chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260630.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260630.1.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 5, 2026, 7:21 AM ET / 11:21 UTC.

Summary
The PR updates the development dependency @typescript/native-preview from 7.0.0-dev.20260628.1 to 7.0.0-dev.20260630.1 and refreshes the pnpm lockfile entries for its platform packages.

Reproducibility: not applicable. this is a dependency maintenance PR, not a reported runtime bug.

Review metrics: 2 noteworthy metrics.

• Changed files: 2 modified. The PR is limited to the manifest and generated lockfile, which is the expected surface for this dependency bump.
• CI surface: 6 Node matrix checks plus CodeQL and browser smoke passed. The dependency update affects build tooling, so completed cross-platform checks materially reduce merge risk.

Merge readiness
Overall: 🦞 diamond lobster
Proof: 🌊 off-meta tidepool
Patch quality: 🦞 diamond lobster
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Next step before merge

• [P2] No repair lane is needed; this is a clean Dependabot PR for normal maintainer merge handling.

Security
Cleared: The diff is limited to a Dependabot development dependency version bump and generated lockfile integrity updates; no concrete supply-chain regression was found.

Review details

Best possible solution:

Keep this narrow Dependabot update on the normal maintainer merge path; no cleanup close or repair lane is warranted while the bump has not landed on main.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR, not a reported runtime bug.

Is this the best way to solve the issue?

Yes. The narrow package manifest and generated lockfile update is the maintainable solution for this development dependency bump.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 95630872f37a.

Label changes

Label changes:

• add rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency bump, so contributor real-behavior proof is not required by the review gate.

Label justifications:

• P3: This is a routine development dependency update with limited user-facing blast radius.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency bump, so contributor real-behavior proof is not required by the review gate.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; its pnpm and lockfile guidance makes this a focused generated dependency update review rather than a manual lockfile edit concern. (AGENTS.md:1, 95630872f37a)
• Current main still has the old version: main still pins @typescript/native-preview to 7.0.0-dev.20260628.1, so the requested bump is not already implemented on the default branch. (package.json:92, 95630872f37a)
• Current lockfile still resolves the old version: The lockfile importer and tsdown peer resolution still reference 7.0.0-dev.20260628.1 on main. (pnpm-lock.yaml:21, 95630872f37a)
• PR diff is narrow: The PR modifies only package.json and pnpm-lock.yaml, updating the direct dependency, platform package integrity entries, peer-resolution snapshots, and one transitive picomatch lockfile resolution. (package.json:92, 0225bdce3adc)
• GitHub PR status: GitHub reports the PR as mergeable, with successful Node 22/24 matrix checks, CodeQL, workflow lint, and Ghostty browser smoke checks. (0225bdce3adc)
• Dependency surface history: Recent history shows the same dependency/package surface was introduced in the release baseline and then maintained through Dependabot development-tooling bumps on main. (package.json:92, 95630872f37a)

Likely related people:

• @openclaw/openclaw-secops: CODEOWNERS explicitly owns package.json and pnpm-lock.yaml, the only files changed by this dependency bump. (role: code owner; confidence: high; files: package.json, pnpm-lock.yaml, .github/CODEOWNERS)
• Vincent Koc: The release-preparation baseline introduced the package metadata and lockfile surface that this bump updates. (role: introduced dependency surface; confidence: medium; commits: af898fe0cdd3; files: package.json, pnpm-lock.yaml)
• dependabot[bot]: Recent merged main commits updated the same development dependency area, including the current native-preview pin on main. (role: recent dependency updater; confidence: medium; commits: 95630872f37a, ed9ce515e4a2; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

Review history (1 earlier review cycle)

• reviewed 2026-07-02T17:19:18.585Z sha 0225bdc :: needs maintainer review before merge. :: none