[0xcadams]

What

updates the native client, server, SDK, and disposable test harness dependencies in a dependency-only layer based on current main. transport and authorization changes stay in their owning PRs.

Why

the coordinated transport work inherited dependency updates from #457, #459, and #481. separating them lets reviewers evaluate the dependency graph without also reviewing the transport cutover. the SDK still supports Node 22.18, so updates requiring Node 22.19 cannot be included. the Go updates also include the x/net HTML parser security fix.

Changes

• reconcile compatible Go and npm updates and their lockfiles, including all nine Go updates from chore(deps): bump the go-modules group across 1 directory with 9 updates #459.
• retain Undici 7 and use ref-parser 15; defer the incompatible proposed majors from chore(deps): bump the npm-packages group across 1 directory with 12 updates #457.
• regenerate the embedded toolbar from its source with the updated build dependencies.
• keep feature-only Pion dependencies out of this layer until the native transport consumer is introduced; do not change product versions or public contracts.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T12:37:39.758884Z	d5e5bca	PR opened
🔒 Security Review	✅ Completed 2026-10-28T12:40:30.685034Z	d5e5bca	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[0xcadams]

qualification for signed d5e5bcadcc18bff1ec5bcfc7400d97a0be6ad283 (parent 51fd72bcdd54798ab3153bb1f186cd4f86e658a6):

• independent review found no blocking issues in scope, dependency reconciliation, generation ownership, engines, or licenses.
• passed frozen pnpm installation, routine Go/public consumer tests, full Go race tests (110 packages; 40 additional packages had no test files), Go lint, harness race tests, and vulnerability scanning.
• passed JavaScript build, type checks, 284 tests, lint/formatting, source-pack and installed-consumer checks, and the browser toolbar test.
• passed committed generation verification, formatting, module verification, and the allowed eight-file/version/engine/license audits.
• vulnerability scanning found no affected symbols or imported packages; its module-only x/crypto/openpgp advisory concerns an unused package with no fixed version.

Node compatibility was checked against declared engines for every newly selected lockfile package. checks ran on pinned Node 22.23.2; this is not an actual Node 22.18 runtime result. no integration deployment, live infrastructure change, release operation, or deployed benchmark ran. CI on this submitted head remains a separate result.

this replaces the compatible dependency portions of #457, #459, and #481. #481's correctness and runtime ancestry still needs explicit homes in the replacement stack; this PR does not dispose of that work.

[0xcadams]

all non-skipped CI checks now pass on unchanged signed d5e5bca. the original runtime-shard failure happened during test discovery while proxy.golang.org returned an HTTP/2 INTERNAL_ERROR fetching aws credentials v1.20.8; no named runtime test or disposable PostgreSQL instance had started. the failure log is retained, and the rerun completed the affected workflow without any source change or relaxed assertion: https://github.com/tnldotdev/tnl/actions/runs/40689226743. superseded dependency inputs #457 and #459 are closed with explicit incorporated/deferred dispositions. #481 remains open for its non-dependency work.