chore(deps): refresh pnpm, Node types, and Pages deployment action

[dependabot]

Refresh the maintenance toolchain while retaining the package's Node >=22 contract and two-day dependency cooldown.

• Retain Dependabot's full-SHA actions/deploy-pages v5.0.1 update, which adds deployment polling backoff and jitter.
• Align pnpm 11.25.0 across package metadata, CI, release preparation, and the Windows identity proof.
• Update @types/node to 26.4.1 and regenerate the lockfile with pnpm.
• Add the required Unreleased changelog entry. The original Dependabot commit and contributor credit are preserved; current main is incorporated without rewriting branch history.

The dependency audit found the direct Rust dependencies and other Actions pins current. @napi-rs/cli 3.9.0, Vitest 5.0.0, and cargo-zigbuild 0.23.4 remain deferred within the cooldown. Zig 0.16 is a separate cross-target toolchain migration.

Validation at 01c08534525f3bb8f683103b288e03de23ffa0b9:

• Frozen pnpm 11.25.0 installation, CI=1 pnpm check, docs site build, workflow lint, and git diff --check passed. The suite passed 216 files / 6,906 tests, with 5 files / 480 expected skips.
• Fresh macOS arm64 native build and auto/require/off smoke passed.
• pnpm package:smoke passed using disposable root-only npm 11.19.0 and pnpm 11.25.0 installs. It exercised native-required SHA-256, missing/omitted binding fallbacks, public imports, and secret-directory replacement/deletion admission. Foreign package payloads were synthetic platform-filter fixtures; this local proof covers macOS arm64.
• Isolated Codex review found no actionable P0–P2 defects.
• The baseline dependency audit reported zero advisories. The final full registry audit timed out; it is not reported as a clean result.

Exact-head workflows all passed: ci, coverage, CodeQL, benchmarks, hash identity Windows proof. No test fixes or CI reruns were needed.

The upstream executable source diff was retrieved and reviewed, including both pinned versions of src/internal/deployment.js. It adds validated polling intervals, successful-status backoff, and jitter while retaining the existing timeout/error cancellation paths. This resolves the automated review's source-retrieval evidence gap.

Actual Pages deployment is not exercised by PR CI and was not dispatched. The exact deployment pin will need observation on the next authorized Pages run.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed September 4, 2026, 4:13 AM ET / 08:13 UTC.

ClawSweeper review

What this changes

Updates pnpm across development and automation, refreshes Node type definitions and the lockfile, and advances the pinned Pages deployment action.

Merge readiness

✅ Ready for maintainer review

Keep open: the update remains absent from fetched main and has no actionable introduced defect. The previous changelog finding is resolved.

Priority: P3
Reviewed head: 01c08534525f3bb8f683103b288e03de23ffa0b9

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A focused, consistently applied maintenance update with reported cross-platform validation and no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This bot-authored maintenance PR is exempt from contributor proof, with no material authority change identified. Captured installs and consumer smokes cover the toolchain update; Pages deployment remains unobserved, so the prior observation request is routine post-merge follow-up.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This bot-authored maintenance PR is exempt from contributor proof, with no material authority change identified. Captured installs and consumer smokes cover the toolchain update; Pages deployment remains unobserved, so the prior observation request is routine post-merge follow-up.
Evidence reviewed	10 items	Repository policy: Read the complete root AGENTS.md and contribution/security policies. No nested AGENTS.md or matching maintainer notes were found. Applied package compatibility, dependency review, and Unreleased changelog guidance; no builds, tests, or autoreview helpers were executed. Verified scope and parentage: The exact head records fetched main 027f643 as its first parent and the original Dependabot commit as its second. Comparing that recorded main parent with head leaves 11 maintenance files; src/, test/, and docs/ are identical. The broader supplied delta includes incorporated main work and does not establish new filesystem changes by this update. Still necessary on fetched main: Fetched main retains pnpm 11.24.0, @types/node 26.4.0, and the previous Pages pin. No merged replacement is established. The supplied latest release is v0.7.2; its package blob was unavailable locally, so no release inclusion claim is made.
Findings	None	None.
Security	None	None.

How this fits together

fs-safe’s maintenance tooling installs dependencies and validates its Node.js package across platforms. Its separate Pages workflow builds documentation and publishes the resulting site.

flowchart TD
  A[Package metadata and lockfile] --> B[Pinned pnpm installation]
  B --> C[Cross-platform package checks]
  C --> D[Release preparation]
  E[Documentation changes on main] --> F[Build and upload site]
  F --> G[Pinned Pages deployment]

Loading

Before merge

None.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Effective review scope	11 files beyond incorporated main; 0 runtime or test files	The 64-file historical comparison includes existing main changes and overstates this maintenance update’s scope.

Technical review

Best possible solution:

Keep the maintenance pins synchronized while preserving the supported Node runtime, frozen installs, and dependency cooldown.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this refreshes maintenance dependencies rather than reporting broken package behavior.

Is this the best way to solve the issue?

Yes: synchronized version updates and a matching lockfile follow the existing maintenance pattern without adding a competing implementation.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 027f6435122b.

Labels

Label changes:

• remove merge-risk: 🚨 automation: Current PR review selected no merge-risk labels.

Label justifications:

• P3: This is a bounded maintenance update with no demonstrated urgent user-facing failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This bot-authored maintenance PR is exempt from contributor proof, with no material authority change identified. Captured installs and consumer smokes cover the toolchain update; Pages deployment remains unobserved, so the prior observation request is routine post-merge follow-up.

Evidence

What I checked:

• Repository policy: Read the complete root AGENTS.md and contribution/security policies. No nested AGENTS.md or matching maintainer notes were found. Applied package compatibility, dependency review, and Unreleased changelog guidance; no builds, tests, or autoreview helpers were executed. (AGENTS.md:39, 01c08534525f)
• Verified scope and parentage: The exact head records fetched main 027f643 as its first parent and the original Dependabot commit as its second. Comparing that recorded main parent with head leaves 11 maintenance files; src/, test/, and docs/ are identical. The broader supplied delta includes incorporated main work and does not establish new filesystem changes by this update. (01c08534525f)
• Still necessary on fetched main: Fetched main retains pnpm 11.24.0, @types/node 26.4.0, and the previous Pages pin. No merged replacement is established. The supplied latest release is v0.7.2; its package blob was unavailable locally, so no release inclusion claim is made. (package.json:169, 027f6435122b)
• Toolchain and compatibility review: Read the complete effective diff and affected workflows. pnpm versions agree across package metadata, six workflows, and the Windows proof assertion. Lockfile changes update Node types and peer references; runtime dependencies, exports, lifecycle scripts, Node >=22, and the 2880-minute dependency cooldown remain unchanged. (package.json:183, 01c08534525f)
• Previous review disposition: CHANGELOG.md now includes the required maintenance entry. The Pages pin is unchanged from the earlier reviewed head. The prior request to observe deployment is routine operational follow-up: this bot-authored update is exempt from contributor proof, and the reviewed integration changes no deployment permissions, principals, or triggers. (CHANGELOG.md:5, 01c08534525f)
• Pages dependency boundary: The deployment step directly executes actions/deploy-pages at the new full SHA, establishing the relevant dependency boundary. The main-only push trigger, github-pages environment, permissions, artifact input, and ten-minute job timeout are unchanged. (.github/workflows/pages.yml:54, 01c08534525f)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)
• openclaw/openclaw-secops: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (5 earlier review cycles)

• reviewed 2026-09-03T17:33:12.939Z sha 7ea3861 :: needs changes before merge. :: [P3] Add an Unreleased changelog entry for this workflow update
• reviewed 2026-09-03T19:04:19.396Z sha 7ea3861 :: needs changes before merge. :: [P3] Add an Unreleased changelog entry for this workflow update
• reviewed 2026-09-04T02:53:17.758Z sha 7ea3861 :: blocked before merge. :: [P3] Add an Unreleased changelog entry for the deployment update
• reviewed 2026-09-04T05:59:05.071Z sha 7ea3861 :: blocked before merge. :: [P3] Add the required Unreleased changelog entry
• reviewed 2026-09-04T07:58:38.629Z sha 01c0853 :: blocked before merge. :: none