chore(deps): bump the swift-deps group across 1 directory with 3 updates by dependabot[bot] · Pull Request #86483 · openclaw/openclaw

dependabot · 2026-05-25T12:43:43Z

Bumps the swift-deps group with 3 updates in the /apps/macos directory: github.com/apple/swift-log, github.com/sparkle-project/sparkle and github.com/steipete/peekaboo.

Updates github.com/apple/swift-log from 1.12.0 to 1.13.1

Release notes

Sourced from github.com/apple/swift-log's releases.

1.13.1

What's Changed

SemVer Patch

Match DefaultStringInterpolation appendInterpolation overloads by @kukushechkin in apple/swift-log#469

Full Changelog: apple/swift-log@1.13.0...1.13.1

1.13.0

What's Changed

SemVer Minor

[SLG-0004]: metadata value attributes implementation by @kukushechkin in apple/swift-log#453

This release contains a source-breaking change of MetadataValue compatibility with custom string interpolations. Please see apple/swift-log#467 for details.

Full Changelog: apple/swift-log@1.12.1...1.13.0

1.12.1

What's Changed

SemVer Patch

Improve readability by extracting separate types to their own files by @samuelmurray in apple/swift-log#444

Skip handler dispatch for setters under MaxLogLevelNone by @rnro in apple/swift-log#465

Other Changes

Update documentation to reflect recent changes by @samuelmurray in apple/swift-log#445

Update dependabot to daily schedule by @kukushechkin in apple/swift-log#446

Bump swiftlang/github-workflows/.github/workflows/soundness.yml from 0.0.9 to 0.0.11 by @dependabot[bot] in apple/swift-log#447

Make dependabot set label by @kukushechkin in apple/swift-log#448

Add tests for SwiftLogNoOpLogHandler by @crleonard in apple/swift-log#449

Cleanup repository structure by @kukushechkin in apple/swift-log#451

Disable nightly 6.3 WASM builds by @kukushechkin in apple/swift-log#454

[SLG-0004]: metadata value attributes proposal (revision 2) by @kukushechkin in apple/swift-log#440

Migrate macOS CI to Swift version inputs by @rnro in apple/swift-log#457

Shared workflows changed from Xcode XX.X to Xcode swift X.X by @kukushechkin in apple/swift-log#461

Adopt multi-package macOS benchmarks workflow by @rnro in apple/swift-log#466

New Contributors

@crleonard made their first contribution in apple/swift-log#449

Full Changelog: apple/swift-log@1.12.0...1.12.1

Commits

2aed77a Match DefaultStringInterpolation appendInterpolation overloads (#469)
7dc6101 [SLG-0004]: metadata value attributes implementation (#453)
a012e0a Adopt multi-package macOS benchmarks workflow (#466)
1069d31 Skip handler dispatch for setters under MaxLogLevelNone (#465)
3061a62 Shared workflows changed from Xcode XX.X to Xcode swift X.X (#461)
184c737 Migrate macOS CI to Swift version inputs (#457)
eca8199 [SLG-0004]: metadata value attributes proposal (revision 2) (#440)
ac3646e Disable nightly 6.3 WASM builds (#454)
5c348a6 Cleanup repository structure (#451)
deae26e Add tests for SwiftLogNoOpLogHandler (#449)
Additional commits viewable in compare view

Updates github.com/sparkle-project/sparkle from 2.9.1 to 2.9.2

Release notes

Sourced from github.com/sparkle-project/sparkle's releases.

2.9.2 Appcast Improvements

Changes:

Show hidden window title in update window for accessibility (#2871) (Zorg)

Polish and update Spanish translations to be gender neutral (#2874, #2875) (Emilio P Egido)

Guard against NULL CFRelease() on failure condition in fallback path (#2867) (Zorg)

Guard against symlinks when applying delta update files (fe7b718) (Zorg, fg0x0)

Enforce connection to installer to be validated before receiving appcast item data (#2876, #2877) (Zorg, fg0x0)

This release contains two high-complex security fixes reported by @fg0x0. The details will be posted in the 2.9 discussion.

Please also check 2.9.1 and 2.9.0 for previous changes.

Commits

6276ba2 Update Package management files for version 2.9.2
113279a Improve synchronization of _receivedAppcastItemData (#2877)
7c4741d Update Package management files for version 2.9.2
5df807d Update README for 2.9.2
c6ab245 Update Package management files for version 2.9.2
6e370a5 Enforce connection to installer to be validated before receiving appcast item...
cbdc150 Polish Spanish localization in Sparkle.strings (#2875)
fe7b718 Merge commit from fork
d2b796b Update you're up to date Spanish translation to be gender neutral (#2874)
2f33f56 Fix QoS warning when running Test app server on main thread (#2873)
Additional commits viewable in compare view

Updates github.com/steipete/peekaboo from 3.2.1 to 3.3.0

Release notes

Sourced from github.com/steipete/peekaboo's releases.

v3.3.0

[3.3.0] - 2026-06-01

Added

peekaboo agent now supports MiniMax China via minimax-cn/... models and MINIMAX_CN_API_KEY, while preserving the existing international MiniMax endpoint. Thanks @LLuke for #161.

Changed

peekaboo click, type, hotkey, press, and paste now use background process-targeted delivery by default when a target PID/app/window/snapshot process can be resolved, with --foreground for focused foreground input.

Fixed

Background text input now prefers AX text editing for typing, paste, clear, and focused-field key presses so targeted apps stay in the background more reliably.

Background text paste no longer snapshots or restores the user clipboard, positional peekaboo paste "text" works again, and background cmd+a selects focused text fields via AX.

peekaboo open --app Finder ... now resolves Finder from CoreServices, matching the documented examples.

Visualizer settings and capture-engine docs now reference peekaboo capture live instead of stale top-level peekaboo watch/peekaboo capture command forms. Thanks @coygeek for #166 and #167.

Verification

npm: https://www.npmjs.com/package/@steipete/peekaboo/v/3.3.0

Registry tarball: https://registry.npmjs.org/@steipete/peekaboo/-/peekaboo-3.3.0.tgz

Integrity: sha512-5VfZ/Xr4KG1Hh4AC1kcQof7SdiNJK0jgSqElW4HErkj9e2hPNft59mJYpZDZnBRQ7JRX3ZJz3vwpx7A8R5+sAA==

Published: 2026-05-31T23:41:15.713Z

Proof: SwiftFormat, SwiftLint, warning gate, pnpm run test:safe (463 tests), notarization, appcast validation, npm registry verification.

v3.2.3

[3.2.3] - 2026-05-24

Added

peekaboo image --json now reports capture coordinate diagnostics and warns when window captures look blank or solid.

Fixed

Interaction commands now accept --snapshot latest explicitly and window/app capture failures list rejected capture candidates.

Release proof

npm: https://www.npmjs.com/package/@steipete/peekaboo/v/3.2.3

registry tarball: https://registry.npmjs.org/@steipete/peekaboo/-/peekaboo-3.2.3.tgz

integrity: sha512-0+NJGpJVNnwTYiw/ApL7VNYCMJkOIHHxQqR8qJubzm7EKRt3tVu7CdqHs1lXkpcdJaJ5PYeGGDngj+PeUlPxFA==

published: 2026-05-24T04:33:55.374Z

proof: autoreview clean; pnpm run test:safe; node scripts/prepare-release.js; notarized app zip accepted; GitHub assets verified; npm latest points to 3.2.3

v3.2.2

[3.2.2] - 2026-05-22

Added

GameBridge manifests now let peekaboo see expose Firestaff/SDL game UI zones from GPU-rendered windows. Thanks @yeager for #152.

Fixed

peekaboo agent now accepts OpenRouter model IDs and can use OPENROUTER_API_KEY from env or credentials. Thanks @delort for #155.

Release Verification

... (truncated)

Commits

faf8430 chore(release): update appcast for 3.3.0
6feffe5 chore(release): prepare 3.3.0
697acdd chore: update Tachikoma submodule
6609a43 fix(cli): improve background text input
619a033 fix(cli): harden background text input
122c96d feat(cli): use background keyboard delivery by default
abb4e87 fix(cli): default clicks to background delivery (#168)
c15ff18 docs: update AXorcist submodule
28a47f9 docs: position README banner
9d32a65 ci: pin macOS runner labels
Additional commits viewable in compare view

clawsweeper · 2026-05-25T12:45:29Z

Codex review: needs maintainer review before merge. Reviewed June 5, 2026, 4:44 AM ET / 08:44 UTC.

Summary
This PR updates the macOS SwiftPM manifest and lockfile to resolve Peekaboo 3.3.0, Sparkle 2.9.2, and swift-log 1.13.1.

PR surface: Other 0. Total 0 across 2 files.

Reproducibility: not applicable. this is a dependency update rather than a bug report. The reviewable proof is current main still pinning the old versions, the PR head pinning the new versions, upstream release notes, and exact-head checks.

Review metrics: 2 noteworthy metrics.

Runtime SwiftPM dependencies: 3 updated. All updated packages are direct production macOS dependencies used by logging, updater, or PeekabooBridge runtime paths.
Exact-head relevant checks: 6 passed, 1 queued. macos-swift, macos-node, dependency-guard, security-fast, Opengrep OSS, and Real behavior proof passed on the inspected head, while ci-timings-summary had not completed yet.

Merge readiness
Overall: 🐚 platinum hermit
Proof: 🌊 off-meta tidepool
Patch quality: 🐚 platinum hermit
Result: ready for maintainer review.

Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch.

Rank-up moves:

Run a signed packaged macOS app launch smoke for this exact head.
[P2] Exercise Sparkle updater initialization/check and PeekabooBridge enable/startup before merge if maintainers want runtime proof.

Mantis proof suggestion
A real macOS desktop proof would materially help verify the signed app, Sparkle updater controls, and PeekabooBridge startup after the dependency bump. A maintainer can ask Mantis to capture proof by posting a new PR comment that starts with the OpenClaw Mantis account mention, followed by:

visual task: launch the packaged macOS app for this PR, open About update controls, enable Peekaboo Bridge, and capture startup or updater errors.

Risk before merge

[P1] Sparkle 2.9.2 changes updater/appcast validation and includes upstream security fixes in the signed app update path, so maintainers should be comfortable with the trust-boundary update before merge.
[P1] Peekaboo 3.3.0 changes background process-targeted input delivery while OpenClaw hosts PeekabooBridge with Team ID allowlisting, so a signed macOS app and bridge startup smoke would reduce runtime uncertainty.
[P1] swift-log 1.13.0 notes a source-breaking MetadataValue custom interpolation change; current OpenClaw logging code uses Logger.Metadata.Value directly and exact-head macos-swift passed, so this looks low risk but still belongs in the compatibility review.

Maintainer options:

Smoke the signed macOS runtime (recommended)
Run a signed packaged app launch that initializes Sparkle and enables PeekabooBridge on this exact head before merging.
Accept the upstream dependency risk
Maintainers may merge based on the green exact-head macOS/package checks and upstream release notes if they are comfortable owning runtime validation after merge.
Split the security-sensitive bumps
If the grouped update is too much to judge at once, close or pause this PR and take Sparkle, Peekaboo, and swift-log as separate dependency PRs with focused proof.

Next step before merge

[P2] The next action is maintainer risk acceptance or runtime proof for signed macOS updater and bridge paths; there is no narrow code repair for ClawSweeper to queue.

Security
Cleared: No concrete malicious or supply-chain regression was found in the narrow SwiftPM manifest and lockfile bump, but the changed Sparkle and Peekaboo trust boundaries remain explicit merge risks.

Review details

Best possible solution:

Land the dependency bump after maintainer acceptance of the signed-updater and PeekabooBridge runtime risk, ideally with a signed macOS app launch, Sparkle updater initialization, and PeekabooBridge enable/startup smoke on the exact head.

Do we have a high-confidence way to reproduce the issue?

Not applicable; this is a dependency update rather than a bug report. The reviewable proof is current main still pinning the old versions, the PR head pinning the new versions, upstream release notes, and exact-head checks.

Is this the best way to solve the issue?

Yes for the maintenance task: updating the SwiftPM manifest and lockfile is the right owner boundary for this dependency group. The safer pre-merge state is maintainer-owned signed-app/updater/bridge smoke or an explicit decision to accept that runtime risk.

AGENTS.md: found and applied where relevant.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 1a3ce7c2a8da.

Label changes

Label justifications:

P3: This is routine dependency maintenance with a bounded macOS surface and no reported user-facing regression.
merge-risk: 🚨 compatibility: The bump includes swift-log's noted source-breaking MetadataValue interpolation change and Peekaboo behavior changes that could affect macOS runtime compatibility.
merge-risk: 🚨 security-boundary: Sparkle owns signed app update handling and PeekabooBridge exposes allowlisted UI automation, so these dependency changes cross security-sensitive runtime boundaries.
rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR. Not applicable: This is a Dependabot dependency PR, so contributor real-behavior proof is not required; maintainers may still request signed macOS runtime smoke for the security-sensitive paths.

Evidence reviewed

PR surface:

Other 0. Total 0 across 2 files.

View PR surface stats

Area	Files	Added	Removed
Source	0	0	0
Tests	0	0	0
Docs	0	0	0
Config	0	0	0
Generated	0	0	0
Other	2	8	8
Total	2	8	8

What I checked:

Live PR state: The live GitHub API shows this PR is open, cleanly mergeable, and at head 661aa2b against current main 1a3ce7c. (661aa2b5b2ca)
Current main dependency pins: Current main still declares swift-log from 1.10.1, Sparkle from 2.9.0, and exact Peekaboo 3.2.1; Package.resolved still locks swift-log 1.12.0, Sparkle 2.9.1, and Peekaboo 3.2.1. (apps/macos/Package.swift:20, 1a3ce7c2a8da)
PR head dependency pins: The PR head changes the exact Peekaboo manifest pin to 3.3.0 and the lockfile to Peekaboo 3.3.0, Sparkle 2.9.2, and swift-log 1.13.1. (apps/macos/Package.resolved:45, 661aa2b5b2ca)
Runtime dependency surface: OpenClaw's macOS app directly imports Sparkle for SPUStandardUpdaterController and imports PeekabooBridge/PeekabooAutomationKit for the Team-ID-allowlisted bridge host, so this is not a test-only dependency bump. (apps/macos/Sources/OpenClaw/MenuBar.swift:461, 1a3ce7c2a8da)
Upstream release contracts: Official upstream release data says Sparkle 2.9.2 includes two high-complexity security fixes, Peekaboo 3.3.0 changes background process-targeted input delivery, and swift-log 1.13.0 contains a source-breaking MetadataValue custom interpolation change fixed forward by 1.13.1.
Exact-head checks: GitHub check-runs for the exact PR head show macos-swift, macos-node, dependency-guard, security-fast, Opengrep OSS, and Real behavior proof completed successfully; ci-timings-summary was still queued at inspection time. (661aa2b5b2ca)

Likely related people:

steipete: Git history and blame show Peter Steinberger introduced Sparkle update support, hosted PeekabooBridge, switched Peekaboo to SPM, and has the recent dominant history on the macOS Package files and runtime dependency paths. (role: feature owner and recent area contributor; confidence: high; commits: ddbe680a585e, c17440f5b487, cf3becfb2e20; files: apps/macos/Package.swift, apps/macos/Package.resolved, apps/macos/Sources/OpenClaw/MenuBar.swift)

What the crustacean ranks mean

🦀 challenger crab: rare, exceptional readiness with strong proof, clean implementation, and convincing validation.
🦞 diamond lobster: very strong readiness with only minor maintainer review expected.
🐚 platinum hermit: good normal PR, likely mergeable with ordinary maintainer review.
🦐 gold shrimp: useful signal, but proof or patch confidence is still limited.
🦪 silver shellfish: thin signal; proof, validation, or implementation needs work.
🧂 unranked krab: not merge-ready because proof is missing/unusable or there are serious correctness or safety concerns.
🌊 off-meta tidepool: rating does not apply to this item.

Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics.

How this review workflow works

ClawSweeper keeps one durable marker-backed review comment per issue or PR.
Re-runs edit this comment so the latest verdict, findings, and automation markers stay together instead of adding duplicate bot comments.
A fresh review can be triggered by eligible @clawsweeper re-review comments, exact-item GitHub events, scheduled/background review runs, or manual workflow dispatch.
PR/issue authors and users with repository write access can comment @clawsweeper re-review or @clawsweeper re-run on an open PR or issue to request a fresh review only.
Maintainers can also comment @clawsweeper review to request a fresh review only.
Fresh-review commands do not start repair, autofix, rebase, CI repair, or automerge.
Maintainer-only repair and merge flows require explicit commands such as @clawsweeper autofix, @clawsweeper automerge, @clawsweeper fix ci, or @clawsweeper address review.
Maintainers can comment @clawsweeper explain to ask for more context, or @clawsweeper stop to stop active automation.

clawsweeper · 2026-05-25T12:53:19Z

ClawSweeper PR egg: ✨ hatched 🥚 common Clockwork Proofling. Rarity: 🥚 common. Trait: sniffs out flaky tests.

Details

Share on X: post this hatch
Copy: My PR egg hatched a 🥚 common Clockwork Proofling in ClawSweeper.
Hatchability:

Merged PRs are hatchable.
Open PRs are hatchable when they are status: 👀 ready for maintainer look, status: 🚀 automerge armed, or labeled clawsweeper:automerge.
Closed unmerged PRs are hatchable only when one of those hatchable labels is still present in the durable record.

About:

Eggs appear after real-behavior proof passes. They are collectible flavor only.
Review momentum changes the shell state: follow-up work warms it, re-review makes it wobble, and a clean final review lets it hatch.
The hatch is seeded from this repository and PR number, so the same PR keeps the same creature; the reviewed head SHA can only change safe visual details.
Rarity is just collectible sparkle: 🥚 common, 🌱 uncommon, 💎 rare, ✨ glimmer, and 🌈 legendary.

Bumps the swift-deps group with 3 updates in the /apps/macos directory: [github.com/apple/swift-log](https://github.com/apple/swift-log), [github.com/sparkle-project/sparkle](https://github.com/sparkle-project/Sparkle) and [github.com/steipete/peekaboo](https://github.com/steipete/Peekaboo). Updates `github.com/apple/swift-log` from 1.12.0 to 1.13.1 - [Release notes](https://github.com/apple/swift-log/releases) - [Commits](apple/swift-log@1.12.0...1.13.1) Updates `github.com/sparkle-project/sparkle` from 2.9.1 to 2.9.2 - [Release notes](https://github.com/sparkle-project/Sparkle/releases) - [Commits](sparkle-project/Sparkle@2.9.1...2.9.2) Updates `github.com/steipete/peekaboo` from 3.2.1 to 3.3.0 - [Release notes](https://github.com/steipete/Peekaboo/releases) - [Commits](openclaw/Peekaboo@v3.2.1...v3.3.0) --- updated-dependencies: - dependency-name: github.com/apple/swift-log dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: swift-deps - dependency-name: github.com/sparkle-project/sparkle dependency-version: 2.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: swift-deps - dependency-name: github.com/steipete/peekaboo dependency-version: 3.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: swift-deps ... Signed-off-by: dependabot[bot] <support@github.com>

…tes (openclaw#86483) Bumps the swift-deps group with 3 updates in the /apps/macos directory: [github.com/apple/swift-log](https://github.com/apple/swift-log), [github.com/sparkle-project/sparkle](https://github.com/sparkle-project/Sparkle) and [github.com/steipete/peekaboo](https://github.com/steipete/Peekaboo). Updates `github.com/apple/swift-log` from 1.12.0 to 1.13.1 - [Release notes](https://github.com/apple/swift-log/releases) - [Commits](apple/swift-log@1.12.0...1.13.1) Updates `github.com/sparkle-project/sparkle` from 2.9.1 to 2.9.2 - [Release notes](https://github.com/sparkle-project/Sparkle/releases) - [Commits](sparkle-project/Sparkle@2.9.1...2.9.2) Updates `github.com/steipete/peekaboo` from 3.2.1 to 3.3.0 - [Release notes](https://github.com/steipete/Peekaboo/releases) - [Commits](openclaw/Peekaboo@v3.2.1...v3.3.0) --- updated-dependencies: - dependency-name: github.com/apple/swift-log dependency-version: 1.12.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: swift-deps - dependency-name: github.com/sparkle-project/sparkle dependency-version: 2.9.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: swift-deps - dependency-name: github.com/steipete/peekaboo dependency-version: 3.2.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: swift-deps ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…26.6.5) (#963) This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/openclaw/openclaw](https://openclaw.ai) ([source](https://github.com/openclaw/openclaw)) | patch | `2026.6.1` → `2026.6.5` | --- ### Release Notes <details> <summary>openclaw/openclaw (ghcr.io/openclaw/openclaw)</summary> ### [`v2026.6.5`](https://github.com/openclaw/openclaw/blob/HEAD/CHANGELOG.md#202665) [Compare Source](openclaw/openclaw@v2026.6.1...v2026.6.5) ##### Highlights - QQBot now strips model reasoning/thinking scaffolding before native delivery, preventing raw `<thinking>` content from leaking into channel replies. ([#89913](openclaw/openclaw#89913), [#90132](openclaw/openclaw#90132)) Thanks [@openperf](https://github.com/openperf). - MCP tool results now coerce `resource_link`, `resource`, `audio`, malformed image, and future non-text/image blocks at the materialize boundary, preventing Anthropic 400s and poisoned session history after a tool returns richer MCP content. ([#90710](openclaw/openclaw#90710), [#90728](openclaw/openclaw#90728)) Thanks [@RanSHammer](https://github.com/RanSHammer) and [@849261680](https://github.com/849261680). - Anthropic extended-thinking sessions recover after prompt-cache expiry or Gateway restart because stream start events wait for `message_start`, letting pre-generation signature errors trigger the existing recovery retry. ([#90667](openclaw/openclaw#90667), [#90697](openclaw/openclaw#90697)) Thanks [@openperf](https://github.com/openperf). - Parallel is now a bundled `web_search` provider with `PARALLEL_API_KEY` discovery, guarded endpoint handling, cache-safe session ids, onboarding picker support, and docs. ([#85158](openclaw/openclaw#85158)) Thanks [@NormallyGaussian](https://github.com/NormallyGaussian). - Google Vertex ADC users get static catalog rows and runtime model resolution again, while single-provider cooldown recovery and memory adapter status checks are more reliable. ([#90506](openclaw/openclaw#90506), [#90609](openclaw/openclaw#90609), [#90717](openclaw/openclaw#90717), [#90816](openclaw/openclaw#90816)) Thanks [@849261680](https://github.com/849261680). - Matrix can preflight voice notes before mention gating, preserve thread reads/replies through Matrix relations pagination, and carry QA coverage for voice and thread flows. ([#78016](openclaw/openclaw#78016), [#90415](openclaw/openclaw#90415)) - Auth and plugin install state is more durable: auth profiles now live in SQLite, official npm plugin install records keep their trusted pins, and prerelease fallback integrity checks avoid carrying stale integrity forward. ([#89102](openclaw/openclaw#89102), [#88585](openclaw/openclaw#88585)) - macOS node mode no longer silently self-reconnects away from a healthy direct Gateway session, reducing unexpected companion app session churn. ([#90668](openclaw/openclaw#90668), [#90815](openclaw/openclaw#90815)) Thanks [@vrurg](https://github.com/vrurg). - Upgrade and service paths are safer: cron legacy JSON stores migrate during doctor preflight, service env placeholders no longer mask state-dir secrets, WhatsApp startup waits are bounded, and disabled WhatsApp accounts tear down on config reload. ([#90072](openclaw/openclaw#90072), [#90208](openclaw/openclaw#90208), [#90277](openclaw/openclaw#90277), [#90488](openclaw/openclaw#90488), [#90486](openclaw/openclaw#90486), [#87951](openclaw/openclaw#87951), [#87965](openclaw/openclaw#87965)) Thanks [@MonkeyLeeT](https://github.com/MonkeyLeeT), [@sallyom](https://github.com/sallyom), [@mcaxtr](https://github.com/mcaxtr), and [@MukundaKatta](https://github.com/MukundaKatta). ##### Changes - Search/providers: add the Parallel bundled web-search plugin, live provider tests, registration contracts, onboarding/docs wiring, and guarded `api.parallel.ai/v1/search` support. ([#85158](openclaw/openclaw#85158)) Thanks [@NormallyGaussian](https://github.com/NormallyGaussian). - Matrix/channels: add voice-message preflight and thread-aware read/reply behavior, including Matrix QA scenario wiring and docs for voice-message behavior. ([#78016](openclaw/openclaw#78016), [#90415](openclaw/openclaw#90415)) - Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. ([#90478](openclaw/openclaw#90478)) Thanks [@Patrick-Erichsen](https://github.com/Patrick-Erichsen). - Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow. - Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable. - Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. ([#61834](openclaw/openclaw#61834)) - Docs/tooling: add Parallel search docs, refresh weather-skill guidance toward `web_fetch`, clarify legacy `openai-codex` auth, document release/test helper scripts, and tighten changed-test routing docs for CI/debugging work. ([#90028](openclaw/openclaw#90028), [#90250](openclaw/openclaw#90250)) Thanks [@fuller-stack-dev](https://github.com/fuller-stack-dev). - Release/process: switch release trains to `YYYY.M.PATCH` monthly patch numbering, keep pre-transition tags compatible, and pin the June 2026 floor at `2026.6.5` after the published beta. - Platform maintenance: refresh Android, Swift/macOS, Docker, CodeQL, Buildx, Docker build/push, and Codex Action dependencies for this release train. ([#74980](openclaw/openclaw#74980), [#81757](openclaw/openclaw#81757), [#86481](openclaw/openclaw#86481), [#86483](openclaw/openclaw#86483), [#90601](openclaw/openclaw#90601)) - QQBot: add `/bot-group-allways on|off` slash command (with named-account and default-account support) to toggle whether group messages require an `@mention` before the bot replies, and clear the runtime config snapshot after the write so the new account-level `defaultRequireMention` takes effect immediately without restart. ([#91423](openclaw/openclaw#91423)) Thanks [@cxyhhhhh](https://github.com/cxyhhhhh). ##### Fixes - Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. ([#89913](openclaw/openclaw#89913), [#90132](openclaw/openclaw#90132)) Thanks [@openperf](https://github.com/openperf). - Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. ([#90710](openclaw/openclaw#90710), [#90728](openclaw/openclaw#90728)) Thanks [@RanSHammer](https://github.com/RanSHammer) and [@849261680](https://github.com/849261680). - Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until `message_start`, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. ([#90667](openclaw/openclaw#90667), [#90697](openclaw/openclaw#90697), [#90163](openclaw/openclaw#90163), [#90108](openclaw/openclaw#90108), [#89874](openclaw/openclaw#89874), [#89505](openclaw/openclaw#89505), [#90632](openclaw/openclaw#90632), [#89302](openclaw/openclaw#89302), [#90729](openclaw/openclaw#90729), [#90317](openclaw/openclaw#90317), [#90319](openclaw/openclaw#90319)) Thanks [@openperf](https://github.com/openperf), [@100yenadmin](https://github.com/100yenadmin), and [@ooiuuii](https://github.com/ooiuuii). - Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. ([#90506](openclaw/openclaw#90506), [#90609](openclaw/openclaw#90609), [#90717](openclaw/openclaw#90717), [#90702](openclaw/openclaw#90702)) Thanks [@849261680](https://github.com/849261680). - Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. ([#85791](openclaw/openclaw#85791), [#90147](openclaw/openclaw#90147), [#90668](openclaw/openclaw#90668), [#90815](openclaw/openclaw#90815)) Thanks [@giodl73-repo](https://github.com/giodl73-repo) and [@vrurg](https://github.com/vrurg). - TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. ([#86205](openclaw/openclaw#86205), [#89600](openclaw/openclaw#89600), [#88592](openclaw/openclaw#88592), [#90123](openclaw/openclaw#90123)) Thanks [@RomneyDa](https://github.com/RomneyDa). - Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir `.env` values, and session transcript rewrites keep registry markers/discriminants consistent. ([#90072](openclaw/openclaw#90072), [#90208](openclaw/openclaw#90208), [#90277](openclaw/openclaw#90277), [#90488](openclaw/openclaw#90488)) Thanks [@MonkeyLeeT](https://github.com/MonkeyLeeT) and [@sallyom](https://github.com/sallyom). - Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep release/test/tooling proof failures bounded and explicit. ([#89732](openclaw/openclaw#89732), [#90145](openclaw/openclaw#90145)) - Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on `globalThis`; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect `toolsAllow`. ([#87951](openclaw/openclaw#87951), [#87965](openclaw/openclaw#87965), [#90486](openclaw/openclaw#90486), [#68113](openclaw/openclaw#68113), [#90534](openclaw/openclaw#90534), [#90181](openclaw/openclaw#90181), [#90607](openclaw/openclaw#90607), [#89500](openclaw/openclaw#89500)) Thanks [@MukundaKatta](https://github.com/MukundaKatta), [@mcaxtr](https://github.com/mcaxtr), [@infoanton](https://github.com/infoanton), [@mushuiyu886](https://github.com/mushuiyu886), and [@sahibzada-allahyar](https://github.com/sahibzada-allahyar). - Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. ([#89659](openclaw/openclaw#89659)) Thanks [@ladygege](https://github.com/ladygege). - Release/CI/E2E: main CI guard drift, PR merge diff scoping, live Docker credential staging, base-image qualification, installer Docker classification, Playwright dependency install recovery, API-key auth for Codex live Docker lanes, Parallels option terminators, and JSON-mode progress handling are tighter so release proof fails cleaner. ([#90532](openclaw/openclaw#90532), [#90287](openclaw/openclaw#90287), [#90058](openclaw/openclaw#90058)) Thanks [@RomneyDa](https://github.com/RomneyDa), [@hxy91819](https://github.com/hxy91819), and [@mrunalp](https://github.com/mrunalp). - Release/CI/E2E: Docker E2E and live Docker harness runs now apply default memory, CPU, and process ceilings while preserving explicit per-lane overrides. - Release/CI/E2E: plugin lifecycle matrix resource sampling now fails phases that exceed RSS, wall-clock, or CPU ceilings instead of only logging the measurements. - Release/CI/E2E: Codex npm plugin live assertions now cap transcript discovery and diagnostic log reads so failure proof stays bounded. - Tests/state isolation: QA Lab valid-tool-call metrics now require runtime tool-call evidence when runtime parity data is available instead of counting tool-backed scenario pass status alone. - Tests/state isolation: QA Lab runtime parity now fails planned-only tool-call rows without matching tool results instead of treating matching mock plans as real tool evidence. - Tests/state isolation: provider, media, auth, cron, task, session, sandbox, Gateway, and Codex timeout fixtures now scope more home/state/env data per test, reducing cross-test leakage and making release validation failures less noisy. ([#90027](openclaw/openclaw#90027), [#89974](openclaw/openclaw#89974)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about these updates again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).  Reviewed-on: https://git.erwanleboucher.dev/eleboucher/homelab/pulls/963

dependabot Bot added dependencies Pull requests that update a dependency file swift_package_manager Pull requests that update swift_package_manager code labels May 25, 2026

openclaw-barnacle Bot added app: macos App: macos size: XS labels May 25, 2026

dependabot Bot changed the title ~~build(deps): bump the swift-deps group across 1 directory with 3 updates~~ chore(deps): bump the swift-deps group across 1 directory with 3 updates May 26, 2026

dependabot Bot force-pushed the dependabot/swift/apps/macos/swift-deps-5bd026013d branch 3 times, most recently from 663f269 to cc9f77b Compare May 28, 2026 09:02

RomneyDa added the dependency-guard-backfill label May 29, 2026

RomneyDa removed the dependency-guard-backfill label May 29, 2026

dependabot Bot force-pushed the dependabot/swift/apps/macos/swift-deps-5bd026013d branch from cc9f77b to ca20eae Compare May 29, 2026 09:01

clawsweeper Bot added rating: 🐚 platinum hermit Good normal PR readiness with ordinary maintainer review expected. and removed rating: 🦐 gold shrimp Decent PR readiness signal, but merge confidence is limited. labels May 29, 2026

dependabot Bot force-pushed the dependabot/swift/apps/macos/swift-deps-5bd026013d branch 2 times, most recently from d01f8b9 to bd9833a Compare June 3, 2026 23:31

clawsweeper Bot added the merge-risk: 🚨 security-boundary 🚨 May affect sandboxing, authorization, credentials, or sensitive data. label Jun 3, 2026

dependabot Bot changed the title ~~chore(deps): bump the swift-deps group across 1 directory with 3 updates~~ build(deps): bump the swift-deps group across 1 directory with 3 updates Jun 4, 2026

dependabot Bot force-pushed the dependabot/swift/apps/macos/swift-deps-5bd026013d branch from bd9833a to b04a9af Compare June 4, 2026 08:38

dependabot Bot changed the title ~~build(deps): bump the swift-deps group across 1 directory with 3 updates~~ chore(deps): bump the swift-deps group across 1 directory with 3 updates Jun 5, 2026

dependabot Bot force-pushed the dependabot/swift/apps/macos/swift-deps-5bd026013d branch from b04a9af to 661aa2b Compare June 5, 2026 08:38

steipete merged commit aee45f5 into main Jun 5, 2026
33 checks passed

steipete deleted the dependabot/swift/apps/macos/swift-deps-5bd026013d branch June 5, 2026 20:10

github-actions Bot mentioned this pull request Jun 5, 2026

📡 Upstream Digest — 2026-06-05 21:17 UTC curtismercier/openclaw-mods#1021

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the swift-deps group across 1 directory with 3 updates#86483

chore(deps): bump the swift-deps group across 1 directory with 3 updates#86483
steipete merged 1 commit into
mainfrom
dependabot/swift/apps/macos/swift-deps-5bd026013d

dependabot Bot commented on behalf of github May 25, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 25, 2026 •

edited

Loading

Uh oh!

clawsweeper Bot commented May 25, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.13.1

What's Changed

SemVer Patch

1.13.0

What's Changed

SemVer Minor

1.12.1

What's Changed

SemVer Patch

Other Changes

New Contributors

2.9.2 Appcast Improvements

v3.3.0

[3.3.0] - 2026-06-01

Added

Changed

Fixed

Verification

v3.2.3

[3.2.3] - 2026-05-24

Added

Fixed

Release proof

v3.2.2

[3.2.2] - 2026-05-22

Added

Fixed

Release Verification

Uh oh!

clawsweeper Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

clawsweeper Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot Bot commented on behalf of github May 25, 2026 •

edited

Loading

clawsweeper Bot commented May 25, 2026 •

edited

Loading

clawsweeper Bot commented May 25, 2026 •

edited

Loading