chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260627.2 to 7.0.0-dev.20260630.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260627.2 to 7.0.0-dev.20260630.1.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed July 2, 2026, 9:29 AM ET / 13:29 UTC.

Summary
This PR bumps the direct devDependency @typescript/native-preview and matching pnpm lockfile entries from 7.0.0-dev.20260627.2 to 7.0.0-dev.20260630.1.

Reproducibility: not applicable. this is a maintenance dependency bump rather than a bug report. Current main can be source-checked at package.json:96 to confirm the old pin remains.

Review metrics: 2 noteworthy metrics.

• Dependency surface: 1 direct devDependency updated. The patch updates only @typescript/native-preview, keeping the package review narrowly scoped.
• Changed files: 2 files, +39/-39. The diff is limited to the package manifest and lockfile, which are the relevant integrity surfaces for this update.

Root-cause cluster
Relationship: canonical
Canonical: #420
Summary: This PR is the active newer Dependabot candidate for the @typescript/native-preview bump; the older closed Dependabot PR is superseded by this version update.

Members:

• superseded: chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260627.2 to 7.0.0-dev.20260629.1 #418 - That closed PR proposed bumping from 7.0.0-dev.20260627.2 to 7.0.0-dev.20260629.1, while this PR proposes the newer 7.0.0-dev.20260630.1 update.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Wait for the Test and Mutation CI jobs to finish before merge.

Risk before merge

• [P1] At inspection time, the Test and Mutation CI jobs were still in progress, so merge should wait for the normal required checks rather than relying only on the completed format, typecheck, lint, build, conformance, and Slophammer jobs.

Maintainer options:

1. Decide the mitigation before merge
   Land the Dependabot bump after required CI completes, preserving package.json and pnpm-lock.yaml as the single source of truth for this pinned dev dependency.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• No ClawSweeper repair lane is needed; the remaining action is ordinary CI completion and maintainer merge handling.

Security
Cleared: No concrete security or supply-chain regression was found in the package-and-lockfile-only Dependabot update.

Review details

Best possible solution:

Land the Dependabot bump after required CI completes, preserving package.json and pnpm-lock.yaml as the single source of truth for this pinned dev dependency.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a maintenance dependency bump rather than a bug report. Current main can be source-checked at package.json:96 to confirm the old pin remains.

Is this the best way to solve the issue?

Yes; the PR uses the standard narrow Dependabot path by updating the direct devDependency and all matching pnpm lockfile references, with no duplicate configuration or new product surface.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 1d882575e34e.

Label changes

Label changes:

• add P3: This is a low-risk routine development dependency maintenance PR with no observed runtime behavior change.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency bump, so contributor-provided real behavior proof is not applicable; normal package checks are the appropriate gate.

Label justifications:

• P3: This is a low-risk routine development dependency maintenance PR with no observed runtime behavior change.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot dependency bump, so contributor-provided real behavior proof is not applicable; normal package checks are the appropriate gate.

Evidence reviewed

What I checked:

• Current main still has the old pin: Current main at 1d882575e34e18621e59229f0e711723cef223ae still pins @typescript/native-preview to 7.0.0-dev.20260627.2, so the requested dependency update is not already implemented. (package.json:96, 1d882575e34e)
• PR diff is narrow: The PR changes only package.json and pnpm-lock.yaml, with 39 additions and 39 deletions, replacing the old preview build with 7.0.0-dev.20260630.1. (package.json:96, 16feb1bb24ce)
• Lockfile references are consistently updated: The lockfile updates the root importer, platform-specific optional packages, snapshots, and tsdown/rolldown-plugin-dts peer snapshots to the same new @typescript/native-preview version without adding unrelated package names. (pnpm-lock.yaml:51, 16feb1bb24ce)
• CI is partially complete: Format, Typecheck, Lint, Build, Conformance Smoke, Slophammer, and CodeQL had completed successfully or neutrally; Test and Mutation were still in progress at inspection time. (16feb1bb24ce)
• Package files are package-integrity surfaces: CODEOWNERS explicitly marks package.json and pnpm-lock.yaml as package integrity surfaces owned by @openclaw/openclaw-secops, which supports treating this as a supply-chain-sensitive but narrow package review. (.github/CODEOWNERS:10, 1d882575e34e)
• Relevant history for the current pin: Blame on the current dependency line points to 7d47fbcf526deafdf720c8a4cc80ef250e377620, a Dependabot commit that previously bumped @typescript/native-preview from 7.0.0-dev.20260616.1 to 7.0.0-dev.20260627.2. (package.json:96, 7d47fbcf526d)

Likely related people:

• dependabot[bot]: Current-main blame and recent package history show Dependabot handled the last @typescript/native-preview bump and related development dependency updates. (role: recent dependency updater; confidence: high; commits: 7d47fbcf526d, 1d882575e34e, b0ea30842bbd; files: package.json, pnpm-lock.yaml)
• @openclaw/openclaw-secops: CODEOWNERS explicitly owns package.json and pnpm-lock.yaml as package integrity surfaces. (role: declared code owner; confidence: high; files: package.json, pnpm-lock.yaml, .github/CODEOWNERS)
• Vincent Koc: Package and lockfile history show multiple recent non-bot commits from this author around release and dependency surfaces. (role: recent package/release area contributor; confidence: medium; commits: e8e39dc485e5, 48d6952b07f1, 712f4d93a4a6; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.