chore: refresh eligible transitive dependencies

[steipete]

What Problem This Solves

Refresh eligible transitive dependencies after the previous dependency sweep: Nano ID 3.3.18 → 3.3.19, Magic String 1.2.3 → 1.3.1, and Obug 2.1.4 → 2.2.1.

User Impact

The CLI keeps its Node 22 minimum and existing behavior. All selected releases are older than the repository's 48-hour release-age window; the pnpm 11.26.0 lockfile was regenerated with pnpm update.

Why This Change Was Made

These are the remaining compatible updates. Runtime and direct development dependencies, GitHub Action SHA pins, CodeQL, and the release workflow's npm CLI are otherwise current within policy. Node 22 typings remain aligned with the runtime floor. Zod 4.6.3/4.6.4 are too recent. pnpm 12.4.1 remains deferred while Dependabot #15904 is open. Nano ID 6 and Obug 3 remain outside PostCSS's ^3.3.18 and Vitest's ^2.1.4 requirements.

Evidence

• Exact reviewed head: 52bbf14f29755f75aec57c1b4d8884cbd9ae4696.
• Exact-head CI passed: frozen pnpm 11.26.0 install, typecheck, lint, formatting, full tests, build, and packaged CLI smoke checks. Full runtime coverage ran on Node 22, 24, and 26; Windows execution tests also passed.
• Node 26 full suite: 50 test files, 957 passed, 2 existing platform skips. No tests or skip conditions changed.
• Live built CLI proof: pnpm pack:smoke packs the build, installs it offline in an isolated directory, runs the installed clawpatch init and clawpatch map commands against a mixed-language fixture, and verifies 13 mapped features, including 3 CUDA features. The same smoke check passed on Node 22 and 24.
• Local frozen install, typecheck, lint, formatting, and actionlint passed. pnpm audit --json reported zero vulnerabilities.
• Local full-suite follow-up hit the existing 30-second timeout in the 140-package Go fixture on a shared host with load above 280; a one-worker rerun reproduced that timeout (11 other integration tests passed). The redundant local full run was stopped. No timeout, assertion, or skip condition was changed; the complete exact-head suite and installed CLI proof passed on all three hosted Node runtimes.
• Independent Codex autoreview: scoped-clean at P0–P2 for the complete change.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review in progress

ClawSweeper is reviewing this revision. This supersedes any previous blocked status.

View the workflow run.