deps: bump toolchain, RTK v0.44.2, caveman v1.9.1 - #14
Merged
Conversation
claude-code 2.1.183->2.1.220, claude-agent-acp 0.48.0->0.64.2,
openspec 1.4.1->1.7.0, codegraph 1.0.1->1.5.0,
server-sequential-thinking 2025.12.18->2026.7.4, pnpm 11.8.0->11.18.0,
prettier 3.8.4->3.9.6, eslint 10.5.0->10.8.0.
RTK v0.42.4->v0.44.2 (both per-arch sha256 recomputed and matched against
the release checksums.txt); caveman plugin tag v1.9.0->v1.9.1.
git-delta 0.19.2 is already the latest release - unchanged.
typescript stays pinned at 6.0.3 on purpose. The `latest` dist-tag is now
7.0.2, the native (Go) compiler rewrite, whose npm package no longer exposes
the full JS compiler API: under it ts-node 10.9.2 dies on every invocation
("Cannot read properties of undefined (reading 'fileExists')" - ts.sys is
undefined), while tsc itself still compiles and type-checks. Verified by
building the image with 7.0.2 and running both tools.
The existing `ts-node --version` build gate did NOT catch that - it prints a
constant without loading the compiler, so a broken ts-node shipped green.
Added a gate line that actually transpiles and runs a typed snippet.
`--compiler-options module=commonjs` is required because, with no tsconfig in
scope, the `-e` REPL emits an ESM `export {}` its own vm.Script cannot parse.
Checked in a clean node:22: the new gate passes on 6.0.3 (and still rejects a
type error) and fails on 7.0.2, while the old gate passes on both.
npm audit after the lockfile regen: 8 vulnerabilities (1 low, 2 moderate,
5 high) -> 2 high, both `fix: false` - perplexity-mcp 0.2.3 (the latest
published version) pins an outdated @modelcontextprotocol/sdk. Same residual
pair as after #7. No top-level pin drift; linux-x64 and linux-arm64 artifacts
are present in the lockfile with integrity for claude-code and codegraph.
Verified on amd64: build exits 0, gate passes, in-image versions match, tsc
compiles and rejects a type error, ts-node executes typed code, and all four
MCP servers report Connected from /workspace at the default MCP_TIMEOUT=10000.
arm64 was not built locally (no qemu binfmt on the host); it rests on the
pull_request CI job that builds both architectures.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This was referenced Aug 3, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Routine toolchain bump.
@anthropic-ai/claude-code@agentclientprotocol/claude-agent-acp@fission-ai/openspec@colbymchenry/codegraph@modelcontextprotocol/server-sequential-thinkingpnpmprettiereslintUnchanged because already latest:
caveman-shrink0.1.0,perplexity-mcp0.2.3,ts-node10.9.2,git-delta0.19.2.Both per-arch RTK sha256 values were recomputed from the downloaded tarballs and matched against the release
checksums.txt.TypeScript stays at 6.0.3 on purpose
The
latestdist-tag is now 7.0.2 — the native (Go) compiler rewrite, whose npm package no longer exposes the full JS compiler API. Built the image with 7.0.2 and exercised both tools:tsc— fine: compiles and still rejects a type error.ts-node10.9.2 — dead on every invocation:TypeError: Cannot read properties of undefined (reading 'fileExists'), becausets.sysis undefined.6.0.3 is the head of the 6.x line. Bumping to 7.x needs
ts-nodereplaced (e.g. bytsx) or fixed upstream; the reasoning is recorded inCLAUDE.md.Build gate fix (in scope because the bump exposed it)
ts-node --versionprints a constant without ever loading the compiler, so a completely brokents-nodepassed the gate and would have shipped green. Added a gate line that actually transpiles and runs a typed snippet.--compiler-options module=commonjsis required: with no tsconfig in scope the-eREPL emits an ESMexport {}that its ownvm.Script(CJS) cannot parse.Checked in a clean
node:22:--version)-e)Security
npm auditafter the lockfile regen: 8 vulnerabilities (1 low, 2 moderate, 5 high) → 2 high, bothfix: false. The remaining pair isperplexity-mcp0.2.3 (the latest published version) pinning an outdated@modelcontextprotocol/sdk— the same residual as after #7.No top-level pin drift;
linux-x64andlinux-arm64artifacts are present in the lockfile with integrity forclaude-codeandcodegraph.Verification
Verified on amd64:
./build.shexits 0, build gate passes.tsccompiles and rejects a type error;ts-nodeexecutes typed code.claude mcp listfrom/workspaceat the defaultMCP_TIMEOUT=10000: codegraph, sequential-thinking, context7, perplexity all ✔ Connected.Not verified locally: arm64 — no qemu binfmt on the build host. The arm64 RTK archive was checked for layout (single
rtkat the root) and ELF architecture (aarch64, glibc), but the arm64 image was not built. This rests on thepull_requestCI job, which builds both architectures.🤖 Generated with Claude Code