chore(deps): update build and runtime dependencies

[drewstone]

Changes

• update Ax, Hono, Zod, OpenAPI, Biome, Node types, lint-staged, and Vitest
• force patched Vite, esbuild, PostCSS, and ws transitive releases
• declare Node types explicitly for the current compiler
• release npm and PyPI packages as 0.126.7

TypeScript 7 was tested but is not included because tsup's declaration dependency does not support it.

Verification

• pnpm install --frozen-lockfile
• pnpm lint
• pnpm typecheck
• pnpm typecheck:examples
• pnpm test (3,395 passed, 3 skipped)
• pnpm build
• pnpm verify:package
• uv lock --check
• pnpm audit --audit-level=low (0 known vulnerabilities)

[tangletools]

✅ Auto-approved drewstone PR — a79b0b38

This PR was opened by the trusted drewstone account.
The full PR reviewer audit still runs separately and will publish findings if it detects issues.

_{tangletools · auto-approval · reason: drewstone_author · 2026-07-24T23:53:47Z}

[tangletools]

🟢 Value Audit — sound

Verdict	sound
Concerns	0 (none)
Heuristic	0.0s
Duplication	0.0s
Interrogation	66.7s (2 bridge agents)
Total	66.7s

💰 Value — sound

A coherent dependency refresh — bumps runtime/build deps to current compatible releases, forces patched transitive versions to reach 0 known vulnerabilities, and declares Node types explicitly; ships in the grain of the existing pnpm overrides pattern.

• What it does: Bumps zod (4.3.6→4.4.3), hono/node-server patches, @ax-llm/ax (23.0.1→23.0.5), @asteasolutions/zod-to-openapi (8.5→9.1), biome (2.4.15→2.5.5), vitest (3.0→4.1.10, major), typescript (5.7→5.9.3), @types/node (25→26), lint-staged, openapi3-ts. Adds pnpm.overrides forcing patched esbuild (^0.28.1), vite (^7.3.5), and postcss (^8.5.18) to clear CVEs, and adds minimumReleaseAgeExclude for esbuild/vite
• Goals it achieves: (1) Reach zero known npm vulnerabilities by forcing patched transitive deps (esbuild/vite/postcss/ws). (2) Stay on current compatible releases of direct deps so the substrate doesn't rot against upstream API changes (notably zod-to-openapi 8→9 and vitest 3→4). (3) Make Node type resolution explicit and deterministic instead of auto-globbing all @types/* packages — faster tsc, fewer accidental glob
• Assessment: Good change on its merits. The pnpm minimumReleaseAge (4320 min) + overrides pattern was already established in the prior package.json (postcss, ws overrides existed); this extends it coherently to clear the remaining CVEs. The minimumReleaseAgeExclude for esbuild/vite is the correct, scoped escape hatch: the overrides force specific patched versions that are necessarily too new to pass the age ga
• Better / existing approach: none — this is the right approach. Searched for an existing dep-management script/automation (scripts/, .github/workflows) that might already handle version bumps or overrides; found scripts/verify-package-exports.mjs and scripts/check-skill.mjs but no dep-refresh tooling to extend. The manual overrides + minimumReleaseAge pattern is the established mechanism here and there's nothing to reuse inst
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 2
• Bridge warning: opencode/kimi-for-coding/k2p7: bridge stream ended without value-audit content

🎯 Usefulness — sound

Routine, coherent dependency maintenance: bumps build/runtime deps, forces patched transitive releases via the existing pnpm-overrides pattern, and ships a consistent 0.126.7 across npm and PyPI.

• Integration: Everything wires into the existing pipeline — tsup (build), vitest 4 (test), biome 2.5 (lint), tsc (typecheck). Version 0.126.7 is consistent across package.json:3, pyproject.toml:7, uv.lock, and the init.py fallback (no stale 0.126.6 outside CHANGELOG history). The one non-dep code change — types: ["node"] in tsconfig.json:7 — is actively load-bearing: src has 84 node: imports (locked-jso
• Fit with existing patterns: Follows established grain. The pnpm.overrides block extends the pre-existing pattern (postcss, ws were already pinned) by adding esbuild/vite range-forced patches; minimumReleaseAgeExclude is the correct paired mechanism to let the forced versions through the 4320-min release-age gate. Caret ranges and dev/runtime split match the existing structure. The test-file reformatting is mechanical Biome 2
• Real-world viability: The two major bumps (vitest 3->4, @types/node 25->26) are the real risk, but both resolve cleanly in the lockfile and the PR reports 3,395 passing + clean typecheck/build/audit. The forced transitive overrides target known-vulnerable ranges (postcss<8.5.18, ws<8.21.0, esbuild 0.27.3-0.28.1, vite<=7.3.4) with lower bounds, so they pin without drifting unbounded. No error-path or concurrency surface
• Model: opencode/zai-coding-plan/glm-5.2
• Bridge attempts: 1

No concerns — sound change, no better or existing approach found. ✅

---

What this audit checks

It judges the change on its merits — not whether it was tasked out in an issue. Unticketed, fast-moving work is fine; the question is whether the change is good and whether a better or existing approach should be used instead.

Pass	What it asks
Heuristic	Vague title? Whitespace-only or cruft-bearing diff? (content signals only)
Duplication	Do added function/class names already exist elsewhere in the repo?
Value Audit	What does it do? What goal does it achieve? Is it good? Better architecture or already-exists?
Usefulness Audit	Does it integrate and fit? Will it hold up in real use and actually get used?

Findings are concerns, not blocks — the human reviewer decides what to do with them.

_{value-audit · 20260724T235729Z}

[tangletools]

✅ No Blockers — a79b0b38

Review health 100/100 · Reviewer score 82/100 · Confidence 95/100 · 2 findings (1 medium, 1 low)

glm: Correctness 82 · Security 82 · Testing 82 · Architecture 82

Reviewer score is advisory once the run is complete and the verdict has no blockers.

Full multi-shot audit completed 8/8 planned shots over 14 changed files. Global verifier still owns final merge decision.

🟠 MEDIUM vitest major bump 3.2.4 → 4.1.10 introduces breaking changes — pnpm-lock.yaml

vitest 4.x is a major release with breaking API changes (chai 5→6, removed vite-node dependency, new peer requirement vite ^7.3.5, @opentelemetry/api peer dep added, std-env 3→4, tinyexec 0.3→1.2, tinyrainbow 2→3). The lockfile correctly resolves all transitive deps, but test suite compatibility with vitest 4.x is not verifiable from the lockfile alone. The global verifier must confirm pnpm test passes with vitest 4.1.10 before merge.

🟡 LOW @asteasolutions/zod-to-openapi major bump 8.5.0 → 9.1.0 — pnpm-lock.yaml

Major version bump for the OpenAPI generation library. zod peer dep is satisfied (^4.0.0). Lockfile is consistent, but the API surface may have changed between v8 and v9. Source files using this library should be reviewed in other shots.

---

_{tangletools · 2026-07-25T00:03:29Z · trace}

[tangletools]

✅ Approved — 2 non-blocking findings — a79b0b38

Full multi-shot audit completed 8/8 planned shots over 14 changed files. Global verifier still owns final merge decision.

Full immutable report for this review: trace

Summary comment for this run: full summary

---

_{tangletools · 2026-07-25T00:03:29Z · immutable trace}