vultr/openclaw
1
0
Fork 0
mirror of https://github.com/openclaw/openclaw.git synced 2026-08-02 03:11:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(deps): remediate tar and Hono advisories (#115029)

Browse Source
This commit is contained in:
Vincent Koc
2026-07-28 16:48:04 +08:00
committed by GitHub
parent f8ed8ecf4f
commit 9d5bec8487
7 changed files with 52 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
extensions/browser/package.json
View File

@@ -5,7 +5,7 @@
"description": "OpenClaw browser tool plugin",
"type": "module",
"dependencies": {
"@modelcontextprotocol/sdk": "1.29.0",
"@modelcontextprotocol/sdk": "1.30.0",
"@noble/ed25519": "3.1.0",
"esbuild": "0.28.1",
"express": "5.2.1",

2
extensions/cua-computer/package.json
View File

@@ -4,7 +4,7 @@
"description": "Experimental cua-driver computer control for Windows and Linux node hosts",
"type": "module",
"dependencies": {
"@modelcontextprotocol/sdk": "1.29.0",
"@modelcontextprotocol/sdk": "1.30.0",
"rastermill": "0.3.1",
"zod": "4.4.3"
},

2
extensions/qa-lab/package.json
View File

@@ -6,7 +6,7 @@
"type": "module",
"dependencies": {
"@copilotkit/aimock": "1.37.2",
"@modelcontextprotocol/sdk": "1.29.0",
"@modelcontextprotocol/sdk": "1.30.0",
"@openclaw/crabline": "0.1.11",
"@openclaw/matrix": "workspace:*",
"p-limit": "7.3.0",

4
package.json
View File

@@ -1922,7 +1922,7 @@
"@homebridge/ciao": "1.3.10",
"@lydell/node-pty": "1.2.0-beta.12",
"@mistralai/mistralai": "2.5.0",
"@modelcontextprotocol/sdk": "1.29.0",
"@modelcontextprotocol/sdk": "1.30.0",
"@mozilla/readability": "0.6.0",
"@openclaw/ai": "workspace:*",
"@openclaw/fs-safe": "0.5.0",
@@ -1963,7 +1963,7 @@
"quickjs-wasi": "3.0.2",
"rastermill": "0.3.1",
"semver": "7.8.5",
"tar": "7.5.21",
"tar": "7.5.22",
"tree-sitter-bash": "0.25.1",
"tslog": "4.11.0",
"typebox": "1.3.6",

129
pnpm-lock.yaml generated
View File

@@ -12,7 +12,7 @@ overrides:
'@aws-sdk/credential-provider-node': 3.972.70
'@aws-sdk/xml-builder': 3.972.36
hono: 4.12.31
'@hono/node-server': 1.19.14
'@hono/node-server': 2.0.12
axios: 1.18.1
fast-uri: 3.1.4
follow-redirects: 1.16.0
@@ -30,7 +30,7 @@ overrides:
qs: 6.15.3
node-domexception: npm:@nolyfill/domexception@1.0.28
typebox: 1.3.6
tar: 7.5.21
tar: 7.5.22
tough-cookie: 4.1.4
yauzl: 3.4.0
protobufjs: 7.6.5
@@ -59,7 +59,7 @@ importers:
version: 0.81.1
'@google/genai':
specifier: 2.12.0
version: 2.12.0(@modelcontextprotocol/sdk@1.29.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@10.2.2)
version: 2.12.0(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)
'@grammyjs/runner':
specifier: 2.0.3
version: 2.0.3(grammy@1.45.1(supports-color@7.2.0))
@@ -76,8 +76,8 @@ importers:
specifier: 2.5.0
version: 2.5.0(@opentelemetry/api@1.9.1)
'@modelcontextprotocol/sdk':
specifier: 1.29.0
version: 1.29.0(supports-color@7.2.0)(zod@4.4.3)
specifier: 1.30.0
version: 1.30.0(supports-color@10.2.2)(zod@4.4.3)
'@mozilla/readability':
specifier: 0.6.0
version: 0.6.0
@@ -199,8 +199,8 @@ importers:
specifier: 7.8.5
version: 7.8.5
tar:
specifier: 7.5.21
version: 7.5.21
specifier: 7.5.22
version: 7.5.22
tree-sitter-bash:
specifier: 0.25.1
version: 0.25.1
@@ -367,7 +367,7 @@ importers:
dependencies:
'@agentclientprotocol/claude-agent-acp':
specifier: 0.59.0
version: 0.59.0(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))
version: 0.59.0(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))
'@agentclientprotocol/codex-acp':
specifier: 1.1.7
version: 1.1.7
@@ -500,8 +500,8 @@ importers:
extensions/browser:
dependencies:
'@modelcontextprotocol/sdk':
specifier: 1.29.0
version: 1.29.0(supports-color@10.2.2)(zod@4.4.3)
specifier: 1.30.0
version: 1.30.0(supports-color@10.2.2)(zod@4.4.3)
'@noble/ed25519':
specifier: 3.1.0
version: 3.1.0
@@ -680,8 +680,8 @@ importers:
extensions/cua-computer:
dependencies:
'@modelcontextprotocol/sdk':
specifier: 1.29.0
version: 1.29.0(supports-color@10.2.2)(zod@4.4.3)
specifier: 1.30.0
version: 1.30.0(supports-color@10.2.2)(zod@4.4.3)
rastermill:
specifier: 0.3.1
version: 0.3.1
@@ -942,7 +942,7 @@ importers:
dependencies:
'@google/genai':
specifier: 2.12.0
version: 2.12.0(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)
version: 2.12.0(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)
google-auth-library:
specifier: 10.9.0
version: 10.9.0(supports-color@10.2.2)
@@ -1566,8 +1566,8 @@ importers:
specifier: 1.37.2
version: 1.37.2(vitest@4.1.10)
'@modelcontextprotocol/sdk':
specifier: 1.29.0
version: 1.29.0(supports-color@10.2.2)(zod@4.4.3)
specifier: 1.30.0
version: 1.30.0(supports-color@10.2.2)(zod@4.4.3)
'@openclaw/crabline':
specifier: 0.1.11
version: 0.1.11
@@ -2151,7 +2151,7 @@ importers:
version: 0.112.3(zod@4.4.3)
'@google/genai':
specifier: 2.12.0
version: 2.12.0(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)
version: 2.12.0(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)
'@mistralai/mistralai':
specifier: 2.5.0
version: 2.5.0(@opentelemetry/api@1.9.1)
@@ -2273,14 +2273,14 @@ importers:
packages/retry: {}
packages/session-url-contract: {}
packages/sdk:
dependencies:
'@openclaw/gateway-client':
specifier: workspace:*
version: link:../gateway-client
packages/session-url-contract: {}
packages/speech-core:
dependencies:
openclaw:
@@ -2338,10 +2338,10 @@ importers:
version: 1.1.6
'@modelcontextprotocol/ext-apps':
specifier: 1.7.4
version: 1.7.4(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(zod@4.4.3)
version: 1.7.4(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(zod@4.4.3)
'@modelcontextprotocol/sdk':
specifier: 1.29.0
version: 1.29.0(supports-color@10.2.2)(zod@4.4.3)
specifier: 1.30.0
version: 1.30.0(supports-color@10.2.2)(zod@4.4.3)
'@noble/ed25519':
specifier: 3.1.0
version: 3.1.0
@@ -3329,9 +3329,9 @@ packages:
resolution: {integrity: sha512-ogAVdPZ9Fo3kSaULpq+acxbtbIvMtd2TDYEkqHIsqvQ9QHJnRNcjm8NQzegaBzJ3gUK1mVX07UWs2/B0NmabSw==}
hasBin: true
'@hono/node-server@1.19.14':
resolution: {integrity: sha512-GwtvgtXxnWsucXvbQXkRgqksiH2Qed37H9xHZocE5sA3N8O8O8/8FA3uclQXxXVzc9XBZuEOMK7+r02FmSpHtw==}
engines: {node: '>=18.14.1'}
'@hono/node-server@2.0.12':
resolution: {integrity: sha512-eWpQYr67tqJLeaSUl0Q+TquuYfUdTibpOJlUMV2FfUP7+KqCC5TufnwnlXL6mobZBJbGAYRd7ZvEBDCbLInjhg==}
engines: {node: '>=20'}
peerDependencies:
hono: 4.12.31
@@ -3701,8 +3701,8 @@ packages:
react-dom:
optional: true
'@modelcontextprotocol/sdk@1.29.0':
resolution: {integrity: sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ==}
'@modelcontextprotocol/sdk@1.30.0':
resolution: {integrity: sha512-xKd8OIzlqNzcqcNumGAa6g+PW2kjD5vrpcKOnfldAUPP3j7lnqMPwlTXQm8gF+UwH72z0lqaRbjr9hqGz0eITA==}
engines: {node: '>=18'}
peerDependencies:
'@cfworker/json-schema': ^4.1.1
@@ -8425,8 +8425,8 @@ packages:
tar-stream@3.2.0:
resolution: {integrity: sha512-ojzvCvVaNp6aOTFmG7jaRD0meowIAuPc3cMMhSgKiVWws1GyHbGd/xvnyuRKcKlMpt3qvxx6r0hreCNITP9hIg==}
tar@7.5.21:
resolution: {integrity: sha512-XdhtCvlMywwxpCW8YEq3lOXBJpUPTR2OHHcwLPO3HwsJqOHa2Ok/oJ7ruGzp+JrKoRPVCzJwAdEjqLW/vNRPHA==}
tar@7.5.22:
resolution: {integrity: sha512-MFO/QzvtAOmJbkhOaCTvbGcFN9L9b+JunIsDwaKljSOdcLMea3NJ1k9Usz/rjdfSXTq4dfzfeS7W4p4YOAAHeA==}
engines: {node: '>=18'}
teex@1.0.1:
@@ -9025,10 +9025,10 @@ snapshots:
zod: 3.25.76
zod-to-json-schema: 3.25.2(zod@3.25.76)
'@agentclientprotocol/claude-agent-acp@0.59.0(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))':
'@agentclientprotocol/claude-agent-acp@0.59.0(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))':
dependencies:
'@agentclientprotocol/sdk': 1.2.1(zod@4.4.3)
'@anthropic-ai/claude-agent-sdk': 0.3.207(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(zod@4.4.3)
'@anthropic-ai/claude-agent-sdk': 0.3.207(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(zod@4.4.3)
zod: 4.4.3
transitivePeerDependencies:
- '@anthropic-ai/sdk'
@@ -9075,10 +9075,10 @@ snapshots:
'@anthropic-ai/claude-agent-sdk-win32-x64@0.3.207':
optional: true
'@anthropic-ai/claude-agent-sdk@0.3.207(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(zod@4.4.3)':
'@anthropic-ai/claude-agent-sdk@0.3.207(@anthropic-ai/sdk@0.112.3(zod@4.4.3))(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(zod@4.4.3)':
dependencies:
'@anthropic-ai/sdk': 0.112.3(zod@4.4.3)
'@modelcontextprotocol/sdk': 1.29.0(supports-color@10.2.2)(zod@4.4.3)
'@modelcontextprotocol/sdk': 1.30.0(supports-color@10.2.2)(zod@4.4.3)
zod: 4.4.3
optionalDependencies:
'@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.207
@@ -10175,27 +10175,14 @@ snapshots:
'@github/copilot-win32-arm64': 1.0.73
'@github/copilot-win32-x64': 1.0.73
'@google/genai@2.12.0(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)':
'@google/genai@2.12.0(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(supports-color@10.2.2)':
dependencies:
google-auth-library: 10.9.0(supports-color@10.2.2)
p-retry: 4.6.2
protobufjs: 7.6.5
ws: 8.21.1
optionalDependencies:
'@modelcontextprotocol/sdk': 1.29.0(supports-color@10.2.2)(zod@4.4.3)
transitivePeerDependencies:
- bufferutil
- supports-color
- utf-8-validate
'@google/genai@2.12.0(@modelcontextprotocol/sdk@1.29.0(supports-color@7.2.0)(zod@4.4.3))(supports-color@10.2.2)':
dependencies:
google-auth-library: 10.9.0(supports-color@10.2.2)
p-retry: 4.6.2
protobufjs: 7.6.5
ws: 8.21.1
optionalDependencies:
'@modelcontextprotocol/sdk': 1.29.0(supports-color@7.2.0)(zod@4.4.3)
'@modelcontextprotocol/sdk': 1.30.0(supports-color@10.2.2)(zod@4.4.3)
transitivePeerDependencies:
- bufferutil
- supports-color
@@ -10259,7 +10246,7 @@ snapshots:
transitivePeerDependencies:
- supports-color
'@hono/node-server@1.19.14(hono@4.12.31)':
'@hono/node-server@2.0.12(hono@4.12.31)':
dependencies:
hono: 4.12.31
@@ -10699,18 +10686,18 @@ snapshots:
- bufferutil
- utf-8-validate
'@modelcontextprotocol/ext-apps@1.7.4(@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(zod@4.4.3)':
'@modelcontextprotocol/ext-apps@1.7.4(@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3))(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(zod@4.4.3)':
dependencies:
'@modelcontextprotocol/sdk': 1.29.0(supports-color@10.2.2)(zod@4.4.3)
'@modelcontextprotocol/sdk': 1.30.0(supports-color@10.2.2)(zod@4.4.3)
'@standard-schema/spec': 1.1.0
zod: 4.4.3
optionalDependencies:
react: 19.2.4
react-dom: 19.2.4(react@19.2.4)
'@modelcontextprotocol/sdk@1.29.0(supports-color@10.2.2)(zod@4.4.3)':
'@modelcontextprotocol/sdk@1.30.0(supports-color@10.2.2)(zod@4.4.3)':
dependencies:
'@hono/node-server': 1.19.14(hono@4.12.31)
'@hono/node-server': 2.0.12(hono@4.12.31)
ajv: 8.20.0
ajv-formats: 3.0.1(ajv@8.20.0)
content-type: 1.0.5
@@ -10730,28 +10717,6 @@ snapshots:
transitivePeerDependencies:
- supports-color
'@modelcontextprotocol/sdk@1.29.0(supports-color@7.2.0)(zod@4.4.3)':
dependencies:
'@hono/node-server': 1.19.14(hono@4.12.31)
ajv: 8.20.0
ajv-formats: 3.0.1(ajv@8.20.0)
content-type: 1.0.5
cors: 2.8.6
cross-spawn: 7.0.6
eventsource: 3.0.7
eventsource-parser: 3.1.0
express: 5.2.1(supports-color@10.2.2)
express-rate-limit: 8.6.0(express@5.2.1(supports-color@10.2.2))(supports-color@7.2.0)
hono: 4.12.31
jose: 6.2.3
json-schema-typed: 8.0.2
pkce-challenge: 5.0.1
raw-body: 3.0.2
zod: 4.4.3
zod-to-json-schema: 3.25.2(zod@4.4.3)
transitivePeerDependencies:
- supports-color
'@mozilla/readability@0.6.0': {}
'@napi-rs/wasm-runtime@1.1.6(@emnapi/core@1.11.1)(@emnapi/runtime@1.11.1)':
@@ -10905,12 +10870,12 @@ snapshots:
'@openclaw/fs-safe@0.4.7':
optionalDependencies:
jszip: 3.10.1
tar: 7.5.21
tar: 7.5.22
'@openclaw/fs-safe@0.5.0':
optionalDependencies:
jszip: 3.10.1
tar: 7.5.21
tar: 7.5.22
'@openclaw/libterminal@0.3.2':
dependencies:
@@ -12641,7 +12606,7 @@ snapshots:
node-api-headers: 1.9.0
rc: 1.2.8
semver: 7.8.5
tar: 7.5.21
tar: 7.5.22
url-join: 4.0.1
which: 6.0.1
yargs: 17.7.3
@@ -13093,14 +13058,6 @@ snapshots:
transitivePeerDependencies:
- supports-color
express-rate-limit@8.6.0(express@5.2.1(supports-color@10.2.2))(supports-color@7.2.0):
dependencies:
debug: 4.4.3(supports-color@7.2.0)
express: 5.2.1(supports-color@10.2.2)
ip-address: 10.2.0
transitivePeerDependencies:
- supports-color
express@5.2.1(supports-color@10.2.2):
dependencies:
accepts: 2.0.0
@@ -15914,7 +15871,7 @@ snapshots:
- bare-buffer
- react-native-b4a
tar@7.5.21:
tar@7.5.22:
dependencies:
'@isaacs/fs-minipass': 4.0.1
chownr: 3.0.0

5
pnpm-workspace.yaml
View File

@@ -61,6 +61,7 @@ minimumReleaseAgeExclude:
- "@microsoft/teams.cards@2.0.12"
- "@microsoft/teams.common@2.0.12"
- "@microsoft/teams.graph@2.0.12"
- "@modelcontextprotocol/sdk@1.30.0"
- "@openai/codex"
- "@openai/codex-*"
- "@pierre/diffs@1.2.3"
@@ -123,7 +124,7 @@ overrides:
"@aws-sdk/credential-provider-node": 3.972.70
"@aws-sdk/xml-builder": 3.972.36
hono: 4.12.31
"@hono/node-server": 1.19.14
"@hono/node-server": 2.0.12
axios: 1.18.1
fast-uri: 3.1.4
follow-redirects: 1.16.0
@@ -141,7 +142,7 @@ overrides:
qs: 6.15.3
node-domexception: "npm:@nolyfill/domexception@1.0.28"
typebox: 1.3.6
tar: 7.5.21
tar: 7.5.22
tough-cookie: 4.1.4
yauzl: 3.4.0
protobufjs: 7.6.5

2
ui/package.json
View File

@@ -19,7 +19,7 @@
"@lezer/highlight": "1.2.3",
"@lit/context": "1.1.6",
"@modelcontextprotocol/ext-apps": "1.7.4",
"@modelcontextprotocol/sdk": "1.29.0",
"@modelcontextprotocol/sdk": "1.30.0",
"@noble/ed25519": "3.1.0",
"@openclaw/gateway-client": "workspace:*",
"@openclaw/libterminal": "0.3.2",