Update: core package ably/cli prod dependencies

[sacOO7]

• Addressed dependabot PRs Bump the production-dependencies group across 1 directory with 13 updates #225 and Bump open from 10.1.1 to 11.0.0 #230
• Dependabot doesn't have permission to run E2E tests as per https://ably.atlassian.net/browse/DX-1017?focusedCommentId=89847

Summary

Updates all core production dependencies of @ably/cli to their latest versions.

Dependency Updates

Package	From	To	Update Type
@ably/spaces	^0.4.0	^0.5.2	Minor
@oclif/core	^4.2.10	^4.10.3	Minor
@oclif/plugin-autocomplete	^3.2.30	^3.2.43	Patch
@oclif/plugin-warn-if-update-available	^3.1.57	^3.1.58	Patch
@xterm/addon-fit	^0.10.0	^0.11.0	Minor
@xterm/addon-web-links	^0.11.0	^0.12.0	Minor
ably	^2.19.0	^2.21.0	Minor
open	^10.1.0	^11.0.0	Major
ws	^8.16.0	^8.20.0	Minor

Test plan

• pnpm prepare succeeds
• pnpm test:unit passes
• pnpm exec eslint . shows 0 errors
• E2E tests pass against real Ably

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
cli-web-cli	Ready	Preview, Comment	Apr 1, 2026 5:56pm

[claude-code-ably-assistant]

Walkthrough: This PR updates nine core production dependencies of @ably/cli to their latest versions, addressing two open Dependabot PRs. Changes confined to package.json and pnpm-lock.yaml only. Review Notes: (1) Major version bump open v10 to v11 - verify API surface unchanged. (2) @ably/spaces v0.4 to v0.5 - check commands in src/commands/spaces/ against Spaces changelog. (3) @oclif/core v4.2 to v4.10 - flag parsing/help rendering may subtly change, run pnpm test:unit and smoke-test --help. (4) No source code changes - no test updates for behavioral differences. (5) E2E tests required before merging.

[claude-code-ably-assistant]

Walkthrough

[claude-code-ably-assistant]

Review: Dependency updates PR

This is a clean dependency bump PR. I reviewed each upgrade for breaking changes, API compatibility, and runtime requirements. Here's what I found:

---

open v10.1.0 → v11.0.0 (Major bump) ✅

The only breaking change in v11 is raising the minimum Node.js requirement from 18 to 20. Since this project already requires node >=22.0.0 (per package.json engines field), this is a non-issue.

The API usage in src/utils/open-url.ts and src/commands/accounts/login.ts:

import open from "open";
await open(url);

…is identical in v10 and v11. No code changes needed.

---

@ably/spaces v0.4.0 → v0.5.2 (Minor) ✅

No breaking changes between 0.4.x and 0.5.x. Notable internal changes in 0.5.0 that don't affect this codebase:

• outboundBatchInterval default changed from 25ms → 50ms (CLI doesn't use this option)
• space.connectionId converted from a field to a getter (CLI reads connectionId from member objects, not the Space directly)

---

@oclif/core v4.2.10 → v4.10.3 (Minor — large jump) ⚠️

No breaking API changes. However, two behavioral changes will affect help output and thus the README:

1. v4.5.6: Optional (non-required) args now display as [ARG_NAME] in ARGUMENTS sections and USAGE lines. Several CLI commands have optional args (accounts login, accounts switch, apps delete, etc.) and their help text will change.

2. v4.8.0: Flags with env: now show [env: VAR_NAME] in --help output. This affects --control-host, --dashboard-host, and --app flags.

The PR checklist doesn't include pnpm exec oclif readme (step 2 of the mandatory workflow). After merging, the README.md will be out of sync with actual help output until regenerated. The PR description says "pnpm prepare succeeds" but that's separate from oclif readme.

Suggest adding pnpm exec oclif readme to the test plan and committing the resulting README changes, or verifying it's already part of pnpm prepare in this project.

---

Other upgrades ✅

• ably v2.19 → v2.21: Minor SDK bump, no API changes affecting CLI commands
• ws v8.16 → v8.20: Patch-level bug fixes within v8
• @oclif/plugin-autocomplete, @oclif/plugin-warn-if-update-available: Patch bumps, no impact
• @xterm/addon-fit, @xterm/addon-web-links: Minor bumps, purely additive (xterm peer dep qualifier disappearing from lockfile is a pnpm format change, not a version issue)

---

Summary

The upgrades are safe and no code changes are required. The one thing to address before merging is the README regeneration — run pnpm exec oclif readme and commit the diff so the README reflects the new [ARG_NAME] and [env: VAR_NAME] formatting that @oclif/core 4.10 will produce.

[claude-code-ably-assistant]

Walkthrough

This PR updates all core production dependencies of @ably/cli to their latest versions, consolidating two Dependabot PRs (#225, #230). The changes are limited to package.json version specifiers and the corresponding pnpm-lock.yaml lockfile — no source code is modified.

Changes

Area	Files	Summary
Config	package.json	Bumped 9 production dependencies to latest versions
Config	pnpm-lock.yaml	Regenerated lockfile to reflect resolved dependency versions

Review Notes

• Major version bump: open moves from ^10.1.0 to ^11.0.0. This is the only major-version change and may include breaking API changes if the open() call signature changed. Worth checking the open v11 changelog against usage in the codebase.
• @ably/spaces minor bump (^0.4.0 to ^0.5.2): Minor versions in pre-1.0 packages can carry breaking changes. The Spaces SDK API surface should be verified against existing command implementations.
• @oclif/core significant minor jump (^4.2.10 to ^4.10.3): An 8-minor-version jump in oclif core could affect CLI framework behavior (help rendering, flag parsing, error handling). Existing unit tests cover the most likely regressions here.
• E2E tests: Cannot be run by Dependabot due to permission restrictions (DX-1017). Manual E2E verification is needed before merging.
• No new dependencies introduced; no source code changes; no migration steps required.