chore(deps): bump the minor-and-patch group across 1 directory with 17 updates

[dependabot]

Bumps the minor-and-patch group with 16 updates in the / directory:

Package	From	To
@astryxdesign/cli	0.4.0	0.4.1
@astryxdesign/core	0.4.0	0.4.1
@biomejs/biome	2.5.6	2.5.8
@types/node	26.1.2	26.2.0
dugite	3.2.2	3.2.3
knip	6.26.0	6.32.2
@openai/agents-core	0.14.3	0.16.0
@larksuiteoapi/node-sdk	1.72.0	1.73.0
ws	8.21.2	8.21.3
esbuild	0.27.7	0.28.2
electron	43.2.0	43.4.0
@earendil-works/pi-tui	0.83.0	0.84.2
lucide-react	1.28.0	1.31.0
@astryxdesign/theme-neutral	0.4.0	0.4.1
@storybook/react-vite	10.5.6	10.5.8
vite	8.1.5	8.2.1

Updates @astryxdesign/cli from 0.4.0 to 0.4.1

Release notes

Sourced from @​astryxdesign/cli's releases.

v0.4.1

Astryx 0.4.1 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

• The keyboard focus ring is now a theme token. --focus-outline-width, --focus-outline-style, --focus-outline-color and --focus-outline-offset drive every ring in core and lab, so one override in a theme's tokens restyles focus system-wide; the color tracks --color-accent unless a theme sets it. The :focus-visible condition is not themeable, so a themed ring still cannot appear for pointer users (#4973). Every ring is now drawn from the shared focus-outline utility rather than written out per component, and a lint rule keeps it that way. Two corrections come with that: the rings that had drifted to a 2px offset (Slider, Switch, Lightbox, ProgressBar, and lab's InfoTip, Step and LogStream) now sit at the documented 3px, and the buttons inside a field — the Date, DateRange and DateTime calendar toggles, the DateRange presets, and the Selector and MultiSelector status buttons — draw the standard 2px ring instead of a 1px one.
• AspectRatio, Badge, Blockquote, Card, Center, Code, Grid, Section, Skeleton and VisuallyHidden no longer carry 'use client' (#823). Each was verified against its transitive import graph to use no React client API, no client-only dependency and no module-level mutable state, so they can now render in a React Server Component without forcing a client boundary. A new serverSafeComponents.test.ts derives the server-safe set from the import graph and fails if one of these components later gains a client dependency without restoring the directive — including the transitive case scripts/check-use-client.mjs cannot see. Not a breaking change: no prop, type or export changed, and 'use client' is inert outside an RSC bundler. Client consumers keep working identically, though bundlers may lay these modules out in different chunks now that they are no longer client entry points.
• Selector and MultiSelector: indicatorPosition places the selection indicator on either edge of the option row — start or end, logical, so it follows RTL. Defaults keep today's rendering (end for Selector's check, start for MultiSelector's checkbox); a start-positioned check reserves its column on every row so labels stay aligned (#4993).

Fixes

• TimeInput: announce arrow-key time stepping via the polite live region (also in DateTimeInput), localize the "Invalid date"/"Invalid time" live-region messages through the i18n catalog, and use long timezone names in Timestamp's AT-facing aria-label while keeping the short form visible (#4363)

• Banner: the 'banner-icon' theme target now rides on the default status Icon itself instead of its layout wrapper, so theme component overrides ('banner-icon' + 'status:X') that set color actually reach the glyph. The Icon keeps its existing color variant (info still renders accent) and same-element rules in @​layer astryx-theme win over it, so default rendering is unchanged. Contract note: '.astryx-banner-icon' now matches the icon element rather than the wrapper when the default icon renders; a theme that used the target for wrapper layout (margin, alignment) now styles the glyph instead. With a custom icon node the target stays on the layout-only wrapper, since core never injects props into consumer elements (#4166)

• CommandPalette: discard in-flight search responses when the palette closes (#3896) Closing the palette while a search was still in flight let the late response re-commit the abandoned query and results into the closed palette, which showed up as a ghost query on reopen. Closing now invalidates any pending request.

• FileInput: validation messages, default placeholder, drag hint, and file-selected announcements now go through the i18n translator instead of hardcoded English. DropdownMenuRadioGroup: consumer xstyle prop is composed into styles instead of being dropped (#4589).

• The popup theme targets added in #4991 sat on the wrong element. astryx-complex-selector-popup and astryx-multi-selector-popup were rendered on each component's own content box — the one with the padding and the scroll — while the element that paints the popup's background, radius and elevation is the surface usePopover creates one level above it. A theme reaching for those classes to restyle a popup got a rule that could not paint it. Both now land on the surface, so they do what they were documented to do. Selector gains the matching astryx-selector-popup, which its sibling MultiSelector had and it did not.

  New: every popup surface carries the shared astryx-popover-surface class, so a theme can style all of them at once, and usePopover accepts a surfaceTarget naming the surface for a component that wants its own target there. A component cannot do this for itself — the surface belongs to usePopover, so any class it renders itself lands inside.

• Selector's menu now clears the trigger by the standard --spacing-1 gap whenever it is not overlaying it — every explicit placement, and search mode. It was the only anchored menu in the system sitting flush against its anchor; DropdownMenu, MultiSelector, ComplexSelector, Popover, and Tooltip all use this clearance. The default selected-item overlay is unchanged: it owns its block geometry and is meant to sit on the trigger (#5003).

• Selector, MultiSelector: the dropdown panel's search field is now part of the panel instead of a bordered input dropped into it. The panel is already a bordered, elevated surface, so the nested TextInput drew a box inside a box; the row now renders a leading magnifier, a borderless input, and the shared clear (✕) button, with a full-bleed divider between it and the options — the same shape the command palette already uses. Focus is shown as an inset ring on the row, rounded to the panel's own corners. Section titles move from labeled dividers to plain secondary headings, matching DropdownMenu and CommandPaletteGroup, and MultiSelector no longer draws a rule under select-all. Behavior, keyboard handling, and accessible names are unchanged; MultiSelector's search row additionally stays put while the options scroll under it. New theme targets: astryx-selector-search, astryx-selector-section-heading, astryx-multi-selector-search, astryx-multi-selector-section-heading; anything that styled the dropdown search through astryx-text-input needs to move to those.

• TableRow: honor className and style on the <tr>. TableRowProps extends BaseProps, but both were spread before mergeProps() and then overwritten by the component's own StyleX classes, so a consumer's values silently had no effect. They are now merged through mergeProps() alongside the row's StyleX styles, the same way TableCell and TableHeaderCell already handle them, in both the in-Table and standalone rendering paths. The Astryx theme classes and striped/hover styling are unchanged (#4391).

@​astryxdesign/cli

Fixes

• astryx theme build no longer warns Unknown prop for documented state override keys. Component docs declare state-driven selectors under theming.targets[].states (radio → checked/disabled, calendar-day → today/selected, …), but override validation only loaded visualProps, so the state syntax the Theming Infrastructure wiki documents — components: {radio: {checked: {...}}} — warned on every build. The CSS was always generated correctly; only the warning was wrong. 30 targets across core were affected (#4778).

Contributors

Thanks to everyone who contributed to this release:

@​AKnassa @​arham766 @​bhamodi @​cixzhang @​Eloitor @​jiunshinn

Full Changelog: facebook/astryx@v0.4.0...v0.4.1

Changelog

Sourced from @​astryxdesign/cli's changelog.

0.4.1

Fixes

• astryx theme build no longer warns Unknown prop for documented state override keys. Component docs declare state-driven selectors under theming.targets[].states (radio → checked/disabled, calendar-day → today/selected, …), but override validation only loaded visualProps, so the state syntax the Theming Infrastructure wiki documents — components: {radio: {checked: {...}}} — warned on every build. The CSS was always generated correctly; only the warning was wrong. 30 targets across core were affected (#4778).

Contributors

Thanks to everyone who contributed to this release:

• @​cixzhang

---

Commits

• 96f9917 chore: version packages for v0.4.1 (#5038)
• 1a333a8 docs(deslop): recast em dashes and curly apostrophes in CLI and lab docs (#5028)
• fff8412 fix(cli): load theming target states in theme-build override validation (#4778)
• 41f53a0 fix(core): move the popup theme targets onto the surface that paints (#5009)
• c6a994e feat(theme): make the focus outline a token (#4973)
• See full diff in compare view

Updates @astryxdesign/core from 0.4.0 to 0.4.1

Release notes

Sourced from @​astryxdesign/core's releases.

v0.4.1

Astryx 0.4.1 — all @astryxdesign/* packages ship at this version.

npx astryx upgrade --apply

@​astryxdesign/core

New Features

• The keyboard focus ring is now a theme token. --focus-outline-width, --focus-outline-style, --focus-outline-color and --focus-outline-offset drive every ring in core and lab, so one override in a theme's tokens restyles focus system-wide; the color tracks --color-accent unless a theme sets it. The :focus-visible condition is not themeable, so a themed ring still cannot appear for pointer users (#4973). Every ring is now drawn from the shared focus-outline utility rather than written out per component, and a lint rule keeps it that way. Two corrections come with that: the rings that had drifted to a 2px offset (Slider, Switch, Lightbox, ProgressBar, and lab's InfoTip, Step and LogStream) now sit at the documented 3px, and the buttons inside a field — the Date, DateRange and DateTime calendar toggles, the DateRange presets, and the Selector and MultiSelector status buttons — draw the standard 2px ring instead of a 1px one.
• AspectRatio, Badge, Blockquote, Card, Center, Code, Grid, Section, Skeleton and VisuallyHidden no longer carry 'use client' (#823). Each was verified against its transitive import graph to use no React client API, no client-only dependency and no module-level mutable state, so they can now render in a React Server Component without forcing a client boundary. A new serverSafeComponents.test.ts derives the server-safe set from the import graph and fails if one of these components later gains a client dependency without restoring the directive — including the transitive case scripts/check-use-client.mjs cannot see. Not a breaking change: no prop, type or export changed, and 'use client' is inert outside an RSC bundler. Client consumers keep working identically, though bundlers may lay these modules out in different chunks now that they are no longer client entry points.
• Selector and MultiSelector: indicatorPosition places the selection indicator on either edge of the option row — start or end, logical, so it follows RTL. Defaults keep today's rendering (end for Selector's check, start for MultiSelector's checkbox); a start-positioned check reserves its column on every row so labels stay aligned (#4993).

Fixes

• TimeInput: announce arrow-key time stepping via the polite live region (also in DateTimeInput), localize the "Invalid date"/"Invalid time" live-region messages through the i18n catalog, and use long timezone names in Timestamp's AT-facing aria-label while keeping the short form visible (#4363)

• Banner: the 'banner-icon' theme target now rides on the default status Icon itself instead of its layout wrapper, so theme component overrides ('banner-icon' + 'status:X') that set color actually reach the glyph. The Icon keeps its existing color variant (info still renders accent) and same-element rules in @​layer astryx-theme win over it, so default rendering is unchanged. Contract note: '.astryx-banner-icon' now matches the icon element rather than the wrapper when the default icon renders; a theme that used the target for wrapper layout (margin, alignment) now styles the glyph instead. With a custom icon node the target stays on the layout-only wrapper, since core never injects props into consumer elements (#4166)

• CommandPalette: discard in-flight search responses when the palette closes (#3896) Closing the palette while a search was still in flight let the late response re-commit the abandoned query and results into the closed palette, which showed up as a ghost query on reopen. Closing now invalidates any pending request.

• FileInput: validation messages, default placeholder, drag hint, and file-selected announcements now go through the i18n translator instead of hardcoded English. DropdownMenuRadioGroup: consumer xstyle prop is composed into styles instead of being dropped (#4589).

• The popup theme targets added in #4991 sat on the wrong element. astryx-complex-selector-popup and astryx-multi-selector-popup were rendered on each component's own content box — the one with the padding and the scroll — while the element that paints the popup's background, radius and elevation is the surface usePopover creates one level above it. A theme reaching for those classes to restyle a popup got a rule that could not paint it. Both now land on the surface, so they do what they were documented to do. Selector gains the matching astryx-selector-popup, which its sibling MultiSelector had and it did not.

  New: every popup surface carries the shared astryx-popover-surface class, so a theme can style all of them at once, and usePopover accepts a surfaceTarget naming the surface for a component that wants its own target there. A component cannot do this for itself — the surface belongs to usePopover, so any class it renders itself lands inside.

• Selector's menu now clears the trigger by the standard --spacing-1 gap whenever it is not overlaying it — every explicit placement, and search mode. It was the only anchored menu in the system sitting flush against its anchor; DropdownMenu, MultiSelector, ComplexSelector, Popover, and Tooltip all use this clearance. The default selected-item overlay is unchanged: it owns its block geometry and is meant to sit on the trigger (#5003).

• Selector, MultiSelector: the dropdown panel's search field is now part of the panel instead of a bordered input dropped into it. The panel is already a bordered, elevated surface, so the nested TextInput drew a box inside a box; the row now renders a leading magnifier, a borderless input, and the shared clear (✕) button, with a full-bleed divider between it and the options — the same shape the command palette already uses. Focus is shown as an inset ring on the row, rounded to the panel's own corners. Section titles move from labeled dividers to plain secondary headings, matching DropdownMenu and CommandPaletteGroup, and MultiSelector no longer draws a rule under select-all. Behavior, keyboard handling, and accessible names are unchanged; MultiSelector's search row additionally stays put while the options scroll under it. New theme targets: astryx-selector-search, astryx-selector-section-heading, astryx-multi-selector-search, astryx-multi-selector-section-heading; anything that styled the dropdown search through astryx-text-input needs to move to those.

• TableRow: honor className and style on the <tr>. TableRowProps extends BaseProps, but both were spread before mergeProps() and then overwritten by the component's own StyleX classes, so a consumer's values silently had no effect. They are now merged through mergeProps() alongside the row's StyleX styles, the same way TableCell and TableHeaderCell already handle them, in both the in-Table and standalone rendering paths. The Astryx theme classes and striped/hover styling are unchanged (#4391).

@​astryxdesign/cli

Fixes

• astryx theme build no longer warns Unknown prop for documented state override keys. Component docs declare state-driven selectors under theming.targets[].states (radio → checked/disabled, calendar-day → today/selected, …), but override validation only loaded visualProps, so the state syntax the Theming Infrastructure wiki documents — components: {radio: {checked: {...}}} — warned on every build. The CSS was always generated correctly; only the warning was wrong. 30 targets across core were affected (#4778).

Contributors

Thanks to everyone who contributed to this release:

@​AKnassa @​arham766 @​bhamodi @​cixzhang @​Eloitor @​jiunshinn

Full Changelog: facebook/astryx@v0.4.0...v0.4.1

Changelog

Sourced from @​astryxdesign/core's changelog.

0.4.1

New Features

• The keyboard focus ring is now a theme token. --focus-outline-width, --focus-outline-style, --focus-outline-color and --focus-outline-offset drive every ring in core and lab, so one override in a theme's tokens restyles focus system-wide; the color tracks --color-accent unless a theme sets it. The :focus-visible condition is not themeable, so a themed ring still cannot appear for pointer users (#4973). Every ring is now drawn from the shared focus-outline utility rather than written out per component, and a lint rule keeps it that way. Two corrections come with that: the rings that had drifted to a 2px offset (Slider, Switch, Lightbox, ProgressBar, and lab's InfoTip, Step and LogStream) now sit at the documented 3px, and the buttons inside a field — the Date, DateRange and DateTime calendar toggles, the DateRange presets, and the Selector and MultiSelector status buttons — draw the standard 2px ring instead of a 1px one.
• AspectRatio, Badge, Blockquote, Card, Center, Code, Grid, Section, Skeleton and VisuallyHidden no longer carry 'use client' (#823). Each was verified against its transitive import graph to use no React client API, no client-only dependency and no module-level mutable state, so they can now render in a React Server Component without forcing a client boundary. A new serverSafeComponents.test.ts derives the server-safe set from the import graph and fails if one of these components later gains a client dependency without restoring the directive — including the transitive case scripts/check-use-client.mjs cannot see. Not a breaking change: no prop, type or export changed, and 'use client' is inert outside an RSC bundler. Client consumers keep working identically, though bundlers may lay these modules out in different chunks now that they are no longer client entry points.
• Selector and MultiSelector: indicatorPosition places the selection indicator on either edge of the option row — start or end, logical, so it follows RTL. Defaults keep today's rendering (end for Selector's check, start for MultiSelector's checkbox); a start-positioned check reserves its column on every row so labels stay aligned (#4993).

Fixes

• TimeInput: announce arrow-key time stepping via the polite live region (also in DateTimeInput), localize the "Invalid date"/"Invalid time" live-region messages through the i18n catalog, and use long timezone names in Timestamp's AT-facing aria-label while keeping the short form visible (#4363)

• Banner: the 'banner-icon' theme target now rides on the default status Icon itself instead of its layout wrapper, so theme component overrides ('banner-icon' + 'status:X') that set color actually reach the glyph. The Icon keeps its existing color variant (info still renders accent) and same-element rules in @​layer astryx-theme win over it, so default rendering is unchanged. Contract note: '.astryx-banner-icon' now matches the icon element rather than the wrapper when the default icon renders; a theme that used the target for wrapper layout (margin, alignment) now styles the glyph instead. With a custom icon node the target stays on the layout-only wrapper, since core never injects props into consumer elements (#4166)

• CommandPalette: discard in-flight search responses when the palette closes (#3896) Closing the palette while a search was still in flight let the late response re-commit the abandoned query and results into the closed palette, which showed up as a ghost query on reopen. Closing now invalidates any pending request.

• FileInput: validation messages, default placeholder, drag hint, and file-selected announcements now go through the i18n translator instead of hardcoded English. DropdownMenuRadioGroup: consumer xstyle prop is composed into styles instead of being dropped (#4589).

• The popup theme targets added in #4991 sat on the wrong element. astryx-complex-selector-popup and astryx-multi-selector-popup were rendered on each component's own content box — the one with the padding and the scroll — while the element that paints the popup's background, radius and elevation is the surface usePopover creates one level above it. A theme reaching for those classes to restyle a popup got a rule that could not paint it. Both now land on the surface, so they do what they were documented to do. Selector gains the matching astryx-selector-popup, which its sibling MultiSelector had and it did not.

  New: every popup surface carries the shared astryx-popover-surface class, so a theme can style all of them at once, and usePopover accepts a surfaceTarget naming the surface for a component that wants its own target there. A component cannot do this for itself — the surface belongs to usePopover, so any class it renders itself lands inside.

• Selector's menu now clears the trigger by the standard --spacing-1 gap whenever it is not overlaying it — every explicit placement, and search mode. It was the only anchored menu in the system sitting flush against its anchor; DropdownMenu, MultiSelector, ComplexSelector, Popover, and Tooltip all use this clearance. The default selected-item overlay is unchanged: it owns its block geometry and is meant to sit on the trigger (#5003).

• Selector, MultiSelector: the dropdown panel's search field is now part of the panel instead of a bordered input dropped into it. The panel is already a bordered, elevated surface, so the nested TextInput drew a box inside a box; the row now renders a leading magnifier, a borderless input, and the shared clear (✕) button, with a full-bleed divider between it and the options — the same shape the command palette already uses. Focus is shown as an inset ring on the row, rounded to the panel's own corners. Section titles move from labeled dividers to plain secondary headings, matching DropdownMenu and CommandPaletteGroup, and MultiSelector no longer draws a rule under select-all. Behavior, keyboard handling, and accessible names are unchanged; MultiSelector's search row additionally stays put while the options scroll under it. New theme targets: astryx-selector-search, astryx-selector-section-heading, astryx-multi-selector-search, astryx-multi-selector-section-heading; anything that styled the dropdown search through astryx-text-input needs to move to those.

• TableRow: honor className and style on the <tr>. TableRowProps extends BaseProps, but both were spread before mergeProps() and then overwritten by the component's own StyleX classes, so a consumer's values silently had no effect. They are now merged through mergeProps() alongside the row's StyleX styles, the same way TableCell and TableHeaderCell already handle them, in both the in-Table and standalone rendering paths. The Astryx theme classes and striped/hover styling are unchanged (#4391).

Contributors

Thanks to everyone who contributed to this release:

• @​AKnassa
• @​arham766
• @​bhamodi
• @​cixzhang
• @​Eloitor
• @​jiunshinn

---

Commits

• 96f9917 chore: version packages for v0.4.1 (#5038)
• dad87f5 fix(selector): make the dropdown search part of the panel, not a box inside i...
• b575c18 docs(deslop): recast em dash in Indicator children description (#4982)
• 3ee137e docs(storybook): remove JS comments from globalIconRegistry @​example blocks (...
• ab60c59 docs(dense): restore AppShell bestPractices parity in docsDense (#4981)
• e18b6db fix(CommandPalette): discard in-flight search responses on close (#3896)
• 647ff7e feat(core): drop 'use client' from server-safe primitives (#4407)
• 3112e99 fix(core): TopNavMegaMenu anchors to its trigger outside a <nav> (#4905) (#4916)
• 9e52262 fix(table): honor className and style on TableRow (#4391)
• d6d345c fix(banner): move the 'banner-icon' theme target onto the status Icon so 'sta...
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.6 to 2.5.8

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.5.8

2.5.8

Patch Changes

• #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

• #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.5.8

Patch Changes

• #10710 0a0fbc1 Thanks @​dyc3! - Added a new nursery rule useReactCompiler, which reports diagnostics from React Compiler lint mode.

• #11251 ea9dd8a Thanks @​dyc3! - Improved performance of noImportCycles.

• #11247 52b44d6 Thanks @​dyc3! - Added the nursery rule noSvelteLegacyConst, which disallows legacy Svelte {@const} tags and recommends declaration tags with $derived().

  Invalid:

  {#each boxes as box}
    {@const area = box.width * box.height}
    <p>{area}</p>
  {/each}

  Valid:

  {#each boxes as box}
    {const area = $derived(box.width * box.height)}
    <p>{area}</p>
  {/each}

• #11252 d5f5704 Thanks @​Turtle-Hwan! - Fixed #11250: useAwait no longer reports async functions that contain an await using declaration.

• #11143 6be7be1 Thanks @​vznh! - Fixed #11017: noUselessUndefined no longer reports return undefined when the enclosing function has a return type annotation other than undefined or void.

• #11234 caefe39 Thanks @​subotac! - Fixed #11228: CSS block comments between a declaration colon and value now preserve their source indentation.

   :root {
     --font-stack:
  -/* comment */
  +    /* comment */
       system-ui;
   }

• #11285 bca1f73 Thanks @​denbezrukov! - Fixed #11280: CSS formatting keeps comments inside functional pseudo-classes and pseudo-elements instead of moving them before the function name.

  -:/* comment */ where(div) {}
  +:where(/* comment */ div) {}

... (truncated)

Commits

• 6b8f09c ci: release (#11236)
• 23c0369 feat(lint): nursery noInvalidPropertyInitValue (#11187)
• 52b44d6 feat(lint/html): add noSvelteLegacyConst (#11247)
• 0a0fbc1 feat(lint/js): add useReactCompiler (#10710)
• 191d051 ci: release (#11119)
• 9847e68 feat(lint): add noNonScalableViewport rule (#11168)
• e63354c feat(lint): add noExtendNative nursery rule (#11136)
• 2fa0a62 docs: rework CLI (#11134)
• e007143 feat(lint): add nursery rule noTailwindArbitraryValue (#10094)
• c171b3b feat(lint): add ignoreIfStatements option to useNullishCoalescing (#10822)
• See full diff in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Updates dugite from 3.2.2 to 3.2.3

Release notes

Sourced from dugite's releases.

v3.2.3

What's Changed

• Update documentation for v3.0.0 API by @​niik in desktop/dugite#624
• Update actions by @​niik in desktop/dugite#628
• Update dugite-native to v2.53.0-4 by @​dugite-releases[bot] in desktop/dugite#629
• Pin publish workflow to npm 11 by @​tidy-dev in desktop/dugite#630

Full Changelog: desktop/dugite@v3.2.2...v3.2.3

Commits

• 84cd716 3.2.3
• 65dc019 Pin publish workflow to npm 11 (#630)
• 29a0247 Update dugite-native to v2.53.0-4 (#629)
• 03f0b52 Merge pull request #628 from desktop/update-actions
• 83065c1 Fail early if release already exists in publish workflow
• ac670db Fix heredoc indentation in update-git PR body
• 15f4730 Set git author and committer for update-git workflow
• c1df32c Merge pull request #624 from desktop/docs-updates
• 28bafec Update create-github-app-token to v3 in update-git workflow
• 3fb1fbd Replace peter-evans/create-pull-request with gh CLI
• Additional commits viewable in compare view

Updates knip from 6.26.0 to 6.32.2

Release notes

Sourced from knip's releases.

Release 6.32.2

• Support oxfmt.config.mts (#1933) (795900191dc75eec8d1e717b866bf57e1e2912cc) - thanks @​joealden!
• Support oxlint.config.mts (#1934) (531e2dc7c1d8bf31babea0068c34391182ec2d50) - thanks @​joealden!
• Fix Supported lint-staged Configs (#1935) (f9c755e414ed10baa4d01af8ddac6d04cb8d5617) - thanks @​joealden!
• Update dependencies (95f7c529f918dd9e1a84f92c68d064738977b825)
• Update sentry snapshot (ea7929fcbd6b323c8bdd9252ac57017feeb29ecf)

Release 6.32.1

• Handle referenced config files in their own plugin (resolve #1931, close #1932) (982c1d8e28cc62d3cba5ecde6dd8df2740c7c329)
• Fix type-check against typescript@5.0.4 (2febefe44a8b39f74158916a2bc73933b4c281ae)
• Update sentry snapshot (0397bddbf809e2b24fe59a4bea8c0258526bb565)

Release 6.32.0

• fix: attribute wildcard subpath-import aliases as dependency usage (#1918) (4890a2ad5317b9e3f0ab844631ad0f0592802c3e) - thanks @​jsmecham!
• Add Borp plugin (5eb9ad4cfb2ccb7770eac49f6109459d30590211)
• Add tsd plugin (bd4ae7041f3fc6aef27b027644f80daefc432aca)
• Resolve Rollup --config argument as plugin configuration (8111f97981406f4327d5e6a655c13308a9dc4426)
• Resolve babel-jest configFile from Jest transform options (24794ccecb80fdaecfe4d46a26faff46c30d9015)
• Add pre-commit plugin (ac726b0918cb931a6d538797e342484812a6752e)
• Thread script words through resolvers to preserve quoting (89f9ada6ca81229bf8f7293439998acc5f87d457)
• Resolve entries from Mocha script arguments (353f860f8e32f05f7c87dc5501071befc0e5a293)
• Detect Node test runner through c8 (fa44be722aa35c6e8b441cd8cd0f4cf644027c22)
• Update dependencies (non-major) (#1922) (6b1e6f3cbb1749776e3798f46eb2b99cd95ed56a) - thanks @​renovate[bot]!
• fix(playwright): match config files with .cjs, .cts and .mts extensions (#1919) (1c1073a1817fdb3bcd3dc00eda2b1d858e444156) - thanks @​davidpavlovschi!
• Restart VS Code language server process (resolve #1923) (d48eac5a2447567a33e835ce3e1648bf3f4ffb2b)
• Classify built-ins from module specifiers (resolve #1925) (3528c5d0f808b7b2155f69a1f98493ee0e3e06c1)
• Don't turn absolute-path script tokens into entries (resolve #1928) (e5608e77b434145c8dd5c2c2872bfb90ae622ce7)
• Update sponsors data (025884bb53eede041732723197ac0415a1a50f71)
• Update dependencies (d2c0a07c09cea70ab2cae5f97d12da272a6e43e6)

Release 6.31.0

• feat: Add basic support for Marko 6 and 5 (#1914) (c6b151642701f9b4864ddb5ea8e40580623f59d1) - thanks @​caseycarroll!
• Use Array.from in Marko compiler (5aadf47a22bdfd43bb8ad4082768e07fe37fc5ca)
• Update release-it and fix release script flags (6fa9c269c65c0923965924226a5ccf0778842967)
• Downgrade @​types/vscode to match extension engines range (6d8e9bf5200cf982d0bc801469c4e2be5627e5b8)

Release 6.30.0

• docs: migrate to Starlight Blog plugin (#1854) (c89e3e3c9) - thanks @​trueberryless!
• Include workspace dependencies in scoped runs (resolve #1901) (a75309eda)
• Simplify workspace assembly (b3ac16411)
• Document export declaration safety (ef98a7682)
• Read object jsPlugin specifiers from Vite+ config (#1879) (3ea6a92d4) - thanks @​matchai!
• Compile gitignore negations once (6884cdb20)
• Cache Node test script detection (d970f67d8)
• Track only enabled workspace plugins (67d48268a)
• Skip unsupported Vite config command (545bb2d36)
• Add SARIF reporter (ce11cf5d4)
• Track catalog refs in pnpm dlx scripts (resolve #1885, close #1886) (102189a1a)
• Report unresolved catalog references (b2b86c3e5)
• Track catalog references across scoped runs (resolve #1905) (f0365bae0)

... (truncated)

Commits

• 196a11a Release knip@6.32.2
• 95f7c52 Update dependencies
• f9c755e Fix Supported lint-staged Configs (#1935)
• 531e2dc Support oxlint.config.mts (#1934)
• 7959001 Support oxfmt.config.mts (#1933)
• 437b608 Release knip@6.32.1
• 2febefe Fix type-check against typescript@5.0.4
• 982c1d8 Handle referenced config files in their own plugin (resolve #1931, close #1932)
• f21bcbb Release knip@6.32.0
• d2c0a07 Update dependencies
• Additional commits viewable in compare view

Updates @openai/agents-core from 0.14.3 to 0.16.0

Release notes

Sourced from @​openai/agents-core's releases.

v0.16.0

Key Changes

Deterministic SDK testing utilities

This release adds provider-neutral testing utilities through @openai/agents/testing, @openai/agents-core/testing, @openai/agents/realtime/testing, and @openai/agents-realtime/testing. ScriptedModel, scriptedSandboxSession(), and ScriptedRealtimeTransport let applications exercise runner, sandbox, and Realtime workflows without live model, sandbox, WebRTC, or WebSocket dependencies. Existing runtime entry points and defaults remain unchanged.

Standard Schema inputs and outputs

Tools, handoffs, and agent structured outputs now accept supported Standard Schema values alongside Zod and raw JSON Schema. The schema must provide synchronous ~standard.validate behavior plus ~standard.jsonSchema.input() and ~standard.jsonSchema.output(), and generated schemas must have an object root. Standard Schema function-tool parameters require strict mode; use a Zod schema, raw JSON Schema, or application-side validation for unsupported cases.

Safer run, provider, and Realtime behavior

CallModelInputFilter can opt into stable prepared-item identity with preserveInputIdentity = true; default filters continue to receive deep copies, and the SDK does not freeze opted-in items. The release also tightens interruption snapshots, max-turn finalization, invalid tool-output redaction, Responses parallel-tool-call forwarding, Chat Completions reasoning placement, Realtime audio-rate fallback, and unsupported assistant-audio history replay handling.

What's Changed

• feat: add scripted testing utilities by @​seratch in openai/openai-agents-js#1640
  • fix: detach Manifest snapshots in scripted sandbox calls by @​seratch in openai/openai-agents-js#1658
  • fix: detach scripted model stream snapshots by @​seratch in openai/openai-agents-js#1657
• feat: support Standard Schema inputs and agent outputs by @​seratch in openai/openai-agents-js#1648
  • fix: avoid redundant Standard Schema validation by @​seratch in openai/openai-agents-js#1656
• feat: preserve model input identity by @​seratch in openai/openai-agents-js#1654
• fix(core): isolate interruption result arrays by @​seratch in openai/openai-agents-js#1659
• fix(core): align Responses parallel tool calls with tools by @​seratch in openai/openai-agents-js#1660
• fix(core): reject partially matched stacked diff anchors by @​seratch in openai/openai-agents-js#1655
• fix(core): apply stacked diff anchors sequentially by @​seratch in openai/openai-agents-js#1649
• fix...

  Description has been truncated

[Astro-Han]

Summary for review — chore(deps): bump the minor-and-patch group with 16 updates, now with the adaptation work needed to make the bump green.

What is in the diff, beyond the lockfile bump:

1. pi-tui 0.84.2 (breaking): TUI became an interface; the value is now TuiMainScreen (same constructor signature, mode: "regular", main buffer). packages/cli/src/pi-tui-runner.ts switched new TUI(terminal) → new TuiMainScreen(terminal); the input-listener TS errors were inference fallout from the failed new TUI and disappeared with it. 103 pi-tui-runner tests pass.
2. astryx 0.4.1: the patches/@astryxdesign+core+0.4.0.patch was regenerated as 0.4.1.patch (patch-package matches by exact version; verified it applies cleanly to a fresh 0.4.1 tree and yields the same content as before — the upstream bump absorbed none of the five seams). Regenerated maka.css/js/d.ts because 0.4.1 emits the theme differently (astryx:theme --check was red).
3. Third-party notices: both THIRD_PARTY_NOTICES.txt targets (desktop + cli) regenerated; new exact-version copyright overrides for @astryxdesign/core@0.4.1 and @earendil-works/pi-tui@0.84.2 (no shipped LICENSE in either tarball).
4. knip 6.32 findings: removed two dead forwarding layers it can now see through — the pip-electron re-exports in pip-window.ts (no callers since the code moved; the file still imports from pip-electron directly) and the unused QuietPreview type re-export in builtin-preview.ts. The withComputerUsePip forwarding line stays (imported by desktop-native-capability-assembly).
5. dugite held at 3.2.2: 3.2.3 only bumps dugite-native (v2.53.0-4) and docs, while the Git-bundling pipeline pins the exact version (DUGITE_VERSION); reverting avoids retooling the native pin for no consumer benefit.

Validation: local build + full typecheck + lint + format:check + both knip workspaces + both notice targets green; pi-tui-runner (103) and UI inline-completion tests pass; npm audit --omit=dev 0 vulnerabilities. CI is fully green on this head (20/20 checks): typecheck, test, test_runtime_host, test_workspaces, package, e2e, storybook, audit, all Validate-installed-CLI platforms, and the Windows lanes.

Not a fast-path merge: it touches licensing (notices) and runtime behavior (pi-tui). Needs a normal review.

[zhiiw]

中文

这里建议将 dugite 恢复为精确版本 "dugite": "3.2.2"。当前虽然 lockfile 已回退到 3.2.2，但 package.json 使用的是 ^3.2.2，因此后续正常刷新 lockfile 时仍可能静默升级到 3.2.3。

dugite 不是普通开发依赖：它决定 resume / managed workspace 使用的 bundled Git 原生发行物，而相关准备脚本、native release、来源 commit、校验信息和 runtime identity 目前都固定在 3.2.2。当前改法只是由 lockfile 暂时掩盖了版本约束不一致。

我的建议是：本 PR 继续精确固定在 3.2.2，不在这里升级到 3.2.3。 考虑到 resume 尚未完全上线，如果后续确定升级到 3.2.3，我会另开一个独立 PR，统一更新依赖、lockfile、allowScripts、native release/commit、许可证和文档，并完成各平台及恢复路径的验证。

English

I recommend restoring dugite to the exact version "dugite": "3.2.2". Although the lockfile has been rolled back to 3.2.2, package.json currently declares ^3.2.2, so a future routine lockfile refresh may silently resolve to 3.2.3.

dugite is not an ordinary development dependency here: it selects the bundled native Git distribution used by resume / managed workspaces, while the preparation scripts, native release, source commit, integrity metadata, and runtime identity are all currently pinned to 3.2.2. The current lockfile only masks that constraint mismatch temporarily.

My recommendation is: keep an exact 3.2.2 pin in this PR and do not upgrade to 3.2.3 here. Since resume has not been fully rolled out, if we later decide to move to 3.2.3, I will open a separate PR that updates the dependency, lockfile, allowScripts, native release/commit, licenses, and documentation together, with platform and recovery-path validation.

[Astro-Han]

@zhiiw Fixed in 432c3b2f8: both package.json and the lockfile root declaration now exact-pin dugite to 3.2.2. The resolved package was already 3.2.2 and remains unchanged. Re-requesting your review on the updated head.

Implemented by Codex at AstroHan’s request.

[Astro-Han]

/agentic_review

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Esbuild install script blocked 🐞 Bug ☼ Reliability

Description

The PR installs esbuild 0.28.2 while allowScripts still approves only 0.27.7, so npm 11.19 skips
the new package's required install script during clean installs. The desktop preload build then
invokes an esbuild installation whose platform binary may be unavailable.

Code

apps/desktop/package.json[78]

+    "esbuild": "^0.28.2",

Relevance

●●● Strong

Accepted reliability findings address install/runtime dependency hazards; this is a deterministic
versioned allowlist mismatch.

PR-#1920
PR-#3147

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The changed desktop manifest requests esbuild 0.28.2, and the lockfile resolves that exact version
with hasInstallScript: true. However, the root allowlist authorizes only esbuild@0.27.7; npm
documents that unmatched dependency install scripts are skipped, while the desktop preload build
directly executes esbuild.

apps/desktop/package.json[25-25]
apps/desktop/package.json[76-79]
package.json[81-85]
package-lock.json[7549-7555]
🌐 npm documents that dependency install scripts are blocked by default and silently skipped unless a matching allowScripts entry permits them.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The esbuild dependency was upgraded to 0.28.2, but the root `allowScripts` configuration remains pinned to 0.27.7. Update the existing approval to the locked version so clean npm installs run esbuild's install script.

## Issue Context
The repository pins npm 11.19.0, which blocks dependency install scripts without a matching approval. Consolidation or a new configuration path is unnecessary; the smallest correction is replacing the stale version in the existing authority.

## Fix Focus Areas
- package.json[81-85]
- apps/desktop/package.json[76-79]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Web pages:

  🌐 npm-install-scripts | npm Docs

  🌐 npm-approve-scripts | npm Docs

  🌐 Config | npm Docs

  +2 more

Review mode: ⚖️ Balanced: This dependency PR updates runtime/build/tooling packages across several application surfaces and includes compatibility source changes, so it carries real regression and contract risk, but the logical edits are not dense enough to justify redundant extended passes.

Tip of the day

💡 Did you know, you can keep summaries lean with Finding overflow, which tucks the rest behind 'View more'

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Esbuild install script blocked 🐞 Bug ☼ Reliability

The PR installs esbuild 0.28.2 while allowScripts still approves only 0.27.7, so npm 11.19 skips
the new package's required install script during clean installs. The desktop preload build then
invokes an esbuild installation whose platform binary may be unavailable.

Agent Prompt

## Issue description
The esbuild dependency was upgraded to 0.28.2, but the root `allowScripts` configuration remains pinned to 0.27.7. Update the existing approval to the locked version so clean npm installs run esbuild's install script.

## Issue Context
The repository pins npm 11.19.0, which blocks dependency install scripts without a matching approval. Consolidation or a new configuration path is unnecessary; the smallest correction is replacing the stale version in the existing authority.

## Fix Focus Areas
- package.json[81-85]
- apps/desktop/package.json[76-79]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

[Astro-Han]

The dependency update is otherwise coherent on the current head: dugite is now exact at 3.2.2 across the declaration, lockfile, bundled-Git validation, provenance, and script approval; the pi-tui/Astryx migrations and notices are consistent; and all live checks are green.

One small authority mismatch still blocks approval: the existing Qodo thread correctly notes that the locked esbuild@0.28.2 no longer matches the root allowScripts entry for 0.27.7. I am not duplicating that inline finding. From first principles, the existing script-approval map is the right single authority; the smallest fix is simply to replace the stale version and verify the install-script inventory. The PR description should also be refreshed because its generated dependency list still describes the earlier dugite/agents-core state, but that documentation drift is non-blocking.

Reviewed with Codex using three independent reviewer agents and OpenCode Go DeepSeek V4 Flash (high); I verified the exact current head, dependency/provenance chain, existing discussion, and live CI.

中文

当前 head 的依赖更新整体已经一致：dugite 在声明、lockfile、bundled-Git 校验、provenance 和脚本审批中都精确固定为 3.2.2；pi-tui/Astryx 迁移与 notices 也一致，实时检查全绿。

目前只剩一个很小但会阻塞批准的权威不一致：现有 Qodo 行内评论正确指出，实际锁定的 esbuild@0.28.2 已经不匹配根 allowScripts 中的 0.27.7。我不重复发布相同行内问题。按第一性原理，现有脚本审批表就是正确的单一权威；最小修复只是替换过期版本并核验 install-script inventory。PR 描述中的自动依赖清单仍是早期 dugite/agents-core 状态，也建议同步，但不阻塞。

本次由 Codex 配合三个独立 reviewer agent，以及 OpenCode Go DeepSeek V4 Flash（high）审查；我核验了当前精确 head、依赖/provenance 链、已有讨论和实时 CI。

[dependabot]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

[YayoiNanoka]

PR Assessment

What problem does this PR solve?

This PR refreshes the repository’s dependency set while preserving compatibility across the desktop application, CLI, runtime, generated Astryx theme, dependency patches, license notices, and bundled-Git provenance.

How does this PR solve the problem?

It updates dependency declarations and the lockfile, migrates the CLI from TUI to TuiMainScreen, regenerates Astryx artifacts and notices, re-pins the Astryx patch, removes exports newly identified as unused by Knip, and restores the required exact dugite@3.2.2 pin.

Is the problem correctly defined?

Correct.

The compatibility and generated-artifact changes are directly attributable to the dependency refresh. No unrelated state or abstraction was introduced. The PR description is stale, but the implementation scope itself is coherent.

Principle-based assessment

• First principles: declarations, lockfile, generated assets, patches, license notices, native provenance, and install-script approvals must agree. They do, except for the stale esbuild approval.
• Occam's razor: the compatibility changes are narrow adapters or generated updates; no smaller known solution preserves the upgraded dependencies.
• Minimal sufficient solution: update the stale approval after reviewing esbuild 0.28.2; no new policy mechanism is required.

Review Findings

P1 Blocker

None.

P2 Should Fix

[P2 Should Fix] Install-script approval no longer covers the locked esbuild version

• Location: package.json:82
• Trigger: run npm approve-scripts --allow-scripts-pending on this head → esbuild@0.28.2 is reported as unreviewed, while the only approval remains esbuild@0.27.7.
• Root cause: apps/desktop/package.json and package-lock.json were upgraded to esbuild 0.28.2 without updating the version-pinned allowScripts authority.
• Evidence: the exact-head inventory reports esbuild@0.28.2 as pending. npm 11.19 treats this policy as advisory, so current installs still run the script; therefore the existing review thread overstates the present runtime impact. The concrete defect is a stale dependency-review record and future enforcement risk, not a current clean-install failure. See the npm 11.19 approval documentation.
• Required direction: review esbuild 0.28.2’s postinstall script, replace esbuild@0.27.7 with esbuild@0.28.2, and rerun the pending-script inventory.

Suggestion

Refresh the generated PR description. It still claims a dugite 3.2.2 → 3.2.3 update even though the final head correctly keeps 3.2.2 exact-pinned, so its package count and final diff no longer agree.

Verification

• Base: 781fa8d18d7f1d5e983de8283b3e0a61cd05751d
• Head: 57917cde1e4064b955b928f3509b9c9cd394c55d
• Executed: isolated exact-head checkout; source and lockfile review; git diff --check; conflict-free merge-tree verification; npm 11.19 pending-script inventory; esbuild executable check; exact-head GitHub workflow and review-thread inspection.
• Key results: clean diff and merge-tree; esbuild reports version 0.28.2; its approval is pending; CI, dependency audit, CLI validation, Windows checks, workspace tests, Runtime Host tests, Storybook, and desktop E2E all passed.
• Temporary tests: not created; the isolated checkout was removed and was never committed or pushed.
• Original workspace: confirmed unchanged; the pre-existing untracked file was preserved.
• Not verified: the second local full install stopped during Electron download with an environmental network termination. The exact-head GitHub jobs completed installation, build, typecheck, tests, and E2E successfully.

Conclusion

Merge conditionally.

Condition: update the version-pinned esbuild install-script approval and confirm it no longer appears in the pending inventory. The stale PR description is non-blocking.

点击展开中文

PR 判断

这个 PR 解决了什么问题？

这个 PR 更新仓库依赖，同时保持桌面端、CLI、Runtime、生成的 Astryx 主题、依赖补丁、许可证清单和 bundled-Git provenance 的兼容性。

这个 PR 如何解决这个问题？

它更新了依赖声明和 lockfile，将 CLI 从 TUI 迁移到 TuiMainScreen，重新生成 Astryx 产物和许可证清单，重定位 Astryx 补丁，删除新版 Knip 识别出的未使用导出，并恢复必须精确固定的 dugite@3.2.2。

这个问题定义得对吗？

Correct（正确）。

兼容性修改和生成产物更新都直接由依赖升级引起，没有引入无关状态或抽象。PR 描述已经过时，但实现范围本身是一致的。

原则性判断

• 第一性原理：依赖声明、lockfile、生成产物、补丁、许可证、原生 provenance 和安装脚本审批必须一致。除 esbuild 的过期审批外，其余均一致。
• 奥卡姆剃刀：兼容性改动都是窄范围适配或生成产物更新；不存在已知的更小方案能够保留这些依赖升级。
• 最小充分解：审查 esbuild 0.28.2 后更新旧审批即可，不需要增加新的策略机制。

Review Findings

P1 阻塞

无。

P2 应该改

[P2 应该改] 安装脚本审批不再覆盖实际锁定的 esbuild 版本

• 位置：package.json:82
• 触发条件：在当前 head 执行 npm approve-scripts --allow-scripts-pending → esbuild@0.28.2 被列为未审查，但唯一审批仍是 esbuild@0.27.7。
• 根因：apps/desktop/package.json 和 package-lock.json 已升级到 esbuild 0.28.2，却没有同步版本固定的 allowScripts 权威。
• 证据：当前精确 head 的 inventory 将 esbuild@0.28.2 列为 pending。npm 11.19 中这项策略仍只是告警，安装脚本默认仍会执行，因此现有 review thread 夸大了当前运行时影响。实际缺陷是依赖审查记录过期以及未来启用强制执行后的风险，而不是当前 clean install 必然失败。参见 npm 11.19 审批文档。
• 必须恢复的方向：审查 esbuild 0.28.2 的 postinstall 脚本，将 esbuild@0.27.7 替换为 esbuild@0.28.2，然后重新检查 pending-script inventory。

建议

刷新自动生成的 PR 描述。它仍声称将 dugite 从 3.2.2 升级到 3.2.3，但最终 head 已正确保持精确固定的 3.2.2，因此依赖数量和最终 diff 已不一致。

验证

• Base：781fa8d18d7f1d5e983de8283b3e0a61cd05751d
• Head：57917cde1e4064b955b928f3509b9c9cd394c55d
• 已执行：隔离的精确 head checkout；源码和 lockfile 审查；git diff --check；无冲突 merge-tree 验证；npm 11.19 pending-script inventory；esbuild 可执行文件检查；精确 head 的 GitHub workflow 和 review thread 检查。
• 关键结果：diff 和 merge-tree 均正常；esbuild 返回 0.28.2；其审批处于 pending；CI、依赖审计、CLI 验证、Windows 检查、workspace 测试、Runtime Host 测试、Storybook 和桌面 E2E 均通过。
• 临时测试：未创建；隔离 checkout 已删除，从未 commit 或 push。
• 原工作区：确认未改变；保留了原有未跟踪文件。
• 未验证：第二次本地完整安装在下载 Electron 时因环境网络中断而停止。精确 head 的 GitHub 任务已成功完成安装、构建、类型检查、测试和 E2E。

结论

有条件合入。

条件：更新版本固定的 esbuild 安装脚本审批，并确认它不再出现在 pending inventory 中。PR 描述过期不阻塞合入。

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.