chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 2 updates in the / directory: undici and openclaw.

Removes undici

Updates openclaw from 2026.5.12 to 2026.7.1-2

Release notes

Sourced from openclaw's releases.

openclaw 2026.7.1-beta.6

2026.7.1

Highlights

• New models and providers: add Featherless, Claude Sonnet 5 and Mythos 5, Meta Muse Spark 1.1, and ClawRouter; make GPT-5.6 the new-setup default with /think ultra for Sol and Terra plus max for Luna, honor Z.AI max, and refresh model availability after OAuth renewal. (#101092, #98254, #101238, #102873, #103070, #103163, #99658, #99759, #98333, #103581, #98021, #104778, #102289) Thanks @​vincentkoc, @​vortexopenclaw, @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, @​steipete-oai, @​bdjben, @​obviyus, @​sallyom, @​anyech, @​100yenadmin, and @​fuller-stack-dev.
• Control UI and native macOS chat: make sessions primary with a minimal searchable sidebar, compact context ring, reasoning-effort slider, cleaner dashboard chrome, and a native macOS session browser with model and thinking pickers, slash commands, transcript export, and context usage. (#99289, #99838, #100386, #101103, #101497)
• Conversational onboarding: Crestodian now runs a real agent-loop setup across the CLI, web install, and macOS app, with AI-guided provider setup, model-judged approvals bound to exact operations, masked credential prompts, and deterministic fallback when no model is available. (#99935, #100029, #100656, #101887) Thanks @​fuller-stack-dev.
• Offline and spoken mobile chat: iOS and Android now pre-paint bounded per-gateway session and transcript caches offline; Apple Watch gains full voice turns, and iOS can speak replies through configured Gateway TTS with on-device fallback. (#100219, #100227, #100283, #100770, #100771)
• Session organization and generated titles: generate concise session titles through utility-model routing and add Gateway-backed groups, unread state, rename, fork, archive, and delete controls, plus group management across web, iOS, and Android. (#87643, #100814, #101117, #101234) Thanks @​zhangguiping-xydt and @​Juliangsm.
• Telegram and Codex continuity: pair Codex through private /login, steer active runs with /steer and /tell, preserve messages when transcript acknowledgement is missing, adopt durable turns safely, and recover final sends across Telegram formatting and flood-wait failures. (#98006, #98126, #98786, #103664, #103916) Thanks @​100yenadmin, @​Kyzcreig, @​obviyus, and @​jalehman.
• Startup and upgrade recovery: run container migrations before Gateway readiness, stop recoverable legacy state from blocking startup, and enter control-plane-safe mode after repeated unclean boots instead of restart flapping. (#101881, #104529) Fixes #98565 Thanks @​sallyom, @​jacobtomlinson, @​bdjben, @​obviyus, and @​shakkernerd.

Changes

• Meta provider: add bundled muse-spark-1.1 Responses API support with streaming, tool calls, encrypted reasoning replay, onboarding, exact-model live validation, and standalone npm/ClawHub distribution as @openclaw/meta-provider. (#102873, #103070, #103163) Thanks @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, and @​vincentkoc.

• Android chat agent selector: switch the active agent directly from the live chat screen while keeping chat, Talk mode, and home canvas on the same canonical session. (#80422) Thanks @​bcperry and @​joshavant.

• Gateway host status: show the connected Gateway's host, network address, OS, runtime, uptime, CPU, memory, and disk details in Control UI Settings. (#100478)

• Gateway crash-loop recovery: persist boot outcomes, enter control-plane-safe mode after repeated unclean starts, hold transport and provider activation until recovery, and exit with EX_CONFIG for fatal configuration errors so systemd and launchd stop restart flapping. Thanks @​obviyus.

• iOS offline chat: pre-paint recent sessions and canonical transcripts from a protected, bounded per-gateway cache, keep sending disabled offline, and purge cached conversation text when pairing is reset. (#100219)

• Slack progress indicators: use Slack's native assistant thread status and rotating loading messages by default while keeping acknowledgement reactions static; lifecycle reaction updates now require messages.statusReactions.enabled: true.

• Control UI Talk controls: keep voice, model, sensitivity, and other realtime defaults in Settings → Communications → Talk, and use the composer microphone caret to select any browser audio input. (#101046)

• Cron model selection: choose an agent-turn model in Control UI Quick Create and show configured or default models in cron job rows and details. (#95341) Thanks @​ly85206559.

• Control UI GitHub previews: show issue and pull request state, title, author, activity, comments, and change statistics in hover and keyboard-focus cards. (#100434)

• Logbook work journal: add a disabled-by-default bundled plugin that turns paired-node screen snapshots into a private timeline, daily standup, and timeline-grounded Q&A in a plugin-contributed Control UI tab. (#99930)

• Control UI message context: reveal per-message token, context, and model details from the timestamp on hover or activation instead of showing a separate Context button.

• Control UI session titles: reveal truncated recent-session names with a reduced-motion-safe hover animation.

• Control UI sidebar navigation: show a small customizable pinned destination set, keep the remaining pages under More, move Settings to the footer, and persist sidebar customization in the browser. (#100296) Thanks @​vincentkoc.

• Control UI sidebar usage: remove the provider usage quota row from the expanded sidebar while keeping usage details available in the chat composer and Usage page. Thanks @​shakkernerd.

• Android chat code highlighting: render fenced Kotlin, Swift, TypeScript, JavaScript, Python, Bash, and JSON blocks with bounded, theme-aware syntax colors while preserving plain rendering for unknown, partial, or oversized blocks. (#100217)

• Gateway TTS playback: add an operator-scoped tts.speak RPC that returns configured-provider speech as inline whole-clip audio for remote clients. (#100770)

• Control UI context usage: show context-window progress, latest-run input/output tokens, and the active model when the chat context ring is opened.

• Apple Watch voice turns: dictate a message from the Watch chat and hear the new OpenClaw reply spoken on the Watch, with explicit silent-message and stop-speaking controls. (#100224) Thanks @​vincentkoc.

• Conversational onboarding: add a real agent-loop Crestodian setup flow across the CLI, Gateway, web install, and macOS app, with typed operations, exact approval binding, masked credential prompts, isolated session transcripts, and safe handoff to the normal agent. Thanks @​vincentkoc.

• Generated session titles: name new Control UI sessions from their first message, and add default/per-agent utilityModel routing for lower-cost session, topic, and thread title generation. Thanks @​Juliangsm, @​zhangguiping-xydt, and @​vincentkoc.

• ClawRouter routing and quotas: add the bundled ClawRouter provider plugin with credential-scoped dynamic model discovery, OpenAI-compatible and native Anthropic/Gemini transports, and managed budget reporting across OpenClaw usage surfaces. (#99658)

• Model and provider coverage: add GPT-5.6 support, use Nemotron Super's 1M context window, and preserve explicit OpenRouter authentication headers. (#98333, #98726, #98187) Thanks @​steipete-oai, @​eleqtrizit, @​sunlit-deng, @​laurencebrown, and @​shakkernerd.

• CLI and node workflows: add openclaw attach, node context-path support, actionable device-approval recovery guidance, soft-resume CLI sessions when prompt metadata changes, and clearer plugin install exit diagnostics. (#96454, #97679, #98115, #98146, #98497, #99822) Thanks @​anagnorisis2peripeteia, @​obviyus, @​wm0018, @​welfo-beo, @​RomneyDa, @​Sanjays2402, and @​vincentkoc.

• Cron and usage: add exit-triggered schedules, detached session-targeted runs, and an in-flight job doctor warning, while making the existing usage footer easier to wrap on Telegram. (#92037, #98755, #98620, #92877) Thanks @​anagnorisis2peripeteia, @​obviyus, @​EthanSK, @​masatohoshino, @​Marvinthebored, and @​vincentkoc.

• Native apps and localization: modernize iOS presentation, Chat, Talk, onboarding, and reconnect flows; add Gateway speech providers; improve QR onboarding and protocol recovery; install the local Gateway from macOS; localize core Apple and Android surfaces; and add Swedish mobile localization. (#98452, #98736, #99243, #98376, #98302, #98385, #99767, #97110, #97111, #97112, #97113, #98043) Thanks @​jcooley8, @​Tony-ooo, @​joelnishanth, @​cursoragent, @​joshavant, @​vincentkoc, and @​yeager.

• Messaging capabilities: add native iMessage polls, Telegram Codex pairing and steering, Telegram multi-lane progress summaries, and Signal target aliases. (#98421, #98006, #98126, #98907, #95738) Thanks @​omarshahine, @​lobster, @​100yenadmin, @​Kyzcreig, @​Marvinthebored, and @​jesse-merhi.

• Local inference and chat controls: auto-discover Ollama inference nodes, add Control UI session-first navigation, reasoning controls, and command picking, and keep OpenClaw control tools available when deferred tool search selects the wrong tool family. (#99234, #99289, #99426, #99838, #99561) Thanks @​100yenadmin, @​joshavant, @​VicZhang6, @​Solvely-Colin, and @​vincentkoc.

• Doctor and diagnostics: expose auth-profile, workspace, device-pairing, channel-plugin, memory-provider, systemd exhaustion, and Windows LAN firewall findings. (#97125, #97358, #97366, #97496, #97968, #98291, #98666) Thanks @​giodl73-repo, @​masatohoshino, and @​joshavant.

• Policy repair previews: show review-required Gateway bind and denied node-command changes during doctor --fix without applying them or counting the findings as repaired. (#99776) Thanks @​giodl73-repo.

• Conversation and review controls: prepare scoped conversation capability profiles and add Cursor Agent as an autoreview engine. (#98536, #97348) Thanks @​hxy91819.

Fixes

• Codex runtime switching: accept the bundled Codex runtime for both codex/* and openai/* model routes while keeping unsupported provider/runtime pairs rejected. (#103762)

... (truncated)

Commits

• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Attestation changes

This version has no provenance attestation, while the previous version (2026.5.12) was attested. Review the package versions before updating.

Updates tar from 7.5.13 to 7.5.19

Commits

• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• Additional commits viewable in compare view

Updates openclaw from 2026.5.12 to 2026.7.1-2

Release notes

Sourced from openclaw's releases.

openclaw 2026.7.1-beta.6

2026.7.1

Highlights

• New models and providers: add Featherless, Claude Sonnet 5 and Mythos 5, Meta Muse Spark 1.1, and ClawRouter; make GPT-5.6 the new-setup default with /think ultra for Sol and Terra plus max for Luna, honor Z.AI max, and refresh model availability after OAuth renewal. (#101092, #98254, #101238, #102873, #103070, #103163, #99658, #99759, #98333, #103581, #98021, #104778, #102289) Thanks @​vincentkoc, @​vortexopenclaw, @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, @​steipete-oai, @​bdjben, @​obviyus, @​sallyom, @​anyech, @​100yenadmin, and @​fuller-stack-dev.
• Control UI and native macOS chat: make sessions primary with a minimal searchable sidebar, compact context ring, reasoning-effort slider, cleaner dashboard chrome, and a native macOS session browser with model and thinking pickers, slash commands, transcript export, and context usage. (#99289, #99838, #100386, #101103, #101497)
• Conversational onboarding: Crestodian now runs a real agent-loop setup across the CLI, web install, and macOS app, with AI-guided provider setup, model-judged approvals bound to exact operations, masked credential prompts, and deterministic fallback when no model is available. (#99935, #100029, #100656, #101887) Thanks @​fuller-stack-dev.
• Offline and spoken mobile chat: iOS and Android now pre-paint bounded per-gateway session and transcript caches offline; Apple Watch gains full voice turns, and iOS can speak replies through configured Gateway TTS with on-device fallback. (#100219, #100227, #100283, #100770, #100771)
• Session organization and generated titles: generate concise session titles through utility-model routing and add Gateway-backed groups, unread state, rename, fork, archive, and delete controls, plus group management across web, iOS, and Android. (#87643, #100814, #101117, #101234) Thanks @​zhangguiping-xydt and @​Juliangsm.
• Telegram and Codex continuity: pair Codex through private /login, steer active runs with /steer and /tell, preserve messages when transcript acknowledgement is missing, adopt durable turns safely, and recover final sends across Telegram formatting and flood-wait failures. (#98006, #98126, #98786, #103664, #103916) Thanks @​100yenadmin, @​Kyzcreig, @​obviyus, and @​jalehman.
• Startup and upgrade recovery: run container migrations before Gateway readiness, stop recoverable legacy state from blocking startup, and enter control-plane-safe mode after repeated unclean boots instead of restart flapping. (#101881, #104529) Fixes #98565 Thanks @​sallyom, @​jacobtomlinson, @​bdjben, @​obviyus, and @​shakkernerd.

Changes

• Meta provider: add bundled muse-spark-1.1 Responses API support with streaming, tool calls, encrypted reasoning replay, onboarding, exact-model live validation, and standalone npm/ClawHub distribution as @openclaw/meta-provider. (#102873, #103070, #103163) Thanks @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, and @​vincentkoc.

• Android chat agent selector: switch the active agent directly from the live chat screen while keeping chat, Talk mode, and home canvas on the same canonical session. (#80422) Thanks @​bcperry and @​joshavant.

• Gateway host status: show the connected Gateway's host, network address, OS, runtime, uptime, CPU, memory, and disk details in Control UI Settings. (#100478)

• Gateway crash-loop recovery: persist boot outcomes, enter control-plane-safe mode after repeated unclean starts, hold transport and provider activation until recovery, and exit with EX_CONFIG for fatal configuration errors so systemd and launchd stop restart flapping. Thanks @​obviyus.

• iOS offline chat: pre-paint recent sessions and canonical transcripts from a protected, bounded per-gateway cache, keep sending disabled offline, and purge cached conversation text when pairing is reset. (#100219)

• Slack progress indicators: use Slack's native assistant thread status and rotating loading messages by default while keeping acknowledgement reactions static; lifecycle reaction updates now require messages.statusReactions.enabled: true.

• Control UI Talk controls: keep voice, model, sensitivity, and other realtime defaults in Settings → Communications → Talk, and use the composer microphone caret to select any browser audio input. (#101046)

• Cron model selection: choose an agent-turn model in Control UI Quick Create and show configured or default models in cron job rows and details. (#95341) Thanks @​ly85206559.

• Control UI GitHub previews: show issue and pull request state, title, author, activity, comments, and change statistics in hover and keyboard-focus cards. (#100434)

• Logbook work journal: add a disabled-by-default bundled plugin that turns paired-node screen snapshots into a private timeline, daily standup, and timeline-grounded Q&A in a plugin-contributed Control UI tab. (#99930)

• Control UI message context: reveal per-message token, context, and model details from the timestamp on hover or activation instead of showing a separate Context button.

• Control UI session titles: reveal truncated recent-session names with a reduced-motion-safe hover animation.

• Control UI sidebar navigation: show a small customizable pinned destination set, keep the remaining pages under More, move Settings to the footer, and persist sidebar customization in the browser. (#100296) Thanks @​vincentkoc.

• Control UI sidebar usage: remove the provider usage quota row from the expanded sidebar while keeping usage details available in the chat composer and Usage page. Thanks @​shakkernerd.

• Android chat code highlighting: render fenced Kotlin, Swift, TypeScript, JavaScript, Python, Bash, and JSON blocks with bounded, theme-aware syntax colors while preserving plain rendering for unknown, partial, or oversized blocks. (#100217)

• Gateway TTS playback: add an operator-scoped tts.speak RPC that returns configured-provider speech as inline whole-clip audio for remote clients. (#100770)

• Control UI context usage: show context-window progress, latest-run input/output tokens, and the active model when the chat context ring is opened.

• Apple Watch voice turns: dictate a message from the Watch chat and hear the new OpenClaw reply spoken on the Watch, with explicit silent-message and stop-speaking controls. (#100224) Thanks @​vincentkoc.

• Conversational onboarding: add a real agent-loop Crestodian setup flow across the CLI, Gateway, web install, and macOS app, with typed operations, exact approval binding, masked credential prompts, isolated session transcripts, and safe handoff to the normal agent. Thanks @​vincentkoc.

• Generated session titles: name new Control UI sessions from their first message, and add default/per-agent utilityModel routing for lower-cost session, topic, and thread title generation. Thanks @​Juliangsm, @​zhangguiping-xydt, and @​vincentkoc.

• ClawRouter routing and quotas: add the bundled ClawRouter provider plugin with credential-scoped dynamic model discovery, OpenAI-compatible and native Anthropic/Gemini transports, and managed budget reporting across OpenClaw usage surfaces. (#99658)

• Model and provider coverage: add GPT-5.6 support, use Nemotron Super's 1M context window, and preserve explicit OpenRouter authentication headers. (#98333, #98726, #98187) Thanks @​steipete-oai, @​eleqtrizit, @​sunlit-deng, @​laurencebrown, and @​shakkernerd.

• CLI and node workflows: add openclaw attach, node context-path support, actionable device-approval recovery guidance, soft-resume CLI sessions when prompt metadata changes, and clearer plugin install exit diagnostics. (#96454, #97679, #98115, #98146, #98497, #99822) Thanks @​anagnorisis2peripeteia, @​obviyus, @​wm0018, @​welfo-beo, @​RomneyDa, @​Sanjays2402, and @​vincentkoc.

• Cron and usage: add exit-triggered schedules, detached session-targeted runs, and an in-flight job doctor warning, while making the existing usage footer easier to wrap on Telegram. (#92037, #98755, #98620, #92877) Thanks @​anagnorisis2peripeteia, @​obviyus, @​EthanSK, @​masatohoshino, @​Marvinthebored, and @​vincentkoc.

• Native apps and localization: modernize iOS presentation, Chat, Talk, onboarding, and reconnect flows; add Gateway speech providers; improve QR onboarding and protocol recovery; install the local Gateway from macOS; localize core Apple and Android surfaces; and add Swedish mobile localization. (#98452, #98736, #99243, #98376, #98302, #98385, #99767, #97110, #97111, #97112, #97113, #98043) Thanks @​jcooley8, @​Tony-ooo, @​joelnishanth, @​cursoragent, @​joshavant, @​vincentkoc, and @​yeager.

• Messaging capabilities: add native iMessage polls, Telegram Codex pairing and steering, Telegram multi-lane progress summaries, and Signal target aliases. (#98421, #98006, #98126, #98907, #95738) Thanks @​omarshahine, @​lobster, @​100yenadmin, @​Kyzcreig, @​Marvinthebored, and @​jesse-merhi.

• Local inference and chat controls: auto-discover Ollama inference nodes, add Control UI session-first navigation, reasoning controls, and command picking, and keep OpenClaw control tools available when deferred tool search selects the wrong tool family. (#99234, #99289, #99426, #99838, #99561) Thanks @​100yenadmin, @​joshavant, @​VicZhang6, @​Solvely-Colin, and @​vincentkoc.

• Doctor and diagnostics: expose auth-profile, workspace, device-pairing, channel-plugin, memory-provider, systemd exhaustion, and Windows LAN firewall findings. (#97125, #97358, #97366, #97496, #97968, #98291, #98666) Thanks @​giodl73-repo, @​masatohoshino, and @​joshavant.

• Policy repair previews: show review-required Gateway bind and denied node-command changes during doctor --fix without applying them or counting the findings as repaired. (#99776) Thanks @​giodl73-repo.

• Conversation and review controls: prepare scoped conversation capability profiles and add Cursor Agent as an autoreview engine. (#98536, #97348) Thanks @​hxy91819.

Fixes

• Codex runtime switching: accept the bundled Codex runtime for both codex/* and openai/* model routes while keeping unsupported provider/runtime pairs rejected. (#103762)

... (truncated)

Commits

• See full diff in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Attestation changes

This version has no provenance attestation, while the previous version (2026.5.12) was attested. Review the package versions before updating.

Updates protobufjs from 7.5.8 to 7.6.3

Release notes

Sourced from protobufjs's releases.

protobufjs: v7.6.3

7.6.3 (2026-06-09)

Bug Fixes

• Avoid name collisions in generated code (#2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#2312) (df91652)

protobufjs: v7.6.2

7.6.2 (2026-05-30)

Bug Fixes

• Backport consistency and correctness fixes (#2294) (a92f72e)

protobufjs: v7.6.1

7.6.1 (2026-05-22)

Bug Fixes

• Backport misc utility hardening (#2280) (8a45c13)
• Treat fixed64 as unsigned in converters (#2266) (479dfdc)

protobufjs: v7.6.0

7.6.0 (2026-05-18)

Features

• Support BigInt conversions (7.x) (#2258) (f769242)

protobufjs: v7.5.9

7.5.9 (2026-05-17)

Bug Fixes

• Backport bundler-safe optional module lookups (#2254) (0853a62)

Changelog

Sourced from protobufjs's changelog.

7.6.3 (2026-06-09)

Bug Fixes

• Avoid name collisions in generated code (#2311) (78a9576)
• Preserve null conversion behavior for fieldless messages (#2312) (df91652)

7.6.2 (2026-05-30)

Bug Fixes

• Backport consistency and correctness fixes (#2294) (a92f72e)

7.6.1 (2026-05-22)

Bug Fixes

• Backport misc utility hardening (#2280) (8a45c13)
• Treat fixed64 as unsigned in converters (#2266) (479dfdc)

7.6.0 (2026-05-18)

Features

• Support BigInt conversions (7.x) (#2258) (f769242)

7.5.9 (2026-05-17)

Bug Fixes

• Backport bundler-safe optional module lookups (#2254) (0853a62)

Commits

• 1d3796d chore: release protobufjs-v7.x (#2317)
• df91652 fix: Preserve null conversion behavior for fieldless messages (#2312)
• 78a9576 fix: Avoid name collisions in generated code (#2311)
• ec90ef9 chore: release protobufjs-v7.x (#2295)
• a92f72e fix: Backport consistency and correctness fixes (#2294)
• f0b50d2 chore: release protobufjs-v7.x (#2268)
• 8a45c13 fix: Backport misc utility hardening (#2280)
• 479dfdc fix: Treat fixed64 as unsigned in converters (#2266)
• e30c334 chore: release protobufjs-v7.x (#2260)
• f769242 feat: Support BigInt conversions (7.x) (#2258)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.