[vvillait88]

Summary

Maintenance sweep release, 2.9.4. Dev-tree changes only; nothing in the published package changes.

• dotenv 18.0.8 to 18.0.9 (dev).
• zod 4.6.5 to 4.6.7 in the lock (a dev-only transitive through knip), clearing GHSA-mrhx-c7xc-m3w5.
• .claude/CLAUDE.md said ESLint 9; the repo is on 10.

Checked and current: every GitHub Action and the osv-scanner binary (v2.7.0); dependabot covers bun and actions and its last runs succeeded.

Worked with: Varun, who asked for the sweep.

Not taken: knip 6.43.0 (published under 24 hours ago, inside the release-age soak; it lands next pass) and typescript 7 (held org-wide; the lift condition still fails, as typescript-eslint 8.72.0 peers <6.1.0).

Type of change

• Bug fix (no breaking change)
• New feature (no breaking change)
• Breaking change (existing callers must update)
• Docs, tests, or internal maintenance only

Public API

None.

Test plan

lint, typecheck, knip, test (154 passed, 2 skipped) and build all exit 0 locally. osv-scanner scan source --lockfile=bun.lock reports no issues.

Checklist

• Tests cover the new behavior, and the suite passes locally
• Lint, format, and type checks pass
• Docs and README examples updated if the public surface changed
  (the public surface did not change)
• No secrets, credentials, or personal data in the diff or the tests

[vvillait88]

Review of c77e2af (base a5477d7, which is current main). No blocking findings.

Lock diff. Exactly three hunks: the embedded dotenv range ^18.0.8 to ^18.0.9, dotenv@18.0.8 to 18.0.9, and zod@4.6.5 to 4.6.7. Nothing else moved. zod's only consumer in the lock is knip ("zod": "^4.6.5"), so it stays dev-only. bun install --frozen-lockfile at the head is clean (209 packages).

Missed bumps. bun outdated --filter '*' at the head lists two rows only: knip 6.42.1 (6.43.0 marked *, release-age) and typescript 6.0.3 to 7.0.2. knip 6.43.0 was published 2026-10-24T08:32Z, about 16.5h before this review, so it is inside the 86400s minimumReleaseAge in bunfig.toml. The package has no runtime or peer dependencies, so there are no unlisted exact pins to query by name. dotenv and zod latest on npm are 18.0.9 and 4.6.7.

TypeScript hold. Re-tested the lift condition in a scratch worktree of main with typescript@7.0.2 installed: lint exits 2 ("typescript-eslint does not support TS 7.0") and build exits 1 (rollup-plugin-dts: no compiler API). typescript-eslint latest 8.72.0 and canary 8.72.1-alpha.11 both peer typescript >=4.8.4 <6.1.0. I also tried the side-by-side route the error messages now suggest, adding @typescript/typescript6 6.0.2 next to TS 7: typecheck passes, but lint still exits 2 with the same refusal and build exits 1 (parseJsonConfigFileContent is not a function). So the hold stands, and the compat package does not rescue it either. The dependabot ignore on typescript is scoped to semver-major.

OSV. osv-scanner 2.7.0 with an explicitly empty config: head lock, 389 packages, "No issues found". Positive control on main's lock: one High, GHSA-mrhx-c7xc-m3w5, zod 4.6.5, fixed 4.6.6. osv-scanner.toml carries no ignores, so there is nothing unused to remove. One lockfile in the tree (find).

Published dist. Built main and the head, then diffed both against the published 2.9.3 tarball from npm. The only difference in all four files is the inlined user-agent version, @agent-score/sdk@${"2.9.3"} to "2.9.4" in index.js and index.mjs. The .d.ts/.d.mts are byte-identical.

Gates at the head. lint, typecheck, knip, test (6 files passed, 1 skipped; 154 passed, 2 skipped) and build all exit 0. All 9 PR checks are green, CodeQL and Dependency Scan included.

Actions and dependabot. checkout v7 (latest v7.0.1), setup-node v7 (v7.1.0), cache v6 (v6.1.0), setup-bun v2 (v2.2.0) and useblacksmith/checkout v1 (v1.8.1) are all floating majors at their current line. The osv-scanner binary input is v2.7.0, which is latest. The four most recent Dependabot Updates runs (bun and actions, 2026-10-19) succeeded, and no dependabot PRs are open.

Non-blocking. The holds registry entry for typescript names only the typescript-eslint peer and the tsup crash. Both errors now point at running TS 7 side by side with the TS 6 API package, and that route fails too, as shown above. It is worth one line in the entry so the next pass does not spend time re-trying it.

CLAUDE.md "ESLint 10" matches eslint ^10.13.0.