Skip to content

fix(deps): pin dependencies - #612

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-npm-dependencies
Open

fix(deps): pin dependencies#612
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-npm-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Type Update Change Pending Age Confidence
@biomejs/biome (source) devDependencies pin ^2.4.4 → 2.5.15 age confidence
@noble/curves (source) dependencies pin ^2.0.1 → 2.4.0 age confidence
@noble/ed25519 (source) dependencies pin ^3.0.0 → 3.2.0 age confidence
@noble/hashes (source) dependencies pin ^2.0.1 → 2.4.0 age confidence
@types/js-yaml (source) devDependencies pin ^4.0.9 → 4.0.9 age confidence
@types/node (source) devDependencies pin ^22.0.0 → 22.20.5 age confidence
@types/react (source) devDependencies pin ^18.3.0 → 18.3.31 age confidence
@types/safe-regex (source) devDependencies pin ^1.1.6 → 1.1.6 age confidence
@types/ws (source) dependencies pin ^8.18.1 → 8.18.2 age confidence
blake2b devDependencies pin ^2.1.4 → 2.1.4 age confidence
blake2b dependencies pin ^2.1.4 → 2.1.4 age confidence
bun (source) packageManager minor 1.3.10 → 1.4.2 1.4.3 age confidence
bun-types (source) devDependencies pin ^1.3.10 → 1.4.2 age confidence
canonicalize dependencies pin ^3.0.0 → 3.0.0 age confidence
chacha20-universal devDependencies pin ^1.0.4 → 1.0.4 age confidence
chacha20-universal dependencies pin ^1.0.4 → 1.0.4 age confidence
fast-check (source) devDependencies pin ^4.5.3 → 4.10.2 age confidence
handlebars (source) dependencies pin ^4.7.10 → 4.7.10 age confidence
ink dependencies pin ^5.2.0 → 5.2.1 age confidence
ink-text-input dependencies pin ^6.0.0 → 6.0.0 age confidence
js-tiktoken dependencies pin ^1.0.13 → 1.0.21 age confidence
js-yaml dependencies pin ^4.3.2 → 4.3.2 age confidence
js-yaml overrides pin ^4.3.2 → 4.3.2 age confidence
meow dependencies pin ^13.2.0 → 13.2.0 age confidence
msgpackr dependencies pin ^1.11.8 → 1.12.1 age confidence
nanoassert devDependencies pin ^3.1.0 → 3.1.0 age confidence
nanoassert dependencies pin ^3.1.0 → 3.1.0 age confidence
node (source) engines pin >=22 → v26.11.1 age confidence
node (source) engines pin 22.x || 24.x → v24.21.0 age confidence
noise-handshake dependencies pin ^4.2.0 → 4.2.0 age confidence
openclaw peerDependencies pin >=2026.3.7 → 2026.5.22 age confidence
openclaw peerDependencies pin >=2026.8.1 → 2026.8.1 age confidence
openclaw devDependencies minor 2026.8.1 → 2026.9.8 2026.10.3 (+3) age confidence
react (source) dependencies pin ^18.3.1 → 18.3.1 age confidence
react-devtools-core (source) devDependencies pin ^7.0.1 → 7.0.1 age confidence
require-addon dependencies pin ^1.2.0 → 1.3.0 age confidence
safe-regex dependencies pin ^2.1.1 → 2.1.1 age confidence
sha256-universal devDependencies pin ^1.2.1 → 1.2.1 age confidence
sha256-universal dependencies pin ^1.2.1 → 1.2.1 age confidence
sha512-universal devDependencies pin ^1.2.1 → 1.2.1 age confidence
sha512-universal dependencies pin ^1.2.1 → 1.2.1 age confidence
shell-quote overrides pin ~1.11.0 → 1.11.0 age confidence
siphash24 devDependencies pin ^1.3.1 → 1.3.1 age confidence
siphash24 dependencies pin ^1.3.1 → 1.3.1 age confidence
snooplogg dependencies pin ^6.1.1 → 6.1.1 age confidence
sodium-javascript devDependencies pin ^0.8.0 → 0.8.0 age confidence
sodium-javascript dependencies pin ^0.8.0 → 0.8.0 age confidence
typescript (source) devDependencies pin ^5.7.0 → 5.9.3 age confidence
ws dependencies pin ^8.19.0 → 8.22.0 age confidence
ws overrides pin ^8.21.0 → 8.22.0 age confidence
ws dependencies pin ^8.21.0 → 8.22.0 age confidence
xsalsa20 devDependencies pin ^1.2.0 → 1.2.0 age confidence
xsalsa20 dependencies pin ^1.2.0 → 1.2.0 age confidence
zod (source) dependencies pin ^3.24.0 → 3.25.76 age confidence

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

Release Notes

oven-sh/bun (bun)

v1.4.2: Bun v1.4.2

Compare Source

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade
Read Bun v1.4.2's release notes on Bun's blog
Thanks to 3 contributors!

v1.4.1: Bun v1.4.1

Compare Source

To install Bun v1.4.1

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.1:

bun upgrade
Read Bun v1.4.1's release notes on Bun's blog
Thanks to 7 contributors!

v1.4.0: Bun v1.4

Compare Source

To install Bun v1.4

curl -fsSL https://bun.com/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post:

image (1)

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

v1.3.14: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade
Read Bun v1.3.14's release notes on Bun's blog
Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade
Read Bun v1.3.13's release notes on Bun's blog
Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade
Read Bun v1.3.12's release notes on Bun's blog
Thanks to 8 contributors!

v1.3.11: Bun v1.3.11

Compare Source

To install Bun v1.3.11

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.11:

bun upgrade
Read Bun v1.3.11's release notes on Bun's blog
Thanks to 15 contributors!
openclaw/openclaw (openclaw)

v2026.9.8: openclaw 2026.9.8

Compare Source

OpenClaw v2026.9.8

58 commits · 43 pull requests · 21 contributors

Changes included in this release

The release notes and changelog contain the same content, presented in two formats:

  • Release notes — formatted for people, with expandable sections.
  • Changelog — plain Markdown for AI agents and tools.
Thanks

@​609NFT @​aniketkrs @​aniruddhaadak80 @​EndeavorPioneer @​ericcaiwx-star @​fuller-stack-dev @​hailongguo0530-alt @​jasdeepohri-max @​miguelpt2026 @​NickM83 @​obviyus @​Patrick-Erichsen @​PennyVibe @​RomneyDa @​scotthuang @​steipete @​VACInc @​vincentkoc @​WG-Mojo @​xilopaint @​yashas-13

Release verification

v2026.9.7: openclaw 2026.9.7

Compare Source

OpenClaw v2026.9.7

518 direct commits · 2,818 pull requests · 334 contributors

Changes included in this release

The release notes and changelog contain the same content, presented in two formats:

  • Release notes — formatted for people, with expandable sections.
  • Changelog — plain Markdown for AI agents and tools.
Thanks

@​609NFT @​Aalmann @​aatreya @​abacha @​abuegab1-spec @​ada-KVR @​AgentSolomon @​aicyberg @​ajmtrz @​Alekstodo @​aleps001 @​alexph-dev @​alibux @​Alix-007 @​altaywtf @​amarsmission @​AmesGit @​anarchia-99 @​andersonjeccel @​aniruddhaadak80 @​anyech @​apple2345-pixel @​areslp @​AS76 @​aspalagin @​auriga-agents @​avirtudazo-officeconnect @​AXEG0 @​axiom-ncis @​Ayushdevo @​azakharko @​baiwei0427 @​bappamp4 @​Baumus @​bdjben @​benlaube @​bill-starfoundry @​BillVerhelle @​bitkylin @​blackdiamondcyber-png @​blackeyes-boy @​blyszcz @​BoatAngle @​bogdandragosvasile @​boycez @​brokemac79 @​Bruce-Yii @​brucemccurdy @​canvrno-oai @​Captain69G @​CarotaWealth @​caseyjustus @​cbhawthorne84 @​ceckert @​chac4l @​chaolawo-byte @​charlie-morrison @​chelsealong @​chopin-op60 @​choury @​cipp-ashe @​cjn119-ui @​Colton-Harris @​Conan-Scott @​context-down @​coygeek @​cp7553479 @​Cyb3rb1ade @​dankarization @​DarkJuanFra @​DasX @​davidcittadini @​desksk @​destinedenergy @​dh-js @​dimonnld @​dmmc12 @​dmwtech @​DonnieFi @​dots-oai @​dragomirdimitrov-mmrndm @​Dreamer-HIT @​DrToNy1 @​dwalthour @​dwonshin @​dynamite-bud @​eddiekk @​EduHerranz @​ekinnee @​eleqtrizit @​EndeavorPioneer @​eric-basketbot @​ericcaiwx-star @​etzelm @​fchaudhryspear @​fduch-stranger @​Flakedict @​flyto168 @​fourestfire @​fransqaas @​freeqaz-openai @​fulgerulnegru @​fuller-stack-dev @​Fuma2013 @​funklawfirm-dotcom @​galiniliev @​gaoanze888 @​Geokec @​giangthb @​giodl73 @​giodl73-repo @​gisk0 @​gokay-ai @​goslingmanagment @​Gr33n93 @​grape404 @​Grynn @​h94916 @​haldana88 @​hannesrudolph @​hartmark @​he-yufeng @​Hensarj @​highfly-hi @​Hmache @​holny @​hpyhandsome @​htuyer121 @​hugenshen @​hurtlovewow @​hxy91819 @​ion-developing @​Irish-Joseph @​islandpreneur007 @​ivankuznetsov @​IWhatsskill @​Jackten @​jalehman @​jb168 @​jb510 @​JefRH1 @​jiangzhao2121-debug @​jihoon-ernesto @​jjjhenriksen @​johnfink8 @​johnnyjrizzo @​JordanNewell @​joshavant @​joshbunker @​joshpetras @​Journey417 @​jscd98 @​jtatum @​JUMPUNDER @​kai0126-claw @​Kaspnov @​kassol @​kchuang1015 @​kevinlin-openai @​keysersozeh @​Kiiatkin @​Kimiyu-186 @​kirylh @​kybrcore @​laisonamarante @​laurencebrown @​laurentschwartz @​leilei3167 @​lennartack @​Leon-SK668 @​liemnhoang @​LinzeShi @​lisheguo @​liunan12345678-spec @​LiuwqGit @​liuxb553-panda @​liyoulu @​Loganwoooof @​lovelefeng-glitch @​lucarinaorg @​Ludwigtheo0815 @​lukewd @​ly85206559 @​marinabotobs @​mariorivas1 @​markmcd @​markomiric @​martinxomag @​Marvinthebored @​masatohoshino @​MasterSwords1 @​Matuno @​mcaxtr @​MertBasar0 @​meska @​MikyWang @​mmartoccia @​MoerAI @​mohit @​mrclawfield @​mrzeepek @​msobrosa @​myagizmaktav @​Nakagawa-master @​name5566 @​Navras98 @​ndakota79 @​neyudo @​NianJiuZst @​Nickfost @​NicolasDerito @​Niriakot @​nkeil @​NobleVision @​noelillinger @​nomiSFI @​NovaUnboundAi @​nz365guy @​obviyus @​Oldrich333 @​oleagui @​Olli0103 @​olyapop @​omarshahine @​OpenClawKobian99 @​Orionation @​oxen-horse @​ozp @​pash-openai @​Patrick-Erichsen @​paweldrozd @​Peetiegonzalez @​Pegorim @​pengzh1 @​PennyVibe @​pgondhi987 @​Pluviobyte @​pmika @​podulator @​polaris-arch @​PollyBot13 @​potterdigital @​prashantkamani @​QuinsZouls @​rboy1 @​redxzeta @​revision-co-ltd @​ReyesAdrian @​RileyJJY @​rmyers64 @​rogeriochaves @​RomneyDa @​ruel225 @​ryan-dyer-sp @​ryanjkelly @​S1gv4rd @​s93101179 @​saariuslystoned @​sahilsatralkar @​sallyom @​salmunclaw @​sandra-peach @​Sanjays2402 @​sarahliyanage @​ScientificProgrammer @​seaurching @​SebTardif @​SecureCloudProjO @​serg0x @​shadesurgeon @​shakkernerd @​shootingsyh @​sidboswell @​siri1410 @​SiskoYU @​sjf @​sjf-oa @​Solvely-Colin @​sonofakel @​spikewillcocks @​steipete @​stevenlee-oai @​SummitOperations26 @​SundayDriver @​sunlit-deng @​SunnyShu0925 @​superandylin @​superdiaodiao @​sxh313 @​Takhoffman @​TeaCup404 @​team-contractorscale @​texasaggie1 @​thoth-ctl @​timothyfs @​todddickerson @​tomdailey55 @​tomm789 [@​Torsie](https://re

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

  • Branch creation
    • "before 9am on monday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner October 12, 2026 09:36
@coderabbitai

coderabbitai Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration
  • Configuration used: defaults
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: dbae6c51-652c-4526-bbe7-76332734c486

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@socket-security

socket-security Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Updatedopenclaw@​2026.8.1 ⏵ 2026.9.85110010098 +180 -19
Addedrequire-addon@​1.3.01001007186100
Updated@​types/​ws@​8.18.1 ⏵ 8.18.2100 +110073 +185100
Updated@​types/​react@​18.3.28 ⏵ 18.3.311001007990100
Added@​types/​node@​22.20.51001008196100
Updated@​noble/​ed25519@​3.0.0 ⏵ 3.2.010010010084 -2100
Updated@​noble/​hashes@​2.0.1 ⏵ 2.4.010010010084100
Updated@​noble/​curves@​2.0.1 ⏵ 2.4.010010010084 -1100
Updatedmsgpackr@​1.11.8 ⏵ 1.12.1100 +2100100 +190100
Updatedws@​8.21.0 ⏵ 8.22.09910010090100
Updatedfast-check@​4.5.3 ⏵ 4.10.2100 +110010092 +5100
Added@​biomejs/​biome@​2.5.1510010010099100

View full report

@socket-security

socket-security Bot commented Oct 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority Alert  (click "▶" to expand/collapse) Action
Low priority
System shell access: npm dotenv in module child_process

Module: child_process

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/dotenv@18.0.1

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/dotenv@18.0.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Install-time scripts: npm esbuild during postinstall

Install script: postinstall

Source: node install.js

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/esbuild@0.28.2

ℹ Read more on: This package | This alert | What is an install script?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm esbuild in module https

Module: https

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/esbuild@0.28.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm esbuild in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/esbuild@0.28.2

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
System shell access: npm esbuild in module child_process

Module: child_process

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/esbuild@0.28.2

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/esbuild@0.28.2. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module tls

Module: tls

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module net

Module: net

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module globalThis["fetch"]

Module: globalThis["fetch"]

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module node:net

Module: node:net

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module node:tls

Module: node:tls

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module node:http

Module: node:http

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module node:http2

Module: node:http2

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module node:dns

Module: node:dns

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
System shell access: npm npm in module child_process

Module: child_process

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is shell access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module dns

Module: dns

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module http2

Module: http2

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module http

Module: http

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn
Low priority
Network access: npm npm in module https

Module: https

Location: Package overview

From: plugins/openclaw-github-review/package-lock.json → npm/openclaw@2026.9.8 → npm/npm@11.20.0

ℹ Read more on: This package | This alert | What is network access?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/npm@11.20.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn

View full report

@renovate
renovate Bot force-pushed the renovate/non-major-npm-dependencies branch 15 times, most recently from 00c9396 to 3db6219 Compare October 13, 2026 23:41
@renovate
renovate Bot force-pushed the renovate/non-major-npm-dependencies branch from 3db6219 to 9a537f7 Compare October 14, 2026 00:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies supply-chain

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants