build(deps): refresh formatter, lint, and Node setup

[steipete]

Update oxfmt to 0.72.0, oxlint to 1.87.0, and the pinned actions/setup-node action to 7.1.0. This consolidates #101 and #102 and preserves the two-day dependency cooldown, Node runtime support, pnpm 11 toolchain, and package version.

The formatter update made all check jobs in #101 fail because it now sorts imports inside Markdown code blocks. Reproduced that failure and applied the formatter's two-line import reorder in README.md. Added the Unreleased changelog entry and retained Dependabot's contribution credit.

Validation on Linux with the repository's pnpm 11.28.0:

• pnpm install --frozen-lockfile
• pnpm check: formatting, build, type checks, lint, all 140 tests, and packed-package import checks pass.
• pnpm test:coverage: all 140 tests pass.
• pnpm test:browser: all 9 Chromium tests pass with Node and Worker assets.
• Independent Codex autoreview: no actionable P0–P3 findings.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Updates oxfmt, oxlint, and the pinned Node setup action, with the README import order required by the new formatter.

Example: Run repository formatting checks with oxfmt 0.72.0.

• Before: The README example imports the stream module before the protocol module.
• After: The protocol import precedes the stream import, matching the new formatter order.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	Focused, worthwhile maintenance with passing exact-head checks and no actionable defects; validation is supported by workflow results and the reported Linux run.
Proof confidence	🐚 platinum hermit (4/6)	The supplied MEMBER classification places this tooling maintenance outside the external-contributor proof gate; successful exact-head workflow steps support validation, while raw logs were inaccessible.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Contributors need maintained formatting, linting, and Node setup tools that continue to pass repository checks.
Reason: This focused refresh follows established dependency maintenance and resolves the README ordering required by the formatter update.

Merge readiness

✅ Ready for maintainer review

Keep open: this PR consolidates useful dependency maintenance absent from current main, addresses the formatter compatibility change, and has passing checks with no actionable findings.

Priority: P3
Reviewed head: d7adb84c3ef0f1f10eec1dd040487b644567e067

Before merge

None.

Findings

None.

Agent review details

How this fits together

Development dependencies and GitHub Actions prepare Node and pnpm, validate repository source, and support protected tag-driven npm releases.

flowchart TD
  A[Repository source] --> B[Node and pnpm setup]
  C[Dependency lockfile] --> B
  B --> D[Formatter and linter]
  B --> E[Package and browser checks]
  D --> F[Validation results]
  E --> F
  F --> G[Protected tag release]

Loading

Technical review

Best possible solution:

Land the focused dependency refresh with its README compatibility adjustment and existing maintenance boundaries.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance; the formatter incompatibility is described in the body and the adjusted head passes repository checks, but no local reproduction was run.

Is this the best way to solve the issue?

Updating the existing dependencies and action pins, with the small formatting adjustment, preserves the established tooling ownership without adding parallel paths.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against fc0f56595507.

Provenance checked

• Formatter and linter versions keeps the original intent (be91947: Refresh development tooling while preserving runtime support, the Ghostty pin, pnpm, and the dependency cooldown.)
• CI and release Node setup pins keeps the original intent (0f3f616: Refresh the toolchain and align the setup-node version across validation and release workflows.)
• README import example keeps the original intent (c8ff7e3: Demonstrate the public protocol and stream subpath imports.)

Testing

Proof path: none.

Security

None.

Evidence

What I checked:

• Pinned introduced change: The introduced diff updates three setup-node pins, two development tools and their platform bindings, one README import order, and an Unreleased changelog entry; it changes no runtime source or tests. (package.json:97, d7adb84c3ef0)
• Current-main necessity: The default branch remains at the pinned base, which uses oxfmt 0.71.0, locked oxlint 1.86.0, and setup-node 7.0.0. (package.json:97, fc0f56595507)
• Exact-head validation: All 13 reported checks now succeed, including the seven Node matrix jobs, browser smoke, workflow lint, and CodeQL; the inspected Linux job also records successful setup, installation, Check, and coverage steps. (.github/workflows/ci.yml:59, d7adb84c3ef0)
• Executed dependency provenance: The target workflows directly execute this dependency; the official v7.1.0 tag resolves to the proposed immutable SHA, and the upstream comparison retains the node24 action runtime and existing inputs. (action.yml, 949feb2413d6)
• Established maintenance direction: The prior merged tooling refresh preserves the same cooldown, runtime pin, and Node support boundaries; the current PR follows that direction and retains pnpm 11.28.0. (package.json:97, be919476ad42)
• Related contribution credit: This PR explicitly consolidates Dependabot's formatter/linter update at build(deps-dev): bump the development group with 2 updates #101 and action update at build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the actions group #102, while retaining contribution credit. (CHANGELOG.md:9, d7adb84c3ef0)

Likely related people:

• Vincent Koc: Raw commit c8ff7e3 adds package.json:72 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: c8ff7e3cc762; files: package.json)

Root-cause cluster

Relationship: canonical
Canonical: #103
Summary: This PR explicitly consolidates the two open dependency updates and adds the formatter compatibility adjustment.

Members:

• superseded: build(deps-dev): bump the development group with 2 updates #101 - Its formatter and linter updates are included in this consolidation.
• superseded: build(deps): bump actions/setup-node from 7.0.0 to 7.1.0 in the actions group #102 - Its three setup-node pin updates are included in this consolidation.

Proposal only: this assessment does not dispatch repair, suppress jobs, mutate sibling items, close, or merge anything.

Labels

Label changes:

• add P3: Routine development-tool and workflow dependency maintenance with no demonstrated urgent runtime failure.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine development-tool and workflow dependency maintenance with no demonstrated urgent runtime failure.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🐚 platinum hermit and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only; repair and merge need explicit maintainer commands such as @clawsweeper autofix or @clawsweeper automerge.

Reviewed October 10, 2026, 3:23 AM ET / 07:23 UTC.