[steipete]

Update PhoneNumberKit to 5.0.14 (phone metadata 9.0.43) and refresh both CodeQL steps to the current immutable v4 revision. Keep the Swift 6.1 package minimum, macOS 14 deployment floor, xcode-27 build runners, and documented macOS 26 CodeQL tracing exception.

There are no open Dependabot alerts. The dependency release is from November 6, and no repository cooldown policy blocks it. Validate with the documented Linux gate on Crabbox, exact-head CI, and a release workflow dry run at the existing version after merge. No release, tag, or version bump is requested.

Validation: the complete documented Linux gate passed, including tests, release archive smoke checks, and docs. Independent P2 review is clean. Full macOS/Linux and CodeQL checks run at this PR head.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-14T07:26:24.024344Z	738f631	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

This PR updates PhoneNumberKit to 5.0.14, refreshes both CodeQL action pins, and records the updates in the changelog.

Example: Building imsg with its tracked dependency lock.

• Before: PhoneNumberKit 5.0.13 supplies phone metadata 9.0.42.
• After: PhoneNumberKit 5.0.14 supplies phone metadata 9.0.43.

Review scores

Measure	Result	What it means
Overall readiness	🦐 gold shrimp (3/6)	A focused, useful patch supported by upstream release verification and passing exact-head build/test checks; supplied runtime evidence is limited to automated validation.
Proof confidence	🦐 gold shrimp (3/6)	This maintainer-authored maintenance PR is outside the contributor proof gate; exact-head CI verifies builds and tests, while no metadata-specific live normalization scenario is supplied.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Phone-number normalization and repository security analysis depend on periodically refreshed upstream releases.
Reason: The maintainer-authored update keeps the existing dependency and workflow owners, preserves supported platforms, and introduces no additional configuration or machinery.

Merge readiness

✅ Ready for maintainer review

Keep this maintainer-authored PR open: the dependency updates are absent from main, and the focused patch has no actionable correctness or security findings.

Priority: P3
Reviewed head: 738f631b11d5a2720f4bb5ec68b9883c37b89665

Before merge

None.

Findings

None.

Agent review details

How this fits together

IMsgCore uses PhoneNumberKit to normalize recipient and contact numbers; the separate CodeQL workflow analyzes repository code and uploads security results.

flowchart LR
  A[Recipient and contact numbers] --> B[IMsgCore normalizer]
  C[PhoneNumberKit metadata] --> B
  B --> D[Normalized handles]
  E[Repository source] --> F[Pinned CodeQL actions]
  F --> G[Security analysis results]

Loading

Technical review

Best possible solution:

Land the existing focused dependency refresh through the repository’s normal checks.

Do we have a high-confidence way to reproduce the issue?

This is a maintenance update rather than a bug report; the old pins on main and replacement release identities are directly verified.

Is this the best way to solve the issue?

Updating the existing pins is the smallest complete change, and upstream confirms that the PhoneNumberKit update changes metadata rather than implementation or minimum platform requirements.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 30893116d52d.

Provenance checked

• PhoneNumberKit lock keeps the original intent (3773620: The preceding update refreshed phone metadata while retaining existing platform minimums; the tracked lock supports reproducible release builds.)
• CodeQL action references keeps the original intent (22b4da7: Scheduled scanning retained PR/manual coverage and explicitly left pinned-action maintenance to maintainers.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Pinned scope and current main: The introduced diff changes only two action references, one dependency revision/version pair, and an Unreleased entry; GitHub still reports main at the pinned base. (Package.resolved:27, 738f631b11d5)
• Verified metadata-only dependency release: The annotated 5.0.14 tag resolves to the pinned commit, and the comparison with 5.0.13 changes only metadata version, XML, and JSON resources; executable Swift code and the package manifest are unchanged. (Sources/PhoneNumberKit/Resources/.metadata-version:1, ff40a615c71b)
• Verified immutable CodeQL release: The annotated v4.39.3 tag resolves to the new action pin; its release describes a fix for alert filtering on paths containing special characters. The old pin is unavailable through the upstream commit API, preventing a complete upstream comparison. (33d7b85da1a0)
• Exact-head validation: macOS lint, tests, build, and architecture checks passed, as did the documented Linux gate and Actions/JavaScript CodeQL analyses. Swift CodeQL remains in progress; the neutral aggregate currently reports its missing configuration. (.github/workflows/ci.yml:36, 738f631b11d5)
• Existing operational intent preserved: fix(ci): schedule weekly CodeQL main scans #380 established scheduled scanning and maintainer-owned action updates; fix(send): verify iMessage sends that land in an SMS-labelled any;-; chat #373 retained macOS 26 for Swift tracing. This PR preserves both decisions, workflow permissions, and build minimums. (.github/workflows/codeql.yml:35, 30893116d52d)
• Policy and feature-history review: The complete root AGENTS.md applies, with no nested policy or maintainer notes present. History identifies repeated dependency work by steipete and CodeQL work by vincentkoc and webmasu; older rename-following history encounters unavailable local objects, so no unsupported original-introduction claim is made. (AGENTS.md:1, 30893116d52d)

Likely related people:

• webmasu: Raw commit d24d95d adds .github/workflows/codeql.yml:36 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: medium; commits: d24d95dd0140; files: .github/workflows/codeql.yml)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P3: Routine dependency and security-tool maintenance with no established urgent user regression.
• add rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine dependency and security-tool maintenance with no established urgent user regression.
• rating: 🦐 gold shrimp: Overall readiness is 🦐 gold shrimp; proof is 🦐 gold shrimp and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 14, 2026, 2:38 AM ET / 07:38 UTC.