chore(deps-dev): bump the development-minor-and-patch group across 1 directory with 8 updates

[dependabot]

Bumps the development-minor-and-patch group with 8 updates in the / directory:

Package	From	To
@react-email/ui	6.9.1	6.9.2
@types/node	26.1.2	26.2.0
@types/semver	7.7.1	7.8.0
convex-test	0.0.54	0.0.55
oxfmt	0.61.0	0.63.0
oxlint	1.76.0	1.78.0
react-email	6.9.1	6.9.2
vite	8.2.0	8.2.1

Updates @react-email/ui from 6.9.1 to 6.9.2

Release notes

Sourced from @​react-email/ui's releases.

@​react-email/ui@​6.9.2

Patch Changes

• 9b1a4d5: Bump next to 16.3.0 to fix high-severity vulnerabilities in its bundled postcss and sharp dependencies flagged by npm audit (#3689).

Changelog

Sourced from @​react-email/ui's changelog.

6.9.2

Patch Changes

• 9b1a4d5: Bump next to 16.3.0 to fix high-severity vulnerabilities in its bundled postcss and sharp dependencies flagged by npm audit (#3689).

Commits

• 128cb99 chore(root): version packages (#3701)
• 9b1a4d5 fix: bump next to 16.3.0 to remove vulnerable postcss/sharp deps (#3698)
• 770f193 chore: revert next bump to 16.3.0 (#3691) (#3697)
• 460b9c0 fix(ui): bump next to 16.3.0 (#3691)
• See full diff in compare view

Updates @types/node from 26.1.2 to 26.2.0

Commits

• See full diff in compare view

Updates @types/semver from 7.7.1 to 7.8.0

Commits

• See full diff in compare view

Updates convex-test from 0.0.54 to 0.0.55

Changelog

Sourced from convex-test's changelog.

0.0.55

• Support db.vars.commitTs and v.commitTs().
• Fix an issue where finishAllScheduledFunctions would drop functions scheduled under real timers.

Commits

• 925f5f8 0.0.55
• c8575b8 fix: finishAllScheduledFunctions dropping functions scheduled under real time...
• b1c5f10 0.0.55-alpha.0
• 33d87bf Support db.vars.commitTs (#130)
• 95b2c64 remove raw snapshot query syscall (#124)
• See full diff in compare view

Updates oxfmt from 0.61.0 to 0.63.0

Commits

• c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
• 00f490d refactor(oxfmt,formatter): split sortImports validation and use type enum (...
• 9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (#25251)
• e6e584b fix(oxfmt): type jsdoc. enum options (#25008)
• See full diff in compare view

Updates oxlint from 1.76.0 to 1.78.0

Changelog

Sourced from oxlint's changelog.

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

Commits

• c42d639 release(apps): oxlint v1.78.0 && oxfmt v0.63.0 (#25473)
• ccb8fe8 feat(linter/jsdoc): implement no-blank-blocks rule (#25207)
• 9573937 fix(linter/typescript): validate ban-ts-comment description_format (#25320)
• d4a897c feat(linter/eslint): implement one-var rule (#24470)
• 5ab9340 feat(linter/jsx-a11y/anchor-has-content): add options to match eslint (#24571)
• 9a423f2 release(apps): oxlint v1.77.0 && oxfmt v0.62.0 (#25251)
• 5c0fa61 fix(linter/eslint/no-warning-comments): unify config structs and remove manua...
• 9dc7756 docs(linter/typescript/no-unnecessary-condition): clarify options (#25110)
• See full diff in compare view

Updates react-email from 6.9.1 to 6.9.2

Changelog

Sourced from react-email's changelog.

6.9.2

Commits

• 128cb99 chore(root): version packages (#3701)
• See full diff in compare view

Updates vite from 8.2.0 to 8.2.1

Release notes

Sourced from vite's releases.

plugin-legacy@8.2.1

Please refer to CHANGELOG.md for details.

v8.2.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from vite's changelog.

8.2.1 (2026-08-06)

Bug Fixes

• build: make client chunkImportMap work with sharedPlugins: true (#23184) (15f0307)
• bundled-dev: inject client script tag before chunk scripts (#23161) (eac0cc8)
• css: don't re-run lightningcss visitor during minify (fix #23146) (#23147) (de041a7)
• deps: update all non-major dependencies (#23136) (14454fd)
• deps: update rolldown-related dependencies (#23070) (7ac6f7f)
• don't mutate the user config when resolving the lib entry from the top-level input (#23135) (b4bf596)
• handle shebang ending with uncommon line terminators (#23038) (17f7b2f)
• server: use a random port when port is 0 (#23158) (fddf4ea)

Performance Improvements

• css: look up pure CSS chunks through a Set (#23114) (1331b0b)

Documentation

• build: fix incomplete @default for build.minify (#23177) (ef02435)

Miscellaneous Chores

• deps: update dependency rolldown-plugin-dts to ^0.28.0 (#23137) (4adc1e7)
• deps: update dependency strip-literal to v4 (#23140) (9db65ce)

Code Refactoring

• bundled-dev: avoid injecting server values in the bundle (#22967) (23b8a08)
• bundled-dev: remove rolldown lazy stub module workaround (#23129) (e72036e)

Tests

• bundled-dev: enable sourcemap playgrounds (#23080) (c2155fe)
• reduce logs (#23138) (7673c02)

Commits

• 4216158 release: v8.2.1
• fddf4ea fix(server): use a random port when port is 0 (#23158)
• de041a7 fix(css): don't re-run lightningcss visitor during minify (fix #23146) (#23147)
• 15f0307 fix(build): make client chunkImportMap work with sharedPlugins: true (#23184)
• c2155fe test(bundled-dev): enable sourcemap playgrounds (#23080)
• ef02435 docs(build): fix incomplete @default for build.minify (#23177)
• eac0cc8 fix(bundled-dev): inject client script tag before chunk scripts (#23161)
• 23b8a08 refactor(bundled-dev): avoid injecting server values in the bundle (#22967)
• e72036e refactor(bundled-dev): remove rolldown lazy stub module workaround (#23129)
• 14454fd fix(deps): update all non-major dependencies (#23136)
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clawhub	Ready	Preview	Aug 14, 2026 4:09pm

[clawsweeper]

Codex review: found issues before merge. Reviewed August 14, 2026, 7:54 PM ET / 23:54 UTC.

ClawSweeper review

What this changes

The PR updates eight root development dependencies, synchronizes Node type versions in two CLI packages, and regenerates Bun’s lockfile.

Merge readiness

⛔ Blocked by patch quality or review findings - 8 items remain

Keep open: the grouped update leaves two root overrides below the exact/ranged requirements recorded by the updated packages, so the lockfile does not represent their declared contracts. Likely related people: Patrick Erichsen and Yiğit ERDOĞAN (medium confidence).

Priority: P2
Reviewed head: 9d953e1e19c1f9db7412ec6d945b8dde7dd0aa2e

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	PR readiness rating was derived from proof quality, review findings, security review, and reviewer confidence.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🧂 unranked krab (1/6)	Security review found an item that needs attention.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.
Evidence reviewed	5 items	React Email contract conflict: The PR adds @react-email/ui 6.9.2, whose lock entry requires next 16.3.0, while the unchanged root override and resolved lock entry retain next 16.2.11. Vite contract conflict: The PR adds Vite 8.2.1, whose lock metadata requires postcss ^8.5.25, while the unchanged root override resolves postcss 8.5.23. Changed manifest leaves both pins unchanged: The dependency bump changes the two affected development dependencies but does not update the next or postcss overrides directly below them.
Findings	2 actionable findings	[P1] Honor React Email’s required Next release [P2] Satisfy Vite’s PostCSS requirement
Security	Needs attention	Retained overrides bypass updated security dependency path: The lockfile records @react-email/ui 6.9.2 requiring Next 16.3.0, but the root override resolves 16.2.11; Vite 8.2.1 similarly requires PostCSS ^8.5.25 while 8.5.23 remains pinned.

How this fits together

ClawHub’s root development toolchain supplies build, lint, test, and email-development packages to the app and CLI packages. Package manifests and root overrides are resolved by Bun into the lockfile used by local development and CI.

flowchart LR
  A[Package manifests] --> B[Bun resolver]
  C[Root overrides] --> B
  B --> D[Lockfile]
  D --> E[Development tools]
  E --> F[CI and local builds]

Loading

Before merge

• Honor React Email’s required Next release (P1) - The new lock entry declares @react-email/ui@6.9.2 depends on next@16.3.0, but the unchanged root override resolves next@16.2.11. Update the override and regenerate the lockfile, or omit this package bump, so installs satisfy the locked package contract.
• Satisfy Vite’s PostCSS requirement (P2) - Vite 8.2.1 declares postcss: ^8.5.25, while the unchanged root override locks postcss@8.5.23. Raise the override and regenerate bun.lock so the upgraded build tool resolves a supported PostCSS version.
• Resolve security concern: Retained overrides bypass updated security dependency path - The lockfile records @react-email/ui 6.9.2 requiring Next 16.3.0, but the root override resolves 16.2.11; Vite 8.2.1 similarly requires PostCSS ^8.5.25 while 8.5.23 remains pinned.
• Resolve merge risk (P1) - Merging would lock @react-email/ui and Vite against Next/PostCSS versions outside their declared requirements, leaving an unsupported dependency graph.
• Resolve merge risk (P1) - No contributor-provided after-fix terminal or runtime proof shows that a clean install and the affected validation paths work with the resolved graph.
• Complete next step (P2) - The dependency corrections are mechanically clear, but this external PR still needs contributor-provided real behavior proof before a merge decision.
• Improve patch quality - Resolve the security review concern or explain why the changed path is safe.
• Improve patch quality - Address the highest-priority review finding and re-run the changed-surface validation.

Findings

• [P1] Honor React Email’s required Next release — package.json:163
• [P2] Satisfy Vite’s PostCSS requirement — package.json:186
• [medium] Retained overrides bypass updated security dependency path — package.json:163

Agent review details

Security

Needs attention: The updated React Email package advertises security remediation, but the unchanged overrides retain older Next and PostCSS versions outside the new packages’ declared requirements.

Review metrics

Metric	Value	Why it matters
Dependency footprint	8 packages updated; 4 files affected; +66/-66	The grouped update changes the shared development resolution graph, including two root overrides that remain unchanged.

Merge-risk options

Maintainer options:

1. Align the pinned transitive dependencies (recommended)
   Update the Next and PostCSS root overrides to satisfy the newly locked packages, regenerate bun.lock, and validate the resulting install and CI toolchain.
2. Defer the incompatible grouped update
   Remove the React Email and Vite bumps from this PR if their required override changes are not acceptable for the current toolchain.

Technical review

Best possible solution:

Raise the root Next override to 16.3.0 and PostCSS to at least 8.5.25, regenerate the lockfile, then provide redacted terminal evidence from a clean install and the relevant validation gates.

Do we have a high-confidence way to reproduce the issue?

Yes: the proposed lockfile directly records @react-email/ui requiring Next 16.3.0 and Vite requiring PostCSS ^8.5.25 while resolving lower root-overridden versions.

Is this the best way to solve the issue?

No: updating the package declarations without aligning the root overrides leaves both updated packages outside their declared dependency contracts.

Full review comments:

• [P1] Honor React Email’s required Next release — package.json:163
  The new lock entry declares @react-email/ui@6.9.2 depends on next@16.3.0, but the unchanged root override resolves next@16.2.11. Update the override and regenerate the lockfile, or omit this package bump, so installs satisfy the locked package contract.
  Confidence: 0.99
• [P2] Satisfy Vite’s PostCSS requirement — package.json:186
  Vite 8.2.1 declares postcss: ^8.5.25, while the unchanged root override locks postcss@8.5.23. Raise the override and regenerate bun.lock so the upgraded build tool resolves a supported PostCSS version.
  Confidence: 0.99

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against 36b775a6d9a0.

Labels

Label changes:

• add merge-risk: 🚨 security-boundary: The React Email release notes cite security remediation, but the unchanged Next/PostCSS overrides prevent the declared updated dependency path from being resolved.

Label justifications:

• P2: This is a bounded development-toolchain update with concrete build and installation compatibility defects.
• merge-risk: 🚨 compatibility: The proposed lockfile resolves Next and PostCSS below requirements declared by updated packages.
• merge-risk: 🚨 security-boundary: The React Email release notes cite security remediation, but the unchanged Next/PostCSS overrides prevent the declared updated dependency path from being resolved.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🌊 off-meta tidepool and patch quality is 🧂 unranked krab.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: Real behavior proof is not required for maintainer- or bot-authored pull requests.

Evidence

Security concerns:

• [medium] Retained overrides bypass updated security dependency path — package.json:163
  The lockfile records @react-email/ui 6.9.2 requiring Next 16.3.0, but the root override resolves 16.2.11; Vite 8.2.1 similarly requires PostCSS ^8.5.25 while 8.5.23 remains pinned.
  Confidence: 0.98

What I checked:

• React Email contract conflict: The PR adds @react-email/ui 6.9.2, whose lock entry requires next 16.3.0, while the unchanged root override and resolved lock entry retain next 16.2.11. (bun.lock:719, 9d953e1e19c1)
• Vite contract conflict: The PR adds Vite 8.2.1, whose lock metadata requires postcss ^8.5.25, while the unchanged root override resolves postcss 8.5.23. (bun.lock:1977, 9d953e1e19c1)
• Changed manifest leaves both pins unchanged: The dependency bump changes the two affected development dependencies but does not update the next or postcss overrides directly below them. (package.json:163, 9d953e1e19c1)
• Dependency-constraint provenance: Recent main history shows Yiğit ERDOĞAN’s audit-restoration change immediately before this PR, making that security-sensitive dependency policy an important compatibility constraint to preserve. (bun.lock:180, 8b31a7e6e1a5)
• Real-proof inspection: The prepared media consists only of Blacksmith “Fix with Codesmith” button images; it does not show an after-fix install, build, test, or runtime result.

Likely related people:

• Yiğit ERDOĞAN: Authored the recent audit-restoration change immediately preceding this PR, which is the relevant history for the root override policy. (role: introduced adjacent dependency-security constraints; confidence: medium; commits: 8b31a7e6e1a5; files: package.json, bun.lock)
• Patrick Erichsen: Recent main history includes dependency maintenance and the email-rendering surface that makes React Email tooling relevant to this repository. (role: recent dependency and email-surface contributor; confidence: medium; commits: 109384dcb8f0, 87ca030c30f3; files: package.json, bun.lock, convex/lib/emailRendering.tsx)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (14 earlier review cycles; latest 8 shown)

• reviewed 2026-08-14T16:10:12.460Z sha 9d953e1 :: needs changes before merge. :: [P2] Raise the PostCSS override for Vite 8.2.1
• reviewed 2026-08-14T17:30:09.523Z sha 9d953e1 :: needs changes before merge. :: [P2] Raise the PostCSS override for Vite 8.2.1
• reviewed 2026-08-14T17:44:31.366Z sha 9d953e1 :: found issues before merge. :: [P1] Honor React Email’s required Next release | [P2] Raise the PostCSS override for Vite 8.2.1
• reviewed 2026-08-14T19:42:17.334Z sha 9d953e1 :: needs changes before merge. :: [P1] Honor React Email’s required Next release | [P2] Raise the PostCSS override for Vite 8.2.1
• reviewed 2026-08-14T20:04:45.149Z sha 9d953e1 :: needs changes before merge. :: [P1] Honor React Email’s required Next release | [P2] Raise the PostCSS override for Vite 8.2.1
• reviewed 2026-08-14T21:36:03.939Z sha 9d953e1 :: found issues before merge. :: [P1] Honor React Email’s required Next release | [P2] Align the PostCSS override with Vite 8.2.1
• reviewed 2026-08-14T22:35:46.972Z sha 9d953e1 :: needs changes before merge. :: [P1] Honor React Email’s required Next release | [P2] Satisfy Vite’s PostCSS requirement
• reviewed 2026-08-14T22:47:13.498Z sha 9d953e1 :: found issues before merge. :: [P1] Honor React Email’s required Next release | [P2] Align the PostCSS override with Vite 8.2.1