Prepare OpenClaw 2026.7.1-2 compatibility release - #392
Conversation
Bundle Size Report
|
|
🔄 New commits pushed 1 new commits (+124 / -101) Latest commits:• b0c6fbb Prepare OpenClaw 2026.7.1-2 compatibility release (Mark Goldenstein) |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48e24af899
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Swish! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
2026.7.1-2as the install, plugin API, Gateway, and peer dependency floor so both the correction release and higher-precedence stable2026.7.1satisfy the published contractfast-uri3.1.5 and Hono 4.12.34 to clear the production dependency advisorieshono@4.12.34through the 24-hour release-age quarantine with a documented, machine-checked exception that expires on 2026-08-05Why
OpenClaw 2026.7.1-2 only normalizes singleton-array output from newer
npm view --jsonclients while continuing to reject ambiguous multi-version metadata. The plugin's exact build metadata and development dependency previously identified 2026.7.1. Published compatibility metadata now uses the correction release itself as the floor because a standard SemVer>=2026.7.1peer range excludes2026.7.1-2;>=2026.7.1-2accepts both that correction release and stable2026.7.1.The production graph also resolved vulnerable
fast-uriand Hono versions through the MCP SDK. The patchedfast-urirelease had aged into policy; the patched Hono release was still inside the repository's release-age window. The exact Hono exception preserves the default quarantine for every other package and fails verification after its removal deadline.Validation
pnpm install --frozen-lockfilepnpm verify(98 test files)pnpm smoke:backend-paritypnpm smoke:codex-worktreespnpm test:integ:crabboxpnpm check-plugin-securitypnpm run validate:release-metadata -- 4.7.7pnpm audit:prod(no known vulnerabilities)npm pack --dry-rungit diff --checkThis PR does not upgrade or reconfigure the host, restart Gateway, publish a release, deploy the plugin, or close the release-monitor event.