build(deps-dev): bump the development-minor-and-patch group with 2 updates

[dependabot]

Bumps the development-minor-and-patch group with 2 updates: oxfmt and oxlint.

Updates oxfmt from 0.62.0 to 0.63.0

Changelog

Sourced from oxfmt's changelog.

Changelog

All notable changes to this package will be documented in this file.

The format is based on Keep a Changelog.

Commits

• c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
• 00f490d refactor(oxfmt,formatter): split sortImports validation and use type enum (...
• See full diff in compare view

Updates oxlint from 1.77.0 to 1.78.0

Changelog

Sourced from oxlint's changelog.

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

Commits

• c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
• ccb8fe8 feat(linter/jsdoc): implement no-blank-blocks rule (#25207)
• 9573937 fix(linter/typescript): validate ban-ts-comment description_format (#25320)
• d4a897c feat(linter/eslint): implement one-var rule (#24470)
• 5ab9340 feat(linter/jsx-a11y/anchor-has-content): add options to match eslint (#24571)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 24, 2026, 4:12 AM ET / 08:12 UTC.

ClawSweeper review

What this changes

The branch raises the Oxfmt development dependency to 0.63.0 and updates the pnpm lockfile to resolve Oxlint 1.78.0 and their native bindings.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

Keep this PR open: current main still resolves the older tool versions, and the clean two-file update matches the repository’s Dependabot policy. Successful Ubuntu CI is useful, but a native cross-platform tooling refresh still needs real non-Linux validation before merge.

Priority: P3
Reviewed head: 192e87b0c5739ea0076ba2989b890d7121760812

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	8 items	Current main has not absorbed the update: Current main still declares Oxfmt 0.62.0 and resolves Oxlint 1.77.0, while the PR head declares/resolves 0.63.0 and 1.78.0 respectively. The PR is a narrow dependency update: The three-way diff modifies only package.json and pnpm-lock.yaml; the lockfile resolves Oxfmt 0.63.0 and Oxlint 1.78.0. Native binding scope: The lockfile refreshes 38 Oxfmt/Oxlint platform-native binding package records, covering developer platforms beyond the Ubuntu CI runner.
Findings	None	None.
Security	None	None.

How this fits together

Clawpatch’s pnpm development scripts invoke Oxfmt and Oxlint to verify TypeScript formatting and linting before builds and releases. The manifest and lockfile select those executable tools and their platform-specific native bindings for CI and contributors.

flowchart LR
A[Developer or CI] --> C[pnpm scripts]
B[Manifest and lockfile] --> C
C --> D[Oxfmt and Oxlint]
D --> E[Platform native bindings]
E --> F[Lint and format results]

Loading

Before merge

• Resolve merge risk (P1) - This refresh replaces 38 platform-specific native formatter and linter bindings, while the repository workflow exercises only Ubuntu; macOS or Windows contributors could encounter a broken local validation tool despite green Linux CI.
• Complete next step (P2) - A maintainer or trusted platform runner must supply the missing non-Linux real-behavior evidence; there is no narrow code repair for an automated worker to make.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Dependency surface	2 direct development tools; 38 native binding package records refreshed	The lockfile changes executable formatter and linter binaries across contributor platforms, not only metadata.

Merge-risk options

Maintainer options:

1. Verify a non-Linux native binding (recommended)
   Run a clean frozen-lockfile install on macOS or Windows with the supported Node version, then capture successful pnpm lint and pnpm format:check output before merge.
2. Accept Linux-only coverage
   Merge based on the passing Ubuntu checks while explicitly accepting that the refreshed macOS and Windows bindings were not exercised.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Run a clean macOS or Windows frozen-lockfile install with the supported Node version, then attach redacted successful output from pnpm lint and pnpm format:check.

Technical review

Best possible solution:

Land the routine Dependabot update once a clean non-Linux installation demonstrates that the upgraded formatter and linter execute successfully against this repository.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this PR updates development tooling and does not report an existing product failure. The relevant verification is an after-update execution of the formatter and linter on supported developer platforms.

Is this the best way to solve the issue?

Yes, the grouped Dependabot update matches the repository’s configured development dependency policy; a non-Linux execution check is the narrowest remaining confidence step.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 36b5c739e0f9.

Labels

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🦞 diamond lobster, so this older rating label is no longer current.

Label justifications:

• P3: This is routine development-tool maintenance with no reported production regression.
• merge-risk: 🚨 compatibility: Updated native formatter and linter binaries may affect local macOS or Windows validation paths not covered by Ubuntu CI.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

What I checked:

• Current main has not absorbed the update: Current main still declares Oxfmt 0.62.0 and resolves Oxlint 1.77.0, while the PR head declares/resolves 0.63.0 and 1.78.0 respectively. (package.json:44, 36b5c739e0f9)
• The PR is a narrow dependency update: The three-way diff modifies only package.json and pnpm-lock.yaml; the lockfile resolves Oxfmt 0.63.0 and Oxlint 1.78.0. (pnpm-lock.yaml:28, 192e87b0c573)
• Native binding scope: The lockfile refreshes 38 Oxfmt/Oxlint platform-native binding package records, covering developer platforms beyond the Ubuntu CI runner. (pnpm-lock.yaml:41, 192e87b0c573)
• Tooling is an active development contract: The package scripts execute Oxlint and Oxfmt, so their runtime compatibility directly affects local validation and release checks. (package.json:24, 36b5c739e0f9)
• Repository policy expects this dependency group: Dependabot is configured to group development minor and patch npm updates, matching the PR’s stated scope. (.github/dependabot.yml:16, 36b5c739e0f9)
• CI coverage is Ubuntu-only: The workflow runs installation, lint, format checking, tests, build, and package smoke checks on ubuntu-latest; it does not exercise the updated macOS or Windows native bindings. (.github/workflows/ci.yml:9, 36b5c739e0f9)

Likely related people:

• openclaw/openclaw-secops: Current CODEOWNERS assigns package.json and pnpm-lock.yaml, the two changed package-integrity surfaces, to this team. (role: CODEOWNERS review group; confidence: high; files: .github/CODEOWNERS, package.json, pnpm-lock.yaml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (6 earlier review cycles)

• reviewed 2026-08-17T18:32:07.669Z sha 192e87b :: needs maintainer review before merge. :: none
• reviewed 2026-08-22T01:17:50.869Z sha 192e87b :: needs maintainer review before merge. :: none
• reviewed 2026-08-22T11:06:22.577Z sha 192e87b :: needs maintainer review before merge. :: none
• reviewed 2026-08-23T05:56:48.839Z sha 192e87b :: needs maintainer review before merge. :: none
• reviewed 2026-08-23T14:59:07.928Z sha 192e87b :: needs maintainer review before merge. :: none
• reviewed 2026-08-23T21:54:36.211Z sha 192e87b :: needs maintainer review before merge. :: none

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.