[dependabot]

Bumps the dev-dependencies group with 2 updates in the / directory: openclaw and typescript-eslint.

Updates openclaw from 2026.10.4 to 2026.10.6

Release notes

Sourced from openclaw's releases.

openclaw 2026.10.6

2026.10.6

Highlights

• Patched Node runtime required: OpenClaw now requires Node 24.22.1+ on the 24 line or 26.12.1+ on the 26 line, which reject TLS chains signed with the compromised certificate keys addressed in the October 2026 Node.js security releases. Docker images ship Node 24.22.1, installers select the patched runtimes, and openclaw update refuses with recovery guidance before installing on an older Node instead of breaking the running install. Source builds now pin pnpm 12.15.0. (#179992) Thanks @​joshavant.
• Safer updates and recovery: package swaps now refuse unsafe service states, Windows and macOS package-manager updates recover from platform-specific failures, and frozen Gateway startup owners can be retired cleanly. (#171101, #170940, #171936, #171678) Thanks @​RomneyDa, @​homeworld520, @​Yolo521-bot, @​stop-time, @​AntaresGG, and @​TommyLei666.
• Data-preserving migrations and backups: Doctor and migration paths now refuse malformed or lossy workspace imports, preserve malformed Notes bytes, reject unsafe non-UTF-8 wiki rewrites, keep deeply nested SQLite backups, and retain staging evidence when restore inspection fails. (#172293, #172953, #172742, #174573, #168583, #170867, #172028) Thanks @​wangmiao0668000666, @​RomneyDa, @​Leon-SK668, @​ericcurtin, @​Yolo521-bot, @​obviyus, and @​altaywtf.
• Reliable delivery across restarts: queued turns, watched child results, dead-lettered deliveries, and streamed replies now survive recovery without disappearing, duplicating, or producing false missing-answer notices. (#170384, #169489, #169932, #173798) Thanks @​RomneyDa, @​huyengiang101086-spec, and @​Yolo521-bot.
• Provider and model resilience: GPT-5.6 tool turns, OpenRouter DeepSeek tool calls, LM Studio overflow recovery, parallel OpenAI reasoning settings, and model retry/fallback budgets now behave consistently. (#176709, #175058, #169189, #169322, #164808) Thanks @​RomneyDa, @​Linux2010, @​ZhimingQ, @​xpeng5278-web, and @​anyech.
• Windows and mobile stability: fresh Windows state stores, Proxy-backed environments, and stored Anthropic credentials no longer block startup, while iOS Talk and chat connectivity recover from first-reply and timeout failures. (#176174, #176194, #174571, #168416, #169912) Thanks @​RomneyDa, @​tjarrau-dev, @​skyzhao1223, @​easyteacher, @​scalesmart, @​masatohoshino, @​Takhoffman, and @​Solvely-Colin.
• Agent and tool-call recovery: unfinished tools now time out visibly, context overflow compacts after steered tool results, malformed calls continue after earlier refusals, large patch hunks avoid argument-limit crashes, and stopped yielded tasks stay stopped. (#172983, #172019, #170615, #174477, #169453) Thanks @​RomneyDa, @​budzation, @​mirasrael, @​r3n3x, @​freeqaz-openai, and @​obviyus.
• Channel delivery correctness: WhatsApp retries and stickers, Telegram albums and dual-stack replies, Slack relay recovery, and Discord voice-call replies no longer lose or duplicate messages. (#142434, #164210, #163926, #171564, #173407, #172380) Thanks @​ashawwal, @​RomneyDa, @​andrewwbuilds, @​abacha, @​Dat1GUI, @​brainmonger, @​obviyus, and @​vincentkoc.
• Worker and worktree recovery: hosts reclaim worker capacity after reboot, partial-clone worktrees repair missing objects, and child-result and exec-wake evidence survives Gateway restarts. (#168863, #168864, #169489, #169645) Thanks @​RomneyDa.

Changes

• This patch release contains focused reliability fixes only; it does not introduce new user-facing features.

Fixes

• State and system-agent recovery: restore access to agents held by affected upgrades, recover held system-agent databases after schema changes, and preserve live configuration when forensic snapshots fail. (#175007, #176783, #171217) Thanks @​RomneyDa, @​PennyVibe, and @​Yolo521-bot.
• Windows state and updates: canonicalize schema ownership across path aliases, serialize Proxy-backed environments before inspection IPC, hide SQLite helper windows during update work, and recognize native Scheduled Task permission failures in every locale. (#176174, #176194, #174969, #178624) Thanks @​RomneyDa, @​tjarrau-dev, @​skyzhao1223, @​easyteacher, and @​throwingbones.
• macOS companion execution: honor long command and approval deadlines across the companion socket, classify late or lost replies without replaying submitted commands, and preserve native permission details. (#172117) Thanks @​holgergruenhagen, @​RomneyDa, @​ylcn91, and @​Colton-Harris.
• Doctor and managed plugins: repair empty retired-plugin metadata, clear resolved migration warnings, and converge app-managed plugins onto the installed core version. (#173851, #177096, #174257) Thanks @​RomneyDa, @​fengfan201314-eng, @​ScientificProgrammer, @​yinx65588-boop, @​jj5638521, and @​kazuyuki-eguchi.
• Update diagnostics: preserve FRV blockers, explain package-journal identity and runtime-retention failures, and avoid cleanup stalls on shared recovery manifests. (#171186, #170385, #169280, #174249) Thanks @​vincentkoc, @​RomneyDa, @​astapenkoav, @​council10-kera, and @​shoaibulhaque.
• SQLite correctness: preserve transaction outcomes when warning handlers throw, settle peer closes after shared-worker refusal, and prevent retired cache generations from taking worker ownership. (#157151, #173813, #172798) Thanks @​vincentkoc and @​RomneyDa.
• Reply recovery: preserve side-question and immediate fallback ordering, avoid repeated or missing answers after streamed delivery, and keep stopped yielded tasks from restarting. (#174869, #169305, #173798, #169453) Thanks @​RomneyDa and @​freeqaz-openai.
• Codex and native sessions: release stalled startup waits and completed subagents after cancellation or cleanup failures, preserve conversations across runtime restarts, keep workspace bindings across reply resets, and settle recovered child binding writes before session readiness. (#168347, #173547, #166368, #160549, #177564) Thanks @​RomneyDa, @​Kimiyu-186, @​alkor2000, @​jhgaylor, @​vincentkoc, @​jjjhenriksen, and @​obviyus.
• Gateway lifecycle: retain restart custody, avoid stop-time lease deadlocks, recover worker capacity after reboot, and preserve suppressed-channel configuration across reloads. (#172852, #171308, #168863) Thanks @​RomneyDa.
• CLI and process diagnostics: preserve JSON output on Gateway command exits, report resource-disposal and PTY EOF failures, and surface failed diagnostic writes without crashing. (#176795, #173566, #176362, #174622) Thanks @​vincentkoc and @​RomneyDa.
• Scheduled follow-ups: same-conversation follow-ups scheduled from an authorized operator turn keep that operator's current authority when they run, and one-shot continuations can call next_check to check back later. (#176422)
• Media and TTS: time out slow hosted speech synthesis and report playback cache, probe, and quota failures rather than silently dropping cleanup errors. (#175614, #175634, #174668) Thanks @​RomneyDa.

Complete contribution record

This audited record covers the complete v2026.10.5..bba7238a1be3a0d4e92c371988f94e81011a06b2 history: 293 in-range PRs + 0 retained seed-only PRs = 293 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #176194 Related #176111. Thanks @​skyzhao1223 and @​RomneyDa and @​easyteacher.
• PR #176174 Related #176163. Thanks @​RomneyDa and @​tjarrau-dev.
• PR #175007 Thanks @​RomneyDa.
• PR #176783 Related #176669. Thanks @​RomneyDa and @​PennyVibe.
• PR #171101 Related #170774, #171036. Thanks @​RomneyDa and @​homeworld520 and @​Yolo521-bot.
• PR #171217 Related #171187. Thanks @​RomneyDa and @​Yolo521-bot.
• PR #171678 Related #171513. Thanks @​RomneyDa and @​TommyLei666.
• PR #173851 Related #173659. Thanks @​RomneyDa and @​fengfan201314-eng.
• PR #174257 Related #174120. Thanks @​RomneyDa and @​kazuyuki-eguchi.
• PR #174969 Related #174906. Thanks @​RomneyDa and @​throwingbones.

... (truncated)

Changelog

Sourced from openclaw's changelog.

Changelog

Release notes: https://docs.openclaw.ai/releases

Each release has its complete changelog below. Audited contribution records are retained separately when available.

• Unreleased · Raw
• 2026.10.7 · Raw
• 2026.10.6 · Raw
• 2026.10.5 · Raw
• 2026.10.4 · Raw
• 2026.10.3 · Raw
• 2026.10.2 · Raw
• 2026.10.1 · Raw
• 2026.9.9 · Raw
• 2026.9.8 · Raw
• 2026.9.7 · Raw
• 2026.9.6 · Raw
• 2026.9.5 · Raw
• 2026.9.4 · Raw
• 2026.9.3 · Raw
• 2026.9.2 · Raw
• 2026.9.1 · Raw
• 2026.8.2 · Raw
• 2026.8.1 · Raw
• 2026.7.1 · Raw
• 2026.6.11 · Raw
• 2026.6.10 · Raw
• 2026.6.9 · Raw
• 2026.6.8 · Raw
• 2026.6.7 · Raw
• 2026.6.6 · Raw
• 2026.6.5 · Raw
• 2026.6.2 · Raw
• 2026.6.1 · Raw
• 2026.5.31 · Raw
• 2026.5.28 · Raw
• 2026.5.27 · Raw
• 2026.5.26 · Raw
• 2026.5.22 · Raw
• 2026.5.20 · Raw
• 2026.5.19 · Raw
• 2026.5.17 · Raw
• 2026.5.14 · Raw
• 2026.5.12 · Raw
• 2026.5.7 · Raw
• 2026.5.6 · Raw
• 2026.5.5 · Raw

... (truncated)

Commits

• fe06181 docs(changelog): drop the internal thanks handle from the scheduled follow-up...
• d3449d0 test(update): provision a supported private Node in the live runtime proof
• ba45176 fix(ui): carry main's translations for the patched worker image help
• 4ada23b fix(release): keep the publish changelog gate helper private
• a908882 fix(security): require patched Node and native pnpm runtimes (#179992)
• 8f86f0d docs(changelog): note the Node runtime floor and scheduled follow-up authorit...
• 31a1f56 test(ui): settle web-push waits on real events instead of polling (#180235)
• 78cd266 test(agents): prove live compaction from the successful direct read (#180236)
• 5c0d399 fix: scheduled follow-ups lose authorized task access (#176422)
• b08e0a0 fix(release): refuse publish FRV dispatch when candidate changelog gates fail...
• Additional commits viewable in compare view

Updates typescript-eslint from 8.71.2 to 8.72.0

Release notes

Sourced from typescript-eslint's releases.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from typescript-eslint's changelog.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• a4c2603 chore(release): publish 8.72.0
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: BlockRunAI/ClawRouter
• Branch: main
• File: .coderabbit.yaml
• Commit: 9a1197a
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: 285cdfa1-b71a-4e6a-9cd6-2c329a543498

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[VickyXAI]

@dependabot rebase