[Zach Dunn (zachdunn)]

Requested by Zach · project thread

Summary

This follows #1399 with the major or pre-1.0 bumps that turned out to be safe. Each bump is its own commit.

• oxfmt 0.57 → 0.77: clears the tinypool critical advisories. The new version reformats 20 files: mostly markdown spacing, plus collapsed vi.fn(async () => ({…})) wrapping in one test and one plugin hook. Root skills/ and the plugin copy got the same changes, so plugin-skills:check still passes.
• vitest 4.1 → 5.1 across every workspace. No config or test changes were needed.
• tsup 8 → 9 in @uploads/ui. dist/ comes out byte-identical to the tsup 8 build.
• ai 6 → 7 (dev dependency of the CLI, only there for files-sdk's optional peer, which accepts ^6 || ^7).

pnpm audit drops from 10 advisories to 4, all under shadcn (zod 3, minimatch, deepmerge) or files-sdk → MCP SDK → @hono/node-server.

Held back

• stripe 23: v23 pins the 2026-10-28.endive API version, and its types reject our explicit 2026-06-24.dahlia. Even 22.6 does the same with 2026-08-26.dahlia. Taking either means upgrading the Stripe API version itself (webhook payload shapes, endpoint version in the dashboard), so it's a separate decision.
• @changesets/cli 3 (+ @manypkg/get-packages 3): v3 rewrote changeset publish and no longer prints New tag:. release.yml greps for that line to decide whether to create the GitHub release, so publishing would quietly skip the release step.
• prettier-plugin-astro 1: reformats 78 .astro files (~5.6k lines), including moving inline text in buttons and links onto separate lines. That changes whitespace in the rendered output, so it needs its own PR with a visual check.
• TypeScript 7 in apps/web: @astrojs/check peers on typescript ^5 || ^6.

Test plan

• pnpm typecheck, pnpm lint, pnpm format:check
• pnpm test on Node 24 (the .nvmrc version): 7,915 passed
• changeset, server-json, plugin-version, plugin-skills and plugin-directory checks
• CLI build + pack:check, MCP bundle:check, viewer:bundle:check

Note: on Node 22, auth-proxy.test.ts "settles with a synthetic 503" times out under vitest 5 when it runs after the other tests in its file. It passes every time on Node 24, which is what CI and .nvmrc use.

---

Generated by Claude Code

[changeset-bot]

⚠️ No Changeset found

Latest commit: 716c73b

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 2

• coderabbit:review
• review

🚫 Excluded labels (none allowed): 1

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 166c110a-10dd-45c0-be81-214c6509d8ca

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[uploads-sh]

No uploads on this PR yet

This PR changes UI files (packages/email/package.json, plugins/claude/uploads/hooks/register.tsx and scripts/demos/fixtures/workflow-listening-room.html). Screenshots help reviewers see what changed.

• From the CLI: uploads put before.png after.png --pr 1402
• From an agent: ask it to attach screenshots with uploads.sh
• By hand: drag images into the PR description and they're imported automatically

Tips for agents

Label each shot so reviewers know what they're seeing. Labels apply to every file in a call, so run one put per shot:

uploads put after.png --pr 1402 --meta path=/settings --state after --caption "Saved settings toast"
uploads put chat.png --pr 1402 --app ios --screen "Chat" --state after

No CLI? With the Uploads MCP, call sign_upload_url for files on disk (or put) with repo, pr: 1402 and the same screen, state and caption fields.

This comment updates with each upload, so you don't need to post the images yourself. A shot or two in the PR description is still welcome. Check what's attached with uploads list --pr 1402. More in the github-screenshots skill or the agent docs.

_{Workspace admins can turn this comment off in Settings → GitHub · docs}