Prepare OpenClaw 2026.7.1-2 compatibility release - #392
Conversation
Bundle Size Report
|
|
🔄 New commits pushed 1 new commits (+124 / -101) Latest commits:• b0c6fbb Prepare OpenClaw 2026.7.1-2 compatibility release (Mark Goldenstein) |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48e24af899
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3bd67007e5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Follow-up to #392 after a late exact-head Codex review identified that npm ignores `overrides` declared by installed dependencies. This patch release fix: - replaces ineffective published overrides with exact runtime dependencies and a published npm shrinkwrap - pins the Claude/MCP runtime graph, including patched fast-uri, Hono, ip-address, node-server, and express-rate-limit versions - verifies the packed artifact in an isolated npm consumer and audits that resolved graph - applies the repository 24-hour release-age policy to every shrinkwrapped package and rejects undocumented exclusions - adds bounded ClawHub post-publish verification backoff after the v4.7.7 propagation race - bumps release metadata to 4.7.8 Verified locally: - `pnpm verify` (98 test files) - `pnpm check-plugin-security` - `pnpm verify:npm-consumer` - `pnpm validate:release-metadata -- 4.7.8` - `pnpm audit` and `pnpm audit --prod` - `actionlint` and `git diff --check` No host plugin install, Gateway config change, restart, publish, or deploy was performed locally.
1 participant
Summary
2026.7.1-2as the install, plugin API, Gateway, and peer dependency floor so both the correction release and higher-precedence stable2026.7.1satisfy the published contractfast-uri, Hono, andip-address, plus patched development-graph versions ofprotobufjs,tar, andundiciminimumReleaseAge: 1440; remove the expired Hono exception after the patched release aged through quarantineWhy
OpenClaw 2026.7.1-2 only normalizes singleton-array output from newer
npm view --jsonclients while continuing to reject ambiguous multi-version metadata. The plugin's exact build metadata and development dependency previously identified 2026.7.1. Published compatibility metadata now uses the correction release itself as the floor because a standard SemVer>=2026.7.1peer range excludes2026.7.1-2;>=2026.7.1-2accepts both that correction release and stable2026.7.1.The dependency graph also resolved vulnerable transitive versions through the Claude/MCP and OpenClaw development graphs. All selected patched releases have aged beyond the 24-hour quarantine. The release-age guard now fails if the repository-wide 1440-minute policy is removed or reduced, and still rejects malformed, ranged, or expired security exceptions.
Validation
pnpm install --frozen-lockfilepnpm verify(98 test files)pnpm audit(no known vulnerabilities)pnpm audit --prod(no known vulnerabilities)pnpm run validate:release-metadata -- 4.7.7npm pack --dry-rungit diff --checkThis PR does not upgrade or reconfigure the host, restart Gateway, install the plugin locally, publish a release, deploy the plugin, or close the release-monitor event.