chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260628.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260628.1.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for @​typescript/native-preview since your current version.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 29, 2026, 1:20 PM ET / 17:20 UTC.

Summary
This PR updates the direct devDependency @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260627.2 and refreshes the matching pnpm-lock.yaml entries.

Reproducibility: not applicable. this is a Dependabot dependency maintenance PR, not a bug report. The relevant source check is that current main still pins 7.0.0-dev.20260615.1 while the PR updates it.

Review metrics: 3 noteworthy metrics.

• Dependency scope: 1 direct devDependency updated. The change affects the TypeScript native tooling path, not the published runtime dependency list.
• Diff surface: 2 files changed; +69/-55. The review surface is limited to the manifest and generated pnpm lockfile.
• Validation surface: 6 Node matrix jobs, browser smoke, workflow lint, and CodeQL passed. The dependency ships native tooling, so cross-OS and Node-version CI success is meaningful pre-merge evidence.

Root-cause cluster
Relationship: canonical
Canonical: #21
Summary: This PR is the active newer native-preview Dependabot update; older daily native-preview bumps were closed unmerged as superseded.

Members:

• superseded: chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260620.1 #16 - Dependabot commented that the 7.0.0-dev.20260620.1 update was superseded by this PR, and that older PR is closed unmerged.
• superseded: chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260615.1 to 7.0.0-dev.20260617.2 #14 - The 7.0.0-dev.20260617.2 update was first superseded by the later native-preview update, which is itself superseded by this PR.
• adjacent_distinct: chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260614.1 to 7.0.0-dev.20260615.1 #6 - This earlier merged native-preview bump established the current main version but does not cover the newer requested version.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• none.

Risk before merge

• [P1] This is still a native preview toolchain dependency approval: registry metadata changes the tsgo bin target from bin/tsgo.js to bin/tsgo and adds an npm maintainer name, but the PR does not change repository scripts, workflows, permissions, or secrets and the cross-platform CI matrix passed.

Maintainer options:

1. Decide the mitigation before merge
   Review and merge the package/lockfile-only bump if maintainers are comfortable advancing the pinned native-preview dev toolchain.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• No automated repair is needed; this PR only needs normal maintainer dependency approval and merge handling.

Security
Cleared: The diff only updates an existing direct devDependency and matching pnpm integrity entries; no workflow, permission, script, secret, or publishing change was found.

Review details

Best possible solution:

Review and merge the package/lockfile-only bump if maintainers are comfortable advancing the pinned native-preview dev toolchain.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a Dependabot dependency maintenance PR, not a bug report. The relevant source check is that current main still pins 7.0.0-dev.20260615.1 while the PR updates it.

Is this the best way to solve the issue?

Yes: changing only package.json plus the generated pnpm-lock.yaml is the narrow maintainable path for this pinned direct devDependency update.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 8ffb44049333.

Label changes

Label changes:

• add P3: This is routine development dependency maintenance with no source, protocol, or runtime behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot dependency PRs do not need contributor real-behavior proof; GitHub CI is supplemental validation here.

Label justifications:

• P3: This is routine development dependency maintenance with no source, protocol, or runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Dependabot bot dependency PRs do not need contributor real-behavior proof; GitHub CI is supplemental validation here.

Evidence reviewed

What I checked:

• Repository policy read: The full target AGENTS.md was read; its focused-change and repository-script guidance shaped the dependency-only review while the checkout stayed read-only. (AGENTS.md:1, 8ffb44049333)
• Current main still pins older dependency: Current main still has @typescript/native-preview pinned to 7.0.0-dev.20260615.1, so the requested bump is not already implemented. (package.json:92, 8ffb44049333)
• Current lockfile still resolves older version: The lockfile importer and tsdown peer resolution still reference 7.0.0-dev.20260615.1 on current main. (pnpm-lock.yaml:21, 8ffb44049333)
• PR diff is scoped to dependency files: The PR diff changes only package.json and pnpm-lock.yaml, replacing the native-preview package and related lockfile resolutions with 7.0.0-dev.20260627.2. (package.json:92, 9388d449bc64)
• GitHub validation is green: GitHub reports the PR as mergeable/clean with Node 22 and Node 24 checks on Ubuntu, macOS, and Windows passing, plus browser smoke, workflow lint, and CodeQL success. (9388d449bc64)
• Registry metadata checked: The npm registry entry for 7.0.0-dev.20260627.2 is Apache-2.0, exposes tsgo, keeps the same Node engine floor, and its package integrity matches the lockfile diff.

Likely related people:

• vincentkoc: Recent history shows Vincent Koc owning package/release validation changes, the Dependabot configuration baseline, and the prior native-preview bump merge path. (role: recent package and release contributor; confidence: high; commits: 8ffb44049333, c1ca6f199108, af898fe0cdd3; files: package.json, pnpm-lock.yaml, .github/dependabot.yml)
• dependabot[bot]: Blame shows the current @typescript/native-preview version on main came from a prior merged Dependabot update, and this PR follows the same manifest plus lockfile update pattern. (role: dependency automation for current pin; confidence: medium; commits: ed9ce515e4a2, 9388d449bc64; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[steipete]

@dependabot rebase