chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260630.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260630.1.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 8, 2026, 6:08 PM ET / 22:08 UTC.

Summary
Dependabot updates the devDependency @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260630.1 and refreshes pnpm-lock.yaml.

Reproducibility: not applicable. this is a dependency maintenance PR rather than a reported runtime bug. The relevant verification is manifest/lockfile inspection plus CI status.

Review metrics: 2 noteworthy metrics.

• Dependency files changed: 2 files, 215 additions, 40 deletions. The review surface is limited to the manifest and lockfile, but the lockfile refresh includes native optional package resolutions.
• Package check matrix: 6 Node platform checks passed. The changed dev toolchain was exercised on Node 22 and Node 24 across Ubuntu, macOS, and Windows.

Root-cause cluster
Relationship: canonical
Canonical: #5
Summary: This is the canonical open PR for the 7.0.0-dev.20260630.1 native-preview bump; the earlier 7.0.0-dev.20260629.1 PR was closed as superseded.

Members:

• superseded: chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260629.1 #3 - Dependabot closed the earlier 7.0.0-dev.20260629.1 bump unmerged and commented that it was superseded by this PR.
• adjacent_distinct: chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260627.2 to 7.0.0-dev.20260628.1 #1 - This merged PR established the current 7.0.0-dev.20260628.1 baseline; it is dependency-history provenance, not a replacement for this later bump.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] The lockfile refresh moves a preview TypeScript native dev toolchain and transitive native optional packages, so maintainers still own ordinary dependency acceptance risk even though CI is green.

Maintainer options:

1. Decide the mitigation before merge
   Keep the bump narrow and merge it only if the package code owners accept the green CI matrix as sufficient validation for this preview dev-toolchain update.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• [P2] No repair lane is needed; this PR has no actionable finding and should proceed through normal maintainer dependency review.

Security
Cleared: The diff updates an existing devDependency and lockfile integrity entries without changing scripts, workflows, permissions, runtime dependencies, package sources, or secret handling.

Review details

Best possible solution:

Keep the bump narrow and merge it only if the package code owners accept the green CI matrix as sufficient validation for this preview dev-toolchain update.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR rather than a reported runtime bug. The relevant verification is manifest/lockfile inspection plus CI status.

Is this the best way to solve the issue?

Yes; a manifest plus lockfile update is the narrow maintainable path for this devDependency bump, with the package check matrix covering the practical validation surface.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 60add94603e3.

Label changes

Label justifications:

• P3: This is a low-risk development dependency maintenance PR with no runtime router behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external contributor real-behavior proof gate does not apply; CI is the relevant validation signal.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its package verification and narrow package-surface guidance applies to this dependency review. (AGENTS.md:1, 60add94603e3)
• Current main still has old dependency pin: Current main declares @typescript/native-preview as 7.0.0-dev.20260628.1, so the requested bump is not already implemented on main. (package.json:53, 60add94603e3)
• PR head updates manifest: The PR head changes the direct devDependency to 7.0.0-dev.20260630.1. (package.json:53, 07318c1b8793)
• PR head updates lockfile resolution: The PR head resolves @typescript/native-preview and the tsdown peer context against 7.0.0-dev.20260630.1. (pnpm-lock.yaml:14, 07318c1b8793)
• Diff scope and whitespace check: The PR changes only package.json and pnpm-lock.yaml with 215 additions and 40 deletions; git diff --check reported no whitespace errors. (07318c1b8793)
• Live PR checks: GitHub reports the PR as mergeable, with CodeQL, workflow lint, and Node 22/24 checks across Ubuntu, macOS, and Windows passing. (07318c1b8793)

Likely related people:

• openclaw/openclaw-secops: CODEOWNERS routes package.json and pnpm-lock.yaml changes to this team. (role: code owner; confidence: high; commits: 61fb4ea24131; files: .github/CODEOWNERS, package.json, pnpm-lock.yaml)
• Vincent Koc: Git blame and package history show the package metadata, scripts, CODEOWNERS entries, and initial lockfile were introduced in the bootstrap/release commit. (role: initial package setup author; confidence: medium; commits: 61fb4ea24131; files: package.json, pnpm-lock.yaml, .github/CODEOWNERS)
• dependabot[bot]: The current @typescript/native-preview pin on main was last changed by the prior merged Dependabot bump for the same dependency. (role: recent dependency updater; confidence: medium; commits: ec1dfe4ce00d; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (3 earlier review cycles)

• reviewed 2026-07-02T18:58:11.358Z sha 07318c1 :: needs maintainer review before merge. :: none
• reviewed 2026-07-04T15:07:05.072Z sha 07318c1 :: needs maintainer review before merge. :: none
• reviewed 2026-07-06T20:26:25.301Z sha 07318c1 :: needs maintainer review before merge. :: none

[dependabot]

Looks like @typescript/native-preview is up-to-date now, so this is no longer needed.