chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260617.2

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260617.2.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​typescript/​native-preview@​7.0.0-dev.20260617.2

View full report

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 22, 2026, 4:48 AM ET / 08:48 UTC.

Summary
This PR bumps the direct devDependency @typescript/native-preview and matching pnpm lockfile entries from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260617.2.

Reproducibility: not applicable. this is a dependency maintenance PR, not a bug report. The relevant check is that current main still pins the older dependency version while the PR updates it.

Review metrics: 2 noteworthy metrics.

• Dependency scope: 1 direct devDependency updated. The bump affects TypeScript tooling rather than the package's published runtime dependency list.
• Diff surface: 2 files changed, 39 additions and 39 deletions. The review surface is limited to package.json and pnpm-lock.yaml.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Next step before merge

• No ClawSweeper repair lane is needed; this should proceed through normal dependency-PR checks and maintainer merge handling.

Security
Cleared: The diff only updates a pinned direct devDependency and matching lockfile integrity entries, with Socket and CodeQL checks reporting no concrete supply-chain concern.

Review details

Best possible solution:

Merge the package and lockfile-only dependency bump through normal maintainer handling now that the repository checks for the native tooling matrix are green.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR, not a bug report. The relevant check is that current main still pins the older dependency version while the PR updates it.

Is this the best way to solve the issue?

Yes; the PR is the narrowest maintainable path for this dependency update because it changes only package.json and the generated pnpm lockfile entries.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c1ca6f199108.

Label changes

Label justifications:

• P3: This is a low-risk development dependency maintenance update with no runtime protocol or stream behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot-authored dependency update, so the external contributor real-behavior-proof gate does not apply.

Evidence reviewed

What I checked:

• Current main still has the older pin: Current main at c1ca6f1 still pins @typescript/native-preview to 7.0.0-dev.20260615.1, so the requested bump is not implemented on main. (package.json:92, c1ca6f199108)
• Lockfile still resolves the older version: The current lockfile importer and tsdown resolution still reference 7.0.0-dev.20260615.1, matching the older package pin. (pnpm-lock.yaml:21, c1ca6f199108)
• PR diff is dependency-only: The PR commit changes only package.json and pnpm-lock.yaml, replacing 7.0.0-dev.20260615.1 with 7.0.0-dev.20260617.2 across the direct dependency, platform optional packages, and lockfile resolution keys. (package.json:92, 4d86c3d9c9f4)
• Validation status: GitHub reports the PR as MERGEABLE with CI, CodeQL, and Socket checks completed successfully for the PR head. (4d86c3d9c9f4)
• Dependency provenance: Blame shows the current @typescript/native-preview pin was last changed by a prior Dependabot dependency bump, while recent package metadata history is mostly by Vincent Koc. (package.json:92, c1ca6f199108)
• Repository policy read: The full target AGENTS.md was read; its focused-change and repository-script validation guidance applies, but this ClawSweeper review remained read-only. (AGENTS.md:1, c1ca6f199108)

Likely related people:

• Vincent Koc: Recent package.json history and shortlog show most package metadata and release-prep changes under this name, making this a likely routing candidate for package maintenance review. (role: recent package and release contributor; confidence: high; commits: c1ca6f199108, c0fdb1f0ebc2, af898fe0cdd3; files: package.json, pnpm-lock.yaml)
• dependabot[bot]: Blame and prior merged dependency history show the current @typescript/native-preview version on main came from Dependabot, and this PR follows the same package and lockfile bump pattern. (role: dependency automation for the current pin; confidence: medium; commits: ed9ce515e4a2, 4d86c3d9c9f4; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[dependabot]

Superseded by #16.