-tests/vercel-edge (#2024) (8e775cf)
  • deps: bump next from 15.5.20 to 15.5.21 (#2025) (09f0b5e)

6.49.0 (2026-07-23)

Full Changelog: v6.48.0...v6.49.0

Features

  • api: accept None for prompt_cache_key/safety_identifier (c54a7f3)
  • api: add support for spend_limit admin apis (e8238b0)
  • helpers: add standard schema support (#1997) (4ced1a8)
  • helpers: add zod realtime function helper (#1996) (ee59911)
  • stlc: configurable CI runner and private-production-repo support in workflow templates (967a66b)
  • zod: support schema definitions (#1993) (eb04567)

Bug Fixes

  • address code scanning findings (#2007) (2706888)
  • address remaining Dependabot alerts (#2005) (6ab3428)
  • azure: normalize endpoint trailing slashes (#1995) (39a15b4)
  • ci: restore explicit TypeScript SDK runner selection (fe79401)
  • runTools: sanitize replayed messages (#1990) (a60cc25)
  • stream: handle audio completion markers (#1991) (bd86817)
  • zod: escape schema definition refs before strict validation (bff2b10)
  • zod: infer parsed tool callback arguments (#1992) (83cdb79)
  • zod: preserve schema types while escaping refs (cb7e195)

Chores

  • refresh more ecosystem test dependencies (#2003) (3cafa55)
Commits

Updates @types/node from 26.1.1 to 26.1.2

Commits

Updates devtools-protocol from 0.0.1666840 to 0.0.1669207

Commits

Updates es-toolkit from 1.49.0 to 1.50.0

Release notes

Sourced from es-toolkit's releases.

v1.50.0

Released on July 24th, 2026.

  • Added the es-toolkit/types entrypoint: a declaration-only module of compile-time type utilities TypeScript lacks natively — ValueOf, Simplify, Writable, NonEmptyArray, DeepPartial, and DeepReadonly. ([#1818])
  • Added flow to es-toolkit/fp, a reusable data-last composition built on pipe. ([#1812])

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

  • Fixed compat/intersectionBy to dedupe a single array (including by the iteratee) and to keep results consistent with Lodash. ([#1935])

  • Fixed compat/findIndex and compat/findLastIndex to coerce a NaN fromIndex to 0 and to convert fromIndex to an integer. ([#1828], [#1834], [#1938])

  • Fixed compat/lastIndexOf to coerce fromIndex like Lodash. ([#1832])

  • Fixed compat/every to treat a falsy, non-nullish doesMatch as a _.property shorthand instead of identity. ([#1940])

  • Fixed compat/nth to support string inputs. ([#1833])

  • Fixed compat/inRange to not throw on a lone negative bound. ([#1835])

  • Fixed compat/toArray to convert Sets to arrays like Lodash. ([#1840])

  • Fixed compat/values to treat sparse array holes as undefined. ([#1894])

  • Fixed compat/maxBy and compat/minBy to restore Lodash-compatible comparison. ([#1893])

  • Fixed compat/includes to exclude the length property when matching array-like values. ([#1886])

  • Fixed the case functions to split ordinal numbers like Lodash, and to count string size and padding by code points for multi-byte characters. ([#1836], [#1852], [#1853])

  • Fixed compat/unset to not treat an own literal dotted key as a deep path. ([#1808])

  • Moved compat/flattenDepth's flattening logic out of flatten. ([#1847])

  • Restored the standalone eq and templateSettings entry points. ([#1895])

  • Fixed deburr to remove all combining diacritical marks, matching Lodash. ([#1807])

  • Fixed partition to accept any predicate return value, like Array.prototype.filter. ([#1937])

  • Fixed has and hasIn to prioritize nullish literal keys over paths. ([#1810])

  • Fixed invokeMap to normalize a string path via toPath for this binding. ([#1814])

  • Fixed isDeepKey to detect deep keys with stricter patterns. ([#1621])

  • Fixed unzipWith to return an empty array instead of throwing on empty input. ([#1816])

  • Improved documentation, JSDoc accuracy, and internal refactoring across compat and fp. ([#1817], [#1820], [#1822], [#1823], [#1825], [#1829], [#1830], [#1842], [#1845], [#1851], [#1858], [#1867], [#1879])

... (truncated)

Changelog

Sourced from es-toolkit's changelog.

Version v1.50.0

Released on July 24th, 2026.

  • Added the es-toolkit/types entrypoint: a declaration-only module of compile-time type utilities TypeScript lacks natively — ValueOf, Simplify, Writable, NonEmptyArray, DeepPartial, and DeepReadonly. (#1818)
  • Added flow to es-toolkit/fp, a reusable data-last composition built on pipe. (#1812)

The following bring es-toolkit/compat closer to Lodash. Behavior for the affected edge cases now matches Lodash, so results may differ if you relied on the previous output.

  • Fixed compat/intersectionBy to dedupe a single array (including by the iteratee) and to keep results consistent with Lodash. (#1935)

  • Fixed compat/findIndex and compat/findLastIndex to coerce a NaN fromIndex to 0 and to convert fromIndex to an integer. (#1828, #1834, #1938)

  • Fixed compat/lastIndexOf to coerce fromIndex like Lodash. (#1832)

  • Fixed compat/every to treat a falsy, non-nullish doesMatch as a _.property shorthand instead of identity. (#1940)

  • Fixed compat/nth to support string inputs. (#1833)

  • Fixed compat/inRange to not throw on a lone negative bound. (#1835)

  • Fixed compat/toArray to convert Sets to arrays like Lodash. (#1840)

  • Fixed compat/values to treat sparse array holes as undefined. (#1894)

  • Fixed compat/maxBy and compat/minBy to restore Lodash-compatible comparison. (#1893)

  • Fixed compat/includes to exclude the length property when matching array-like values. (#1886)

  • Fixed the case functions to split ordinal numbers like Lodash, and to count string size and padding by code points for multi-byte characters. (#1836, #1852, #1853)

  • Fixed compat/unset to not treat an own literal dotted key as a deep path. (#1808)

  • Moved compat/flattenDepth's flattening logic out of flatten. (#1847)

  • Restored the standalone eq and templateSettings entry points. (#1895)

  • Fixed deburr to remove all combining diacritical marks, matching Lodash. (#1807)

  • Fixed partition to accept any predicate return value, like Array.prototype.filter. (#1937)

  • Fixed has and hasIn to prioritize nullish literal keys over paths. (#1810)

  • Fixed invokeMap to normalize a string path via toPath for this binding. (#1814)

  • Fixed isDeepKey to detect deep keys with stricter patterns. (#1621)

  • Fixed unzipWith to return an empty array instead of throwing on empty input. (#1816)

  • Improved documentation, JSDoc accuracy, and internal refactoring across compat and fp. (#1817, #1820, #1822, #1823, #1825, #1829, #1830, #1842, #1845, #1851, #1858, #1867, #1879)

We sincerely thank @​Antoliny0919, @​raon0211, @​dayongkr, @​spokodev, @​sarathfrancis90, @​mayur-shenoy, @​mahirhir, @​kojesung, @​Hprogram, @​BangDori, and everyone else who contributed. We appreciate your great efforts!

Commits
  • a443efd v1.50.0
  • 9232c57 test(check-dist): skip declaration-only ./types in CJS/ESM check (#1949)
  • 4bac390 fix(types): register ./types entrypoint in check-dist test (#1948)
  • 8ea1291 feat(types): add es-toolkit/types module with compile-time type utilities (#1...
  • b854e15 fix(partition): accept any predicate return value like Array.prototype.filter...
  • 953920b fix(compat/findIndex): convert fromIndex to an integer like lodash (#1938)
  • 9b92739 fix(compat/every): treat falsy doesMatch as property shorthand, not identity ...
  • 278b4fe build(deps): bump github/codeql-action/upload-sarif (#1942)
  • 9d05639 build(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#1944)
  • ffea687 fix(compat/intersectionBy): resolve Lodash compatibility issues (#1935)
  • Additional commits viewable in compare view

Updates oxfmt from 0.60.0 to 0.61.0

Commits

Updates oxlint from 1.75.0 to 1.76.0

Release notes

Sourced from oxlint's releases.

oxlint v1.27.0 && oxfmt v0.12.0

Oxlint v1.27.0

🚀 Features

  • 222a8f0 linter/plugins: Implement SourceCode#isSpaceBetween (#15498) (overlookmotel)
  • 2f9735d linter/plugins: Implement context.languageOptions (#15486) (overlookmotel)
  • bc731ff linter/plugins: Stub out all Context APIs (#15479) (overlookmotel)
  • 5822cb4 linter/plugins: Add extend method to FILE_CONTEXT (#15477) (overlookmotel)
  • 7b1e6f3 apps: Add pure rust binaries and release to github (#15469) (Boshen)
  • 2a89b43 linter: Introduce debug assertions after fixes to assert validity (#15389) (camc314)
  • ad3c45a editor: Add oxc.path.node option (#15040) (Sysix)

🐛 Bug Fixes

  • 6f3cd77 linter/no-var: Incorrect warning for blocks (#15504) (Hamir Mahal)
  • 6957fb9 linter/plugins: Do not allow access to Context#id in createOnce (#15489) (overlookmotel)
  • 7409630 linter/plugins: Allow access to cwd in createOnce in ESLint interop mode (#15488) (overlookmotel)
  • 732205e parser: Reject using / await using in a switch case / default clause (#15225) (sapphi-red)
  • a17ca32 linter/plugins: Replace Context class (#15448) (overlookmotel)
  • ecf2f7b language_server: Fail gracefully when tsgolint executable not found (#15436) (camc314)
  • 3c8d3a7 lang-server: Improve logging in failure case for tsgolint (#15299) (camc314)
  • ef71410 linter: Use jsx if source type is JS in fix debug assertion (#15434) (camc314)
  • e32bbf6 linter/no-var: Handle TypeScript declare keyword in fixer (#15426) (camc314)
  • 6565dbe linter/switch-case-braces: Skip comments when searching for : token (#15425) (camc314)
  • 85bd19a linter/prefer-class-fields: Insert value after type annotation in fixer (#15423) (camc314)
  • fde753e linter/plugins: Block access to context.settings in createOnce (#15394) (overlookmotel)
  • ddd9f9f linter/forward-ref-uses-ref: Dont suggest removing wrapper in invalid positions (#15388) (camc314)
  • dac2a9c linter/no-template-curly-in-string: Remove fixer (#15387) (camc314)
  • 989b8e3 linter/no-var: Only fix to const if the var has an initializer (#15385) (camc314)
  • cc403f5 linter/plugins: Return empty object for unimplemented parserServices (#15364) (magic-akari)

⚡ Performance

  • 25d577e language_server: Start tools in parallel (#15500) (Sysix)
  • 3c57291 linter/plugins: Optimize loops (#15449) (overlookmotel)
  • 3166233 linter/plugins: Remove Arcs (#15431) (overlookmotel)
  • 9de1322 linter/plugins: Lazily deserialize settings JSON (#15395) (overlookmotel)
  • 3049ec2 linter/plugins: Optimize deepFreezeSettings (#15392) (overlookmotel)
  • 444ebfd linter/plugins: Use single object for parserServices (#15378) (overlookmotel)

📚 Documentation

  • 97d2104 linter: Update comment in lint.rs about default value for tsconfig path (#15530) (Connor Shea)
  • 2c6bd9e linter: Always refer as "ES2015" instead of "ES6" (#15411) (sapphi-red)
  • a0c5203 linter/import/named: Update "ES7" comment in examples (#15410) (sapphi-red)
  • 3dc24b5 linter,minifier: Always refer as "ES Modules" instead of "ES6 Modules" (#15409) (sapphi-red)
  • 2ad77fb linter/no-this-before-super: Correct "Why is this bad?" section (#15408) (sapphi-red)
  • 57f0ce1 linter: Add backquotes where appropriate (#15407) (sapphi-red)

Oxfmt v0.12.0

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.76.0] - 2026-07-27

🚀 Features

  • 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
  • 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)
  • 016cf2a linter/oxc: Add bad-match-all-arg rule (#24900) (camc314)
  • cdc941e linter/n: Implement exports-style rule (#24087) (Mikhail Baev)
  • 1ad6f6c linter/eslint: Implement id-denylist rule (#24632) (Mikhail Baev)

📚 Documentation

  • 3ff2e0e linter: Clarify config extends types (#24936) (Boshen)
Commits

Updates puppeteer-core from 25.3.0 to 25.4.0

Release notes

Sourced from puppeteer-core's releases.

puppeteer-core: v25.4.0

25.4.0 (2026-07-27)

🎉 Features

🛠️ Fixes

Changelog

Sourced from puppeteer-core's changelog.

25.4.0 (2026-07-27)

🎉 Features

Dependencies

  • The following workspace dependencies were updated
    • dependencies
      • puppeteer-core bumped from 25.3.0 to 25.4.0

🛠️ Fixes

Commits
  • f5b96c5 chore: release main (#15201)
  • 29a6e7c chore(webmcp): Update WebMCP to Chrome 151 implementation (#15146)
  • 4a48c8a feat: add browser-level PWA install/launch/uninstall APIs (#15235)
  • ffe1c91 chore(deps): bump the all group with 5 updates (#15262)
  • 06442ae feat: roll to Chrome 151.0.7922.47 (#15237)
  • 7c72827 chore(deps): bump svgo from 3.3.3 to 3.3.4 in /website (#15253)
  • 83b0e31 chore(deps): bump fast-uri from 3.1.2 to 3.1.4 in /website (#15254)
  • 0ebbd98 chore(deps): bump shell-quote from 1.8.4 to 1.10.0 in /website (#15255)
  • befa16f chore(deps): bump body-parser from 1.20.5 to 1.20.6 in /website (#15256)
  • 8af689d chore(deps): bump webpack-dev-server from 5.2.5 to 5.2.6 in /website (#15257)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the dependencies group across 1 directory with 9 up…
12a17bb 
…dates

Bumps the dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [@modelcontextprotocol/sdk](https://github.com/modelcontextprotocol/typescript-sdk) | `1.29.0` | `1.30.0` |
| [chalk](https://github.com/chalk/chalk) | `5.6.2` | `6.0.0` |
| [openai](https://github.com/openai/openai-node) | `6.48.0` | `7.0.0` |
| [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.1.1` | `26.1.2` |
| [devtools-protocol](https://github.com/ChromeDevTools/devtools-protocol) | `0.0.1666840` | `0.0.1669207` |
| [es-toolkit](https://github.com/toss/es-toolkit) | `1.49.0` | `1.50.0` |
| [oxfmt](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxfmt) | `0.60.0` | `0.61.0` |
| [oxlint](https://github.com/oxc-project/oxc/tree/HEAD/npm/oxlint) | `1.75.0` | `1.76.0` |
| [puppeteer-core](https://github.com/puppeteer/puppeteer) | `25.3.0` | `25.4.0` |



Updates `@modelcontextprotocol/sdk` from 1.29.0 to 1.30.0
- [Release notes](https://github.com/modelcontextprotocol/typescript-sdk/releases)
- [Commits](modelcontextprotocol/typescript-sdk@v1.29.0...1.30.0)

Updates `chalk` from 5.6.2 to 6.0.0
- [Release notes](https://github.com/chalk/chalk/releases)
- [Commits](chalk/chalk@v5.6.2...v6.0.0)

Updates `openai` from 6.48.0 to 7.0.0
- [Release notes](https://github.com/openai/openai-node/releases)
- [Changelog](https://github.com/openai/openai-node/blob/main/CHANGELOG.md)
- [Commits](openai/openai-node@v6.48.0...v7.0.0)

Updates `@types/node` from 26.1.1 to 26.1.2
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `devtools-protocol` from 0.0.1666840 to 0.0.1669207
- [Commits](ChromeDevTools/devtools-protocol@v0.0.1666840...v0.0.1669207)

Updates `es-toolkit` from 1.49.0 to 1.50.0
- [Release notes](https://github.com/toss/es-toolkit/releases)
- [Changelog](https://github.com/toss/es-toolkit/blob/main/CHANGELOG.md)
- [Commits](toss/es-toolkit@v1.49.0...v1.50.0)

Updates `oxfmt` from 0.60.0 to 0.61.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxfmt/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxfmt_v0.61.0/npm/oxfmt)

Updates `oxlint` from 1.75.0 to 1.76.0
- [Release notes](https://github.com/oxc-project/oxc/releases)
- [Changelog](https://github.com/oxc-project/oxc/blob/main/npm/oxlint/CHANGELOG.md)
- [Commits](https://github.com/oxc-project/oxc/commits/oxlint_v1.76.0/npm/oxlint)

Updates `puppeteer-core` from 25.3.0 to 25.4.0
- [Release notes](https://github.com/puppeteer/puppeteer/releases)
- [Changelog](https://github.com/puppeteer/puppeteer/blob/main/CHANGELOG.md)
- [Commits](puppeteer/puppeteer@puppeteer-core-v25.3.0...puppeteer-core-v25.4.0)

---
updated-dependencies:
- dependency-name: "@modelcontextprotocol/sdk"
  dependency-version: 1.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: chalk
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: openai
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: "@types/node"
  dependency-version: 26.1.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: devtools-protocol
  dependency-version: 0.0.1669207
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: es-toolkit
  dependency-version: 1.50.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: oxfmt
  dependency-version: 0.61.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: oxlint
  dependency-version: 1.76.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: puppeteer-core
  dependency-version: 25.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jul 31, 2026
@clawsweeper clawsweeper Bot added rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask. P2 Normal priority bug or improvement with limited blast radius. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. merge-risk: 🚨 auth-provider 🚨 Merging this PR could break OAuth, tokens, provider routing, model choice, or credentials. labels Jul 31, 2026
@clawsweeper

clawsweeper Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Codex review: needs maintainer review before merge. Reviewed July 31, 2026, 5:39 PM ET / 21:39 UTC.

ClawSweeper review

What this changes

The PR updates seven declared root dependencies and refreshes lockfile resolutions for nine packages, including major releases of Chalk and the OpenAI Node SDK.

Merge readiness

⛔ Blocked until real behavior proof is added - 3 items remain

This constrained dependency refresh has passing cross-platform checks and no discrete patch defect, but its major OpenAI runtime SDK upgrade still needs real after-fix foreground and background evidence before merge.

Priority: P2
Reviewed head: 12a17bbf40e8e7a17919436df877839fc4bac164

Review scores

Measure Result What it means
Overall readiness 🧂 unranked krab (1/6) The constrained patch and passing cross-platform checks are solid, but missing real behavior proof leaves this direct runtime SDK upgrade below merge-ready confidence.
Proof confidence 🧂 unranked krab (1/6) Needs real behavior proof before merge: The PR supplies no redacted after-fix live run, terminal output, recording, or runtime log for the direct OpenAI SDK major upgrade; passing CI is supplemental only. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality 🐚 platinum hermit (4/6) No actionable review findings were identified.

Verification

Check Result Evidence
Real behavior Needs proof Needs real behavior proof before merge: The PR supplies no redacted after-fix live run, terminal output, recording, or runtime log for the direct OpenAI SDK major upgrade; passing CI is supplemental only. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed 6 items Repository policy: The full repository policy makes OpenAI live smoke tests opt-in and identifies the real-key command for the background path; that guidance applies because this PR upgrades Oracle's runtime OpenAI SDK.
Runtime compatibility contract: Oracle declares Node >=24, which satisfies the Node 22 floor stated for the proposed Chalk 6 and OpenAI 7 releases.
OpenAI execution boundary: Current Oracle code instantiates the official SDK and exposes both Responses API streaming and create/retrieve methods, so both foreground and background behavior depend on this major SDK upgrade.
Findings None None.
Security None None.

How this fits together

Oracle is a Node CLI that sends foreground streaming and background polling requests through the official OpenAI SDK. CLI commands build a request, the client wrapper calls the Responses API, and the result is rendered to the terminal or saved as session output.

flowchart LR
  A[CLI command] --> B[Request builder]
  B --> C[OpenAI client wrapper]
  C --> D[Responses API]
  D --> E{Execution mode}
  E -->|Foreground| F[Streaming terminal output]
  E -->|Background| G[Polling and session result]
Loading

Before merge

  • Resolve merge risk (P1) - OpenAI 7 changes a direct runtime SDK on both foreground streaming and background polling paths; green builds do not establish that real credentials still complete both flows.
  • Resolve merge risk (P1) - Chalk 6 and OpenAI 7 are major upgrades. Node >=24 satisfies their stated Node 22 floor, but terminal rendering and Responses API behavior still need an after-upgrade smoke on the exact PR head.
  • Complete next step (P2) - A maintainer or trusted operator must provide or accept the missing real-account proof; this is not a narrow source repair that automation can safely infer.
Agent review details

Security

None.

Review metrics

Metric Value Why it matters
Dependency surface 9 package resolutions updated; 2 files affected The branch is narrowly scoped to the manifest and lockfile, but it groups two major direct runtime upgrades with routine tooling refreshes.
Automated checks 5 successful checks Cross-platform builds and the CDP disconnect proof cover installation and compile-time compatibility, not live OpenAI account behavior.

Merge-risk options

Maintainer options:

  1. Add real OpenAI runtime proof (recommended)
    Run the opt-in OpenAI live smoke or equivalent focused foreground and background commands on this head, then attach redacted terminal output showing completed responses.
  2. Accept the runtime-upgrade risk
    A maintainer may merge based on the constrained Dependabot diff and passing CI while explicitly accepting that the direct OpenAI SDK paths were not exercised against a real account.
  3. Pause the grouped update
    Close or defer this grouped bump if maintainers prefer to split the major OpenAI and Chalk upgrades into separately validated dependency PRs.
Copy recommended automerge instruction 
@clawsweeper automerge

Special instructions:
Run a redacted real-key foreground streaming and background completion smoke on the PR head; attach terminal output proving both responses completed.

Technical review

Best possible solution:

Keep the dependency refresh narrow and merge only after a redacted real-account smoke proves one foreground streamed response and one background completion on the PR head.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a bug report: this is a dependency-update PR. A focused real-account validation path exists through the opt-in OpenAI live suite, but no after-upgrade result is provided.

Is this the best way to solve the issue?

Unclear: grouped Dependabot updates are mechanically appropriate and compile cleanly, but upgrading the direct OpenAI runtime SDK without a live foreground and background check is not yet the safest merge path.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 68b8c51b0ee0.

Labels

Label justifications:

  • P2: This is a normal dependency-maintenance PR with limited surface area, but its direct runtime SDK upgrade deserves review before landing.
  • merge-risk: 🚨 compatibility: Chalk 6 and OpenAI 7 are major version changes that can alter supported runtime and terminal behavior for existing Oracle users.
  • merge-risk: 🚨 auth-provider: Oracle routes foreground streaming and background Responses API work through the upgraded OpenAI SDK, so provider behavior needs real-account validation.
  • rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🐚 platinum hermit.
  • status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs real behavior proof before merge: The PR supplies no redacted after-fix live run, terminal output, recording, or runtime log for the direct OpenAI SDK major upgrade; passing CI is supplemental only. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

  • Repository policy: The full repository policy makes OpenAI live smoke tests opt-in and identifies the real-key command for the background path; that guidance applies because this PR upgrades Oracle's runtime OpenAI SDK. (AGENTS.md:4, 68b8c51b0ee0)
  • Runtime compatibility contract: Oracle declares Node >=24, which satisfies the Node 22 floor stated for the proposed Chalk 6 and OpenAI 7 releases. (package.json:101, 68b8c51b0ee0)
  • OpenAI execution boundary: Current Oracle code instantiates the official SDK and exposes both Responses API streaming and create/retrieve methods, so both foreground and background behavior depend on this major SDK upgrade. (src/oracle/client.ts:69, 68b8c51b0ee0)
  • Existing live coverage: The opt-in live suite covers completed foreground requests, foreground streaming, and Pro background completion, but neither the PR body nor supplied discussion provides an after-upgrade live transcript, log, recording, or artifact. (tests/live/openai-live.test.ts:19, 68b8c51b0ee0)
  • Diff and automated checks: The branch changes only package.json and pnpm-lock.yaml (324 additions, 327 deletions). Supplied CI reports successful macOS, Ubuntu, Windows, security, and CDP disconnect checks, but those do not prove a real OpenAI account flow after the SDK major upgrade. (package.json:63, 12a17bbf40e8)
  • Current-area provenance: The current OpenAI client boundary is attributed locally to the v0.16.1 dependency/security update by Peter Steinberger, which is the clearest current-main ownership signal for this upgrade surface. (src/oracle/client.ts:1, 5daa6ce8c352)

Likely related people:

  • Peter Steinberger: The current OpenAI client wrapper and the latest released dependency update trace locally to the v0.16.1 commit, including the direct runtime dependency boundary. (role: recent runtime and dependency-area contributor; confidence: high; commits: 5daa6ce8c352; files: package.json, src/oracle/client.ts, src/oracle/background.ts)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

  • Attach redacted terminal proof from a real-key foreground streamed response and a background completion on this exact head.
  • If the full live suite is impractical, run the smallest focused commands covering those two paths and record their completed status.

Rating scale

Score Internal tier Crab rank Meaning
6/6 S 🦀 challenger crab Exceptional readiness
5/6 A 🦞 diamond lobster Very strong readiness
4/6 B 🐚 platinum hermit Good normal PR; ordinary maintainer review
3/6 C 🦐 gold shrimp Useful, but confidence is limited
2/6 D 🦪 silver shellfish Proof or implementation needs work
1/6 F 🧂 unranked krab Not merge-ready
N/A NA 🌊 off-meta tidepool Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

  • ClawSweeper keeps one durable marker-backed review comment per issue or PR.
  • Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
  • A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
  • PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
  • Maintainers can also comment @clawsweeper review to request a fresh review only.
  • Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
  • Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
  • Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)
  • reviewed 2026-07-31T20:29:01.128Z sha 12a17bb :: needs maintainer review before merge. :: none

@clawsweeper clawsweeper Bot added rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. and removed rating: 🦪 silver shellfish Thin PR readiness signal; proof, validation, or implementation needs work. labels Jul 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code merge-risk: 🚨 auth-provider 🚨 Merging this PR could break OAuth, tokens, provider routing, model choice, or credentials. merge-risk: 🚨 compatibility 🚨 Merging this PR could break existing users, config, migrations, defaults, or upgrades. P2 Normal priority bug or improvement with limited blast radius. rating: 🧂 unranked krab Not merge-ready due to missing proof or serious correctness/safety concerns. status: 📣 needs proof The PR needs real behavior proof before ClawSweeper can clear the contributor ask.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants