chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260629.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260629.1.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 1, 2026, 1:22 PM ET / 17:22 UTC.

Summary
Dependabot updates the direct dev dependency @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260629.1 and refreshes the corresponding pnpm-lock.yaml entries.

Reproducibility: not applicable. this is a dependency maintenance PR, not a reported runtime bug. The relevant check is whether the manifest and lockfile update coherently advance the existing toolchain package.

Review metrics: 2 noteworthy metrics.

• Changed files: 2 files changed. The update is limited to the manifest and lockfile, which keeps the review surface narrow for a Dependabot bump.
• Dependency surface: 1 direct devDependency updated. Only the existing @typescript/native-preview toolchain package is intentionally advanced; transitive lockfile churn follows that one version change.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Let the repository CI complete install, typecheck, build, and test coverage before merge.

Risk before merge

• [P1] @typescript/native-preview is a prerelease native compiler/toolchain package used by the tsgo typecheck script, so repository CI should verify install, build, and typecheck before merge.

Maintainer options:

1. Decide the mitigation before merge
   Keep the narrow dependency bump open and merge it only after the repository’s normal dependency-update checks pass against the updated tsgo binary.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• No automated repair is needed; the remaining action is normal maintainer and CI gating for a bot dependency update.

Security
Cleared: The diff only updates an existing direct dev dependency and its locked platform packages; no new dependency family, workflow permission, secret handling, or install lifecycle hook concern was found.

Review details

Best possible solution:

Keep the narrow dependency bump open and merge it only after the repository’s normal dependency-update checks pass against the updated tsgo binary.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR, not a reported runtime bug. The relevant check is whether the manifest and lockfile update coherently advance the existing toolchain package.

Is this the best way to solve the issue?

Yes; for this Dependabot update, changing package.json and the generated pnpm lockfile entries together is the narrow maintainable solution, with CI providing the runtime validation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 95630872f37a.

Label changes

Label changes:

• add P3: This is a low-risk development dependency maintenance PR with limited user-facing blast radius.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real behavior proof gate does not apply; CI remains the expected validation path.

Label justifications:

• P3: This is a low-risk development dependency maintenance PR with limited user-facing blast radius.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency PR, so the external-contributor real behavior proof gate does not apply; CI remains the expected validation path.

Evidence reviewed

What I checked:

• Current main dependency pin: Current main still pins @typescript/native-preview to 7.0.0-dev.20260628.1, so the proposed version bump is not already implemented on main. (package.json:92, 95630872f37a)
• PR diff scope: The PR head changes only package.json and pnpm-lock.yaml, replacing 7.0.0-dev.20260628.1 with 7.0.0-dev.20260629.1 across the direct dependency, platform package entries, and dependent lockfile peer keys. (package.json:92, 699d307759e9)
• Lockfile consistency: The current lockfile has the existing importer, platform package, and optional dependency shape for @typescript/native-preview; the PR updates the same existing package family rather than adding a new dependency family. (pnpm-lock.yaml:21, 95630872f37a)
• Whitespace check: The proposed diff has no git diff --check whitespace errors. (699d307759e9)
• Dependency history: Recent history shows the same package and lockfile area is maintained through Dependabot updates, with the current main pin introduced by a previous @typescript/native-preview bump. (package.json:92, 95630872f37a)
• Registry metadata review: Registry metadata for the old and new versions keeps the same package name, repository, tsgo binary, platform optional dependency pattern, and Node engine shape; no new install/postinstall lifecycle hook was identified in this review.

Likely related people:

• Vincent Koc: Git history and blame show Vincent Koc introduced much of the current package.json dependency/release shape and has recent commits in package and release validation paths. (role: package and release-area contributor; confidence: medium; commits: af898fe0cdd3, c1ca6f199108, c0fdb1f0ebc2; files: package.json, pnpm-lock.yaml)
• dependabot[bot]: Current main history shows Dependabot authored the recent @typescript/native-preview bumps and adjacent development dependency updates in the same files. (role: dependency update automation; confidence: high; commits: 95630872f37a, ed9ce515e4a2, 2aae4e95db60; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[dependabot]

Superseded by #24.