chore(deps): bump Fern to 5.80.1

[miyoungc]

Summary

Updates the pinned Fern CLI from 5.72.1 to 5.80.1 and records the complete semantic migration audit for the 21-release, 225-commit gap. The target is documentation tooling only: it does not change a supported NemoClaw runtime or product integration, and the audit found no unresolved high-severity concern.

Changes

• Update the exact Fern version in fern/fern.config.json.
• Make the staging preview cleanup test derive its expected executable selector from the production Fern version authority.
• Add the Fern 5.80.1 dependency review with source-range, artifact, provenance, closure, advisory, downstream-contract, and E2E-exclusion evidence.
• Add a focused contract test that binds the production pin to the reviewed artifact and concern ledger.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification: No user-facing NemoClaw behavior changes. The new Markdown file is internal dependency-review evidence, not a published product page.
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: The only sensitive-path change is the dependency review under docs/security/; no runtime security, policy, credential, or sandbox implementation changes. The note records verified npm integrity, signatures, SLSA provenance, licenses, exact dependency closures, advisories, and all downstream consumers.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue:

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: Reviewed docs/security/fern-5.80.1-dependency-review.md and its supporting Fern pin and tests. The review on the current main-merge head confirmed the four PR files are byte-identical to the approved ee468e110 content, preserve one-sentence-per-line formatting and labeled-table contract assertions, have no blocking documentation or test-contract issue, and do not require live sandbox E2E or a changelog entry because Fern is docs-only tooling with no supported user-visible runtime change.
• Agent: Codex Desktop

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit: Not applicable
• Station profile/scenario: Not applicable
• Result: Not applicable
• Supporting evidence: Not applicable

Verification

• PR description includes a Signed-off-by: line and every commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run check:diff passed when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: focused integration run passed 6/6 tests; npm run docs passed with fern-api@5.80.1; source-shape and Vitest project-membership checks passed.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: Not applicable; this is an exact documentation-tool pin with focused workflow and audit-contract coverage.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only)
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

npm run docs passed with zero errors. Fern 5.72.1 and 5.80.1 report the same two pre-existing warnings: unauthenticated local redirect validation is skipped, and the existing light-mode accent contrast is 2.41:1. The new internal dependency-review note has an SPDX header and is not a published Fern page, so frontmatter does not apply.

Live sandbox E2E is not a relevant proof for this change because Fern is never installed or executed in NemoClaw runtime images or sandboxes. The required PR gate remains authoritative for CI routing.

---

Signed-off-by: Miyoung Choi miyoungc@nvidia.com
Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

[coderabbitai]

📝 Walkthrough

Walkthrough

Fern is upgraded from 5.72.1 to 5.80.1 for documentation tooling. The staging workflow test now reads the configured version, while a security review document and Vitest tests capture and validate dependency evidence.

Changes

Fern 5.80.1 dependency update

Layer / File(s)	Summary
Update Fern version and workflow validation fern/fern.config.json, test/docs-publish-staging-workflow.test.ts	Pins Fern 5.80.1 and derives the staging preview cleanup expectation from the configuration.
Record dependency review evidence docs/security/fern-5.80.1-dependency-review.md	Documents package provenance, source history, dependency closure, downstream contract checks, concern dispositions, verification results, and remaining publication gates.
Validate configuration and review assertions test/fern-dependency-review.test.ts	Checks the configured version and required package, hash, metric, severity, and concern-marker content in the review document.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: bumping the Fern dependency to 5.80.1.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/bump-fern-5.80.1

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-code-quality]

Code Coverage Overview

Languages: TypeScript

TypeScript / code-coverage/plugin

The overall coverage in commit b0053eb in the codex/bump-fern-5.80... branch remains at 96%, unchanged from commit cee573a in the main branch.

TypeScript / code-coverage/cli

The overall coverage in commit b0053eb in the codex/bump-fern-5.80... branch remains at 80%, unchanged from commit f1161a5 in the main branch.

Show a code coverage summary of the most impacted files.

File	main f1161a5	codex/bump-fern-5.80... b0053eb	+/-
src/lib/shields/index.ts	72%	71%	-1%
src/lib/state/g...way-registry.ts	95%	94%	-1%
src/lib/sandbox...rce-identity.ts	87%	87%	0%
src/lib/onboard...ndbox-create.ts	83%	91%	+8%
src/lib/onboard...-create-plan.ts	75%	88%	+13%
src/lib/onboard...ndbox-create.ts	33%	83%	+50%

---

_{Updated July 24, 2026 02:34 UTC}

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-7458.docs.buildwithfern.com/nemoclaw

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@fern/fern.config.json`:
- Line 3: Update the pinned Fern version expectation in
test/docs-publish-staging-workflow.test.ts from fern-api@5.72.1 to
fern-api@5.80.1, matching the version configured in fern.config.json.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 6eb8740f-eeed-4b4f-a598-e51ec0735b2f

📥 Commits

Reviewing files that changed from the base of the PR and between acd5e5f and e3cb807.

📒 Files selected for processing (1)

• fern/fern.config.json

[github-actions]

PR Review Advisor — Informational

Advisor assessment: Informational / high confidence
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions
Status: No actionable findings remain in the canonical review ledger.

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Model comparison: normalized findings match; normalized E2E selections differ; severity counts match.

Nemotron output stays in workflow artifacts and does not change the assessment above.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: None

1 optional E2E recommendation

• docs-validation

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/security/fern-5.80.1-dependency-review.md`:
- Around line 10-21: Reformat the documentation section so every sentence
occupies its own Markdown line, including the paragraph beginning “Pin the
documentation tool” and the paragraphs describing the upgrade and residual
risks. Preserve all wording and content; only adjust line breaks to follow the
repository’s one-sentence-per-line convention.

In `@test/fern-dependency-review.test.ts`:
- Around line 17-37: Strengthen the tests in “binds the production pin to the
reviewed target artifact” and “records complete range, closure, and concern
dispositions” by validating labeled review records or parsing the relevant
tables instead of using unconstrained toContain checks. Ensure the version,
target source commit, integrity hash, and artifact commit are asserted under
their corresponding labels, and verify each FERN concern ID belongs to an actual
ledger row.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 91209678-c82e-4fc5-8161-265703319d3c

📥 Commits

Reviewing files that changed from the base of the PR and between 7adea13 and d5bc0cc.

📒 Files selected for processing (3)

• docs/security/fern-5.80.1-dependency-review.md
• test/docs-publish-staging-workflow.test.ts
• test/fern-dependency-review.test.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• test/docs-publish-staging-workflow.test.ts

[prekshivyas]

Re-reviewed exact head b0053eb after preserving the author’s stronger Fern audit fixes and synchronizing current main. Focused tests (6/6), dependency-review contracts, docs, project membership, receipt, and check:diff pass. Independent maintainer review remains requested because I pushed the synchronization commit.