chore(deps-dev): bump @typescript/native-preview from 7.0.0-dev.20260526.1 to 7.0.0-dev.20260527.1

[dependabot]

Bumps @typescript/native-preview from 7.0.0-dev.20260526.1 to 7.0.0-dev.20260527.1.

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed May 29, 2026, 12:38 PM ET / 16:38 UTC.

Summary
This PR bumps the direct devDependency @typescript/native-preview and the pnpm lockfile from 7.0.0-dev.20260526.1 to 7.0.0-dev.20260527.1.

Reproducibility: not applicable. this is a dependency bump PR, not a bug report. The relevant verification is build, typecheck, test, and mutation CI against the updated toolchain.

Review metrics: 2 noteworthy metrics.

• Changed files: 2 modified, 39 added, 39 removed. The diff is limited to package.json and pnpm-lock.yaml, which keeps the review surface narrow.
• CI state: 10 completed, 1 in progress. Most checks had completed successfully, but Mutation had not finished when reviewed.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

• [P2] Wait for the Mutation check to complete successfully before merge.

Risk before merge

• [P1] Mutation was still in progress at review time, so merge should wait for the full CI result on the exact PR head.

Maintainer options:

1. Decide the mitigation before merge
   Leave the branch open for normal dependency-update handling and merge only after the full package/build/test check set completes successfully.
2. Pause or close
   Do not merge this PR until maintainers decide whether the risk is worth taking.

Next step before merge

• No ClawSweeper repair is needed; the branch is a clean dependency-only update that should be handled by normal package owner review once CI completes.

Security
Cleared: The dedicated security pass found no unrelated workflow, secret, publishing, script, or package-source change beyond the pinned devDependency and lockfile update.

Review details

Best possible solution:

Leave the branch open for normal dependency-update handling and merge only after the full package/build/test check set completes successfully.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency bump PR, not a bug report. The relevant verification is build, typecheck, test, and mutation CI against the updated toolchain.

Is this the best way to solve the issue?

Yes; updating package.json and pnpm-lock.yaml is the narrow supported path for this Dependabot devDependency bump, and the diff does not duplicate existing behavior.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against f6de6dd18aae.

Label changes

Label changes:

• add P3: This is a low-risk devDependency maintenance update with no reported user-facing regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, so the contributor real behavior proof gate does not apply.

Label justifications:

• P3: This is a low-risk devDependency maintenance update with no reported user-facing regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot bot PR, so the contributor real behavior proof gate does not apply.

Evidence reviewed

What I checked:

• Repository policy read: AGENTS.md was read fully; package.json and pnpm-lock.yaml changes are regular repo changes whose validation path is pnpm run check. (AGENTS.md:261, f6de6dd18aae)
• Current main still has previous version: Current main pins @typescript/native-preview to 7.0.0-dev.20260526.1, so the requested bump is not already implemented on main. (package.json:95, f6de6dd18aae)
• Lockfile currently resolves old toolchain: pnpm-lock.yaml resolves @typescript/native-preview and the tsdown peer resolution to 7.0.0-dev.20260526.1 on current main. (pnpm-lock.yaml:48, f6de6dd18aae)
• PR diff is dependency-only: The PR diff changes package.json plus pnpm-lock.yaml and updates only @typescript/native-preview package, platform optional packages, and dependent lockfile snapshots. (package.json:95, d8abbab87525)
• CI status inspected: GitHub checks showed Lint, Typecheck, Build, Slophammer, Conformance Smoke, Test, and Format passed, while Mutation was still in progress at review time. (d8abbab87525)
• Feature history: The current @typescript/native-preview line was last updated by a prior merged Dependabot dependency bump, and the package surface dates back to the initial package/lockfile import. (package.json:95, ba1897fbe1ab)

Likely related people:

• Peter Steinberger: Git history shows the package/lockfile dependency surface and Dependabot configuration coming from the initial package import, with a later manual development dependency refresh in the same area. (role: package surface introducer and recent dependency contributor; confidence: high; commits: 00e4c9452290, bd39a0b20e8a; files: package.json, pnpm-lock.yaml, .github/dependabot.yml)
• Vincent Koc: Git history shows recent security dependency work and the CODEOWNERS change marking package.json and pnpm-lock.yaml as package integrity surfaces. (role: package integrity and security-adjacent owner; confidence: medium; commits: 2a8d7147b14c, e0e1a3c2afde; files: package.json, pnpm-lock.yaml, .github/CODEOWNERS)

What the crustacean ranks mean

• 🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
• 🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
• 🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
• 🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
• 🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
• 🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
• 🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​typescript/​native-preview@​7.0.0-dev.20260527.1

View full report