fix(deps): pin dependencies by renovate[bot] · Pull Request #612 · tpsdev-ai/cli

renovate · 2026-10-12T09:36:50Z

Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Type	Update	Change	Pending
@biomejs/biome (source)	devDependencies	pin	`^2.4.4` → `2.5.15`
@noble/curves (source)	dependencies	pin	`^2.0.1` → `2.4.0`
@noble/ed25519 (source)	dependencies	pin	`^3.0.0` → `3.2.0`
@noble/hashes (source)	dependencies	pin	`^2.0.1` → `2.4.0`
@types/js-yaml (source)	devDependencies	pin	`^4.0.9` → `4.0.9`
@types/node (source)	devDependencies	pin	`^22.0.0` → `22.20.5`
@types/react (source)	devDependencies	pin	`^18.3.0` → `18.3.31`
@types/safe-regex (source)	devDependencies	pin	`^1.1.6` → `1.1.6`
@types/ws (source)	dependencies	pin	`^8.18.1` → `8.18.2`
blake2b	devDependencies	pin	`^2.1.4` → `2.1.4`
blake2b	dependencies	pin	`^2.1.4` → `2.1.4`
bun (source)	packageManager	minor	`1.3.10` → `1.4.3`
bun-types (source)	devDependencies	pin	`^1.3.10` → `1.4.2`
canonicalize	dependencies	pin	`^3.0.0` → `3.0.0`
chacha20-universal	devDependencies	pin	`^1.0.4` → `1.0.4`
chacha20-universal	dependencies	pin	`^1.0.4` → `1.0.4`
fast-check (source)	devDependencies	pin	`^4.5.3` → `4.10.2`
handlebars (source)	dependencies	pin	`^4.7.10` → `4.7.10`
ink	dependencies	pin	`^5.2.0` → `5.2.1`
ink-text-input	dependencies	pin	`^6.0.0` → `6.0.0`
js-tiktoken	dependencies	pin	`^1.0.13` → `1.0.21`
js-yaml	dependencies	pin	`^4.3.2` → `4.3.2`
js-yaml	overrides	pin	`^4.3.2` → `4.3.2`
meow	dependencies	pin	`^13.2.0` → `13.2.0`
msgpackr	dependencies	pin	`^1.11.8` → `1.12.1`
nanoassert	devDependencies	pin	`^3.1.0` → `3.1.0`
nanoassert	dependencies	pin	`^3.1.0` → `3.1.0`
node (source)	engines	pin	`>=22` → `v26.12.0`
node (source)	engines	pin	`22.x \|\| 24.x` → `v24.22.0`
noise-handshake	dependencies	pin	`^4.2.0` → `4.2.0`
openclaw	peerDependencies	pin	`>=2026.3.7` → `2026.5.22`
openclaw	peerDependencies	pin	`>=2026.8.1` → `2026.8.1`
openclaw	devDependencies	minor	`2026.8.1` → `2026.10.1`	`2026.10.4` (+2)
react (source)	dependencies	pin	`^18.3.1` → `18.3.1`
react-devtools-core (source)	devDependencies	pin	`^7.0.1` → `7.0.1`
require-addon	dependencies	pin	`^1.2.0` → `1.3.0`
safe-regex	dependencies	pin	`^2.1.1` → `2.1.1`
sha256-universal	devDependencies	pin	`^1.2.1` → `1.2.1`
sha256-universal	dependencies	pin	`^1.2.1` → `1.2.1`
sha512-universal	devDependencies	pin	`^1.2.1` → `1.2.1`
sha512-universal	dependencies	pin	`^1.2.1` → `1.2.1`
shell-quote	overrides	pin	`~1.11.0` → `1.11.0`
siphash24	devDependencies	pin	`^1.3.1` → `1.3.1`
siphash24	dependencies	pin	`^1.3.1` → `1.3.1`
snooplogg	dependencies	pin	`^6.1.1` → `6.1.1`
sodium-javascript	devDependencies	pin	`^0.8.0` → `0.8.0`
sodium-javascript	dependencies	pin	`^0.8.0` → `0.8.0`
typescript (source)	devDependencies	pin	`^5.7.0` → `5.9.3`
ws	dependencies	pin	`^8.19.0` → `8.22.0`
ws	overrides	pin	`^8.21.0` → `8.22.0`
ws	dependencies	pin	`^8.21.0` → `8.22.0`
xsalsa20	devDependencies	pin	`^1.2.0` → `1.2.0`
xsalsa20	dependencies	pin	`^1.2.0` → `1.2.0`
zod (source)	dependencies	pin	`^3.24.0` → `3.25.76`

Add the preset :preserveSemverRanges to your config if you don't want to pin your dependencies.

Release Notes

oven-sh/bun (bun)

`v1.4.3`: Bun v1.4.3

Compare Source

To install Bun v1.4.3

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.3:

bun upgrade

Read Bun v1.4.3's release notes on Bun's blog

Thanks to 8 contributors!

`v1.4.2`: Bun v1.4.2

Compare Source

To install Bun v1.4.2

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.2:

bun upgrade

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

`v1.4.1`: Bun v1.4.1

Compare Source

To install Bun v1.4.1

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.4.1:

bun upgrade

Read Bun v1.4.1's release notes on Bun's blog

Thanks to 7 contributors!

`v1.4.0`: Bun v1.4

Compare Source

To install Bun v1.4

curl -fsSL https://bun.com/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.0:

bun upgrade

Read the blog post:

Thank you

Bun is free, open source, and MIT-licensed. We receive a lot of contributions from the community, and we'd like to thank everyone who fixed a bug or contributed since Bun v1.3.

`v1.3.14`: Bun v1.3.14

Compare Source

To install Bun v1.3.14

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.14:

bun upgrade

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

`v1.3.13`: Bun v1.3.13

Compare Source

To install Bun v1.3.13

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.13:

bun upgrade

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

`v1.3.12`: Bun v1.3.12

Compare Source

To install Bun v1.3.12

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.12:

bun upgrade

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

`v1.3.11`: Bun v1.3.11

Compare Source

To install Bun v1.3.11

curl -fsSL https://bun.sh/install | bash

# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.sh/install.ps1|iex"

To upgrade to Bun v1.3.11:

bun upgrade

Read Bun v1.3.11's release notes on Bun's blog

Thanks to 15 contributors!

openclaw/openclaw (openclaw)

`v2026.10.1`: openclaw 2026.10.1

Compare Source

OpenClaw v2026.10.1

3,055 commits · 2,425 pull requests · 402 contributors

Changes included in this release

The release notes and changelog contain the same content, presented in two formats:

Release notes — formatted for people, with expandable sections.
Changelog — plain Markdown for AI agents and tools.

Thanks

@100yenadmin @51Google @609NFT @A1fred-AI @abacha @adamamzalag @adamczhang @addyCooks @adele-with-a-b @adembektas @aikohoshinoai-prog @akennedytog @akrosliving @Alex-vonAllmen @alexeysophia @alexph-dev @alfred429 @ali-log @Alix-007 @alkor2000 @altaywtf @AmelioMansour @amittell @andersonjeccel @aniketkrs @aniruddhaadak80 @anyech @aounakram @armstrongsam25 @aron-intframe @Arslan-Mehmood1 @ashleywolf @asikorskiy @aspalagin @astra-openclaw @avirtudazo-officeconnect @awss1i @axeg0 @axiom-ncis @ayaangazali @ayoakouh @Ayushdevo @azuretek @b4rRa @Bartok9 @Baumus @big-hill @BillBOT33 @bipolar84 @boeingchoco @brainatworkharris @brandon-julio-t @bulingbuling688 @carlosjarenom @catnipluss @cbhawthorne84 @ceckert @cestercian @CHAESH @chaitongxue @changeroa @ChenGuoShun1979 @chffhc @chiyunshen @chopin-op60 @ChuLaiTheGreat @cjn119-ui @cknzraposo @cmillwat @cmrstudio56 @Colton-Harris @Conan-Scott @coygeek @cunzai007-hub @danieljimz @dankarization @dapangkai11 @DarkJuanFra @DasX @datus1982 @DaveFan-NCHC @davidcittadini @deepujain @Deregtx @dh-js @DonnieFi @dori-jitter @dprev @drakeo338 @Dylanzhang1128 @eddiekk @ekinnee @eleqtrizit @eltonwf-del @elvisquirino @EmisvaldoSilva @EndeavorPioneer @ericcaiwx-star @ericcurtin @etzelm @eugifa @exGeni @farisoftfry @fede-kamel @FelixIsaac @fenglanhua @Finn763 @FlagshipClaw @Flakedict @frankhli843 @Frosmans @FtlC-ian @fuller-stack-dev @g0st1n @g62nkcx4q7-wq @Gabrielnkl @galiniliev @ghowkay @Giannoulakos @giodl73 @giodl73-repo @glaiveai @glebsergeevich @GodBlf @GoDiao @godinpt-floada @gokay-ai @GoldArowana @gollymashed @goncalonc @goutamadwant @griswomw2 @grtninja @hailongguo0530-alt @hannesrudolph @hannnnn-l @hansraj316 @harshitgupta31415 @hartmark @hartra344 @Harvey-XuH @hawkit @he-yufeng @hewal-dev @hogawa000 @holgergruenhagen @hotfemale @hpyhandsome @hrp6vv9mwr-glitch @hshs38033-cmd @hubofvalley @HunterStile @hxy91819 @iancollyer87 @ignamiranda @iJaack @imabotone-ui @ioannis-giannoulakos @Irish-Joseph @islandpreneur007 @IstiqlalBhat @itayzit @ivan-magda @IWhatsskill @izrl613 @jacobtomlinson @JakeBotFleet @JakeMalis @jalehman @jamiezigelbaum @jarimustonen @Jarvis-Baba @jasdeepohri-max @jason-allen-oneal @jayzhou2309 @jbfranklin @JD8855122 @Jeehut @jesse-merhi @jgs-jeeves @jj5638521 @jjjhenriksen @jlapenna @jm9151821 @jocojolo @joelwp @jonathanlindsay @joryirving @joshavant @JuampiHernandez @juyterman1000 @kazuyuki-eguchi @kenmege @kevin2966n @Kimiyu-186 @KirDE @kirylh @klabir @KoalaShen @krissding @krumch @laurentschwartz @leoreq @LifeViwer @LinzeShi @LiuwqGit @LLagoon3 @louria @love-ai-open-source @lshamash @Ludwigtheo0815 @ly85206559 @MaikiMolto @marcoschierhorn @marctomas-png @MarkMa84 @markoub @martinderm @Marvinthebored @masatohoshino @MasterSwords1 @matthematics1137 @matthewmoroz @maxpuppet @mbelinky @MertBasar0 @mgr-nick @mick-lu-lingyue @miguelarios @miguelbranco80 @miguelpt2026 @MikyWang @mmaps @MoerAI @monde @Monkeykingll @mpquemel @mrzeepek @nachoratico-source @namest504 @nancymx-dev @nano-richtera @nashtu3000 @ndakota79 @Nehanth @neilofneils404 @nessim-liamani @ngominhduc263 @NianJiuZst @NickM83 @nikosml @nimarosa @nkarkare @nocodet888-arch @NovaUnboundAi @nwang783 @nweishar @obnoxious2011-cmd @obviyus @oc-jarvis @odrodash @Oldrich333 @Olli0103 @oNo500 @ooiuuii @oscarsixsecllc @oxen-horse @oywino @Patrick-Erichsen @paulcam206 @PaulClawitzki @paulotvlincelia @paweldrozd @Peetiegonzalez @PennyVibe @percilabs @personaltrainerkoichan @pibur @ploy-elison @PollyBot13 @postoso @potterdigital @priyabrataedu-droid @produtoramaxvision @qingminglong @R3NK0R @Ram-G @ranukadf82-hub @Raven-Gt @rebarshop-24 @RileyJJY @ringbe-cyber @robburke @RomneyDa @roslinmahmud @rosmiroslav-create @Rotocruz @rtfcv @ruel225 @RuiCatalao7 @RvsL @RXQ6 @ryan-dyer-sp @sahilsatralkar @saizero-dr @sallyom @samadarsh @sasan1200 @ScientificProgrammer @scotthuang @sercada @serg0x @sergiorodriguez-sudo @shadow-enthusiast @shailaja-bot @shakkernerd @shanselman @Shenrui-Ma @sjf @sjf-oa @slinkoff @SMF12138 @smoe @song-jia @sonofakel @SparcleAI @Spheresta @spunzon @stackingrockss @stbtyx747 @steipete @StevenKrebs @stevenlee-oai @Stronggenetics [@stuart-minion-ai](

[!IMPORTANT]
✂ PR body was truncated to here.

Configuration

📅 Schedule: (in timezone America/New_York)

Branch creation
- "before 9am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

coderabbitai · 2026-10-12T09:37:12Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 84e2474e-e409-4402-ae2e-dbf259c8e650

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-10-12T09:37:49Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance	License
openclaw@2026.8.1 ⏵ 2026.10.1			⁺¹	^-19
require-addon@1.3.0
@types/ws@8.18.1 ⏵ 8.18.2	⁺¹	⁺¹
@types/react@18.3.28 ⏵ 18.3.31
@types/node@22.20.5
@noble/ed25519@3.0.0 ⏵ 3.2.0			^-2
@noble/hashes@2.0.1 ⏵ 2.4.0
@noble/curves@2.0.1 ⏵ 2.4.0			^-1
msgpackr@1.11.8 ⏵ 1.12.1	⁺²	⁺¹
ws@8.21.0 ⏵ 8.22.0
fast-check@4.5.3 ⏵ 4.10.2	⁺¹		⁺⁵
@biomejs/biome@2.5.15

View full report

socket-security · 2026-10-12T09:37:51Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert (click "▶" to expand/collapse)	Action
	System shell access: npm `dotenv` in module child_process Module: child_process Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/dotenv@18.0.3` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/dotenv@18.0.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Install-time scripts: npm `esbuild` during postinstall Install script: postinstall Source: `node install.js` From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/esbuild@0.28.2` ℹ Read more on: This package \| This alert \| What is an install script? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/esbuild@0.28.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `esbuild` in module https Module: https Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/esbuild@0.28.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/esbuild@0.28.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `esbuild` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/esbuild@0.28.2` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/esbuild@0.28.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: npm `esbuild` in module child_process Module: child_process Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/esbuild@0.28.2` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/esbuild@0.28.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module net Module: net Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module globalThis["fetch"] Module: globalThis["fetch"] Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module node:net Module: node:net Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module node:tls Module: node:tls Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module node:http Module: node:http Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module node:http2 Module: node:http2 Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module node:dns Module: node:dns Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	System shell access: npm `npm` in module child_process Module: child_process Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is shell access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should avoid accessing the shell which can reduce portability, and make it easier for malicious shell access to be introduced. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module tls Module: tls Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module dns Module: dns Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module http2 Module: http2 Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module http Module: http Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn
	Network access: npm `npm` in module https Module: https Location: Package overview From: plugins/openclaw-github-review/package-lock.json → `npm/openclaw@2026.10.1` → `npm/npm@12.1.0` ℹ Read more on: This package \| This alert \| What is network access? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should remove all network access that is functionally unnecessary. Consumers should audit network access to ensure legitimate use. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@12.1.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report

tps-flint · 2026-10-18T01:08:58Z

Closing: this group exact-pins the runtime dependencies of the published @tpsdev-ai/cli, @tpsdev-ai/agent and platform packages, pins peer ranges (the openclaw-github-review plugin's peer and its devDependency now disagree), and pins engines to exact Node versions that neither CI nor the reviewer runtime matrix provides. It also bundles a bun upgrade and an openclaw 2026.9.9 bump. The openclaw bump breaks the gateway lane, whose driver targets 2026.8.1, the release the reviewer hosts run.

The devDependency pins in it are fine. They'll come back in a regenerated group once the Renovate config keeps ranges for published runtime dependencies, leaves peers and engines alone, and moves bun and node only together with the reviewer runtime matrix. That config change is tracked separately.

renovate Bot added dependencies supply-chain labels Oct 12, 2026

renovate Bot requested a review from a team as a code owner October 12, 2026 09:36

renovate Bot added dependencies supply-chain labels Oct 12, 2026

renovate Bot force-pushed the renovate/non-major-npm-dependencies branch 22 times, most recently from 60722c7 to 2d569d9 Compare October 16, 2026 06:50

renovate Bot force-pushed the renovate/non-major-npm-dependencies branch 10 times, most recently from 2c62fc3 to ba404cd Compare October 17, 2026 04:22

fix(deps): pin dependencies

23bfa1e

renovate Bot force-pushed the renovate/non-major-npm-dependencies branch from ba404cd to 23bfa1e Compare October 18, 2026 01:06

tps-flint closed this Oct 18, 2026

tps-flint mentioned this pull request Oct 18, 2026

fix(renovate): align Renovate proposals with the reviewer gates; allow checkout v4.4.0 #665

Merged

Navigation Menu

Repository navigation

fix(deps): pin dependencies - #612

fix(deps): pin dependencies#612
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/non-major-npm-dependencies

renovate Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Review skipped

Uh oh!

socket-security Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

tps-flint commented Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

renovate Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v1.4.3: Bun v1.4.3

Read Bun v1.4.3's release notes on Bun's blog

Thanks to 8 contributors!

v1.4.2: Bun v1.4.2

Read Bun v1.4.2's release notes on Bun's blog

Thanks to 3 contributors!

v1.4.1: Bun v1.4.1

Read Bun v1.4.1's release notes on Bun's blog

Thanks to 7 contributors!

v1.4.0: Bun v1.4

Thank you

v1.3.14: Bun v1.3.14

Read Bun v1.3.14's release notes on Bun's blog

Thanks to 11 contributors!

v1.3.13: Bun v1.3.13

Read Bun v1.3.13's release notes on Bun's blog

Thanks to 8 contributors!

v1.3.12: Bun v1.3.12

Read Bun v1.3.12's release notes on Bun's blog

Thanks to 8 contributors!

v1.3.11: Bun v1.3.11

Read Bun v1.3.11's release notes on Bun's blog

Thanks to 15 contributors!

v2026.10.1: openclaw 2026.10.1

OpenClaw v2026.10.1

Changes included in this release

Thanks

Configuration

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

socket-security Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tps-flint commented Oct 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Oct 12, 2026 •

edited

Loading

`v1.4.3`: Bun v1.4.3

`v1.4.2`: Bun v1.4.2

`v1.4.1`: Bun v1.4.1

`v1.4.0`: Bun v1.4

`v1.3.14`: Bun v1.3.14

`v1.3.13`: Bun v1.3.13

`v1.3.12`: Bun v1.3.12

`v1.3.11`: Bun v1.3.11

`v2026.10.1`: openclaw 2026.10.1

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

socket-security Bot commented Oct 12, 2026 •

edited

Loading

socket-security Bot commented Oct 12, 2026 •

edited

Loading