chore(deps): bump typebox from 1.1.38 to 1.3.0

[dependabot]

Bumps typebox from 1.1.38 to 1.3.0.

Commits

• 9b6cb03 Version 1.3.0 (#1636)
• 68530cf Challenge
• eede247 Version 1.2.19 (#1634)
• b0f947d Version 1.2.18 (#1633)
• 9daa038 Documentation
• ede7a5c Tasksmith
• ae8d975 Version 1.2.17 (#1632)
• 20e0b60 Documentation
• 4ec060a Version 1.2.16 (#1628)
• c6dde47 Version 1.2.15 (#1627)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[tps-sherlock]

Security/Auth Review — bob#54

Verdict: APPROVE ✅

My lane is security/auth. This is a pure dependency version bump — typebox from 1.1.38 to 1.3.0 across four packages (cap-discord, cap-flair, cap-observatory, shell).

What changed

// Old:
"typebox": "1.1.38"

// New:
"typebox": "1.3.0"

No code changes, no API surface changes, no auth logic touched.

Security analysis

TypeBox is a JSON Schema / TypeScript type builder — it's a compile-time and runtime validation library, not a network library, not a crypto library, not an auth library. A minor version bump within the 1.x range carries no security-relevant changes.

No new dependencies introduced, no credentials handled, no endpoints changed.

Summary

Pure dependency chore. Zero security impact. Approve.

[tps-kern]

Architecture & Correctness Review — PR #54 (tpsdev-ai/bob)

Verdict: REQUEST_CHANGES

Dependabot bump: typebox 1.1.38 → 1.3.0 across 4 packages (cap-discord, cap-flair, cap-observatory, shell). 4 files changed, 4 additions, 4 deletions. No code changes.

CI failures

Two checks failing, both from the same root cause:

1. Dependency Audit (FAILURE): sfw bun install --frozen-lockfile fails with:

   error: No version matching "typebox" found for specifier "1.3.0" (blocked by minimum-release-age: 604800 seconds)

   Socket Firewall enforces a 7-day minimum release age policy. typebox@1.3.0 was published too recently and is blocked.

2. Build (TypeScript strict) (FAILURE): Same sfw bun install --frozen-lockfile step fails → can't install deps → build can't proceed. Unit Tests was SKIPPED as a downstream dependency.

Analysis

The version bump itself is a minor version upgrade (1.1.38 → 1.3.0) with no code changes. TypeBox is a JSON Schema / TypeScript type builder — no security-relevant surface. Sherlock's security review is correct: zero security impact.

However, CI cannot pass because the Socket Firewall minimum-release-age policy blocks the new version. This is a hard gate, not a soft warning — bun install exits non-zero.

Required action

Either:

1. Wait ~7 days for typebox@1.3.0 to age past the minimum-release-age policy, then rebase/re-trigger CI. The Dependabot PR can be left open until then.
2. Override the policy if the team has a documented exception process for low-risk dependency bumps.
3. Close and re-create the Dependabot PR after the age window passes.

Do not merge with failing CI — the build is broken because deps can't install.

[dependabot]

Superseded by #59.