chore(deps): bump actions/upload-artifact from 4 to 7#16
Open
dependabot[bot] wants to merge 2793 commits intodevelopfrom
Open
chore(deps): bump actions/upload-artifact from 4 to 7#16dependabot[bot] wants to merge 2793 commits intodevelopfrom
dependabot[bot] wants to merge 2793 commits intodevelopfrom
Conversation
- Feishu/group slash command detection: normalize group mention wrappers before command-authorization probing so mention-prefixed commands are recognized in group routing.\n- Source PR: #36011\n- Contributor: @liuxiaopai-ai\n\nCo-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>\nCo-authored-by: liuxiaopai-ai <73659136+liuxiaopai-ai@users.noreply.github.com>
…ld (fixes #35131) (#35177) Merged via squash. Prepared head SHA: d9a2869ad69db9449336a2e2846bd9de0e647ac6 Co-authored-by: maweibin <18023423+maweibin@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
* fix(feishu): avoid media regressions from global http timeout * fix(feishu): source HTTP timeout from config * fix(feishu): apply media timeout override to image uploads * fix(feishu): invalidate cached client when timeout changes * fix(feishu): clamp timeout values and cover image download
…guardrails (#35094)
…flow, trigger compaction (#35934) Merged via squash. Prepared head SHA: 20fa77289c80b2807a6779a3df70440242bc18ca Co-authored-by: RealKai42 <44634134+RealKai42@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman
…es (#36451) Merged via squash. Prepared head SHA: 52dd6317895c7bd10855d2bd7dbbfc2f5279b68e Co-authored-by: Sid-Qin <201593046+Sid-Qin@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman
…6445) - Prevent Control UI session render crashes when `marked.parse()` encounters pathological recursive markdown by safely falling back to escaped `<pre>` output. - Tighten markdown fallback regression coverage and keep changelog attribution in sync for this crash-hardening path. Co-authored-by: Bin Deng <dengbin@romangic.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
…ent orphaned files (#35493) Merged via squash. Prepared head SHA: 0d95549d752adecfc0b08d5cd55a8b8c75e264fe Co-authored-by: byungsker <72309817+byungsker@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman
…ptPolicy (#32813) Merged via squash. Prepared head SHA: f522d21ca59a42abac554435a0aa646f6a34698d Co-authored-by: Sid-Qin <201593046+Sid-Qin@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman
…wn text (#32972) Merged via squash. Prepared head SHA: 813c16f5afce415da130a917d9ce9f968912b477 Co-authored-by: stakeswky <64798754+stakeswky@users.noreply.github.com> Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com> Reviewed-by: @altaywtf
* fix(agents): classify transient failover statuses consistently * fix(agents): preserve legacy failover status mapping
…or (#32828) (#36646) Merged via squash. Prepared head SHA: 46fb4306127972d7635f371fd9029fbb9baff236 Co-authored-by: jnMetaCode <12096460+jnMetaCode@users.noreply.github.com> Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com> Reviewed-by: @altaywtf
Merged via squash. Prepared head SHA: be473efd1635616ebbae6e649d542ed50b4a827f Co-authored-by: rodrigouroz <384037+rodrigouroz@users.noreply.github.com> Co-authored-by: jalehman <550978+jalehman@users.noreply.github.com> Reviewed-by: @jalehman
* test(agents): add provider-backed failover fixtures * test(agents): cover more provider error docs * test(agents): tighten provider doc fixtures
* UI: bump dompurify to 3.3.2 * Deps: refresh dompurify lockfile
…es (#32423) Merged via squash. Prepared head SHA: 9e8ec13933b5317e7cff3f0bc048de515826c31a Co-authored-by: jriff <50276+jriff@users.noreply.github.com> Co-authored-by: altaywtf <9790196+altaywtf@users.noreply.github.com> Reviewed-by: @altaywtf
…min scope (openclaw#35704) Verified: - pnpm install --frozen-lockfile - pnpm build - pnpm check - pnpm test:macmini Co-authored-by: Naylenv <45486779+Naylenv@users.noreply.github.com> Co-authored-by: Octane0411 <88922959+Octane0411@users.noreply.github.com> Co-authored-by: Sid-Qin <201593046+Sid-Qin@users.noreply.github.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
Fix merged schema cache key generation for high-cardinality plugin/channel metadata by hashing incrementally instead of serializing one large aggregate string. Includes changelog entry for the user-visible regression fix. Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com> Co-authored-by: Bill <gsamzn@gmail.com>
Restore Slack local file upload parity with CVE-era local media allowlist enforcement by threading `mediaLocalRoots` through the Slack send call chain. - pass `ctx.mediaLocalRoots` from Slack channel action adapter into `handleSlackAction` - add and forward `mediaLocalRoots` in Slack action context/send path - pass `mediaLocalRoots` into `sendMessageSlack` for upload allowlist enforcement - add changelog entry with attribution for this behavior fix Co-authored-by: 2233admin <1497479966@qq.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
…937) This PR fixes Slack mention loss without reintroducing duplicate dispatches. - Preserve seen-message dedupe at ingress to prevent duplicate processing. - Allow a one-time app_mention retry only when the paired message event was previously dropped before dispatch. - Add targeted race tests for both recovery and duplicate-prevention paths. Co-authored-by: littleben <1573829+littleben@users.noreply.github.com> Co-authored-by: OpenClaw Agent <agent@openclaw.ai> Co-authored-by: Tak Hoffman <781889+Takhoffman@users.noreply.github.com>
…36602) (thanks @dutifulbob) (#36602) Co-authored-by: Onur Solmaz <2453968+osolmaz@users.noreply.github.com>
Merged via squash. Prepared head SHA: 6b9d883b6ae33628235fb02ce39c0d0f46a065bb Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Co-authored-by: gumadeiras <5599352+gumadeiras@users.noreply.github.com> Reviewed-by: @gumadeiras
- New passive-memory.ts module: every 5 turns, background LLM call extracts important conversation details to memory/passive-YYYY-MM.md - Uses local Ollama (llama3.2:3b) for cost-free extraction - Integrates at agent_end in attempt.ts (fire-and-forget) - Monthly passive memory files, auto-detected by existing MemoryFileWatcher - Add .memory-index/ and *.memory-vec.db to .gitignore - Coexists with explicit memory_search/memory_write tools
DAG only activates when memorySearch.provider is set (not 'none'). Same gating logic as passive memory — no point storing if search is unavailable.
- dag-search-wrapper.ts: wraps MemorySearchManager to merge DAG results - search-manager.ts: auto-wraps all managers with DAG search - DAG results appear alongside vector/file results in memory_search - Parallel execution: inner search + DAG FTS5 run concurrently - Deduplication: skip DAG results that overlap with inner results - Non-fatal: DAG search failure doesn't break memory_search
Bypasses MemorySearchManager cache — DAG results are now fetched directly in the memory_search tool execute() and merged with standard vector/file results. Runs in parallel via Promise.all().
…am media IPv6 timeout)
- Add src/cli/swarm-cli.ts: init/status/sync subcommands - Register 'soulclaw swarm' in command-registry - Add swarm config to AgentDefaultsSchema (dir, autoSync, syncIntervalMinutes) - Wire swarm config from params.config into inline-sync hook - soulclaw swarm init [--remote <url>] [--dir <path>] - soulclaw swarm status - soulclaw swarm sync
- soulclaw soulscan [dir] [--json] [--min-score N]: scan soul files - soulclaw persona check [--text]: run drift check against SOUL.md - soulclaw persona metrics [-n N]: show drift history - soulclaw persona rules [--json]: show parsed persona rules - Register both in command-registry
Swarm: - swarm sync --llm-merge: LLM semantic conflict resolution - swarm resolve [file] --llm|--ours|--theirs|--manual Persona: - drift-notifier.ts: gateway/Telegram drift alert notifications - persona config --enable|--disable: opt-in drift detection - personaDrift config schema in openclaw.json - Default OFF, gated behind enabled flag
- Remove src/soulscan/rules.ts (498 lines of security rules) - Replace src/soulscan/engine.ts with thin wrapper that imports clawsouls scanner - Falls back to basic structural checks when clawsouls is not installed - Security rules now live exclusively in clawsouls package (not open source) - Protects SoulScan Premium API business model
- Add src/soulscan/inline-scan.ts: rate-limited soul file integrity check (5min interval) - Add src/persona/inline-drift.ts: periodic drift detection (keyword/Ollama fallback) - Add src/swarm/inline-sync.ts: rate-limited memory sync to shared repo (10min interval) - Wire all three as fire-and-forget hooks in attempt.ts after agent turns - Fix lint: String(err) for template expressions, remove redundant union type - All non-fatal: errors caught and logged, never block agent execution
…roadmap and config
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](actions/upload-artifact@v4...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps actions/upload-artifact from 4 to 7.
Release notes
Sourced from actions/upload-artifact's releases.
... (truncated)
Commits
bbbca2dSupport direct file uploads (#764)589182cUpgrade the module to ESM and bump dependencies (#762)47309c9Merge pull request #754 from actions/Link-/add-proxy-integration-tests02a8460Add proxy integration testb7c566aMerge pull request #745 from actions/upload-artifact-v6-releasee516bc8docs: correct description of Node.js 24 support in READMEddc45eddocs: update README to correct action name for Node.js 24 support615b319chore: release v6.0.0 for Node.js 24 support017748bMerge pull request #744 from actions/fix-storage-blob38d4c79chore: rebuild distDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)