chore(deps): refresh Zod, Lucide, and transitive dependencies

[steipete]

Refresh Birdclaw's dependencies while preserving its verified Bun canary and Node 26 runtime contract. Lucide's check-circle icon used for completed/replied states has a slightly larger checkmark; the changelog records that visible change.

Dependency changes

• lucide-react: 1.34.0 → 1.37.0.
• zod: 4.4.3 → 4.5.4, shared by the app, MCP SDK, and TanStack tooling.
• Regenerate bun.lock with the pinned Bun package manager to refresh compatible transitive dependencies, including CSS parsing, source maps, browser compatibility data, EventSource parsing, Express rate limiting, JOSE, query-string parsing, and Seroval.
• Every direct dependency, development dependency, and override was checked against the npm registry. No direct major upgrade was available or skipped. No direct dependency was added or removed.
• All seven GitHub Actions are already pinned to their latest release commits: checkout 7.0.1, cache 6.1.0, setup-node 7.0.0, upload-artifact 7.0.1, configure-pages 6.0.0, upload-pages-artifact 5.0.0, and deploy-pages 5.0.0.

Upstream notes: Zod 4.5, Zod 4.5.4, Lucide 1.37.0.

Visual proof

Actual CheckCircle2 exports from Lucide 1.34.0 and 1.37.0 rendered through React, shown at 20px and enlarged. Captured in Chrome; the complete image contains only synthetic comparison content.

CI reasoning

The base commit is already green: build/test CI and Pages deployment. CI tests Bun/Istanbul, Node/V8, installed packages under both runtimes, and Chromium against the production server. Pages is documentation deployment; Update Homebrew Tap is a release/manual operation, not a build/test gate. There are no scheduled monitoring workflows in this repository. No workflow, assertion, timeout, or coverage threshold is relaxed.

All four jobs in PR CI passed on commit cf888e0ebd32c476edef42e6a07eb5dcaa360740: Bun coverage/build/runtime smoke, Node coverage/build, dual-runtime installed-package smoke, and Chromium E2E. No hosted CI retries were needed.

The exact Bun 1.4.0-canary.1+f972c287f remains the repository's explicitly qualified source runtime. Node 26.5.1 remains the minimum compatibility lane. Changing these contracts is outside this dependency refresh.

Review

Codex autoreview: scoped-clean at the requested default P0 blocking threshold, with no accepted/actionable findings.

Live proof

The built CLI and production server used an isolated directory seeded solely from Birdclaw's bundled demo data:

export BIRDCLAW_HOME="$PWD/.toolchains/deps-refresh/demo"
export BIRDCLAW_BACKUP_AUTO_SYNC=0
export BIRDCLAW_DISABLE_LIVE_WRITES=1
export BIRDCLAW_DISABLE_LIVE_PROFILE_LOOKUP=1
./scripts/bun-canary.sh bin/birdclaw.mjs init --demo --json | jq .demo

{
  "requested": true,
  "seeded": true,
  "counts": {"accounts": 2, "profiles": 6, "tweets": 6, "conversations": 4, "messages": 8}
}

./scripts/bun-canary.sh bin/birdclaw.mjs search tweets 'local-first' --limit 3 --json | jq 'map({id,text})'

[
  {
    "id": "tweet_001",
    "text": "We need more software that defaults to local-first, legible state, and repairable failure modes. https://t.co/local"
  }
]

./scripts/bun-canary.sh bin/birdclaw.mjs serve --host 127.0.0.1 --port 43893
# Birdclaw listening on http://127.0.0.1:43893
curl --fail -sS -o .toolchains/deps-refresh/live-home.html -w 'GET / -> HTTP %{http_code}\n' http://127.0.0.1:43893/
# GET / -> HTTP 200
curl --fail -sS 'http://127.0.0.1:43893/api/query?resource=home&limit=3' | jq '{resource, count: (.items | length)}'
# { "resource": "home", "count": 3 }

Chrome also loaded and hydrated the built production app, then successfully filtered Home to Replied and displayed the expected seeded conversation.

Full local validation

The first SSD-backed attempts hit CLI and backup timeouts while the shared host was waiting heavily on file I/O. Those runs were stopped. Both complete coverage suites subsequently passed with fixtures on a temporary 2 GiB APFS RAM volume, referenced by ram-tmp below. For example, the unchanged backup export/import/validation test went from a 20-second timeout to 359 ms. Test assertions, hook/test timeouts, and coverage thresholds were not changed.

TMPDIR="$PWD/.toolchains/deps-refresh/ram-tmp" BIRDCLAW_BACKUP_AUTO_SYNC=0 BIRDCLAW_DISABLE_LIVE_WRITES=1 fnm exec --using 26.5.1 -- ./scripts/bun-canary.sh run coverage:node --maxWorkers=2 --reporter=verbose

Test Files  149 passed (149)
     Tests  1467 passed (1467)
  Duration  151.54s
Statements   : 89.21% ( 15623/17511 )
Branches     : 80.81% ( 11526/14262 )
Functions    : 90.32% ( 3901/4319 )
Lines        : 90.82% ( 14816/16313 )

TMPDIR="$PWD/.toolchains/deps-refresh/ram-tmp" BIRDCLAW_BACKUP_AUTO_SYNC=0 BIRDCLAW_DISABLE_LIVE_WRITES=1 ./scripts/bun-canary.sh run --bun coverage --maxWorkers=2 --reporter=verbose --coverage.reportsDirectory=.toolchains/deps-refresh/ram-tmp/coverage-bun

Test Files  149 passed (149)
     Tests  1467 passed (1467)
  Duration  156.01s
Statements   : 89.11% ( 15586/17489 )
Branches     : 79.7% ( 11382/14280 )
Functions    : 90.31% ( 3906/4325 )
Lines        : 90.71% ( 14787/16301 )

Also passed:

./scripts/bun-canary.sh install --frozen-lockfile
./scripts/bun-canary.sh scripts/verify-bun-canary.mjs
./scripts/bun-canary.sh pm untrusted
./scripts/bun-canary.sh run --bun check
./scripts/bun-canary.sh run --bun build
fnm exec --using 26.5.1 -- ./scripts/bun-canary.sh run build:node

The clean frozen install succeeded, exact Bun checksum/revision verification passed, no untrusted lifecycle scripts were found, and format/lint/type checks and both complete web/server/CLI builds passed. An initial incremental install retained stale nested Zod copies; regenerating the lockfile and performing the clean frozen install removed the resulting MCP schema type mismatch without application-code changes.

TMPDIR="$PWD/.toolchains/deps-refresh/ram-tmp" fnm exec --using 26.5.1 -- ./scripts/bun-canary.sh scripts/package-smoke.mjs --json

Real output excerpt:

"ok": true,
"files": 100,
"nodeVersion": "v26.5.1",
"bunRevision": "1.4.0-canary.1+f972c287f"

The installed-package smoke validates matching npm/Bun file inventories, CLI, SQLite, SSR/static assets, read-only MCP, and shutdown under both runtimes.

TMPDIR="$PWD/.toolchains/deps-refresh/ram-tmp" BIRDCLAW_PLAYWRIGHT_PORT=43895 ./scripts/bun-canary.sh ./node_modules/@playwright/test/cli.js test

Running 12 tests using 1 worker
12 passed (15.0s)

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: needs maintainer review before merge. Reviewed August 31, 2026, 3:26 AM ET / 07:26 UTC.

ClawSweeper review

What this changes

Updates Zod and Lucide, regenerates Bun’s locked transitive dependency resolutions, and records the visible check-circle icon refinement in the changelog.

Merge readiness

⚠️ Ready for maintainer review - 2 items remain

This owner-authored dependency refresh is cleanly scoped and has no actionable introduced defect; it remains open for explicit maintainer merge judgment.

Priority: P3
Reviewed head: cf888e0ebd32c476edef42e6a07eb5dcaa360740
Owner decision: Required. See Decision needed.

Review scores

Measure	Result	What it means
Overall readiness	🦞 diamond lobster (5/6)	A tightly scoped dependency refresh with complete recorded compatibility coverage and no identified patch defect.
Proof confidence	🌊 off-meta tidepool	Not applicable: Real-behavior proof is not a gate for this owner-authored PR; the reviewed PR snapshot nevertheless supplies exact-head CLI, server, package-smoke, dual-runtime, and Chromium after-update traces.
Patch quality	🦞 diamond lobster (5/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: Real-behavior proof is not a gate for this owner-authored PR; the reviewed PR snapshot nevertheless supplies exact-head CLI, server, package-smoke, dual-runtime, and Chromium after-update traces.
Evidence reviewed	5 items	Direct dependency update: The manifest changes only lucide-react to ^1.37.0 and zod to ^4.5.4; no application source or runtime contract is changed. Affected runtime consumers: Current UI routes import and render CheckCircle2 for completed results, while the repository uses Zod schemas across API and streaming contracts. Bun compatibility context: The repository documents that its exact Bun canary requires Zod to be inlined by Vitest, making the declared Zod update relevant to the dual-runtime validation described in the PR.
Findings	None	None.
Security	None	None.

How this fits together

Birdclaw uses its package manifest and Bun lockfile to produce the CLI, MCP server, and web application. Zod validates data contracts while Lucide supplies UI icons used by completed and replied states.

flowchart LR
A[Declared dependency versions] --> B[Bun lockfile resolution]
B --> C[Birdclaw build and runtime]
C --> D[CLI and MCP server]
C --> E[Web application views]

Loading

Decision needed

Question	Recommendation
Should this owner-authored dependency refresh be merged after the normal maintainer confirmation?	Approve the refresh: Merge the two direct dependency upgrades and regenerated lockfile as reviewed.

Why: The repository policy and author association require explicit maintainer handling even though the scoped diff and recorded validation show no concrete blocker.

Before merge

• Complete next step (P2) - The patch has no mechanical repair to dispatch; explicit maintainer merge judgment is required for this owner-authored PR.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Change surface	3 files; 38 additions, 33 deletions	The branch is limited to two declared dependency versions, their Bun resolutions, and one changelog entry.
Production source changes	0 production source files	Runtime behavior is exercised through existing consumers rather than altered application logic.

Technical review

Best possible solution:

Merge the coupled manifest and lockfile refresh after normal maintainer confirmation while retaining the established Bun and Node compatibility lanes.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a dependency maintenance PR rather than a reported product failure; the reviewed snapshot includes targeted runtime validation instead.

Is this the best way to solve the issue?

Yes: updating the declared versions and regenerated lockfile together is the narrow maintainable path, and the recorded dual-runtime and browser validation covers the affected execution surfaces.

AGENTS.md: not found in the target repository.

Codex review notes: model internal, reasoning high; reviewed against c184cf5f1b5e.

Labels

Label justifications:

• P3: This is a low-risk maintenance refresh with no user-facing defect or introduced correctness finding.
• rating: 🦞 diamond lobster: Overall readiness is 🦞 diamond lobster; proof is 🌊 off-meta tidepool and patch quality is 🦞 diamond lobster.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: Real-behavior proof is not a gate for this owner-authored PR; the reviewed PR snapshot nevertheless supplies exact-head CLI, server, package-smoke, dual-runtime, and Chromium after-update traces.

Evidence

What I checked:

• Direct dependency update: The manifest changes only lucide-react to ^1.37.0 and zod to ^4.5.4; no application source or runtime contract is changed. (package.json:66, cf888e0ebd32)
• Affected runtime consumers: Current UI routes import and render CheckCircle2 for completed results, while the repository uses Zod schemas across API and streaming contracts. (src/routes/today.tsx:485, cf888e0ebd32)
• Bun compatibility context: The repository documents that its exact Bun canary requires Zod to be inlined by Vitest, making the declared Zod update relevant to the dual-runtime validation described in the PR. (docs/bun-canary.md:48, cf888e0ebd32)
• Area history: Recent merged main history includes the same author’s dependency/runtime refresh commit, establishing a current-main ownership trail for this package surface. (package.json:66, c184cf5f1b5e)
• Validation evidence: The reviewed PR snapshot reports successful Bun, Node 26, installed-package, and Chromium checks for the exact head; GitHub context also records all five check runs as successful. (cf888e0ebd32)

Likely related people:

• steipete: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (1 earlier review cycle)

• reviewed 2026-08-31T07:20:18.992Z sha cf888e0 :: needs maintainer review before merge. :: none

[steipete]

Independent triage verification of cf888e0ebd32c476edef42e6a07eb5dcaa360740, now merged via 1221c3b. The checks below passed.

I read the complete manifest/lockfile/changelog diff and comments. This is a bounded refresh of Zod, Lucide, and compatible transitive resolutions; the runtime pins and application source remain unchanged. The manifest and lockfile agree, and the visible icon change is documented and pictured in the PR.

Independent verification used a fresh archive of this commit, the checksum-pinned Bun runtime, and a clean frozen install on a task-owned RAM volume. All passed:

./scripts/bun-canary.sh install --frozen-lockfile
./scripts/bun-canary.sh run --bun check
./scripts/bun-canary.sh run --bun build

The resulting real CLI and production server used only bundled demo data, with backup sync, live writes, and live profile lookup disabled. Observed output:

Demo initialized: 2 accounts, 6 profiles, 6 tweets, 4 conversations, 8 messages
GET / -> HTTP 200; html_bytes=30318
GET /api/query?resource=home&limit=3 -> HTTP 200; resource=home; count=3
Built CLI search local-first --limit 3 --json -> exit 0; 1 result; tweet_001

Codex autoreview returned scoped-clean at the default P0 threshold. I also verified that CI run 33367783167 succeeded on this exact commit across all four jobs, including installed-package and browser smoke. I made no additional code changes and did not perform the merge.