chore(deps): bump typebox from 1.1.38 to 1.3.16

[dependabot]

Bumps typebox from 1.1.38 to 1.3.16.

Commits

• 8f8d861 Version 1.3.16 (#1670)
• 421b3bb Version 1.3.15 (#1668)
• 71aee26 Coverage
• d2fec9e Version 1.3.14 (#1667)
• aaa53b9 Specification
• fc21b5e Prototype
• 6ef14ba Revision 1.3.13 (#1666)
• 4ba56d4 Documentation
• 49a4f29 Revision 1.3.12 (#1665)
• 2b91384 Specification
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

No issue: routine dependency bump opened by dependabot under the bun ecosystem. Tracks no issue by design; the upgrade is the work.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	typebox@​1.3.16

View full report

[tps-kern]

API-surface review for typebox 1.1.38 -> 1.3.16.

Bob's typebox usage is narrow and stable: Type.Object, Type.String, Type.Array, Type.Optional, Type.Boolean, Value.Check, Value.Errors, TSchema, and the Static type. I checked all 14 files that import typebox.

The 1.3.0 changelog describes this as a maintenance revision that deprecates Base, Awaited, Promise, AsyncIterator, Iterator, and Mutate types. None of these are used by bob. The deprecations are removals of niche types (RPC-oriented, React state management); the core Type.* builder API and Value.* validation API that bob uses are unchanged.

The bun.lock shows typebox 1.1.38 is retained as a transitive for @earendil-works/pi-* packages (they pin 1.1.38), so the top-level bump to 1.3.16 is a clean deduplication — bob gets 1.3.16, the pi packages keep their pinned 1.1.38. No forced cascade.

CI green (9 pass). The type surface bob uses is stable across 1.1 -> 1.3. Approve.

[tps-kern]

API-surface checked. Bob uses Type.Object, Type.String, Type.Array, Type.Boolean, Type.Integer, Type.Literal, Type.Optional, Type.Union, Value.Check, Value.Errors — all stable APIs preserved through 1.3.x. The removed APIs in 1.3.7 (Type.Base, Type.Awaited, Type.Promise, Type.AsyncIterator, Type.Iterator, Type.Options, Value.Mutate) are not used anywhere in bob's source. bun.lock shows transitive deps (pi-agent-core, pi-ai, pi-coding-agent) still pin typebox@1.1.38 as their nested resolution, so no forced upgrade in the dependency tree. Safe to merge.

[tps-sherlock]

Approving. typebox 1.1.38 -> 1.3.16 is a major bump, but the surface bob uses is narrow and stable: Type.Object/String/Optional/Array/Union/Literal/Integer/Boolean/Number plus Value.Check/Value.Errors from typebox/value. None of those changed across 1.1->1.3. The schemas are consumed locally (capability-loader.ts, config.ts) and only a string piPackage path is handed to pi — no typebox schema object crosses the pi boundary, so there is no cross-package type-compat risk. CI typecheck is green, which is a meaningful signal here because typebox is a type-level library: a surface break would fail typecheck, exactly as #110's pi-coding-agent bump did. Clean.