build(deps): refresh Worker and forwarder toolchains

[steipete]

What Problem This Solves

Refresh the bot’s runtime dependencies and build tools to their current releases.

User Impact

PostCSS CLI 12 now requires Node.js 22 or later, matching Wrangler’s existing minimum. CI continues using Node.js 24 and updates Bun to 1.4.2. The repository’s Node minimum, bot package version and deployment process are unchanged.

Why This Change Was Made

Update React, React Router, Drizzle, Wrangler, PostCSS and their types, regenerate both Bun lockfiles, and update the forwarder’s Bun types. All updates are patch/minor except PostCSS CLI 12. Its migration is small for this repository: the existing JavaScript configuration needs neither the removed implicit YAML dependency nor changes to config/watch arguments. The existing Node minimum is documented in the README; no new runtime requirement is introduced.

The existing GitHub Actions SHA pins and esbuild/ws overrides already match current releases.

Evidence

• Independent Codex review: no actionable P0–P2 findings.
• Bun reports no remaining outdated direct dependencies after the update.
• Frozen installs, both package typechecks, and the Worker dry-run build pass on Linux with Bun 1.4.2, Node.js 24.18.1, Wrangler 4.136.3, ImageMagick 7 and WebP tools. Worker runtime declarations were regenerated with this Wrangler version and retained verbatim.
• Full test output from that run:

367 pass
0 fail
185369 expect() calls
Ran 367 tests across 39 files. [190.22s]

Validation commands:

bun install --frozen-lockfile
(cd forwarder && bun install --frozen-lockfile)
bun run typecheck
(cd forwarder && bun run typecheck)
bun run deploy:dry-run
bun run test

The dry-run builds the production Worker without deploying. No production deployment or live Discord/provider interaction was performed. Independent review of the complete diff, including regenerated Worker types, found no actionable P0–P2 issues.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs real behavior proof before merge. Reviewed September 23, 2026, 5:38 AM ET / 09:38 UTC.

ClawSweeper review

What this changes

Updates Worker runtime and build dependencies, forwarder Bun types, CI’s Bun version, generated Cloudflare declarations, and setup documentation.

Merge readiness

⛔ Blocked before merge - 2 items remain

This remains useful dependency maintenance that current main does not contain. No actionable code defect was found, but the updated runtime dependencies still need real Worker behavior proof before merge.

Priority: P3
Reviewed head: d555b4d13dd6be671287513ed594c0c8819ae757

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The patch is focused and supported by passing build/test evidence, but real runtime proof remains incomplete.
Proof confidence	🦪 silver shellfish (2/6)	Needs stronger real behavior proof before merge: Reported Linux installs, typechecks, tests, and Wrangler dry-run validate the build toolchain, but do not show updated React/router rendering and Drizzle D1 access through a running Worker. Redacted runtime output from a local or preview setup is sufficient; production deployment is unnecessary. No stored-data contract changes require migration proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Verification

Check	Result	Evidence
Real behavior	Needs proof	Needs stronger real behavior proof before merge: Reported Linux installs, typechecks, tests, and Wrangler dry-run validate the build toolchain, but do not show updated React/router rendering and Drizzle D1 access through a running Worker. Redacted runtime output from a local or preview setup is sufficient; production deployment is unnecessary. No stored-data contract changes require migration proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
Evidence reviewed	8 items	Introduced changes: The pinned base-to-head delta changes seven files and contains no application-source, SQL migration, authorization, deployment-script, or workflow-permission edits. The verified test merge has the pinned main and head parents and preserves the same scope. Current main still uses previous versions: Current main retains React 19.2.8, React Router 8.3.1, Drizzle ORM 0.45.2, PostCSS CLI 11.0.1, and Wrangler 4.127.1. GitHub confirmed main remains e5bc0b0; the open-PR listing supplied no competing dependency refresh, and the release listing and local tags were empty. PostCSS minimum runtime: Published npm metadata for postcss-cli 12.0.0 declares Node >=22 and identifies postcss/postcss-cli as its repository: https://registry.npmjs.org/postcss-cli/12.0.0. Hermit's package.json directly executes this CLI for Forms styles; its configuration is JavaScript rather than YAML.
Findings	None	None.
Security	None	None.

How this fits together

Hermit runs Discord handlers and server-rendered Forms pages on Cloudflare Workers, with Drizzle accessing D1 storage. Bun and PostCSS prepare the application, while a separate Bun forwarder sends Discord gateway events to the Worker.

flowchart LR
  A[Dependency lockfiles] --> B[Bun and PostCSS build]
  B --> C[Cloudflare Worker]
  D[Forms requests] --> C
  E[Discord gateway forwarder] --> C
  C --> F[D1 database]
  C --> G[Forms pages and Discord responses]

Loading

Before merge

• Add real behavior proof - Needs stronger real behavior proof before merge: Reported Linux installs, typechecks, tests, and Wrangler dry-run validate the build toolchain, but do not show updated React/router rendering and Drizzle D1 access through a running Worker. Redacted runtime output from a local or preview setup is sufficient; production deployment is unnecessary. No stored-data contract changes require migration proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.
• Complete next step (P2) - Add after-update runtime evidence from a local or preview Worker showing Forms rendering and representative D1 access. Screenshots or recordings can show visible results; include terminal output or logs for runtime behavior. Redact credentials, IP addresses, private endpoints, and personal data. Updating the PR body should trigger re-review; otherwise ask a maintainer to comment @clawsweeper re-review.

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Generated declaration growth	Generated types +486/-16; application implementation +0/-0; tests +0/-0	The apparent code growth comes from Wrangler-generated declarations, consistent with the stated toolchain refresh.

Technical review

Best possible solution:

Retain the focused dependency refresh and establish that Forms rendering and D1 access still work through the real Worker entrypoint before normal Cloudflare Builds deployment.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is dependency maintenance rather than a reported behavioral defect, and inspection found no concrete introduced failure.

Is this the best way to solve the issue?

Yes: updating the existing manifests, lockfiles, CI version, and generated types is a focused approach; runtime validation remains incomplete.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against e5bc0b0bb5d4.

Labels

Label changes:

• add P3: Routine dependency and build-tool maintenance with no demonstrated urgent user-facing failure.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• add status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Reported Linux installs, typechecks, tests, and Wrangler dry-run validate the build toolchain, but do not show updated React/router rendering and Drizzle D1 access through a running Worker. Redacted runtime output from a local or preview setup is sufficient; production deployment is unnecessary. No stored-data contract changes require migration proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Label justifications:

• P3: Routine dependency and build-tool maintenance with no demonstrated urgent user-facing failure.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦪 silver shellfish and patch quality is 🐚 platinum hermit.
• status: 📣 needs proof: The PR needs real behavior proof before ClawSweeper can clear the contributor ask. Needs stronger real behavior proof before merge: Reported Linux installs, typechecks, tests, and Wrangler dry-run validate the build toolchain, but do not show updated React/router rendering and Drizzle D1 access through a running Worker. Redacted runtime output from a local or preview setup is sufficient; production deployment is unnecessary. No stored-data contract changes require migration proof. After adding proof, update the PR body; ClawSweeper should re-review automatically. If it does not, the PR author or someone with repository write access can comment @clawsweeper re-review.

Evidence

What I checked:

• Introduced changes: The pinned base-to-head delta changes seven files and contains no application-source, SQL migration, authorization, deployment-script, or workflow-permission edits. The verified test merge has the pinned main and head parents and preserves the same scope. (package.json:24, d555b4d13dd6)
• Current main still uses previous versions: Current main retains React 19.2.8, React Router 8.3.1, Drizzle ORM 0.45.2, PostCSS CLI 11.0.1, and Wrangler 4.127.1. GitHub confirmed main remains e5bc0b0; the open-PR listing supplied no competing dependency refresh, and the release listing and local tags were empty. (package.json:24, e5bc0b0bb5d4)
• PostCSS minimum runtime: Published npm metadata for postcss-cli 12.0.0 declares Node >=22 and identifies postcss/postcss-cli as its repository: https://registry.npmjs.org/postcss-cli/12.0.0. Hermit's package.json directly executes this CLI for Forms styles; its configuration is JavaScript rather than YAML.
• Existing Node requirement verified: Published npm metadata for both Wrangler 4.127.1 and 4.136.3 declares Node >=22.0.0 and identifies cloudflare/workers-sdk as the repository. Thus the PostCSS update does not raise Hermit's existing toolchain minimum. Sources: https://registry.npmjs.org/wrangler/4.127.1 and https://registry.npmjs.org/wrangler/4.136.3.
• Generated declarations and storage boundary: The regenerated file changes Cloudflare runtime declarations while retaining the same D1/R2 bindings and compatibility date. No stored schema or serialized-data contract changes were identified. (worker-configuration.d.ts:3, d555b4d13dd6)
• Validation coverage and remaining proof gap: The complete supplied body reports frozen installs, both typechecks, a Worker dry-run build, and 367 passing tests on Linux with Bun 1.4.2 and Node 24.18.1. It explicitly reports no deployment or live Discord/provider interaction. This supports build compatibility but supplies no observed Worker request exercising the updated React/router rendering and Drizzle D1 path. Snapshot identity: sourceRevision 9ead08241dbc33f37e1ed0aa4d5f98f77f55a2ed8000fcf1cd78278edb5cfac7. No tests or builds were executed during this read-only review. (d555b4d13dd6)

Likely related people:

• Peter Steinberger: Raw commit 72b5de1 adds .github/workflows/ci.yml:35 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 72b5de12bb9d; files: .github/workflows/ci.yml)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Provide redacted after-update Worker request/response evidence covering Forms rendering and representative D1 access.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.