chore(deps): refresh compatible workspace dependencies

[steipete]

What Problem This Solves

Refreshes the workspace's compatible npm dependencies while preserving the current authentication schema, SDK contracts, Node support declaration, and two-day dependency release cooldown.

Why This Change Was Made

The refresh uses pnpm 11.24.0 and its generated lockfile. No direct dependencies were added or removed, and no application source or CI assertions changed.

Dependency	Before	After
@biomejs/biome and config schema	2.5.10	2.5.11
@tanstack/react-query	5.102.4	5.102.8
react-router	8.3.0	8.3.1
@vitejs/plugin-react	6.1.0	6.1.1
zod	4.4.3	4.5.2
@cloudflare/vitest-plugin	1.1.0	1.1.2
@cloudflare/workers-types	5.20260826.1	5.20260829.1
wrangler	4.126.0	4.127.1
@types/node	26.3.0	26.4.0
@testing-library/react	16.3.2	16.3.3

The lockfile also refreshes compatible transitive packages, including workerd, Miniflare, Rolldown, and sourcemap-codec. All twelve GitHub Actions dependencies were checked against upstream release tags and peeled commit SHAs; their existing pins are current. pnpm and Carapace are current too.

Deferred updates:

• Better Auth 1.7.2: its 1.7 release notes require Account.issuer and an identity backfill. The current D1 schema has no issuer column. Keep runtime and schema-generator CLI at 1.6.30 and handle the migration with a separately reviewed data-preservation and rollout plan. This also affects the Better Auth update proposed by chore(deps): bump the production group with 2 updates #86; this PR overlaps its React Query update only.
• jsdom 30.0.1: its major release requires Node ^22.22.2 || ^24.15.0 || >=26.0.0, which narrows the repository's declared >=22.22.0 support. Keep the direct React test dependency at 29.1.1 pending a deliberate support-floor change. Existing jsdom 30 optional peer snapshots elsewhere in the lockfile predate this PR.
• Clipanion 4.0.0-rc.4: prerelease; retain stable 3.2.1.
• Newer Zod and Workers types releases remain inside the existing 48-hour cooldown at refresh time. No cooldown exceptions were added.

User Impact

No intentional user-visible behavior change, public API change, or database migration. This is dependency maintenance, so no new changelog entry is added.

Evidence

Local validation used Node 26.8.1 and pnpm 11.24.0:

pnpm lint
pnpm typecheck
pnpm test
pnpm --dir apps/admin build
pnpm --dir apps/demo build
pnpm --dir packages/cli build
pnpm docs:build
pnpm verify:sdk-packages
pnpm --dir apps/api exec wrangler deploy --dry-run --outdir ../../.artifacts/deps-refresh-20260830/worker-build

All passed. Lint reported six warnings and no errors. Full suite output excerpts:

ℹ tests 6
ℹ pass 6
ℹ fail 0
Test Files  3 passed (3)
     Tests  37 passed (37)
Test Files  2 passed (2)
     Tests  33 passed (33)
Test Files  2 passed (2)
     Tests  48 passed (48)
Test Files  15 passed (15)
     Tests  128 passed (128)
SDK package verification passed: packed runtime and type entry points load.
--dry-run: exiting now.

Live local proof

The existing migrations and synthetic seed were applied only to local D1. A built dashboard and local Worker were started with these commands (the auth secret below is a disposable local fixture):

pnpm --dir apps/api exec wrangler d1 migrations apply krillswitch --local
pnpm --dir apps/api exec wrangler d1 execute krillswitch --local --file=./seed/seed.sql
pnpm --dir apps/api exec wrangler dev --local --ip 127.0.0.1 --port 8799 --var DEV_AUTH_ENABLED:1 --var BETTER_AUTH_URL:http://localhost:8799 --var BETTER_AUTH_SECRET:krillswitch-local-proof-only-secret
curl --max-time 10 -sS -i -X POST http://localhost:8799/v1/eval \
  -H 'Authorization: Bearer ks_clawhub_development_local' \
  -H 'Content-Type: application/json' \
  -d '{"context":{"key":"dependency-refresh","attributes":{"role":"admin"}}}'

Actual response:

HTTP/1.1 200 OK
Content-Length: 430
Content-Type: application/json
Access-Control-Allow-Origin: *
Cache-Control: private, no-store
ETag: W/"bf85b19a"
Access-Control-Expose-Headers: ETag,Server-Timing
Server-Timing: cache;desc=miss, config;dur=182.000, eval;dur=0.000, total;dur=183.000

{"flags":{"souls":{"value":true,"variationId":"var_souls_on","reason":{"kind":"default"}},"theme":{"value":"dark","variationId":"var_theme_dark","reason":{"kind":"rule","attribute":"role"}},"rollout-demo":{"value":"b","variationId":"var_rollout_b","reason":{"kind":"rollout"}},"checkout-experiments-2026-q3-progressive-disclosure-variant-rollout-long-tail":{"value":false,"variationId":"var_longkey_off","reason":{"kind":"off"}}}}

A local Node integration script exercised conditional HTTP requests, rejected unauthenticated management access, invoked the compiled SDK evaluator against the running Worker, and ran the built CLI using an ephemeral local viewer token. The token was kept in process memory, passed through the child environment, and revoked afterward. The CLI command was:

node packages/cli/dist/index.js eval -p clawhub -e development --key dependency-refresh --attr role=admin --json

Actual integration output excerpts:

HTTP eval: 200; souls=true; theme=dark; Cache-Control=private, no-store
Conditional HTTP eval: 304
Unauthenticated admin request: 401
Built SDK + local Worker: {"souls":true,"theme":"dark","absent":"fallback"}

Actual CLI output excerpt:

{
  "flags": {
    "souls": {
      "value": true,
      "variationId": "var_souls_on",
      "reason": {
        "kind": "default"
      }
    },
    "theme": {
      "value": "dark",
      "variationId": "var_theme_dark",
      "reason": {
        "kind": "rule",
        "attribute": "role"
      }
    }
  }
}

The excerpt omits two additional fixture flags. The integration finished with Live proof passed. The dashboard also returned HTTP 200.

CI reasoning

Default-branch build/test CI was already green at 59f724c: CI run. Its jobs cover workflow lint, lint, typecheck, tests, and builds. CodeQL is a separate security analysis workflow, also green: scheduled CodeQL run. Stale and ClawSweeper Dispatch are operational automation, not build/test proof. Docs publishes on main; Cloudflare deployment is manual and SDK publication is tag-triggered. This PR does not deploy, publish, or alter production.

The API suite was also repeated using the installed Node 24.20.0 runtime, matching CI's Node major:

PATH=/opt/homebrew/opt/node@24/bin:$PATH pnpm --dir apps/api test

Test Files  15 passed (15)
     Tests  128 passed (128)

Both successful Worker runs printed two non-failing Error: internal error diagnostics; neither run failed an assertion or exited unsuccessfully. No tests, assertions, or jobs were weakened.

Codex autoreview completed with no actionable findings:

.agents/skills/autoreview/scripts/autoreview --mode local --engine codex --model gpt-5.6-sol --thinking high

The invocation additionally supplied scope context with --prompt covering the deferred updates and unchanged contracts. Result:

autoreview clean: no accepted/actionable findings reported
overall: patch is correct

Final checks for commit 0a0649f4ed4e6ad3e9f5bef9561a4eea8bbc9e2c: CI passed with all five jobs green (workflow lint, lint, typecheck, test, build), and CodeQL passed. No reruns were required. pnpm install --frozen-lockfile also passed locally with Already up to date.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 5, 2026, 7:59 AM ET / 11:59 UTC.

ClawSweeper review

What this changes

Updates compatible workspace dependencies, synchronizes Biome’s configuration schema, and regenerates the pnpm lockfile.

Merge readiness

✅ Ready for maintainer review

This remains a useful landing candidate: the refresh is absent from pinned main, and review found no blocking correctness or security defect.

Priority: P3
Reviewed head: 0a0649f4ed4e6ad3e9f5bef9561a4eea8bbc9e2c

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused dependency refresh with strong local runtime evidence, successful supplemental checks, and no actionable finding.
Proof confidence	🦞 diamond lobster (5/6)	Sufficient (terminal): The captured after-refresh terminal output exercises the real Worker with local D1 through the updated Wrangler/Zod path, showing expected evaluation values, HTTP 304 revalidation, management HTTP 401 rejection, and successful compiled SDK and CLI results.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Verified	Sufficient (terminal): The captured after-refresh terminal output exercises the real Worker with local D1 through the updated Wrangler/Zod path, showing expected evaluation values, HTTP 304 revalidation, management HTTP 401 rejection, and successful compiled SDK and CLI results.
Evidence reviewed	9 items	Repository policy applied: Read the complete root AGENTS.md and CONTRIBUTING.md. No additional ancestor-scoped policy or maintainer notes apply to the eight changed files. Applied the compatibility, generated-lockfile, and local Worker validation guidance; no target-bundled review helper was executed. Introduced change and merge identity: Inspected all introduced hunks, including the lockfile portions truncated in GitHub context. Changes comprise six manifests, Biome’s schema URL, and the lockfile. The verified test merge has the pinned main and PR head as its ordered parents, and its tree equals the reviewed head. Refresh remains absent from main: Pinned main still declares Zod 4.4.3 and Wrangler 4.126.0; its dashboard also retains React Query 5.102.4 and React Router 8.3.0. No merged fixing PR is established by the supplied context.
Findings	None	None.
Security	None	None.

How this fits together

Workspace dependencies support Krillswitch’s operator dashboard, Cloudflare Worker, SDKs, and development tools. The Worker validates evaluation requests and reads D1 configuration to return flag values to applications.

flowchart LR
  A[Workspace manifests] --> B[pnpm lockfile]
  B --> C[Dashboard and build tools]
  B --> D[Worker runtime]
  E[Evaluation requests] --> D
  F[D1 flag configuration] --> D
  D --> G[Flag values for applications]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency scope	11 version specifiers across 6 manifests; 0 direct dependencies added or removed	The refresh preserves dependency selection and avoids expanding the workspace’s direct dependency surface.

Technical review

Best possible solution:

Adopt the bounded refresh while keeping authentication migrations and runtime-support changes in separately reviewed work.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR refreshes dependencies rather than reporting a specific broken behavior.

Is this the best way to solve the issue?

Yes. Synchronized manifests and a generated lockfile provide a focused update without mixing in schema migrations or a higher runtime support floor.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 59f724c8d5aa.

Labels

Label justifications:

• P3: This is routine compatible dependency maintenance with no reported urgent user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🦞 diamond lobster and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Sufficient (terminal): The captured after-refresh terminal output exercises the real Worker with local D1 through the updated Wrangler/Zod path, showing expected evaluation values, HTTP 304 revalidation, management HTTP 401 rejection, and successful compiled SDK and CLI results.
• proof: sufficient: Contributor real behavior proof is sufficient. The captured after-refresh terminal output exercises the real Worker with local D1 through the updated Wrangler/Zod path, showing expected evaluation values, HTTP 304 revalidation, management HTTP 401 rejection, and successful compiled SDK and CLI results.

Evidence

What I checked:

• Repository policy applied: Read the complete root AGENTS.md and CONTRIBUTING.md. No additional ancestor-scoped policy or maintainer notes apply to the eight changed files. Applied the compatibility, generated-lockfile, and local Worker validation guidance; no target-bundled review helper was executed. (AGENTS.md:1, 0a0649f4ed4e)
• Introduced change and merge identity: Inspected all introduced hunks, including the lockfile portions truncated in GitHub context. Changes comprise six manifests, Biome’s schema URL, and the lockfile. The verified test merge has the pinned main and PR head as its ordered parents, and its tree equals the reviewed head. (29f7e62586ea)
• Refresh remains absent from main: Pinned main still declares Zod 4.4.3 and Wrangler 4.126.0; its dashboard also retains React Query 5.102.4 and React Router 8.3.0. No merged fixing PR is established by the supplied context. (apps/api/package.json:26, 59f724c8d5aa)
• Release check: No available release tag contains the PR head. The supplied latest release is sdk-v0.0.1; no release inclusion is claimed for this refresh. (0a0649f4ed4e)
• Compatibility and supply-chain boundaries preserved: The 48-hour release cooldown, exotic-subdependency block, build allowlist, dependency sources, scripts, and workflows are unchanged. Better Auth and its generator remain at 1.6.30, direct React-test jsdom remains at 29.1.1, and the existing jsdom 30 optional snapshots predate this patch. No schema, SDK export, or declared Node-floor change is introduced. (pnpm-workspace.yaml:6, 0a0649f4ed4e)
• Production-path proof: The supplied complete PR body, captured under sourceRevision 73e02137ca5115c6d817792fe56213452e96bf3dd08ee950986cea0a8380cd1d, reports an after-refresh Wrangler-local Worker with migrated and seeded D1. Actual output shows evaluation HTTP 200 with expected values, conditional HTTP 304, unauthenticated management HTTP 401, compiled SDK fallback behavior, and built CLI evaluation. These exercise the real Worker path using the refreshed Wrangler and Zod dependencies. Dashboard HTTP 200 establishes serving only, not browser interaction coverage. (apps/api/src/index.ts:117, 0a0649f4ed4e)

Likely related people:

• Peter Steinberger: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• Vincent Koc: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (14 earlier review cycles; latest 8 shown)

• reviewed 2026-09-02T16:06:09.500Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-02T19:24:47.677Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-03T04:00:10.787Z sha 0a0649f :: blocked before merge. :: none
• reviewed 2026-09-03T07:56:41.696Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-03T19:04:06.996Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T05:59:25.458Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T10:03:06.135Z sha 0a0649f :: needs maintainer review before merge. :: none
• reviewed 2026-09-04T17:59:52.475Z sha 0a0649f :: needs maintainer review before merge. :: none