Repository navigation
chore(deps): bump provider pins, remove unused ws devDep - #1429
Merged
TheGreatAxios merged 2 commits intoOct 15, 2026
Merged
TheGreatAxios merged 2 commits into
TheGreatAxios merged 2 commits into
Conversation
codex-provider 0.1.2 adds a bundled-models constant; oauth-core 0.3.0 adds RFC 8707 resource passthrough and 401-challenge discovery while keeping every consumer symbol intact (refresh signature narrows to a Pick — acceptance-widening). Wire behavior for our providers is byte-identical (no resource configured). The peer range declared by codex-provider (0.2.x) lags these additions; upstream should widen it. ws had zero first-party imports and leaves the tree.
Contributor
|
Superseded by the comment below. |
corbits-triage
Bot
added
Triage: Needs Human Review
Triage: Ready
and removed
Triage: Needs Human Review
Triage: Ready
labels
Contributor
|
Superseded by the comment below. |
corbits-triage
Bot
added
Triage: Ready
Triage: Needs Human Review
and removed
Triage: Needs Human Review
Triage: Ready
labels
Contributor
|
Triage: Unsure Not yet confirmed, a maintainer will check:
|
corbits-triage
Bot
added
Triage: Ready
Triage: Not Ready
and removed
Triage: Needs Human Review
Triage: Ready
labels
TheGreatAxios
changed the base branch from
cl-10655-replace-abandoned-ts-prune-with-knip-in-dead-export
to
main
October 15, 2026 20:34
…-pins-codex-provider-oauth-core-ws-remov # Conflicts: # package.json
corbits-triage
Bot
added
Triage: Needs Human Review
and removed
Triage: Not Ready
labels
![corbits-triage[bot]](https://avatars.githubusercontent.com/u/275831056?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@corbits/codex-provider0.1.1 -> 0.1.2: additive only (newCODEX_DEFAULT_MODELSconstant, bundled Codex model catalog); tarball-diff verified, no consumer adaptation needed.@corbits/oauth-core0.2.0 -> 0.3.0: verified non-breaking from source — no exported symbol removed;refreshTokenRequestnarrows its first parameter to a Pick (acceptance-widening); RFC 8707resourcepassthrough is added-but-unconfigured (no first-party config sets it, wire behavior for our providers byte-identical); discovery gains 401-challenge metadata.startCallbackServer/callbackTargetFor/OAuthRefreshFailedErrorintact.codex-provider@0.1.2declares@corbits/oauth-core: ^0.2.0while this installs 0.3.0 (runtime-verified non-breaking against every symbol it imports); upstream should widen the peer range.wsdevDep removed: bounded grep (src/testkit/e2e/scripts/vendor/packages) shows zero first-party imports — repo-seeding heritage. MCP SDK carries its ownwstransitively.Verification
bun run checkexit 0: 8948 pass / 0 fail across 580 files; codex+xai+provider suites 498 pass / 0 fail; full auth-adjacent set (oauth scope check, callback page, token session boundary, refresh lock, MCP re-auth caps, settings OAuth recovery) green.Fixes CL-10659