[dependabot]

Summary

Update the SDK's pinned incur and React patch versions. Incur fixes MCP stdio transport loading in bundled CLIs; React remains compatible with the existing Ink renderer.

Changes

• Update incur from 0.7.0 to 0.7.1 and react from 19.3.0 to 19.3.1.
• Refresh lockfile integrity records and React peer bindings. No new transitive package versions are introduced.
• Reviewed incur's release, React's release, and the shipped package diffs. Both retain their engine requirements and have no installation hooks.

Testing

• Frozen SDK dependency installation passed with the repository's pinned pnpm version.
• SDK build:ci, build:plugin, build, types, and format passed locally.
• Focused CLI, saved-log formatting, and patch TUI suites passed: 235 tests, seed 12345.
• Full SDK suite passed across three CI shards with seed 12345: 6,268 passed, 81 skipped, zero failures.
• Packed SDK archive inspection and git diff --check passed.
• Downloaded package integrity matches the registry and lockfile.
• An initial local fixture failure was traced to an existing Git marker above the temporary directory. The full suite passed using fresh temporary directories outside that marker.

Risk and rollout

Both npm versions were published on October 14, 2026 and completed the required seven-day cooldown on October 21. Neither package is excluded from the cooldown. Incur's shipped runtime change makes the existing MCP import statically discoverable; the shipped React runtime changes only its version strings. The existing Node requirements and React renderer peer range remain compatible. Normal package release rollout applies.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-22T09:11:42.956934Z	0ad8db3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed upstream publication dates, package integrity and shipped changes for incur 0.7.1 and React 19.3.1. Both meet the seven-day cooldown. Local builds, types, formatting, package archive inspection, 235 focused tests, and the full three-shard SDK suite (6,268 passed; 81 skipped; zero failures; seed 12345) passed. The initial temporary-directory fixture issue was isolated and resolved for the full rerun. Current-head required CI passes and there are no unresolved review threads.