[dependabot]

Bumps openclaw/clawhub/.github/workflows/skill-publish.yml from 0.23.3 to 0.24.1.

Release notes

Sourced from openclaw/clawhub/.github/workflows/skill-publish.yml's releases.

clawhub 0.24.1

0.24.1 - 2026-10-28

Fixes

• CLI/API: let authorized skill owners inspect the publication state of an exact held version, including failed checks and active retries, without exposing private uploads publicly. Avoid reporting a clean older release as the held version's result, and fail file reads until that version is available.

Compatibility

• The CLI includes Plugin Inspector 0.4.3 and requires Node.js 22.13+ on the 22.x line or Node.js 24+.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.24.1
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.24.1.tgz
• integrity: sha512-je0nAOJvXBhA1WaIwLFL+9MKDNQBhu+23N074pvB3s8XCKAOV/QfjgWCr8Co2AGCGO8yE0KmllfUOqPs2CDTlQ==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/40642033913
• npm publish: https://github.com/openclaw/clawhub/actions/runs/40642249975
• Installed npm CLI and production verification

The signed npm publish was accepted while npm processed the version. The workflow’s short post-publish metadata wait expired; the public registry artifact and installed CLI were verified afterward.

Changelog

Sourced from openclaw/clawhub/.github/workflows/skill-publish.yml's changelog.

Changelog

Unreleased

• Publishing: prepare staged ClawPacks in the Node runtime so large archives can reach package validation without exhausting the HTTP action memory limit.

• Scanning: stop classifying Manifest V3 browser host permissions as installation sources while retaining checks for install URLs elsewhere in the manifest.

• CI: speed up the Linux root typecheck with pinned tsrs while retaining native TypeScript for local checks and package builds.

• skills.sh: sync once a day at 03:00 Pacific and mirror the top 4,000 rows of the all-time and trending views, so the sync completes again after skills.sh expanded its default feed to ~93k rows; Trending keeps the last skills.sh run for up to 50 hours.

• Workers: include bounded, redacted skill evaluation failure reasons in CI logs so operators can diagnose failed runs.

• Tooling: accept Bun's environment-file loading diagnostic in local dependency audits while preserving tool-error and malware failures.

• Plugins: show informational notices for OpenClaw APIs with scheduled retirement dates, with replacement details and a publisher dashboard nudge.

• Dependencies: update Plugin Inspector to 0.4.0 in the app and CLI to retain structured API retirement guidance; the CLI now requires Node.js 22.13+ on the 22.x line or Node.js 24+.

• CLI/Scans: load Plugin Inspector only for validation, select Node.js 24 for hosted Convex actions, and run bulk scans under Node.js; ordinary Bun CLI commands remain available, while local plugin validation explains its Node.js requirement.

• Dependencies: patch vulnerable DOMPurify, Next.js preview tooling, shell-quote, and source-map-js versions.

• Dependencies: refresh supported React, TanStack, Radix, email, CLI utility, lint, format, and test packages while retaining the current Node and compiler compatibility contracts.

• Tests: update Vitest and its V8 coverage provider together to 5.0.3; retain registered auth callbacks across per-test mock cleanup.

• Tests: update jsdom to 30.1.2 and allow its required Undici 8 transport while keeping the CLI on Undici 7.

• Runtime: use Bun 1.3.14 across CI and deployment tooling to preserve labelled conditional blocks when compiling React server rendering.

• Tests: revalidate cached npm metadata before installing updated Convex external dependencies, retaining cached package tarballs and bounded fetches.

• Dependencies: refresh production packages and synchronize the Sharp pin; let each package resolve its supported Undici transport and use the unpatched upstream Workpool release. Retain the old Workpool typecheck patch only for the previous-version test fixture.

• Use one shared autoreview installation from openclaw/agent-skills; repository entrypoints now receive upstream fixes without copied helpers or test suites.

0.25.0 - 2026-11-01

Compatibility

• Experimental Claw packages are now Templates. Use clawhub package explore --family template and clawhub package publish <artifact.tgz> --family template; --family claw is rejected. Public scoped routes use /<owner>/templates/<slug> instead of /<owner>/claws/<slug>.
• New packages use openclaw.template in package.json. CLAW.md, existing package/version identities and published artifact bytes remain unchanged.

Fixes

• CLI: show the publishing step, file position, HTTP status and safe request ID when an upload fails, while preserving retry timing and existing error messages.

0.24.1 - 2026-10-28

Fixes

• CLI/API: let authorized skill owners inspect the publication state of an exact held version, including failed checks and active retries, without exposing private uploads publicly. Avoid reporting a clean older release as the held version's result, and fail file reads until that version is available.

Compatibility

• The CLI includes Plugin Inspector 0.4.3 and requires Node.js 22.13+ on the 22.x line or Node.js 24+.

0.24.0 - 2026-09-30

... (truncated)

Commits

• 65248d7 chore: prepare CLI 0.24.1 publication status release (#4110)
• 5a451de improve: make Endor vulnerability reports easier to scan (#4096)
• 4bf5854 fix(security): install and attest the source-pinned Bash parser (#4108)
• 5f3b6e9 fix: report exact-version publication state to owners (#4109)
• 19aaf59 fix: show owners when publication checks fail (#4107)
• e1eca92 fix(security): adopt bounded OSV advisory coverage (#4106)
• 4e802bb fix: drain bundled SkillSpector stderr (#4105)
• 7e5d3c0 chore: remove verified legacy native-family repair (#4103)
• 8686adf fix: preserve failed pending plugin history during family repair (#4102)
• cb267ec fix: recover verified legacy native plugin families (#4100)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)