[Dependency Upgrade] OpenChamber 1.13.7→1.13.8 + glab 1.103.0→1.105.0 — auto-merge blocked (no CI)

[tryweb]

Summary

PR #34 bumps two pinned tool versions in the Dockerfile, but the standard CI pipeline did not run on the PR — auto-merge is therefore blocked and this issue tracks the human review.

Bumps

Tool	Old	New	Source	Risk
OpenChamber (npm @openchamber/web)	1.13.7	1.13.8	openchamber/openchamber	Patch, no breaking changes
GitLab CLI (glab)	1.103.0	1.105.0	gitlab-org/cli v1.105.0	Minor with glab orbit --format → --response-format rename

OpenChamber 1.13.8 — release highlights

• Startup hang (~20s) on launch fixed
• When a separate OpenCode is already running, OpenChamber now starts its own server instead of attaching (fixes "could not finish initialization")
• New Follow-up behavior setting (Steer vs Queue) replaces the old queue-mode toggle
• Worktree group deletion now cleans up subagent sessions
• New optional env vars: OPENCODE_HOST, OPENCODE_PORT, OPENCODE_SKIP_START (additive, opt-in)

glab 1.105.0 — release highlights

• ✨ feat(orbit): rename --format flag to --response-format — breaking for any glab orbit --format=... usage (none in this repo)
• 🐛 fix(orbit): handle new nested status response shape
• 🐛 fix: route deprecation warnings to stderr
• 📦 Dep bump: gitlab.com/gitlab-org/api/client-go/v2 to v2.40.1

CI status (blocker)

• Workflow run: #232
• Conclusion: action_required
• Jobs executed: 0 (build, test, scan did not start)
• Branch protection on main: none (so the action_required is not a branch-rule approval gate)
• Previous PR (#33) had 3 active jobs, all green — so the standard pipeline works for human PRs

The PR body claims "Integration tests passed on the updated image" and "No new critical Grype findings", but those come from the bot's own pre-PR validation, not from the project's standard CI gate.

Recommended next steps

1. Decide policy: is this bot's pre-PR validation considered sufficient to skip the standard CI gate? If yes, document that as the project's trust model and merge. If no, force the standard CI to run.
2. Force CI to run (easiest): push a no-op commit, or close + reopen the PR. The ci.yml trigger (pull_request: branches: [main]) should then start a fresh run with the build/test/scan jobs.
3. Re-evaluate glab 1.105.0 after CI passes — the orbit flag rename is a minor break in semver terms but does not affect this repo's Dockerfile (no glab orbit --format calls).

Files in the PR

• Dockerfile — 2 lines
• README.md — 1 line
• docs/CHANGELOG.md — adds [1.1.7] entry
• test-output.txt — version sync

References

• PR: chore: update Dockerfile pinned versions #34
• OpenChamber 1.13.8 release: https://github.com/openchamber/openchamber/releases/tag/v1.13.8
• glab 1.105.0 release: https://gitlab.com/gitlab-org/cli/-/releases/v1.105.0
• PR comment: chore: update Dockerfile pinned versions #34 (comment)
• CI run (anomaly): https://github.com/tryweb/ai-engkit/actions/runs/28344334001