[dependabot]

Bumps the npm-minor-patch group with 1 update: openclaw.

Updates openclaw from 2026.10.5 to 2026.10.6

Release notes

Sourced from openclaw's releases.

openclaw 2026.10.6

2026.10.6

Highlights

• Patched Node runtime required: OpenClaw now requires Node 24.22.1+ on the 24 line or 26.12.1+ on the 26 line, which reject TLS chains signed with the compromised certificate keys addressed in the October 2026 Node.js security releases. Docker images ship Node 24.22.1, installers select the patched runtimes, and openclaw update refuses with recovery guidance before installing on an older Node instead of breaking the running install. Source builds now pin pnpm 12.15.0. (#179992) Thanks @​joshavant.
• Safer updates and recovery: package swaps now refuse unsafe service states, Windows and macOS package-manager updates recover from platform-specific failures, and frozen Gateway startup owners can be retired cleanly. (#171101, #170940, #171936, #171678) Thanks @​RomneyDa, @​homeworld520, @​Yolo521-bot, @​stop-time, @​AntaresGG, and @​TommyLei666.
• Data-preserving migrations and backups: Doctor and migration paths now refuse malformed or lossy workspace imports, preserve malformed Notes bytes, reject unsafe non-UTF-8 wiki rewrites, keep deeply nested SQLite backups, and retain staging evidence when restore inspection fails. (#172293, #172953, #172742, #174573, #168583, #170867, #172028) Thanks @​wangmiao0668000666, @​RomneyDa, @​Leon-SK668, @​ericcurtin, @​Yolo521-bot, @​obviyus, and @​altaywtf.
• Reliable delivery across restarts: queued turns, watched child results, dead-lettered deliveries, and streamed replies now survive recovery without disappearing, duplicating, or producing false missing-answer notices. (#170384, #169489, #169932, #173798) Thanks @​RomneyDa, @​huyengiang101086-spec, and @​Yolo521-bot.
• Provider and model resilience: GPT-5.6 tool turns, OpenRouter DeepSeek tool calls, LM Studio overflow recovery, parallel OpenAI reasoning settings, and model retry/fallback budgets now behave consistently. (#176709, #175058, #169189, #169322, #164808) Thanks @​RomneyDa, @​Linux2010, @​ZhimingQ, @​xpeng5278-web, and @​anyech.
• Windows and mobile stability: fresh Windows state stores, Proxy-backed environments, and stored Anthropic credentials no longer block startup, while iOS Talk and chat connectivity recover from first-reply and timeout failures. (#176174, #176194, #174571, #168416, #169912) Thanks @​RomneyDa, @​tjarrau-dev, @​skyzhao1223, @​easyteacher, @​scalesmart, @​masatohoshino, @​Takhoffman, and @​Solvely-Colin.
• Agent and tool-call recovery: unfinished tools now time out visibly, context overflow compacts after steered tool results, malformed calls continue after earlier refusals, large patch hunks avoid argument-limit crashes, and stopped yielded tasks stay stopped. (#172983, #172019, #170615, #174477, #169453) Thanks @​RomneyDa, @​budzation, @​mirasrael, @​r3n3x, @​freeqaz-openai, and @​obviyus.
• Channel delivery correctness: WhatsApp retries and stickers, Telegram albums and dual-stack replies, Slack relay recovery, and Discord voice-call replies no longer lose or duplicate messages. (#142434, #164210, #163926, #171564, #173407, #172380) Thanks @​ashawwal, @​RomneyDa, @​andrewwbuilds, @​abacha, @​Dat1GUI, @​brainmonger, @​obviyus, and @​vincentkoc.
• Worker and worktree recovery: hosts reclaim worker capacity after reboot, partial-clone worktrees repair missing objects, and child-result and exec-wake evidence survives Gateway restarts. (#168863, #168864, #169489, #169645) Thanks @​RomneyDa.

Changes

• This patch release contains focused reliability fixes only; it does not introduce new user-facing features.

Fixes

• State and system-agent recovery: restore access to agents held by affected upgrades, recover held system-agent databases after schema changes, and preserve live configuration when forensic snapshots fail. (#175007, #176783, #171217) Thanks @​RomneyDa, @​PennyVibe, and @​Yolo521-bot.
• Windows state and updates: canonicalize schema ownership across path aliases, serialize Proxy-backed environments before inspection IPC, hide SQLite helper windows during update work, and recognize native Scheduled Task permission failures in every locale. (#176174, #176194, #174969, #178624) Thanks @​RomneyDa, @​tjarrau-dev, @​skyzhao1223, @​easyteacher, and @​throwingbones.
• macOS companion execution: honor long command and approval deadlines across the companion socket, classify late or lost replies without replaying submitted commands, and preserve native permission details. (#172117) Thanks @​holgergruenhagen, @​RomneyDa, @​ylcn91, and @​Colton-Harris.
• Doctor and managed plugins: repair empty retired-plugin metadata, clear resolved migration warnings, and converge app-managed plugins onto the installed core version. (#173851, #177096, #174257) Thanks @​RomneyDa, @​fengfan201314-eng, @​ScientificProgrammer, @​yinx65588-boop, @​jj5638521, and @​kazuyuki-eguchi.
• Update diagnostics: preserve FRV blockers, explain package-journal identity and runtime-retention failures, and avoid cleanup stalls on shared recovery manifests. (#171186, #170385, #169280, #174249) Thanks @​vincentkoc, @​RomneyDa, @​astapenkoav, @​council10-kera, and @​shoaibulhaque.
• SQLite correctness: preserve transaction outcomes when warning handlers throw, settle peer closes after shared-worker refusal, and prevent retired cache generations from taking worker ownership. (#157151, #173813, #172798) Thanks @​vincentkoc and @​RomneyDa.
• Reply recovery: preserve side-question and immediate fallback ordering, avoid repeated or missing answers after streamed delivery, and keep stopped yielded tasks from restarting. (#174869, #169305, #173798, #169453) Thanks @​RomneyDa and @​freeqaz-openai.
• Codex and native sessions: release stalled startup waits and completed subagents after cancellation or cleanup failures, preserve conversations across runtime restarts, keep workspace bindings across reply resets, and settle recovered child binding writes before session readiness. (#168347, #173547, #166368, #160549, #177564) Thanks @​RomneyDa, @​Kimiyu-186, @​alkor2000, @​jhgaylor, @​vincentkoc, @​jjjhenriksen, and @​obviyus.
• Gateway lifecycle: retain restart custody, avoid stop-time lease deadlocks, recover worker capacity after reboot, and preserve suppressed-channel configuration across reloads. (#172852, #171308, #168863) Thanks @​RomneyDa.
• CLI and process diagnostics: preserve JSON output on Gateway command exits, report resource-disposal and PTY EOF failures, and surface failed diagnostic writes without crashing. (#176795, #173566, #176362, #174622) Thanks @​vincentkoc and @​RomneyDa.
• Scheduled follow-ups: same-conversation follow-ups scheduled from an authorized operator turn keep that operator's current authority when they run, and one-shot continuations can call next_check to check back later. (#176422)
• Media and TTS: time out slow hosted speech synthesis and report playback cache, probe, and quota failures rather than silently dropping cleanup errors. (#175614, #175634, #174668) Thanks @​RomneyDa.

Complete contribution record

This audited record covers the complete v2026.10.5..bba7238a1be3a0d4e92c371988f94e81011a06b2 history: 293 in-range PRs + 0 retained seed-only PRs = 293 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #176194 Related #176111. Thanks @​skyzhao1223 and @​RomneyDa and @​easyteacher.
• PR #176174 Related #176163. Thanks @​RomneyDa and @​tjarrau-dev.
• PR #175007 Thanks @​RomneyDa.
• PR #176783 Related #176669. Thanks @​RomneyDa and @​PennyVibe.
• PR #171101 Related #170774, #171036. Thanks @​RomneyDa and @​homeworld520 and @​Yolo521-bot.
• PR #171217 Related #171187. Thanks @​RomneyDa and @​Yolo521-bot.
• PR #171678 Related #171513. Thanks @​RomneyDa and @​TommyLei666.
• PR #173851 Related #173659. Thanks @​RomneyDa and @​fengfan201314-eng.
• PR #174257 Related #174120. Thanks @​RomneyDa and @​kazuyuki-eguchi.
• PR #174969 Related #174906. Thanks @​RomneyDa and @​throwingbones.

... (truncated)

Changelog

Sourced from openclaw's changelog.

Changelog

Release notes: https://docs.openclaw.ai/releases

Each release has its complete changelog below. Audited contribution records are retained separately when available.

• Unreleased · Raw
• 2026.10.7 · Raw
• 2026.10.6 · Raw
• 2026.10.5 · Raw
• 2026.10.4 · Raw
• 2026.10.3 · Raw
• 2026.10.2 · Raw
• 2026.10.1 · Raw
• 2026.9.9 · Raw
• 2026.9.8 · Raw
• 2026.9.7 · Raw
• 2026.9.6 · Raw
• 2026.9.5 · Raw
• 2026.9.4 · Raw
• 2026.9.3 · Raw
• 2026.9.2 · Raw
• 2026.9.1 · Raw
• 2026.8.2 · Raw
• 2026.8.1 · Raw
• 2026.7.1 · Raw
• 2026.6.11 · Raw
• 2026.6.10 · Raw
• 2026.6.9 · Raw
• 2026.6.8 · Raw
• 2026.6.7 · Raw
• 2026.6.6 · Raw
• 2026.6.5 · Raw
• 2026.6.2 · Raw
• 2026.6.1 · Raw
• 2026.5.31 · Raw
• 2026.5.28 · Raw
• 2026.5.27 · Raw
• 2026.5.26 · Raw
• 2026.5.22 · Raw
• 2026.5.20 · Raw
• 2026.5.19 · Raw
• 2026.5.17 · Raw
• 2026.5.14 · Raw
• 2026.5.12 · Raw
• 2026.5.7 · Raw
• 2026.5.6 · Raw
• 2026.5.5 · Raw

... (truncated)

Commits

• fe06181 docs(changelog): drop the internal thanks handle from the scheduled follow-up...
• d3449d0 test(update): provision a supported private Node in the live runtime proof
• ba45176 fix(ui): carry main's translations for the patched worker image help
• 4ada23b fix(release): keep the publish changelog gate helper private
• a908882 fix(security): require patched Node and native pnpm runtimes (#179992)
• 8f86f0d docs(changelog): note the Node runtime floor and scheduled follow-up authorit...
• 31a1f56 test(ui): settle web-push waits on real events instead of polling (#180235)
• 78cd266 test(agents): prove live compaction from the successful direct read (#180236)
• 5c0d399 fix: scheduled follow-ups lose authorized task access (#176422)
• b08e0a0 fix(release): refuse publish FRV dispatch when candidate changelog gates fail...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions