chore(deps-dev): bump the development group with 2 updates

[dependabot]

Bumps the development group with 2 updates: @napi-rs/cli and @types/node.

Updates @napi-rs/cli from 3.7.4 to 3.8.0

Commits

• 9da8723 chore(release): publish
• 8d22196 chore(deps): update dependency oxc-parser to ^0.142.0 (#3422)
• abc30fb build(deps): bump postcss from 8.5.17 to 8.5.23 (#3421)
• 5542139 build(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 (#3418)
• dc4ee8c build(deps): bump fast-uri from 3.1.3 to 3.1.4 (#3419)
• 050d985 feat(async-runtime): drain-linger surface + lock-free scheduler internals (#3...
• e0b8708 chore(deps): update dependency oxc-parser to ^0.141.0 (#3417)
• fc84940 chore(deps): update actions/setup-node action to v7 (#3413)
• ee598db build(deps): bump protobufjs from 7.6.4 to 7.6.5 (#3410)
• e707ede chore(deps): update actions/setup-node action to v7 (#3412)
• Additional commits viewable in compare view

Updates @types/node from 26.1.1 to 26.1.2

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 31, 2026, 7:11 PM ET / 23:11 UTC.

ClawSweeper review

What this changes

The branch updates the development-only @napi-rs/cli from 3.7.4 to 3.8.0, refreshes resolved @types/node packages to 26.1.2, and regenerates the pnpm lockfile.

Merge readiness

⚠️ Ready for maintainer review - 3 items remain

Keep this PR open for maintainer triage: it is a narrow development-tool update, but the current head has a failing Node 24 Windows validation job and the available evidence does not establish whether that failure is caused by the new native build CLI resolution. Likely related people: Peter Steinberger (high confidence, recent toolchain and CI work) and Sarah Fortune (medium confidence, Windows check coverage).

Priority: P3
Reviewed head: 8fe9bf61c2eabd1ac67c64aa1ea7f59fc38ddb53

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The diff is focused and mechanically consistent, but the unresolved Node 24 Windows failure prevents a merge-ready rating.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is a bot-authored dependency update; the relevant proof is cross-platform build validation rather than contributor runtime media.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot maintenance PR is a bot-authored dependency update; the relevant proof is cross-platform build validation rather than contributor runtime media.
Evidence reviewed	5 items	Narrow dependency diff: The PR changes one direct development dependency in the manifest and its generated resolution graph in the lockfile: @napi-rs/cli 3.7.4 to 3.8.0, plus the resolved Node type version. Affected native-build path: The native workspace runs napi build --platform --release, so this CLI update directly affects the host-binding build executed by CI and release workflows. Windows validation coverage: The regular check workflow installs the lockfile and runs pnpm check across Node 22 and Node 24 on Windows, macOS, and Ubuntu; the provided check state reports the Node 24 Windows job as failed while the other five regular matrix jobs succeeded.
Findings	None	None.
Security	None	None.

How this fits together

The package uses pnpm to install its development toolchain before building TypeScript and compiling native bindings. The updated N-API CLI is invoked by the private native-build workspace and by cross-platform CI and release build paths.

flowchart LR
  A[Package manifest] --> B[PNPM lockfile resolution]
  B --> C[Native build CLI]
  C --> D[Native binding build]
  D --> E[Node 22 and 24 CI matrix]
  E --> F[Package validation and release artifacts]

Loading

Before merge

• Resolve merge risk (P1) - The Node 24 Windows pnpm check job fails on the PR head; without its diagnostic output, merging could leave a supported Windows development or CI path broken.
• Resolve merge risk (P1) - The lockfile changes the native CLI's transitive resolution as well as its direct version, so a green native-only Windows check does not by itself prove the full Node 24 check path remains safe.
• Complete next step (P2) - A maintainer should inspect the failing Node 24 Windows validation before merge; the available review evidence does not identify a safe file-level repair.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Changed surface	2 files affected; 1 manifest entry changed	The source change is narrow, while the lockfile refresh carries the native CLI's full resolved dependency graph.
Cross-platform checks	1 failed, 37 succeeded or skipped	The single failed supported Windows Node 24 lane is the only concrete merge-blocking signal in the supplied check state.

Merge-risk options

Maintainer options:

1. Diagnose and rerun Windows validation (recommended)
   Inspect the failed Node 24 Windows job, repair only a confirmed compatibility problem if present, and require a green rerun before merging.
2. Pause the dependency update
   Close or defer this update if the new native CLI cannot support the repository's Windows Node 24 check without broader toolchain changes.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Inspect the Node 24 Windows check failure; if it is caused by this dependency resolution, make the smallest compatible repair and rerun the affected validation.

Technical review

Best possible solution:

Identify the failing Node 24 Windows step, confirm the 3.8.0 CLI works for both the normal Windows check and native build path, then merge the focused dependency update if the rerun is green.

Do we have a high-confidence way to reproduce the issue?

Not applicable as a user-bug reproduction: the relevant verification is the Node 24 Windows CI path, whose supplied result currently fails but whose detailed log was unavailable during this read-only review.

Is this the best way to solve the issue?

Unclear: updating the development CLI is the narrowest maintenance path, but it should not merge until the Windows Node 24 failure is shown unrelated or is repaired with focused validation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against ab933820c089.

Labels

Label justifications:

• P3: This is a routine development-dependency update with no established production behavior regression.
• merge-risk: 🚨 availability: The updated tool resolution coincides with a failed supported Node 24 Windows validation lane.
• merge-risk: 🚨 automation: The PR changes the dependencies installed by cross-platform CI before build and validation commands run.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This Dependabot maintenance PR is a bot-authored dependency update; the relevant proof is cross-platform build validation rather than contributor runtime media.

Evidence

What I checked:

• Narrow dependency diff: The PR changes one direct development dependency in the manifest and its generated resolution graph in the lockfile: @napi-rs/cli 3.7.4 to 3.8.0, plus the resolved Node type version. (package.json:151, 8fe9bf61c2ea)
• Affected native-build path: The native workspace runs napi build --platform --release, so this CLI update directly affects the host-binding build executed by CI and release workflows. (native/package.json:27, ab933820c089)
• Windows validation coverage: The regular check workflow installs the lockfile and runs pnpm check across Node 22 and Node 24 on Windows, macOS, and Ubuntu; the provided check state reports the Node 24 Windows job as failed while the other five regular matrix jobs succeeded. (.github/workflows/ci.yml:25, ab933820c089)
• Feature-history provenance: Peter Steinberger's toolchain refresh commit and Sarah Fortune's Windows-check coverage commit are the strongest local history signals for this CI/build surface. (.github/workflows/ci.yml:25, b6fa049262a3)
• Current-main and release check: The PR head is not contained by any local branch or tag, while the latest released main commit is v0.5.0; the requested 3.8.0 update is therefore neither implemented on current main nor released. (package.json:151, 66201c1f347a)

Likely related people:

• Peter Steinberger: Authored the recent toolchain refresh and has the largest local history footprint on the repository's build and workflow files. (role: recent toolchain and CI contributor; confidence: high; commits: b6fa049262a3, 90021118499b, b13271263594; files: .github/workflows/ci.yml, native/package.json)
• Sarah Fortune: Authored the commit that added Windows check coverage and guarded Windows-specific test behavior, directly adjacent to the failing validation lane. (role: Windows validation contributor; confidence: medium; commits: 3be7ba6ee384; files: .github/workflows/ci.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Inspect the failed Windows job and capture the failing command or diagnostic output.
• Rerun the Node 24 Windows check after confirming whether the dependency update is compatible.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-07-30T17:28:37.341Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-30T22:08:27.022Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-30T23:13:50.149Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T06:31:47.893Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T09:34:15.901Z sha 8fe9bf6 :: needs maintainer review before merge. :: none
• reviewed 2026-07-31T17:28:59.129Z sha 8fe9bf6 :: needs maintainer review before merge. :: none