[KayzenRoot]

This PR contains the following updates:

Package	Change	Age	Confidence
rxjs (source)	7.8.1 → 7.8.2

---

Release Notes

reactivex/rxjs (rxjs)

v7.8.2

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Migrated from upstream. This pull request was originally opened in
CopilotKit/OpenDots#140
by @renovate[bot] on 2026-10-11.
Original state upstream: open.
Head branch upstream: CopilotKit/OpenDots:renovate/rxjs-7.x-lockfile @ 5d9b22c.
Note: #NNN references in the description above are UPSTREAM issue/PR numbers
and do not resolve to the same items in this fork.
The body is preserved verbatim; discussion comments follow with per-author attribution.

[KayzenRoot]

@jerelvelarde — comment — 2026-11-03 (original):

Holding 5d9b22cdf3f4e8ac20e0f5794bc451a696a7fe6d. The lockfile update goes beyond RxJS: it also moves CopilotKit runtime/core from 1.75.0 to 1.84.0 and changes related channel dependencies. Current CI fails typechecking with incompatible AG-UI message/content and Observable types across the client and server.

Please narrow this to the intended RxJS update, or split out and align the CopilotKit/AG-UI migration with its required source changes and tests. A successful install, typecheck, tests and build on the corrected dependency graph are needed before merge. This is a demonstrated compatibility blocker; the current evidence does not establish a security defect.

[ecc-tools]

ECC Tools / Security Evidence

Commit: 5d9b22cdf3f4e8ac20e0f5794bc451a696a7fe6d

Security evidence gate passed (success)

No security-sensitive scanner-evidence gap detected.

Mode: enforce

Scanned 1 changed file(s). No missing scanner-evidence signal was detected.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / PR Risk Taxonomy

Commit: 5d9b22cdf3f4e8ac20e0f5794bc451a696a7fe6d

PR taxonomy review recommended (neutral)

Detected 2 PR taxonomy bucket(s): Install Manifest Integrity, CI/CD Recommendation.

Scanned 1 changed file(s).

Roadmap taxonomy buckets:

Install Manifest Integrity

Install manifests, plugin metadata, and shipped skills should stay synchronized with user-facing setup guidance.

Signals:

• 1 install or manifest path(s) changed

Paths:

• package-lock.json

CI/CD Recommendation

CI, dependency, coverage, and contract signals should be routed into follow-up checks or verification work.

Signals:

• 1 CI or workflow path(s) changed

Paths:

• package-lock.json

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[ecc-tools]

ECC Tools / Reference Set Readiness

Commit: 5d9b22cdf3f4e8ac20e0f5794bc451a696a7fe6d

Reference set readiness gaps detected (neutral)

Reference evidence present for 0/7 areas (0%) across 1 changed file(s).

This check is based on files changed in this PR. Repository-level readiness is still reported by /ecc-tools analyze comments and generated manifests.

Area	Status	Evidence / Next Step
Deep analyzer corpus	Missing	Add analyzer fixture, golden, benchmark, or reference-set files that can catch analyzer regressions.
RAG/evaluator comparison	Missing	Add retrieval or evaluator reference-set comparison fixtures with expected ranking behavior.
PR salvage/review corpus	Missing	Add stale-PR, review-thread, reopen-flow, or salvage reference cases for queue cleanup automation.
Discussion triage corpus	Missing	Add public discussion triage fixtures, golden cases, or reference sets for informational, answered, and no-response classifications.
Harness compatibility	Missing	Add cross-harness, adapter-compliance, or harness-audit evidence for Claude, Codex, OpenCode, Zed, dmux, and agent surfaces.
Security evidence	Missing	Attach security evidence such as SBOMs, SARIF, audit reports, or AgentShield evidence packs.
CI failure-mode evidence	Missing	Add captured CI failure logs, dry-run fixtures, or troubleshooting docs for common workflow failure modes.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[ecc-tools]

ECC Tools / Hosted Promotion Readiness

Commit: 5d9b22cdf3f4e8ac20e0f5794bc451a696a7fe6d

Hosted promotion readiness passed (success)

No hosted promotion evidence gaps detected across 1 changed file(s); 0 corpus scenarios had matching evidence.

This check compares PR file changes against the evaluator/RAG promotion corpus in src/analyzers/fixtures/evaluator-rag-corpus.ts.
Hosted output scoring inspected 0 completed cached hosted job results.

No evaluator corpus scenarios matched this PR.

Check publication was denied or unavailable. An app owner must enable Checks: read and write, and the installation owner must approve the updated permission.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​copilotkit/​core@​1.75.0 ⏵ 1.84.0	+1		+1	+1
	@​copilotkit/​runtime@​1.75.0 ⏵ 1.84.0	-3
	@​copilotkit/​react-core@​1.75.0 ⏵ 1.84.0

View full report