Skip to content

docs: add v0.0.91 release changelog #7376

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cv merged 2 commits into from
Jul 22, 2026
Merged

docs: add v0.0.91 release changelog #7376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9f12096
docs: add v0.0.91 release changelog
apurvvkumaria Jul 22, 2026
8b86da6
Merge branch 'main' into codex/docs-v0.0.91-catch-up
cjagwani Jul 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/changelog/2026-07-20.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
NemoClaw v0.0.90 keeps managed-image routing identifiers out of secret-shaped build arguments, remediates reviewed OpenClaw dependency vulnerabilities, restores provider-reset recovery, corrects WhatsApp health reporting, and aligns DGX Station guidance with the versioned installer.

- Managed OpenClaw, Hermes, and Deep Agents images now use `NEMOCLAW_INFERENCE_PROVIDER_ID` for the non-secret inference route selector, while provider credentials stay in OpenShell storage and the host-side credential alias remains unchanged.
Existing custom images can use the legacy selector through v0.0.90 and should migrate before the fallback is removed in v0.0.91.
Existing custom images can still use the legacy selector in v0.0.91, but should migrate to `NEMOCLAW_INFERENCE_PROVIDER_ID` before the compatibility fallback is removed in a future release.

@coderabbitai coderabbitai Bot Jul 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📐 Maintainability & Code Quality | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

printf '\n== docs/changelog/2026-07-20.mdx ==\n'
sed -n '1,80p' docs/changelog/2026-07-20.mdx | cat -n

printf '\n== docs/changelog/2026-07-22.mdx ==\n'
sed -n '1,120p' docs/changelog/2026-07-22.mdx | cat -n

printf '\n== docs/reference/commands.mdx (matching lines) ==\n'
rg -n "NEMOCLAW_INFERENCE_PROVIDER_ID|legacy selector|compatibility fallback|v0\.0\.91" docs/reference/commands.mdx docs/changelog/2026-07-20.mdx docs/changelog/2026-07-22.mdx

Repository: NVIDIA/NemoClaw

Length of output: 12348

Keep the v0.0.90 entry historical.

Line 11 backdates v0.0.91 compatibility and removal timing into the v0.0.90 release note. Keep that migration note in the v0.0.91 changelog or the live commands reference instead.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/changelog/2026-07-20.mdx` at line 11, Remove the v0.0.91 compatibility
and removal-timing migration note from the v0.0.90 changelog entry, preserving
that entry as historical. Move the guidance to the v0.0.91 changelog entry or
the live commands reference.

Source: Learnings

For more information, refer to the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
- OpenClaw core, Slack, and Microsoft Teams installations now replace reviewed vulnerable transitive packages with integrity-verified remediated versions while retaining the `openclaw@2026.6.10` release pin.
Archive validation fails closed, and the dependency audit records the remaining reviewed low- and moderate-severity findings.
Expand Down
22 changes: 22 additions & 0 deletions docs/changelog/2026-07-22.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
{/*
* SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
* SPDX-License-Identifier: Apache-2.0
*/}

## v0.0.91

NemoClaw v0.0.91 strengthens completed sandbox images, makes rebuild replacement safer, documents the Hermes API token lifecycle, expands qualified DGX Station guidance, and restores historical release validation.

- Completed OpenClaw, Hermes, and Deep Agents Code images now replace affected `node-tar` installations with reviewed versions and scan the final filesystem before publication.
Current and historical OpenClaw security-revision verifiers also validate exact dependency versions, resolved archives, integrity metadata, executable identity, and transactional state restoration in constrained containers.
For more information, refer to the [OpenClaw 2026.6.10 Dependency Review](https://github.com/NVIDIA/NemoClaw/blob/main/docs/security/openclaw-2026.6.10-dependency-review.md).
- Rebuilds now carry validated local-base trust through Deep Agents Code image preparation, reuse the outer state backup during inner onboarding, and wait for OpenShell to confirm sandbox deletion before removing registry state or creating a replacement.
These checks prevent rebuild from rejecting its own current base, taking a second backup against stale gateway state, or racing an asynchronous sandbox deletion.
For more information, refer to [Recover and Rebuild Sandboxes](/user-guide/openclaw/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes) and the [NemoClaw CLI Commands Reference](/user-guide/openclaw/reference/commands).
- Hermes guidance now explains when the API bearer token remains stable, when rebuild or invalid state rotates it, and how to retrieve the current value with `nemohermes <sandbox> gateway-token --quiet` instead of reading the generated environment file.
For more information, refer to the [NemoHermes CLI Commands Reference](/user-guide/hermes/reference/commands) and [Recover and Rebuild Sandboxes](/user-guide/hermes/manage-sandboxes/operate-sandboxes/recover-and-rebuild-sandboxes).
- DGX Station documentation now records qualified single-system GB300 profiles as tested with limitations while keeping dual-Station and dedicated-CI gaps explicit.
Coding-agent guidance also constructs non-interactive installs with explicit agent, provider, and release-tag variables and keeps Docker approval command-scoped.
For more information, refer to [Platform Support and Launch Claims](/user-guide/openclaw/reference/platform-support), [Prepare DGX Station to Install NemoClaw](/user-guide/openclaw/get-started/additional-setup/dgx-station-preparation), and the [NemoClaw Quickstart with OpenClaw](/user-guide/openclaw/get-started/quickstart).
- Historical OpenClaw gateway-upgrade and Hermes rebuild fixtures now use immutable reviewed inputs that match each pinned release's contract.
This restores deterministic coverage for legacy image upgrades, Hermes token rotation, stale-base replacement, and completed-image security checks without weakening production validation.
4 changes: 2 additions & 2 deletions docs/reference/commands.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -690,9 +690,9 @@ All NemoClaw build arguments (`NEMOCLAW_MODEL`, `NEMOCLAW_INFERENCE_PROVIDER_ID`
`NEMOCLAW_INFERENCE_PROVIDER_ID` is a non-secret inference route identifier (for example `inference` for proxied providers, or a provider family such as `openai`), never a credential; provider credentials stay in OpenShell provider storage.
It replaces the former `NEMOCLAW_PROVIDER_KEY` image argument, whose secret-shaped name triggered a BuildKit `SecretsUsedInArgOrEnv` warning.
The host-side `NEMOCLAW_PROVIDER_KEY` credential alias is unchanged; this migration only renames the managed image route selector.
Custom Dockerfiles that declare either `ARG NEMOCLAW_INFERENCE_PROVIDER_ID` or the legacy `ARG NEMOCLAW_PROVIDER_KEY` keep working through v0.0.90.
Custom Dockerfiles that declare either `ARG NEMOCLAW_INFERENCE_PROVIDER_ID` or the legacy `ARG NEMOCLAW_PROVIDER_KEY` continue working in v0.0.91.
NemoClaw updates whichever supported declaration is present, and runtime consumers read the legacy name as a fallback.
Rename the legacy `ARG`/`ENV` declaration to `NEMOCLAW_INFERENCE_PROVIDER_ID` before legacy support is removed in v0.0.91.
Rename the legacy `ARG`/`ENV` declaration to `NEMOCLAW_INFERENCE_PROVIDER_ID`; the legacy fallback is retained for compatibility in this release and may be removed in a future release.

Custom Dockerfiles must declare `ARG NEMOCLAW_TOOL_DISCLOSURE=progressive` exactly once in the final build stage and promote it into that stage's runtime environment.
The usual runtime contract is:
Expand Down
Loading