Update release dependencies

[austin-thesing]

Summary

• Update root AI SDK/OpenTUI/Bun dependency ranges and lockfile.
• Update website Astro/Starlight/Wrangler/browser tooling ranges and lockfile.
• Externalize OpenTUI platform packages in the Bun build so native optional imports resolve at runtime.

Test plan

• bun run typecheck
• bun run build

Notes

• npm audit still reports transitive Astro/Wrangler dev-server findings; npm's automated fix path downgrades Astro/Wrangler, so this PR leaves the latest versions in place.

Note

Update release dependencies and bump version to 0.2.22

• Bumps version from 0.2.21 to 0.2.22 in package.json and updates description to mention AI gateway, Workers AI, and custom model support
• Updates @ai-sdk/*, ai, @opentui/core, and related packages to newer releases with caret ranges; raises packageManager and engines.bun to 1.3.14
• Adds --external "@opentui/core-*" to the build script so platform-specific @opentui/core packages are resolved at runtime instead of bundled
• Updates website dependencies (@astrojs/starlight, astro, sharp, playwright, wrangler) in website/package.json
• Behavioral Change: @opentui/core-* platform packages are no longer bundled, requiring them to be present in the install environment at runtime

^{Macroscope summarized aef1fdc.}

Summary by CodeRabbit

• Chores

  • Bumped package version to 0.2.22 and expanded the description to cover more AI integrations (including OpenRouter, AI gateways, Workers AI, and custom models).
  • Updated the required Bun toolchain to 1.3.14+.
  • Refreshed dependency versions across the package and website, using updated caret-based constraints.

• Build/Packaging

  • Updated the build script to change how @opentui/core subpackages are bundled via an externalization flag.

[coderabbitai]

📝 Walkthrough

Walkthrough

Version bump from 0.2.21 to 0.2.22 in the main package.json, with an updated description, a new --external '@opentui/core-*' build flag, Bun toolchain upgraded to 1.3.14, and multiple AI SDK and @opentui/core dependencies refreshed to caret ranges. The website/package.json similarly bumps Astro, Sharp, Playwright, Puppeteer, and Wrangler to newer caret-range versions.

Changes

Dependency and Version Maintenance

Layer / File(s)	Summary
Main package version, build script, and dependency updates package.json	Version bumped to 0.2.22, description expanded to include AI gateways and Workers AI, --external '@opentui/core-*' added to the build script, Bun toolchain moved to >=1.3.14, and @ai-sdk/*, @opentui/core, and ai dependencies updated to caret ranges.
Website dependency version bumps website/package.json	@astrojs/starlight, @fontsource/*, astro, and sharp in dependencies, plus playwright, puppeteer, and wrangler in devDependencies, all bumped to newer releases and switched from pinned to caret semver ranges.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'Update release dependencies' accurately describes the primary change, which is updating package dependencies across the project and website.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch release/dependency-upgrades

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Line 19: The build script uses single quotes around the '--external' flag
value '`@opentui/core-`*', which breaks on Windows npm script execution. Replace
the single quotes with double quotes around '`@opentui/core-`*' in the build
script to ensure cross-platform compatibility and proper quoting behavior across
all operating systems.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: d45bca85-b162-43f2-9499-6b3c314c395e

📥 Commits

Reviewing files that changed from the base of the PR and between f45f9c8 and bc32198.

⛔ Files ignored due to path filters (2)

• bun.lock is excluded by !**/*.lock
• website/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (2)

• package.json
• website/package.json

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​types/​bun@​1.3.13 ⏵ 1.3.14				-1
	wrangler@​4.87.0 ⏵ 4.101.0	-27		+1
	@​ai-sdk/​google@​3.0.67 ⏵ 3.0.83	-4		+1
	@​ai-sdk/​openai@​3.0.58 ⏵ 3.0.72	+1		+1
	ai@​6.0.174 ⏵ 6.0.207	-22
	@​ai-sdk/​anthropic@​3.0.74 ⏵ 3.0.85	-1		+1
	playwright@​1.59.1 ⏵ 1.61.0	+1				-19
	@​astrojs/​starlight@​0.38.4 ⏵ 0.40.0			+1
	@​opentui/​core@​0.2.1 ⏵ 0.4.1	+3		+1
	@​ai-sdk/​openai-compatible@​2.0.45 ⏵ 2.0.51				+1
	astro@​6.2.1 ⏵ 6.4.7		+23	+1	+1
	puppeteer@​24.42.0 ⏵ 25.1.0
	sharp@​0.35.1

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm @emnapi/runtime is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: website/package-lock.json → npm/sharp@0.35.1 → npm/astro@6.4.7 → npm/wrangler@4.101.0 → npm/@emnapi/runtime@1.11.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@emnapi/runtime@1.11.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm @opentui/core is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → npm/@opentui/core@0.4.1 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@opentui/core@0.4.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm astro is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: website/package-lock.json → npm/astro@6.4.7 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/astro@6.4.7. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm js-yaml is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: website/package-lock.json → npm/@astrojs/starlight@0.40.0 → npm/astro@6.4.7 → npm/js-yaml@4.2.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/js-yaml@4.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report