Skip to content

chore(deps): bump undici and openclaw in /openclaw - #15

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/openclaw/multi-1214756ae4
Closed

chore(deps): bump undici and openclaw in /openclaw#15
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/openclaw/multi-1214756ae4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor

Bumps undici to 8.10.0 and updates ancestor dependency openclaw. These dependencies need to be updated together.

Updates undici from 8.3.0 to 8.10.0

Release notes

Sourced from undici's releases.

v8.10.0

What's Changed

New Contributors

Full Changelog: nodejs/undici@v8.9.0...v8.10.0

v8.9.0

⚠️ Security fixes

High severity

  • GHSA-4cwx-7wf7-3272: malformed qualified private Cache-Control directives could cause cross-user information disclosure in shared caches or a parse-time crash. The cache parser now treats empty qualified directives conservatively and safely handles mixed qualified and unqualified directives. Fixed by 4fe5bc5f with regression coverage in 9f09b49a.

Medium severity

  • GHSA-m8rv-5g2x-5cg5: a malicious type property on a duck-typed blob-like HTTP/1.1 request body could inject CRLF sequences into the generated content-type header. Undici now coerces and validates the value before adding it to the request. Fixed by 7d3cf924.
  • GHSA-jr45-8vmc-qm54: optional whitespace around = in qualified no-cache and private directives could bypass shared-cache restrictions and disclose authenticated data across users. Cache-Control parsing now normalizes these forms and applies conservative cache decisions. Fixed by c601fff1.
  • GHSA-8xcm-r25x-g524: the retry interceptor could expose a stale Content-Length after resuming a partial response, potentially causing downstream response desynchronization, hangs, or corruption. Undici now rejects partial responses whose Content-Length is inconsistent with Content-Range. Fixed by e11a68ed, with corrected fixtures in 2b3f7493.
  • GHSA-v3r7-h72x-cjcm: unsanitized domain and unparsed values passed to setCookie() could inject cookie attributes. Undici now validates cookie domains, paths, and unparsed attributes more strictly. Fixed by 10d93fc3.

Additional hardening

... (truncated)

Commits
  • c8d80e6 Bumped v8.10.0 (#5644)
  • 66923b4 fix: preserve DNS origin hostname on sockets (#5577)
  • 3926499 fix: retry refused HTTP/2 streams (#5598)
  • 73d6e9e fix(h2): detach upgrade close handler after GOAWAY (#5641)
  • b111adb fix(mock): emit request body lifecycle hooks (#5367)
  • ae4a3e3 build(deps): bump actions/setup-node from 6.4.0 to 7.0.0 (#5636)
  • ec3fbf1 build(deps): bump github/codeql-action/init from 4.36.2 to 4.37.3 (#5634)
  • 2151720 build(deps): bump ossf/scorecard-action from 2.4.3 to 2.4.4 (#5633)
  • b96a116 fix(interceptors): allow interceptors without opts.origin (#5628)
  • a18ef2d fix(mock): non-string path matchers under ignoreTrailingSlash, and DataView r...
  • Additional commits viewable in compare view

Updates openclaw from 2026.6.5 to 2026.8.1

Release notes

Sourced from openclaw's releases.

OpenClaw 2026.8.1

2026.8.1

2026.8.1 release notes

Update help: If the automatic update fails, use a local coding harness to help complete the update, diagnose any migration errors, and verify that the Gateway starts correctly. Back up your configuration and state before making changes.

Highlights

  • Find past conversations: search visible conversation text by exact words or phrases and reopen the surrounding messages from a matching result. (#105057, #105635, #105585) Thanks @​hercial61.
  • Sessions beyond your Gateway: run work on paired devices or cloud workers, move the session workspace with it, and reuse warm machines and project seeds for later cloud sessions. (#123280, #127752, #131744, #132374)
  • Follow work as it happens: keep a durable session progress card through reloads and follow subagent activity and accumulating edits across web and native chat. (#125125, #125438, #125442, #125444, #121549, #121840, #121815, #121813)
  • Answer clearly: respond to structured agent questions through web and native cards, messaging buttons, or plain text, with free-text alternatives and an explicit Skip path. (#109922, #110372, #130262) Thanks @​obviyus.
  • Interactive results and dashboards: use widgets in chat, pin them to session dashboards, grant specific actions or network origins, and export rendered views as images. (#101840, #108983, #110960, #127315) Thanks @​100yenadmin and @​hannesrudolph.
  • Private credential requests: let your agent request a credential through a masked prompt without putting its value in chat or model context, and use an opt-in proxy to limit protected-secret substitution to approved destinations. (#129670, #123216, #132122)
  • Approve recurring work once: grant an automation permission for an exact operation, inspect or revoke that permission later, and require a fresh approval when the job or operation changes. (#129526, #131602)
  • Richer audio and video: keep media attached to the conversation across uploads, generated replies, playback, and reloads, with native playback controls and video uploads on Apple and Android clients. (#115842, #116051, #116037)

Changes

  • OpenProse migration (breaking): remove the bundled OpenProse plugin and /prose command; run openclaw doctor --fix to clean stale configuration and follow the upstream Agent Skill migration, keeping existing .prose source files. (#128494) Thanks @​obviyus and @​vincentkoc.
  • OpenAI route migration (breaking): use openclaw doctor --fix to migrate shipped codex/* and openai-codex/* model refs, provider config, stored sessions, and automation routes to openai/*, retaining Codex runtime intent and flagging conflicts for operator repair. Thanks @​vincentkoc.
  • Upcoming deprecations (2026-09-01): external plugins should migrate ahead of the SDK removal gate: plugin-sdk-config-runtime-subpath moves to api.pluginConfig and the focused openclaw/plugin-sdk/config-mutation, openclaw/plugin-sdk/runtime-config-snapshot, or openclaw/plugin-sdk/config-contracts imports; plugin-sdk-channel-reply-pipeline-subpath and plugin-sdk-channel-lifecycle-subpath move to openclaw/plugin-sdk/channel-outbound; plugin-sdk-channel-message-subpath moves to openclaw/plugin-sdk/channel-outbound and openclaw/plugin-sdk/channel-inbound; plugin-sdk-infra-runtime-subpath moves to focused openclaw/plugin-sdk/ imports such as delivery-queue-runtime, diagnostic-runtime, error-runtime, exec-approvals-runtime, fetch-runtime, and ssrf-runtime, according to the helper used. These are upcoming gates, not removals in this release; see the SDK migration guide for per-helper mappings and remaining compatibility limits.
  • Official provider packages: install BytePlus, ComfyUI, Mistral, NovitaAI, OpenCode, Synthetic, Volcengine, Vydra, and Xiaomi as needed through onboarding. Recover missing configured packages with openclaw update repair or openclaw doctor --fix; complete requested capability review and restart the Gateway after explicit installation. OpenCode Go remains bundled. (#116866, #116888, #116919, #117007, #117035, #116720, #116854, #116813, #116861) Thanks @​vincentkoc.
  • Additional official packages: install Cohere and Meta providers, DuckDuckGo search, Voyage embeddings, and iMessage messaging as separate official plugins when needed; configured missing owners use the same explicit update, doctor, or install recovery flow. (#116662, #116740, #116785, #117101) Thanks @​vincentkoc.
  • OpenAI long-context opt-in: make expanded active-input context an explicit model configuration choice, keeping the runtime budget distinct from the model's native capacity and preserving configured overrides. (#112916)
  • Personal conversation recall: with Active Memory enabled, retrieve bounded same-agent private conversation context by default on personal installs without configured DM isolation; explicit controls can disable recall, and groups and channels remain excluded. (#110597)
  • Grounded dreaming: enable model-backed background memory consolidation by default, promoting provenance-qualified material into long-term memory with a Dream Diary and an explicit disable control. (#114819)
  • Automatic self-learning: capture strong reusable lessons and automatically apply scanner-approved new or Workshop-owned skills by default, while leaving user-authored skill changes pending and preserving explicit off or propose settings. (#115576)
  • Session reset default: keep conversations across idle periods and day boundaries when no reset policy is configured; retain explicit daily or idle policies and manual /new or /reset. (#111140)
  • CPU-scaled foreground concurrency: size default top-level agent concurrency from available CPU parallelism, bounded between 8 and 16 simultaneous runs, while preserving explicit operator limits. (#114047)
  • Explicit model allowlists: separate aliases and per-model settings from explicit modelPolicy.allow restrictions, with per-agent policies and provider wildcards; doctor migrates valid legacy restrictions without silently opening access when migration is incomplete. (#110888) Thanks @​vincentkoc.
  • Remembered model selection and explicit scopes: choose whether a model change affects this session, its agent, or the shared default; preserve existing surface behavior when no scope is set, including session-only Telegram callback picks and local TUI selection. (#115717, #127813) Thanks @​Marvinthebored and @​Peetiegonzalez.
  • Conversation-bound automations and loops: default new agent-turn automations to their originating conversation when creation has session context. Owner-only /loop supports fixed-interval or self-paced checks; context-free CLI/API creation stays isolated. (#114328)
  • Owner-directed ambient heartbeat: send ambient heartbeat alerts to a resolvable owner DM by default and skip unroutable ambient polls; configure an owner or explicit target instead of relying on a previous group conversation. (#121988) Thanks @​obviyus.
  • Named agent setup: choose the first agent name during interactive onboarding or with --agent-name, migrate legacy main-session history to its clear owner, and reuse main as an ordinary agent ID after required doctor repairs. (#123521, #123609, #123424, #123349)
  • Clearer plugin trust: review an external plugin's capabilities, source, version, and exact artifact before install or enablement, while keeping the previous plugin unchanged if you decline an update. (#130168) Thanks @​vincentkoc.
  • Plugin install provenance warnings: require --force for arbitrary executable plugin sources in CLI/chat installs. Trusted ClawHub, bundled, official-catalog, and tracked-update sources skip that provenance warning, but retain capability consent. Crestodian installs require trusted sources. (#102197) Thanks @​jesse-merhi.
  • Session permission modes: choose an explicit session permission mode and keep restricted filesystem access anchored to its recorded workspace or worktree, while newly created worktrees inherit configured policy unless a mode is selected. (#124909, #131547, #132989)
  • Team operator roles: assign verified users named roles that limit accessible agents, other people's sessions, and operator scopes, and optionally require sandboxed execution for newly created sessions; these are collaboration controls, not hostile-tenant isolation. (#128548, #129926)
  • Shared credential store: manage team-scoped secret and environment entries in SQLite through the CLI and Settings; keep secret values write-only, bind protected egress to declared hosts, and distinguish readable environment values from secrets. (#121559, #121724, #126088)
  • Optional 1Password broker: resolve curated SecretRefs or read selected 1Password fields with service-account auth, per-secret approval, and value-free audit. Agent-tool reads expose the selected value to the model for that execution. (#106133)
  • Usage statistics controls: offer opt-in feature statistics with the daily version check. Inspect payloads with openclaw telemetry show; disable statistics or all automatic update requests. Feature statistics default off. (#128476)
  • Incognito threads: keep Control UI conversation transcripts and compaction state in Gateway memory until restart, with memory flush off. Provider processing, diagnostic logs, and explicit tool writes retain their own behavior. (#113006) Thanks @​vincentkoc.
  • Guided onboarding: guide first-run setup through Custodian with structured option cards and native setup controls. (#109841, #110141, #114631) Thanks @​jesse-merhi.
  • Local model setup: offer model-download actions in web and macOS onboarding, prefer stronger available local models during detection, and provide lean mode for local runtimes. (#113476, #109250, #110596)
  • Quick Chat and desktop setup: add macOS dictation, paste-to-app and model controls, Linux agent switching and per-agent routing, and a more complete Linux onboarding flow. (#110994, #110285, #129815)
  • Cloud setup: select project-specific cloud worker defaults and see the active service, profile, machine resources, and worker-slot availability in placement controls. (#126238, #125696, #132405, #132394)
  • Cloud worker bootstrap: use the running Gateway’s verified runtime artifact for cloud nodes, aligning source builds and worker packages. Images need supported Node.js, npm, and registry access; reverse proxies must forward the authenticated bootstrap-artifact route. (#133037)
  • External supervision: set OPENCLAW_SUPERVISOR_MODE=external to let an external supervisor own Gateway restarts, service lifecycle, and updates without competing native service changes. (#109162, #119846, #121069) Thanks @​shakkernerd and @​vincentkoc.

... (truncated)

Changelog

Sourced from openclaw's changelog.

2026.8.1

Highlights

  • Find past conversations: search visible conversation text by exact words or phrases and reopen the surrounding messages from a matching result. (#105057, #105635, #105585) Thanks @​hercial61.
  • Sessions beyond your Gateway: run work on paired devices or cloud workers, move the session workspace with it, and reuse warm machines and project seeds for later cloud sessions. (#123280, #127752, #131744, #132374)
  • Follow work as it happens: keep a durable session progress card through reloads and follow subagent activity and accumulating edits across web and native chat. (#125125, #125438, #125442, #125444, #121549, #121840, #121815, #121813)
  • Answer clearly: respond to structured agent questions through web and native cards, messaging buttons, or plain text, with free-text alternatives and an explicit Skip path. (#109922, #110372, #130262) Thanks @​obviyus.
  • Interactive results and dashboards: use widgets in chat, pin them to session dashboards, grant specific actions or network origins, and export rendered views as images. (#101840, #108983, #110960, #127315) Thanks @​hannesrudolph.
  • Private credential requests: let your agent request a credential through a masked prompt without putting its value in chat or model context, and use an opt-in proxy to limit protected-secret substitution to approved destinations. (#129670, #123216, #132122)
  • Approve recurring work once: grant an automation permission for an exact operation, inspect or revoke that permission later, and require a fresh approval when the job or operation changes. (#129526, #131602)
  • Richer audio and video: keep media attached to the conversation across uploads, generated replies, playback, and reloads, with native playback controls and video uploads on Apple and Android clients. (#115842, #116051, #116037)

Changes

  • OpenProse migration (breaking): remove the bundled OpenProse plugin and /prose command; run openclaw doctor --fix to clean stale configuration and follow the upstream Agent Skill migration, keeping existing .prose source files. (#128494) Thanks @​obviyus and @​vincentkoc.
  • OpenAI route migration (breaking): use openclaw doctor --fix to migrate shipped codex/* and openai-codex/* model refs, provider config, stored sessions, and automation routes to openai/*, retaining Codex runtime intent and flagging conflicts for operator repair. Thanks @​vincentkoc.
  • Upcoming deprecations (2026-09-01): external plugins should migrate ahead of the SDK removal gate: plugin-sdk-config-runtime-subpath moves to api.pluginConfig and the focused openclaw/plugin-sdk/config-mutation, openclaw/plugin-sdk/runtime-config-snapshot, or openclaw/plugin-sdk/config-contracts imports; plugin-sdk-channel-reply-pipeline-subpath and plugin-sdk-channel-lifecycle-subpath move to openclaw/plugin-sdk/channel-outbound; plugin-sdk-channel-message-subpath moves to openclaw/plugin-sdk/channel-outbound and openclaw/plugin-sdk/channel-inbound; plugin-sdk-infra-runtime-subpath moves to focused openclaw/plugin-sdk/ imports such as delivery-queue-runtime, diagnostic-runtime, error-runtime, exec-approvals-runtime, fetch-runtime, and ssrf-runtime, according to the helper used. These are upcoming gates, not removals in this release; see the SDK migration guide for per-helper mappings and remaining compatibility limits.
  • Official provider packages: install BytePlus, ComfyUI, Mistral, NovitaAI, OpenCode, Synthetic, Volcengine, Vydra, and Xiaomi as needed through onboarding. Recover missing configured packages with openclaw update repair or openclaw doctor --fix; complete requested capability review and restart the Gateway after explicit installation. OpenCode Go remains bundled. (#116866, #116888, #116919, #117007, #117035, #116720, #116854, #116813, #116861) Thanks @​vincentkoc.
  • Additional official packages: install Cohere and Meta providers, DuckDuckGo search, Voyage embeddings, and iMessage messaging as separate official plugins when needed; configured missing owners use the same explicit update, doctor, or install recovery flow. (#116662, #116740, #116785, #117101) Thanks @​vincentkoc.
  • OpenAI long-context opt-in: make expanded active-input context an explicit model configuration choice, keeping the runtime budget distinct from the model's native capacity and preserving configured overrides. (#112916)
  • Personal conversation recall: with Active Memory enabled, retrieve bounded same-agent private conversation context by default on personal installs without configured DM isolation; explicit controls can disable recall, and groups and channels remain excluded. (#110597)
  • Grounded dreaming: enable model-backed background memory consolidation by default, promoting provenance-qualified material into long-term memory with a Dream Diary and an explicit disable control. (#114819)
  • Automatic self-learning: capture strong reusable lessons and automatically apply scanner-approved new or Workshop-owned skills by default, while leaving user-authored skill changes pending and preserving explicit off or propose settings. (#115576)
  • Session reset default: keep conversations across idle periods and day boundaries when no reset policy is configured; retain explicit daily or idle policies and manual /new or /reset. (#111140)
  • CPU-scaled foreground concurrency: size default top-level agent concurrency from available CPU parallelism, bounded between 8 and 16 simultaneous runs, while preserving explicit operator limits. (#114047)
  • Explicit model allowlists: separate aliases and per-model settings from explicit modelPolicy.allow restrictions, with per-agent policies and provider wildcards; doctor migrates valid legacy restrictions without silently opening access when migration is incomplete. (#110888) Thanks @​vincentkoc.
  • Remembered model selection and explicit scopes: choose whether a model change affects this session, its agent, or the shared default; preserve existing surface behavior when no scope is set, including session-only Telegram callback picks and local TUI selection. (#115717, #127813) Thanks @​Marvinthebored and @​Peetiegonzalez.
  • Conversation-bound automations and loops: default new agent-turn automations to their originating conversation when creation has session context. Owner-only /loop supports fixed-interval or self-paced checks; context-free CLI/API creation stays isolated. (#114328)
  • Owner-directed ambient heartbeat: send ambient heartbeat alerts to a resolvable owner DM by default and skip unroutable ambient polls; configure an owner or explicit target instead of relying on a previous group conversation. (#121988) Thanks @​obviyus.
  • Named agent setup: choose the first agent name during interactive onboarding or with --agent-name, migrate legacy main-session history to its clear owner, and reuse main as an ordinary agent ID after required doctor repairs. (#123521, #123609, #123424, #123349)
  • Clearer plugin trust: review an external plugin's capabilities, source, version, and exact artifact before install or enablement, while keeping the previous plugin unchanged if you decline an update. (#130168) Thanks @​vincentkoc.
  • Plugin install provenance warnings: require --force for arbitrary executable plugin sources in CLI/chat installs. Trusted ClawHub, bundled, official-catalog, and tracked-update sources skip that provenance warning, but retain capability consent. Crestodian installs require trusted sources. (#102197) Thanks @​jesse-merhi.
  • Session permission modes: choose an explicit session permission mode and keep restricted filesystem access anchored to its recorded workspace or worktree, while newly created worktrees inherit configured policy unless a mode is selected. (#124909, #131547, #132989)
  • Team operator roles: assign verified users named roles that limit accessible agents, other people's sessions, and operator scopes, and optionally require sandboxed execution for newly created sessions; these are collaboration controls, not hostile-tenant isolation. (#128548, #129926)
  • Shared credential store: manage team-scoped secret and environment entries in SQLite through the CLI and Settings; keep secret values write-only, bind protected egress to declared hosts, and distinguish readable environment values from secrets. (#121559, #121724, #126088)
  • Optional 1Password broker: resolve curated SecretRefs or read selected 1Password fields with service-account auth, per-secret approval, and value-free audit. Agent-tool reads expose the selected value to the model for that execution. (#106133)
  • Usage statistics controls: offer opt-in feature statistics with the daily version check. Inspect payloads with openclaw telemetry show; disable statistics or all automatic update requests. Feature statistics default off. (#128476)
  • Incognito threads: keep Control UI conversation transcripts and compaction state in Gateway memory until restart, with memory flush off. Provider processing, diagnostic logs, and explicit tool writes retain their own behavior. (#113006) Thanks @​vincentkoc.
  • Guided onboarding: guide first-run setup through Custodian with structured option cards and native setup controls. (#109841, #110141, #114631) Thanks @​jesse-merhi.
  • Local model setup: offer model-download actions in web and macOS onboarding, prefer stronger available local models during detection, and provide lean mode for local runtimes. (#113476, #109250, #110596)
  • Quick Chat and desktop setup: add macOS dictation, paste-to-app and model controls, Linux agent switching and per-agent routing, and a more complete Linux onboarding flow. (#110994, #110285, #129815)
  • Cloud setup: select project-specific cloud worker defaults and see the active service, profile, machine resources, and worker-slot availability in placement controls. (#126238, #125696, #132405, #132394)
  • Cloud worker bootstrap: use the running Gateway’s verified runtime artifact for cloud nodes, aligning source builds and worker packages. Images need supported Node.js, npm, and registry access; reverse proxies must forward the authenticated bootstrap-artifact route. (#133037)
  • External supervision: set OPENCLAW_SUPERVISOR_MODE=external to let an external supervisor own Gateway restarts, service lifecycle, and updates without competing native service changes. (#109162, #119846, #121069) Thanks @​shakkernerd and @​vincentkoc.
  • ClickClack setup and commands: connect ClickClack with a one-use expiring setup code, verify the account immediately, and publish native command menus at Gateway startup when the token has commands:write. (#107907, #109398) Thanks @​shakkernerd.
  • Memory migration: offer detected Claude Code, Codex, and Hermes memory imports during CLI, macOS, and Linux onboarding. (#108977)
  • Plugin uninstall cleanup: remove exact recorded install paths from plugins.load.paths for marketplace, npm, and other managed installs while preserving parent, child, prefix, and unrelated paths. (#118930) Thanks @​vincentkoc.
  • Recoverable backups: schedule recorded database backups, keep versioned snapshots in an operator-owned Git repository, and restore a verified full archive into a fresh staging directory. (#122485, #122750)
  • Shared Gateway profiles: manage display names and avatars, see who is online, and retain session-creator attribution with person filters. (#111224, #111421, #111501, #112658) Thanks @​joshavant.

... (truncated)

Commits
  • ea80657 chore(release): refresh 2026.8.1 final changelog
  • e1199b1 fix(plugin-sdk): preserve shipped caller contracts
  • 6866c58 chore(release): finalize 2026.8.1 changelog
  • 061bffd test: include Android approval in publish workflow routing
  • 8be657d fix: keep Android publication independent of core release
  • da582d9 fix: allow Android releases from protected publish tags
  • ce39365 fix: package oversized release contribution records without losing notes
  • f2fae49 docs: finalize 2026.8.1 release notes
  • 131fbd6 test(agents): use real admission and durable sessions in runner fixtures
  • beb07f5 fix(agents): preserve native session accounting at finalization
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
chore(deps): bump undici and openclaw in /openclaw
69633a3 
Bumps [undici](https://github.com/nodejs/undici) to 8.10.0 and updates ancestor dependency [openclaw](https://github.com/openclaw/openclaw). These dependencies need to be updated together.


Updates `undici` from 8.3.0 to 8.10.0
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v8.3.0...v8.10.0)

Updates `openclaw` from 2026.6.5 to 2026.8.1
- [Release notes](https://github.com/openclaw/openclaw/releases)
- [Changelog](https://github.com/openclaw/openclaw/blob/v2026.8.1/CHANGELOG.md)
- [Commits](openclaw/openclaw@v2026.6.5...v2026.8.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 8.10.0
  dependency-type: indirect
- dependency-name: openclaw
  dependency-version: 2026.8.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 31, 2026
@omarshahine

omarshahine commented Aug 31, 2026

Copy link
Copy Markdown
Owner

@dependabot recreate

@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@omarshahine

omarshahine commented Sep 1, 2026

Copy link
Copy Markdown
Owner

@dependabot recreate

@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

The dependabot.yml entry that created this PR has been deleted so this PR can't be recreated. Please close the PR so Dependabot can create a new one with the current dependabot.yml.

@omarshahine

omarshahine commented Sep 1, 2026

Copy link
Copy Markdown
Owner

Closing rather than recreating again. These are pre-grouping security PRs: each edits the same lockfile as its sibling, so merging one conflicts the other, @dependabot recreate rebuilds them, and the next merge breaks them again — this pair went round that loop twice tonight.

The repo now has applies-to: security-updates grouping, so Dependabot will re-raise these as one PR per directory instead of two that fight. No advisory is dropped by closing them.

@omarshahine omarshahine closed this Sep 1, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 1, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/openclaw/multi-1214756ae4 branch September 1, 2026 00:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omarshahine