[0xPlayerOne]

This PR contains the following updates:

Package	Type	Update	Change
@adea-ai/ui (source)	dependencies	minor	0.139.0 -> 0.140.0
@adea-ai/ui (source)	devDependencies	minor	0.139.0 -> 0.140.0

---

Release Notes

adea-ai/ui (@​adea-ai/ui)

v0.140.0

Compare Source

Features

• tooling: add vp run orchestration tasks alongside Turbo (#​451) (fa97569)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

---

Cortana maintainer notes (added after merge)

This PR merged as 8f14bec with more than the Renovate bump:

• NOTICE heading updated to 0.140.0 and the two // x-release-please-version markers restored in bun.lock, which made the Unit job pass.
• Security backport: tauri-plugin-updater 2.10.1 is vendored under third_party/tauri-plugin-updater-2.10.1/ with its Windows zip requirement moved from 4 to 9, so apps/desktop/src-tauri/Cargo.lock resolves zip 9.0.4 instead of 4.6.1 (RUSTSEC-2026-0367, -0368, -0369; no audit exception). Only Cargo.toml differs from the published crate (archive sha256 806d9dac662c2e4594ff03c647a552f2c9bd544e7d0f683ec58f872f952ce4af); the upstream change is chore(deps): update rust crate zip to v9 tauri-apps/plugins-workspace#3698 (ba98bfad), not yet in any published release. Provenance and removal criteria: CORTANA-PATCH.md.
• Supporting changes: [patch.crates-io] entry, root workspace exclude, a desktop workflow provenance step, and third_party/** in the oxlint ignore list (vendored minified api-iife.js).
• The verifier merged here (scripts/verify-vendored-updater.mjs) hashes six source files plus the manifest; widening it to all retained files is in chore: align the Bun pin on 1.4.3 and check web types with bun check #2592.
• Local checks on the merged head: desktop clippy, desktop tests (159), script tests, pytest (308), lint, format and cargo audit (exit 0). The Windows ZIP behavior of zip 9 was checked separately; see chore: align the Bun pin on 1.4.3 and check web types with bun check #2592 for scope and limits. Hosted CI at head 64881ac (40 check runs): none failed; the rest succeeded, were skipped or neutral, including Tauri 2 / Linux, Security Audit (cargo-audit), Desktop Clippy and Desktop Tests. The Windows desktop lane was not part of that run.

https://claude.ai/code/session_01MfzvPs9KL9LLoLyPv5DiLP

---

Generated by Claude Code

[0xPlayerOne]

Coordinating personal source review completed for all three manifest/lock patches at exact head 5e2156d. The update selects @adea-ai/ui0.140.0 consistently. Upstream0.139.0→0.140.0 contains the already reviewed additive orchestration work plus opt-in repository tooling and release metadata; no shipped component/style/export/registry implementation or runtime dependency change was identified in that range. No blocking source finding.

Source outcome: approved. Installed-artifact/consumer qualification and all required CI remain pending; draft-skipped checks do not count as passes. Readiness can start qualification without deployment/release side effects. A later main merge is a separate decision because Cortana's main-push workflow creates a dev prerelease. This COMMENT records personal review and is not a formal GitHub approval.

[0xPlayerOne]

Qualification outcome: CHANGES REQUESTED based on hosted CI at 5e2156d. The complete source patch was previously reviewed, but these failures prevent approval/merge.

The bun.lock rewrite removed the two x-release-please-version markers required by the Python release-version guard. Restore the markers without weakening that check. The same Unit job also reports the grouped JavaScript run timing out at about 420 seconds; diagnose the hung/failing group rather than extending limits blindly or dropping tests. https://github.com/adea-ai/cortana/actions/runs/38988368746/job/117265010397

The desktop security audit reports zip 4.6.1 affected by RUSTSEC-2026-0367/0368/0369, with >=9.0.0 shown as the patched range. Inspect the dependency chain and compatibility before proposing an update; do not suppress the advisories. This is a qualification blocker, not a claim that this UI dependency PR introduced the Rust vulnerability. https://github.com/adea-ai/cortana/actions/runs/38988368074/job/117265022847

Existing implementation owner is Shared artifact review via the Cortana project lead. No duplicate assignment, readiness, merge, release or deployment action is recorded. This author-account COMMENT is not a formal GitHub request-changes review.

[0xPlayerOne]

Review outcome: PENDING qualification at b7138cf. I personally reviewed the complete current four-file patch and the two-file repair delta from 5e2156d. NOTICE now matches the locked UI0.140.0 version; both release-please markers are restored without altering versions. The direct UI0.139→0.140 upstream source delta has no component implementation/export/dependency changes; tooling/proof changes remain outside the published package allowlist. No defect identified in these repairs. This is not merge approval: exact-head hosted tests must establish the two former Unit failures are fixed and the JS group completes. Desktop zip4.6.1 audit vulnerabilities remain a separate required remediation with the existing owner; no audit exception or weakened checks. Published package qualification and all applicable protections remain required. Auto-merge remains off.