chore(deps): refresh stabilized dependencies and repair Node 24 test image

[dependabot]

Refresh the stabilized dependency set and make the CLI test container build against the workspace's declared Node 24 runtime. The previous Dockerfile still used Node 22 and an obsolete pnpm bootstrap, omitted the workspace/core package and local security patch inputs, and removed the root prepare script. It now selects pnpm from package.json, copies the required workspace inputs, and runs the normal frozen install and build.

Retain Dependabot's happy-dom 20.11.12, markdown-it 15.0.1, and mediabunny 1.55.3 updates; add Sharp 0.35.4, protobufjs 7.6.6, and pnpm 11.24.0. All six versions and all 33 newly introduced lockfile package identities satisfy the seven-day stabilization policy. Runtime floors and existing image-size security patches are preserved. Documentation and a runtime/toolchain alignment regression test cover the container setup.

Publication dates were independently read from the npm registry on September 4, 2026:

Package	Version	Published (UTC)
happy-dom	20.11.12	2026-08-27T16:06:52.119Z
markdown-it	15.0.1	2026-08-27T21:01:39.918Z
mediabunny	1.55.3	2026-08-26T11:56:18.166Z
sharp	0.35.4	2026-08-26T09:42:27.903Z
protobufjs	7.6.6	2026-08-27T10:15:37.337Z
pnpm	11.24.0	2026-08-24T14:56:01.051Z

The Chromium run also exposed an existing temporary-profile cleanup race: teardown raised ENOTEMPTY while removing the profile. The harness now uses five bounded filesystem retries with 100ms linear backoff; it still reports a cleanup failure if retries are exhausted.

Validation on Node 24:

• Full pnpm -s check: 3,025 passed / 43 skipped tests; coverage above all required thresholds. Frozen install and CLI/core build passed with pnpm 11.24.0.
• Built CLI and core extracted readable text from real HTTPS example.com. The built CLI exercised the actual Pi AI Anthropic adapter over loopback SSE with a synthetic response; no paid-provider inference is claimed.
• Transformer-resolved native Sharp encoded and decoded an image, protobufjs completed a schema/binary round-trip, and extension-resolved Markdown rendering passed.
• Actual Linux arm64 Docker build and execution passed: Node 24.20.0/pnpm 11.24.0, source and built CLI HTTPS extraction, built core HTTPS extraction, native ffmpeg audio processing, yt-dlp startup, and packaged WASM/patch inputs.
• Exact-head CI run 33858079749 passed on 7f4f5be53b1b0b549be74eb2b6ac3fffca7394b9: Node 24 tests/build/pack, Chromium E2E, and Firefox smoke all succeeded.
• Local full Chromium rerun after the cleanup fix: native stage 3 passed; browser stage 110 passed, 7 skipped, and 2 sidepanel initialization timeouts before assertions. Both cases subsequently passed three isolated runs each with unchanged timeouts. Host load was high, but its causal role is unproven; the full local run is not claimed green.
• Final full-candidate isolated Codex P0–P2 review returned scoped-clean with no actionable findings. The previously failing options test passed three consecutive runs after the cleanup correction; final formatting, lint, and type checks passed.

A fresh pnpm audit request timed out, including one bounded retry. The earlier audit reported two image-size advisories covered by the existing local patch; that is historical evidence, not a new successful audit. The patch and its regression tests remain intact.

Dependabot's original commit is retained, with the remaining changes in a normal maintainer follow-up. This PR is prepared for maintainer review and has not been merged.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

[clawsweeper]

Codex review: blocked before merge. Reviewed September 4, 2026, 5:36 AM ET / 09:36 UTC.

ClawSweeper review

What this changes

The PR updates stabilized dependencies, makes the Docker test image use the workspace’s Node 24 and pnpm setup, and retries transient Chromium-profile cleanup.

Merge readiness

⛔ Blocked before merge - 3 items remain

Keep open: the Node 24 container repair and dependency refresh are otherwise well-supported, but the PR adds a release-note entry contrary to the repository contribution policy.

Priority: P3
Reviewed head: 7f4f5be53b1b0b549be74eb2b6ac3fffca7394b9

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	The technical scope and validation are strong, but the single release-note policy violation prevents merge readiness.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot-authored PR has a maintainer-authored current head, so the external-contributor proof gate does not apply; its body nevertheless documents real Docker/CLI runs and exact-head CI for the changed container path.
Patch quality	🦐 gold shrimp (3/6)	1 actionable review finding remain.

Verification

Check	Result	Evidence
Real behavior	Not applicable	Not applicable: This Dependabot-authored PR has a maintainer-authored current head, so the external-contributor proof gate does not apply; its body nevertheless documents real Docker/CLI runs and exact-head CI for the changed container path.
Evidence reviewed	5 items	Repository contribution policy: The contribution guide says contributors must not edit CHANGELOG.md; maintainers add contributor entries when landing. Introduced policy violation: The PR introduces a release-note line in CHANGELOG.md, which conflicts with the contribution policy. Container repair scope: The introduced Dockerfile moves to Node 24, copies workspace/core inputs and vendored assets before installation, then uses Corepack’s declared pnpm and a frozen install so prepare performs the normal build after sources exist.
Findings	1 actionable finding	[P2] Remove the contributor changelog entry
Security	None	None.

How this fits together

The pnpm workspace builds the core library before the CLI, while Dockerfile.test packages that build together with ffmpeg and yt-dlp for command-line extraction checks. The container consumes the root manifest, lockfile, workspace configuration, core package, and vendored ffmpeg assets.

flowchart LR
  Manifest[Workspace manifest and lockfile] --> Install[Frozen pnpm install]
  Core[Core library sources] --> Build[Core and CLI build]
  Install --> Build
  Build --> Image[Node 24 test image]
  Image --> Extraction[CLI extraction run]

Loading

Before merge

• Remove the contributor changelog entry (P2) - This line conflicts with CONTRIBUTING.md’s instruction that contributors do not edit CHANGELOG.md and maintainers add entries when landing. It was missed in the prior same-head review; remove it to keep the release-note workflow single-sourced.
• Resolve merge risk (P1) - Moving the test image from Node 22 to Node 24 and updating pnpm/native dependencies can vary across untested platforms, though the declared Node floor, supplied Docker run, and exact-head CI cover the intended image path.
• Complete next step (P2) - Remove CHANGELOG.md’s PR release-note entry; maintainers should add the contributor entry when landing.

Findings

• [P2] Remove the contributor changelog entry — CHANGELOG.md:18

Agent review details

Security

None.

Review metrics

Metric	Value	Why it matters
Patch scope	11 files; 195 added, 189 removed	Most churn is the lockfile refresh; the behavioral changes are confined to the test image, one cleanup helper, and one alignment test.

Merge-risk options

Maintainer options:

1. Remove the release-note entry before merge (recommended)
   Remove the contributor changelog line, then retain the validated Node 24, pnpm, and dependency alignment changes.

Copy recommended automerge instruction

@clawsweeper automerge

Special instructions:
Remove the added CHANGELOG.md release-note line; do not alter the dependency, Docker, or test changes.

Technical review

Best possible solution:

Remove the PR-authored changelog line, then land the validated Node 24 workspace-image repair and dependency updates; release maintainers can add the final entry when landing.

Do we have a high-confidence way to reproduce the issue?

Not applicable: this is a maintenance PR, not a report of an end-user defect.

Is this the best way to solve the issue?

No: the changelog edit is not the repository’s intended release-note workflow; removing that one line preserves the narrow technical solution.

Full review comments:

• [P2] Remove the contributor changelog entry — CHANGELOG.md:18
  This line conflicts with CONTRIBUTING.md’s instruction that contributors do not edit CHANGELOG.md and maintainers add entries when landing. It was missed in the prior same-head review; remove it to keep the release-note workflow single-sourced.
  Confidence: 0.99
  Late finding: first raised on code an earlier review cycle already covered.

Overall correctness: patch is incorrect
Overall confidence: 0.99

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning high; reviewed against f3ad717a3f92.

Labels

Label changes:

• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot-authored PR has a maintainer-authored current head, so the external-contributor proof gate does not apply; its body nevertheless documents real Docker/CLI runs and exact-head CI for the changed container path.
• remove rating: 🐚 platinum hermit: Current PR rating is rating: 🦐 gold shrimp, so this older rating label is no longer current.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

• P3: This is a small maintenance and contribution-process correction without an urgent user-facing regression.
• merge-risk: 🚨 compatibility: The PR updates the package manager, native Sharp dependency graph, and Docker runtime, which can change installation or container behavior across platforms.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🌊 off-meta tidepool and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action. Not applicable: This Dependabot-authored PR has a maintainer-authored current head, so the external-contributor proof gate does not apply; its body nevertheless documents real Docker/CLI runs and exact-head CI for the changed container path.

Evidence

Acceptance criteria:

• [P1] pnpm -s check.

What I checked:

• Repository contribution policy: The contribution guide says contributors must not edit CHANGELOG.md; maintainers add contributor entries when landing. (CONTRIBUTING.md:82, 7f4f5be53b1b)
• Introduced policy violation: The PR introduces a release-note line in CHANGELOG.md, which conflicts with the contribution policy. (CHANGELOG.md:18, 7f4f5be53b1b)
• Container repair scope: The introduced Dockerfile moves to Node 24, copies workspace/core inputs and vendored assets before installation, then uses Corepack’s declared pnpm and a frozen install so prepare performs the normal build after sources exist. (Dockerfile.test:11, 7f4f5be53b1b)
• Head provenance: The exact PR head records 531e322 as its raw parent and identifies steipete as its author; the added Dockerfile lines are present in that head delta. (Dockerfile.test:13, 7f4f5be53b1b)
• Validation supplied with the PR: The PR body reports real Node 24 Docker/CLI runs and links exact-head CI run 33858079749, whose supplied check data shows the Node 24, Chromium E2E, and Firefox smoke jobs passed. (7f4f5be53b1b)

Likely related people:

• unknown: Suggested for follow-up; no historical authorship or introduction is verified. (role: unverified routing candidate; confidence: low)

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Remove the CHANGELOG.md entry; a release maintainer should add the contributor note when landing.

Rating scale

Score	Internal tier	Crab rank	Meaning
6/6	S	🦀 challenger crab	Exceptional readiness
5/6	A	🦞 diamond lobster	Very strong readiness
4/6	B	🐚 platinum hermit	Good normal PR; ordinary maintainer review
3/6	C	🦐 gold shrimp	Useful, but confidence is limited
2/6	D	🦪 silver shellfish	Proof or implementation needs work
1/6	F	🧂 unranked krab	Not merge-ready
N/A	NA	🌊 off-meta tidepool	Rating does not apply

Overall follows the weaker of proof and patch quality.
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

Workflow

• ClawSweeper keeps one durable marker-backed review comment per issue or PR.
• Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
• A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
• PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
• Maintainers can also comment @clawsweeper review to request a fresh review only.
• Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
• Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
• Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

History

Review history (2 earlier review cycles)

• reviewed 2026-09-04T09:21:32.493Z sha 531e322 :: blocked before merge. :: none
• reviewed 2026-09-04T09:30:26.830Z sha 7f4f5be :: blocked before merge. :: none