chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260613.1 to 7.0.0-dev.20260614.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260613.1 to 7.0.0-dev.20260614.1.

Commits

• See full diff in compare view

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed June 16, 2026, 9:53 AM ET / 13:53 UTC.

Summary
Updates the direct devDependency @typescript/native-preview and related pnpm-lock.yaml entries from 7.0.0-dev.20260613.1 to 7.0.0-dev.20260614.1, including optional platform packages.

Reproducibility: not applicable. this is a dependency maintenance PR, not a bug report. Validation is based on the package/lockfile diff, npm metadata, and CI status rather than a reproduction path.

Review metrics: 2 noteworthy metrics.

• Changed files: 2 modified. Only package.json and pnpm-lock.yaml change, so the dependency bump is narrowly scoped.
• Native platform artifacts: 7 optional packages updated. The dependency carries per-OS native binaries, making platform coverage the main residual review concern.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Optionally run macOS and Windows install plus typecheck if maintainers want platform-specific proof before merge.

Risk before merge

• [P1] The PR updates optional native packages for macOS and Windows as well as Linux; the passing CI proves the repository’s configured Linux/Node path but does not directly exercise every platform binary.

Maintainer options:

1. Merge with existing CI evidence (recommended)
   Maintainers can accept the residual platform risk because this is a devDependency-only bump, npm metadata matches the reviewed lockfile entries, and the required CI jobs passed.
2. Request cross-platform compiler proof
   If platform confidence matters for this native binary preview update, ask for macOS and Windows install plus typecheck evidence before merge.

Next step before merge

• No automated repair is needed; the remaining action is a maintainer merge decision or optional cross-platform proof request for the native compiler preview bump.

Security
Cleared: Cleared: the diff only updates an existing devDependency and lockfile integrities, with no scripts, runtime dependencies, workflow permissions, or publishing metadata changes.

Review details

Best possible solution:

Merge the routine dev tooling bump if maintainers accept the native-preview platform risk; ask for targeted macOS/Windows install and typecheck proof only if this cycle needs extra cross-platform assurance.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency maintenance PR, not a bug report. Validation is based on the package/lockfile diff, npm metadata, and CI status rather than a reproduction path.

Is this the best way to solve the issue?

Yes; the PR uses the narrow package manifest plus lockfile update path for this pinned devDependency. The safer alternative, if maintainers want more assurance, is targeted macOS/Windows install and typecheck proof rather than code changes.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against c5ef9a59159a.

Label changes

Label changes:

• add P3: This is low-risk dependency maintenance with no runtime code changes and green CI.
• add merge-risk: 🚨 compatibility: The lockfile updates native compiler packages for platforms not directly exercised by the Linux CI run.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable because this is a Dependabot bot dependency PR; CI and registry checks are the relevant validation evidence for this review.

Label justifications:

• P3: This is low-risk dependency maintenance with no runtime code changes and green CI.
• merge-risk: 🚨 compatibility: The lockfile updates native compiler packages for platforms not directly exercised by the Linux CI run.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Not applicable because this is a Dependabot bot dependency PR; CI and registry checks are the relevant validation evidence for this review.

Evidence reviewed

What I checked:

• Narrow dependency diff: The PR patch modifies only package.json and pnpm-lock.yaml, changing the pinned @typescript/native-preview version and the corresponding lockfile package/snapshot entries. (package.json:95, 7e2c902079bf)
• Tooling surface: Current main uses tsdown for build/prepack and tsgo for typecheck/build:test, so this dependency affects development and CI tooling rather than runtime application code. (package.json:38, c5ef9a59159a)
• Current lockfile shape: The current lockfile pins @typescript/native-preview as a direct devDependency and includes platform-specific optional packages for the existing version; the PR updates the same structured entries to the new version. (pnpm-lock.yaml:48, c5ef9a59159a)
• Registry metadata check: npm view confirmed @typescript/native-preview@7.0.0-dev.20260614.1 exists, exposes tsgo, requires Node >=16.20.0, and its top-level integrity matches the PR lockfile; the Linux x64 optional package integrity also matches.
• CI and mergeability: GitHub reports the PR as mergeable/CLEAN, with Format, Typecheck, Lint, Build, Conformance Smoke, Test, Mutation, and Slophammer checks passing on the PR head. (7e2c902079bf)
• Area history: git blame shows the current @typescript/native-preview pin came from a prior merged Dependabot bump, while nearby tooling dependencies and the initial package setup trace to recent development-tooling commits. (package.json:95, aec95c2f5bb6)

Likely related people:

• steipete: GitHub commit metadata maps the initial package/dependabot setup and a recent development-tooling refresh to this handle, and those commits cover the package files affected here. (role: development tooling introducer and recent area contributor; confidence: high; commits: 00e4c9452290, ba33aa29bbd6; files: package.json, pnpm-lock.yaml, .github/dependabot.yml)
• dependabot[bot]: The current @typescript/native-preview pin on main and several recent same-dependency bumps were introduced by prior merged Dependabot commits. (role: recent automated dependency updater; confidence: high; commits: aec95c2f5bb6, c7e4cf986a10, ac9fddf02dd8; files: package.json, pnpm-lock.yaml)
• vincentkoc: Recent package/lockfile security-alert work appears in the same dependency maintenance area, though not specifically on this native-preview pin. (role: adjacent dependency and security contributor; confidence: medium; commits: 2a8d7147b14c; files: package.json, pnpm-lock.yaml)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.