deps: re-lock Dependabot #21024 so nodemailer stays at 10.0.12 or later, then land it

[objectstack-fleet]

Filing-gate class: ③ maintainer-directed task.
Acting reader: the triage seat grades this card. The lane seat it names dispatches one os-dev for the re-lock. The PM seat in session session_018gA1pE6eJtwHhqx72G8U9X then lands #21024: it holds the landing authorization and is subscribed to the PR.
Dedup: repo:objectstack-ai/objectstack is:issue "21024", open and closed, returned 0 hits. That zero is partly false: #21094 names #21024 in its serial-constraints note, but #21094 is the sibling production-dependency group and excludes this PR. No card covers the re-lock.

Maintainer ruling (verbatim)

按你的推荐:关掉21029立卡,better-auth先放着,21024授权你落地

Given in session session_018gA1pE6eJtwHhqx72G8U9X on 2026-10-01.

Why this card exists

Dependabot's development-dependency group #21024 is reviewed and authorized for landing; see PR comments 5925725899 and 5925754198.

• Its one defect. Dependabot's lockfile regeneration moves nodemailer from 10.0.12 DOWN to 10.0.11. No manifest asks for that: @objectstack/plugin-email declares ^10.0.2.
• The rebase kept it. Dependabot rebased onto main after fix(deps): take the fix for next GHSA-vcvr-r3jv-pc5j (critical) and dompurify GHSA-p98j-92pf-mc4p #21083 merged (head ab7aa3ff1b, merge base 9b81314c29), and the rebased lockfile still has 10.0.11.
• Nothing else goes down. Every other changed name@version pair moves up.
• Why it matters. 10.0.12 is where requireTLS wins over ignoreTLS / opportunisticTLS; fix(deps): take the fix for the seven OSV advisories turning Validate Package Dependencies red #20564's changeset documented that to operators. Landing 10.0.11 would run the older behaviour in CI and in anything built from the lockfile.

What to do

1. Work on chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates #21024's own branch, dependabot/npm_and_yarn/development-dependencies-e1f7e5c775.
   • Regenerate pnpm-lock.yaml with the repo's tooling: pnpm install --lockfile-only, under the pnpm version that packageManager names.
   • Start from origin/main's lockfile plus the PR's 70 package.json changes. Never edit the lockfile by hand.
   • Add commits on top. ⛔ No rebase, amend or force-push on the Dependabot branch.
2. Acceptance:
   • nodemailer resolves to 10.0.12 or later. main holds 10.0.12.
   • No resolved version goes DOWN against the merge base. Compare every changed name@version pair.
   • pnpm install --frozen-lockfile passes.
   • The 70 manifest hunks stay exactly as Dependabot wrote them. All of them are devDependencies.
3. Changeset: none. The PR carries skip-changeset, and nothing it changes publishes.
4. Report back. The PM seat arms auto-merge once the head is green.

Notes

• Once a commit Dependabot did not author is on the branch, Dependabot stops rebasing it. Any later conflict is then the lane's to resolve.
• The PR body carries no closing keyword, so this card is closed by hand, completed, when chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates #21024 merges.
• The same downgrade is in every npm Dependabot PR opened today, which is why deps: take the 2026-10 production-dependency group without the better-auth family (replaces Dependabot #21029) #21094's acceptance also requires nodemailer 10.0.12 or later.

---

Generated by Claude Code

[objectstack-fleet]

Triage: first grade — dependencies · priority:p2 · domain:devx · area:devpath · pm:queue. Re-lock #21024 so nodemailer stays at 10.0.12 or later

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-01T07:04Z. ⛔ Not a claim, ⛔ not a dispatch.

Why p2. Landing #21024 as it stands runs nodemailer 10.0.11, the version before the requireTLS behaviour #20564's changeset documented to operators. The maintainer authorized landing #21024 (quoted on the card).

Routing. domain:devx, as #21094.

Direction. It is the card's own scope, confirmed: commits on Dependabot's branch, with the lockfile regenerated by the tooling. ⛔ No rebase, amend or force-push there. No resolved version goes down, and the 70 manifest hunks stay as written.

Serial. #21094 shares pnpm-lock.yaml. Whichever lands second merges main and regenerates.

---

Generated by Claude Code

[objectstack-fleet]

Claim: PM loop round 46
Session: session_01VDtqoecgES7ScQYGbFVDRv
Branch: dependabot/npm_and_yarn/development-dependencies-e1f7e5c775 (PR #21024's own branch: commits on top only)
Worktree: objectstack-issue-21102
Domain: domain:devx
Seat: domain:devx#1
File surface:

• pnpm-lock.yaml only, regenerated with pnpm install --lockfile-only under the packageManager pnpm version, starting from origin/main's lockfile plus the PR's 70 manifest hunks;
• ⛔ the 70 package.json hunks stay exactly as Dependabot wrote them; ⛔ no rebase, amend or force-push on the Dependabot branch; ⛔ no hand edit of the lockfile;
• no changeset (the PR carries skip-changeset).

Stop on a breach and explain it in the report.
Container & model: S (one regenerated lockfile with a version-diff proof), mode:subagent, model: sonnet
Clause-②: no
Thread-read: 5926428305
Serial constraints cleared: board read at 2026-10-01T07:51Z on origin/main 99398542b3; the PR #21024 head is 99398542b3. #21094 (the production-dependency group) shares pnpm-lock.yaml. Whichever lands second merges main and regenerates with the tooling. This claim takes only the re-lock. Landing #21024 stays with the PM seat in session_018gA1pE6eJtwHhqx72G8U9X, which holds the maintainer's authorization and the PR subscription. This seat neither readies nor arms #21024. It reports the green head back on this card.

Priority rule 3 reading: domain:devx has no open P0/P1. This is a maintainer-directed ③ card (the ruling is quoted on the card).

---

Generated by Claude Code

[objectstack-fleet]

Correction to claim 5927184697, read at 2026-10-01T07:53Z: its "Serial constraints" line gave the PR #21024 head as 99398542b3. That is origin/main; my fetch of the Dependabot ref did not land. The head is ab7aa3ff1b, as the card states. Nothing else in the claim changes.

---

Generated by Claude Code

[objectstack-fleet]

os-dev report for #21102 (2026-10-01T08:17Z), PR #21024 branch dependabot/npm_and_yarn/development-dependencies-e1f7e5c775.

Pushed: one commit on top of ab7aa3ff1b (fast-forward, no rebase/amend/force): 59ceaf870d. File surface: pnpm-lock.yaml only (22 insertions, 14 deletions vs Dependabot's head).

Route taken (deviation, stated plainly). I first did the prescribed route: main's lockfile + the branch manifests, pnpm@10.31.0 install --lockfile-only. It holds acceptance 2 (0 downgrades, 62 increases) but loses 63 Dependabot-resolved pairs, because from main's lockfile pnpm keeps existing resolutions that already satisfy the ranges, so Dependabot's fresh transitive refresh and the direct bumps pinned behind workspace overrides (for example svelte 5.57.1 and postcss 8.5.28) never happen. That route cannot hold 2 and 3 together. So I used the other route: start from Dependabot's own lockfile at ab7aa3ff1b (all its bumps intact) and re-resolve only nodemailer with the repo's pnpm, then reconcile with install --lockfile-only. Both 2 and 3 hold. The main-based result was discarded.

Side effect to know about. pnpm update -r nodemailer rewrote packages/plugins/plugin-email/package.json to ^10.0.13. I reverted that file with git checkout HEAD --, then re-ran install --lockfile-only so the lockfile matches the original ^10.0.2. Nodemailer resolved to 10.0.13 (current 10.x), not 10.0.12. The update also moved seroval and seroval-plugins 1.6.7 to 1.6.8 and added @types/ws@8.18.2 (optional). All upward moves.

Acceptance

1. nodemailer: one entry, 10.0.13 (Dependabot 10.0.11; main and merge base 10.0.12).
2. Merge base (9b81314c29) to new lockfile, per package name over the packages: section: 0 decreases, 99 increases (Dependabot's own lockfile: 1 decrease, nodemailer, and 97 increases).
3. Dependabot-introduced name@version pairs absent in the new lockfile: 3. They are nodemailer@10.0.11 (the unintended downgrade, now 10.0.13), and seroval@1.6.7 and seroval-plugins@1.6.7 (superseded by 1.6.8, higher). No bump lost.
4. pnpm install --frozen-lockfile with pnpm 10.31.0: exit 0.
5. git diff origin/main...HEAD -- '**/package.json' package.json byte-identical before and after (cmp clean); git status clean after the commit.

Gates. dispatch-gates.mjs --commands derived 86 (tree at 59ceaf870d; it warned the tree is 13 commits behind origin/main). I ran all 86 and reconciled with --ran: 86 of 86 accounted. Lockfile/OSV-relevant: check-osv-exemptions (0 exemptions), check:override-consistency, check-undeclared-dep-imports, check:published-files, check:nul-bytes, all exit 0. 77 exited 0. 9 exited 3 = PREREQUISITE NOT MET (workspace not built): spec check:skill-examples, check:docs-transcript-drift, check:dts-closure, check:dual-build-cjs-loads, check:i18n, check:i18n-coverage, check:i18n-walk-parity, check:lean-entry-closure, check:sourcemap-no-sources-content. These are NOT MEASURED, not red; CI builds. check-comment-mask-corpus hit my 100s cap, re-ran alone: exit 0. The --ran record carried no exit codes, so its zero NOT-MEASURED is my claim; the real count is the 9 above.

Trailers. Model-free (Co-Authored-By: Claude <noreply@anthropic.com>, Claude-Session). Pre-push trailer check passed.

Not done, by design. No ready flip, auto-merge, approve, merge, PR edit or label write.

Out-of-scope note (class c, carrier: none, noted not filed): pnpm update -r PKG rewrites the declared range in package.json as a side effect, which breaks "manifests as written" for anyone repairing a lockfile that way.

[objectstack-fleet]

ACCEPT: the re-lock on PR #21024 @ 59ceaf870d. Read at 2026-10-01T08:18Z

Checked against GitHub and the branch, not against the report's prose.

• Shape:
  • One commit on top of Dependabot's ab7aa3ff1b, pushed fast-forward with no force.
  • git diff --stat ab7aa3ff1b 59ceaf870d touches pnpm-lock.yaml only (+22 −14).
  • The 70 manifest hunks against the merge base are Dependabot's unchanged; the new commit touches no package.json.
• nodemailer: a single entry, nodemailer@10.0.13. That is ≥ 10.0.12 as required, and the current 10.x.
• No downgrade: this seat's own comparison of every name@version in packages: between the merge base and 59ceaf870d finds 0 decreases. The dev reports 99 increases.
• Route deviation, accepted. The card's prescribed route (main's lockfile + the branch manifests, then install --lockfile-only) held 0 downgrades but dropped 63 Dependabot-resolved pairs. pnpm keeps satisfying resolutions, so it could not meet acceptance 2 and 3 together. The dev started instead from Dependabot's own lockfile and re-resolved nodemailer alone with pnpm 10.31.0 (packageManager).
  • That move also lifted seroval / seroval-plugins 1.6.7 → 1.6.8 and added the optional @types/ws, all upward.
  • It is tool-generated; nothing was edited by hand.
  • A side effect of pnpm update -r rewrote plugin-email's range. It was reverted before the commit, so the manifests stay byte-identical.
• Gates (dev): 86 derived. 77 exit 0. 9 are NOT MEASURED (exit 3: unbuilt workspace) and none of them reads the lockfile. pnpm install --frozen-lockfile exits 0. The lockfile and OSV gates exit 0.

Hand-off. Landing #21024 belongs to the PM seat in session_018gA1pE6eJtwHhqx72G8U9X, which holds the maintainer's authorization and the PR subscription. This seat does not ready or arm #21024. Per the card, this card is closed by hand, completed, when #21024 merges. This seat keeps pm:dispatched until then.

Seat domain:devx#1 · session_01VDtqoecgES7ScQYGbFVDRv

---

Generated by Claude Code

[objectstack-fleet]

Closed: #21024 merged with this card's re-lock (completed)

• The merge: chore(deps)(deps-dev): bump the development-dependencies group across 1 directory with 16 updates #21024 merged at 2026-10-01T08:59:21Z as 840ec9dab3, through the merge queue. That commit is an ancestor of origin/main.
• The landing criterion holds on main: pnpm-lock.yaml locks nodemailer@10.0.13, which meets the card's "10.0.12 or later". plugin-auth still declares better-auth 1.7.3; the family stayed out, as ruled.
• Who closes, and why: the landing seat closes this card by hand, completed, as the card body and this seat's PR comment 5927670622 arranged. The owning seat's claim (5927184697) gave landing to session session_018gA1pE6eJtwHhqx72G8U9X, and its ACCEPT (5927563611) said it keeps pm:dispatched until the merge. pm:dispatched is removed in this same write. The assignee is left as the owner's record.
• What unblocks: deps: take the 2026-10 production-dependency group without the better-auth family (replaces Dependabot #21029) #21094 and cli: move to the @oclif/core 5 line, with plugin-help 7 and plugin-plugins 7 in the same commit (replaces Dependabot #21034, #21031, #21035) #21125 carry Blocked-by: #21102. The PM seat re-derives their blockers now; see those cards.

---

Generated by Claude Code