chore(deps-dev): bump jsdom from 29.1.1 to 30.0.1

[dependabot]

Bumps jsdom from 29.1.1 to 30.0.1.

Release notes

Sourced from jsdom's releases.

v30.0.1

• Fixed getComputedStyle() with calc() and other functions throwing an exception, which regressed in v30.0.0. (@​asamuzaK)
• Sped up up range operations on large documents (@​leonidaz)

v30.0.0

Breaking changes:

• Node.js minimum version raised to ^22.22.2 || ^24.15.0 || >=26.0.0.

Other changes:

• Added CSS.escape() and CSS.supports() functions. (@​asamuzaK)
• Added 'background-position-x' and 'background-position-y' CSS properties. (@​olagokemills)
• Fixed getComputedStyle() to convert length values into pixels. (@​asamuzaK)
• Fixed CSS function serialization, e.g., in the return value of getPropertyValue(). (@​asamuzaK)
• Fixed the type of error thrown by document.evaluate() (@​dokson)

Commits

• 6584485 30.0.1
• 0c51df6 Update dependencies and dev dependencies
• 32adb34 Bump @​asamuzakjp/dom-selector
• 70f014a Speed up range operations on large documents
• 250d7ee Partially fix getComputedStyle with calc()
• 20a01fc 30.0.0
• 8c8e583 Precompute WPT expectation matches
• f32245c Bump Node.js floor and dependencies
• 03ef23b Add background-position longhands
• ded056f Test CSS.escape() with numeric IDs
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview	Aug 11, 2026 5:58pm

[clawsweeper]

Codex review: needs changes before merge. Reviewed August 11, 2026, 2:03 PM ET / 18:03 UTC.

ClawSweeper review

What this changes

The PR upgrades the development-only jsdom test environment from 29.1.1 to 30.0.1 and refreshes Bun’s resolved dependency graph.

Merge readiness

⛔ Blocked by patch quality or review findings - 7 items remain

Keep open: the refreshed branch still removes the recorded SHA-512 digest for the unchanged Carapace Git dependency, so the jsdom-only update is not safe to merge yet.

Priority: P2
Reviewed head: a30aeac49d70cbe4738e9367a30fbe674b5a3768

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🧂 unranked krab (1/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	4 items	Unrelated integrity metadata removal: The PR changes the jsdom resolution but also removes the fourth SHA-512 field from the unchanged @openclaw/carapace Git dependency; current main retains that field. Frozen-lockfile CI contract: The shared CI setup installs dependencies with --frozen-lockfile, so the reviewed lockfile is the dependency-resolution and verification record used by CI. Test-runtime dependency: Current main declares jsdom 29.1.1 as a direct development dependency; the proposed manifest update is therefore limited to the test environment.
Findings	1 actionable finding	[P2] Retain Carapace’s lockfile integrity digest
Security	Needs attention	Carapace integrity digest is removed: The proposed Bun lockfile deletes the SHA-512 value for the unchanged @openclaw/carapace Git package, expanding the dependency update beyond jsdom and reducing retained integrity metadata.

How this fits together

ClawHub’s Vitest suite uses jsdom to emulate browser APIs for frontend tests. Bun resolves that test dependency graph from package.json and bun.lock before CI runs the suite.

flowchart LR
  A[Package manifest] --> B[Bun lockfile]
  B --> C[Installed test dependencies]
  C --> D[Vitest jsdom environment]
  D --> E[Frontend tests]

Loading

Before merge

• Retain Carapace’s lockfile integrity digest (P2) - This jsdom update removes the SHA-512 field for the unchanged Carapace Git dependency. Current main records that digest, so the clean merge would weaken dependency verification outside this PR’s stated scope; restore the identical field before merging.
• Resolve security concern: Carapace integrity digest is removed - The proposed Bun lockfile deletes the SHA-512 value for the unchanged @openclaw/carapace Git package, expanding the dependency update beyond jsdom and reducing retained integrity metadata.
• Resolve merge risk (P1) - Merging would retain an unrelated removal of the SHA-512 metadata for the pinned Carapace Git dependency.
• Resolve merge risk (P1) - The PR body contains release notes only; it does not show an after-fix jsdom test run on the proposed dependency graph.
• Complete next step (P2) - The remaining blocker is a narrow mechanical lockfile repair, although real behavior proof must still be supplied before merge.
• Improve patch quality - Resolve the security review concern or explain why the changed path is safe.
• Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

• [P2] Retain Carapace’s lockfile integrity digest — bun.lock:448
• [medium] Carapace integrity digest is removed — bun.lock:448

Agent review details

Security

Needs attention: The lockfile diff weakens recorded verification metadata for an unchanged Git dependency.

Review metrics

Metric	Value	Why it matters
Dependency surface	2 files; +17/-17	The direct dependency bump is small, but the lockfile includes an unrelated integrity-metadata deletion.

Merge-risk options

Maintainer options:

1. Preserve the existing Git-package digest (recommended)
   Restore the unchanged Carapace SHA-512 field and provide after-fix frozen-install and test evidence before merging the jsdom update.

Technical review

Best possible solution:

Keep the jsdom upgrade narrow by restoring the unchanged Carapace digest, then attach a redacted successful frozen-install and jsdom-backed test run before merge.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency-maintenance PR, not a reported product failure.

Is this the best way to solve the issue?

No: the jsdom update is a reasonable path, but the unrelated deletion of existing Carapace integrity metadata must be reversed first.

Full review comments:

• [P2] Retain Carapace’s lockfile integrity digest — bun.lock:448
  This jsdom update removes the SHA-512 field for the unchanged Carapace Git dependency. Current main records that digest, so the clean merge would weaken dependency verification outside this PR’s stated scope; restore the identical field before merging.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against e29b59c7eb22.

Labels

Label changes:

• add rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• remove rating: 🦐 gold shrimp: Current PR rating is rating: 🧂 unranked krab, so this older rating label is no longer current.

Label justifications:

• P2: This major development-test dependency upgrade can affect repository test behavior but does not directly alter production runtime behavior.
• merge-risk: 🚨 security-boundary: The proposed lockfile removes verification metadata for an unchanged Git dependency.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

Security concerns:

• [medium] Carapace integrity digest is removed — bun.lock:448
  The proposed Bun lockfile deletes the SHA-512 value for the unchanged @openclaw/carapace Git package, expanding the dependency update beyond jsdom and reducing retained integrity metadata.
  Confidence: 0.99

Acceptance criteria:

• [P1] bun install --frozen-lockfile.
• [P1] bun run ci:unit.

What I checked:

• Unrelated integrity metadata removal: The PR changes the jsdom resolution but also removes the fourth SHA-512 field from the unchanged @openclaw/carapace Git dependency; current main retains that field. (bun.lock:448, a30aeac49d70)
• Frozen-lockfile CI contract: The shared CI setup installs dependencies with --frozen-lockfile, so the reviewed lockfile is the dependency-resolution and verification record used by CI. (.github/actions/setup-bun/action.yml:15, e29b59c7eb22)
• Test-runtime dependency: Current main declares jsdom 29.1.1 as a direct development dependency; the proposed manifest update is therefore limited to the test environment. (package.json:173, e29b59c7eb22)
• Area provenance: Recent history identifies Patrick Erichsen’s Carapace upgrade as the relevant prior dependency-lockfile work; the current branch is not on main because main still resolves jsdom 29.1.1. (bun.lock:452, 2c7c40f001be)

Likely related people:

• Patrick Erichsen: Authored the recent Carapace upgrade and several adjacent package/lockfile updates on current main. (role: recent dependency-lockfile contributor; confidence: high; commits: 2c7c40f001be, 109384dcb8f0; files: package.json, bun.lock)
• Vincent Koc: Authored the retrying frozen-lockfile install workflow that consumes this lockfile in CI. (role: CI dependency-install contributor; confidence: medium; commits: 74113da8a9fa; files: .github/actions/setup-bun/action.yml)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-08-05T16:10:08.431Z sha e2ac22a :: needs maintainer review before merge. :: none
• reviewed 2026-08-05T17:58:35.527Z sha e2ac22a :: needs changes before merge. :: [P2] Retain Carapace’s lockfile integrity digest