Jacob Tomlinson 63802c1112 docker: add apt-get upgrade to all Dockerfiles (#45384) ...

* docker: add apt-get upgrade to patch base-image vulnerabilities

Closes #45159

* docker: add DEBIAN_FRONTEND and --no-install-recommends to apt-get upgrade

Prevents debconf hangs during Docker builds and avoids pulling in
recommended packages that silently grow the image.

Co-Authored-By: Claude <noreply@anthropic.com>

* Revert "docker: add DEBIAN_FRONTEND and --no-install-recommends to apt-get upgrade"

This reverts commit 6fc3839cb5.

* docker: add DEBIAN_FRONTEND and --no-install-recommends to apt-get upgrade

Prevents debconf hangs during Docker builds and avoids pulling in
recommended packages that silently grow the image.

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

2026-03-13 16:23:02 -07:00

..

dev

refactor(scripts): dedupe guard checks and smoke helpers

2026-03-02 08:54:20 +00:00

docker

docker: add apt-get upgrade to all Dockerfiles (#45384)

2026-03-13 16:23:02 -07:00

docs-i18n

chore(security): bump qs and golang.org/x/net

2026-02-14 21:22:46 +01:00

e2e

test: add parallels macos smoke harness

2026-03-13 21:44:29 +00:00

k8s

docs: add Kubernetes install guide, setup script, and manifests (#34492)

2026-03-12 07:28:21 -04:00

lib

refactor: extract bundled extension manifest parser

2026-03-08 18:26:36 +00:00

podman

fix(run-openclaw-podman): add SELinux :Z mount option on enforcing/permissive hosts (#39449)

2026-03-08 18:53:09 -04:00

pre-commit

refactor: centralize pre-commit file filtering

2026-02-16 03:42:11 +01:00

repro

fix: run cli scripts via node build runner

2026-01-18 18:43:39 +00:00

shell-helpers

fix(clawdock): include docker-compose.extra.yml in helper commands (#17094)

2026-02-19 03:40:47 -08:00

systemd

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

auth-monitor.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

bench-cli-startup.ts

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

bench-model.ts

chore: apply local workspace updates (#9911)

2026-02-05 16:54:44 -05:00

build_icon.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

build-and-run-mac.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

build-docs-list.mjs

chore: Enable linting in scripts.

2026-01-31 21:29:14 +09:00

bundle-a2ui.sh

feat: add sessions_yield tool for cooperative turn-ending (#36537)

2026-03-12 08:46:47 -07:00

canvas-a2ui-copy.ts

chore: Also format scripts and skills.

2026-01-31 21:21:25 +09:00

changelog-to-html.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

check-channel-agnostic-boundaries.mjs

refactor(scripts): dedupe guard checks and smoke helpers

2026-03-02 08:54:20 +00:00

check-composite-action-input-interpolation.py

ci: harden workflow action input handling

2026-02-19 15:27:48 +01:00

check-ingress-agent-owner-context.mjs

fix(security): enforce explicit ingress owner context

2026-03-02 23:50:36 +00:00

check-no-monolithic-plugin-sdk-entry-imports.ts

Plugin SDK: add full bundled subpath wiring

2026-03-04 02:35:12 -05:00

check-no-pairing-store-group-auth.mjs

refactor(scripts): share guard runners and paged select UI

2026-03-02 14:36:41 +00:00

check-no-random-messaging-tmp.mjs

refactor(scripts): share guard runners and paged select UI

2026-03-02 14:36:41 +00:00

check-no-raw-channel-fetch.mjs

fix(discord): use fetch for voice upload slots

2026-03-03 10:22:28 -06:00

check-no-raw-window-open.mjs

refactor(scripts): dedupe guard checks and smoke helpers

2026-03-02 08:54:20 +00:00

check-no-register-http-handler.mjs

chore(lint): add registerHttpHandler usage guard script

2026-03-02 16:24:06 +00:00

check-pairing-account-scope.mjs

refactor(scripts): share guard runners and paged select UI

2026-03-02 14:36:41 +00:00

check-plugin-sdk-exports.mjs

Plugin SDK: add full bundled subpath wiring

2026-03-04 02:35:12 -05:00

check-ts-max-loc.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

check-webhook-auth-body-order.mjs

refactor: split webhook ingress and policy guards

2026-03-02 18:02:21 +00:00

ci-changed-scope.d.mts

test: fix strict runtime mock types in channel tests

2026-03-03 03:06:22 +00:00

ci-changed-scope.mjs

ci: speed up scoped workflow lanes

2026-03-13 19:53:40 +00:00

claude-auth-status.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

clawlog.sh

fix(security): harden clawlog command execution

2026-03-01 23:33:13 +00:00

clawtributors-map.json

🤖 Feishu: expand channel support

2026-02-05 12:29:04 -08:00

codesign-mac-app.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

codespell-dictionary.txt

docs: add custom spellcheck dictionary and fix docs typos (#22457)

2026-02-21 01:35:35 -05:00

codespell-ignore.txt

fix(ci): make docs spellcheck fallback deterministic

2026-02-21 15:08:28 +01:00

committer

fix: retry git lock in committer

2026-03-08 00:28:37 +00:00

copy-export-html-templates.ts

build: reduce build log noise

2026-03-08 04:12:32 +00:00

copy-hook-metadata.ts

build: reduce build log noise

2026-03-08 04:12:32 +00:00

copy-plugin-sdk-root-alias.mjs

Plugins: add root-alias shim and cache/docs updates

2026-03-04 01:20:48 -05:00

create-dmg.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

cron_usage_report.ts

fix(ci): restore main lint/typecheck after direct merges

2026-02-16 23:26:11 +00:00

debug-claude-usage.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

docs-link-audit.mjs

fix: docs broken links and improve link checker (#13056)

2026-02-09 18:45:06 -08:00

docs-list.js

chore: Enable linting in scripts.

2026-01-31 21:29:14 +09:00

docs-spellcheck.sh

fix(ci): make docs spellcheck fallback deterministic

2026-02-21 15:08:28 +01:00

firecrawl-compare.ts

chore: Enable linting in scripts.

2026-01-31 21:29:14 +09:00

generate-host-env-security-policy-swift.mjs

fix(exec): block dangerous override-only env pivots

2026-03-07 19:18:05 +00:00

generate-secretref-credential-matrix.ts

feat(secrets): expand SecretRef coverage across user-supplied credentials (#29580)

2026-03-03 02:58:20 +00:00

ghsa-patch.mjs

refactor(security): enforce v1 node exec approval binding

2026-02-26 18:09:01 +01:00

install.ps1

fix: handle PowerShell execution policy on Windows install (#24794)

2026-03-02 11:09:01 -06:00

install.sh

fix: improve onboarding install diagnostics

2026-03-13 21:44:29 +00:00

ios-asc-keychain-setup.sh

feat(ios): prepare app store connect release assets

2026-03-07 17:21:07 +02:00

ios-beta-archive.sh

feat(ios): add local beta release flow (#42991)

2026-03-11 12:32:28 +02:00

ios-beta-prepare.sh

feat(push): add iOS APNs relay gateway (#43369)

2026-03-12 18:15:35 +02:00

ios-beta-release.sh

feat(ios): add local beta release flow (#42991)

2026-03-11 12:32:28 +02:00

ios-configure-signing.sh

feat(ios): prepare app store connect release assets

2026-03-07 17:21:07 +02:00

ios-team-id.sh

fix(ios): normalize team IDs before preferred match

2026-02-24 15:02:27 +00:00

ios-write-version-xcconfig.sh

chore: bump version to 2026.3.13

2026-03-13 04:38:32 +00:00

label-open-issues.ts

refactor: dedupe extension and ui helpers

2026-03-02 19:57:33 +00:00

make_appcast.sh

fix: support legacy and beta prerelease version formats

2026-02-24 02:05:37 +00:00

mobile-reauth.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

notarize-mac-artifact.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

openclaw-npm-release-check.ts

fix: make node-llama-cpp optional for npm installs

2026-03-12 16:45:59 +00:00

package-mac-app.sh

macOS: default release app builds to universal binaries

2026-03-08 14:14:36 +00:00

package-mac-dist.sh

fix(macos): set release bundle ID so Sparkle auto-update works (#19750)

2026-02-20 12:08:10 +05:30

pr

Revert "feat: add --no-test flag to prepare-gates"

2026-03-12 16:37:50 -07:00

pr-merge

chore: fix root_dir resolution/stale scripts during PR review

2026-02-13 15:09:39 -05:00

pr-prepare

Revert "feat: add --no-test flag to prepare-gates"

2026-03-12 16:37:50 -07:00

pr-review

chore: fix root_dir resolution/stale scripts during PR review

2026-02-13 15:09:39 -05:00

protocol-gen-swift.ts

fix: stabilize swift protocol generation and flaky tests

2026-02-21 16:53:46 +01:00

protocol-gen.ts

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

readability-basic-compare.ts

chore: Enable linting in scripts.

2026-01-31 21:29:14 +09:00

recover-orphaned-processes.sh

fix: reset stale execution state after SIGUSR1 in-process restart (#15195)

2026-02-13 15:30:09 -05:00

release-check.ts

fix: harden windows npm runtime path

2026-03-12 23:03:19 +00:00

restart-mac.sh

refactor: replace bot.molt identifiers with ai.openclaw

2026-02-25 05:03:24 +00:00

run-node.d.mts

chore: Fix types in tests 33/N.

2026-02-17 15:50:07 +09:00

run-node.mjs

fix(gateway): remove watch-mode build/start race (#18782)

2026-02-17 11:24:08 +09:00

run-openclaw-podman.sh

fix(run-openclaw-podman): add SELinux :Z mount option on enforcing/permissive hosts (#39449)

2026-03-08 18:53:09 -04:00

sandbox-browser-entrypoint.sh

feat(security): Harden Docker browser container chromium flags (#23889) (#31504)

2026-03-02 11:28:27 -08:00

sandbox-browser-setup.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

sandbox-common-setup.sh

Docker: improve build cache reuse (#40351)

2026-03-08 17:57:46 -07:00

sandbox-setup.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

setup-auth-system.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

sparkle-build.ts

fix(release): unify sparkle build policy and defaults

2026-02-28 10:04:25 +05:30

sqlite-vec-smoke.mjs

chore: Also format scripts and skills.

2026-01-31 21:21:25 +09:00

sync-labels.ts

CI: add PR size autolabel workflow (#14410)

2026-02-11 21:12:27 -06:00

sync-moonshot-docs.ts

Docs: fix Moonshot sync markers (#6789)

2026-02-02 03:38:14 +01:00

sync-plugin-versions.ts

fix(feishu): restore group command fallback and plugin deps

2026-02-22 19:13:19 +01:00

termux-auth-widget.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

termux-quick-auth.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

termux-sync-widget.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

test-cleanup-docker.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

test-force.ts

chore: Enable "experimentalSortImports" in Oxfmt and reformat all imorts.

2026-02-01 10:03:47 +09:00

test-hotspots.mjs

chore(test): add vitest hotspot reporter script

2026-03-03 00:43:01 +00:00

test-install-sh-docker.sh

Install Smoke: allow reusing prebuilt test images

2026-03-06 14:23:00 -05:00

test-install-sh-e2e-docker.sh

refactor: rename to openclaw

2026-01-30 03:16:21 +01:00

test-live-gateway-models-docker.sh

fix: use build-stage image for docker live tests

2026-03-13 02:59:36 +00:00

test-live-models-docker.sh

fix: use build-stage image for docker live tests

2026-03-13 02:59:36 +00:00

test-parallel.mjs

test: re-enable Node 24 vmForks fast lane

2026-03-13 20:38:24 +00:00

test-perf-budget.mjs

test(perf): slim ios team-id harness and add perf budget guard

2026-03-03 00:20:46 +00:00

test-shell-completion.ts

style: align formatting with oxfmt 0.33

2026-02-18 01:34:35 +00:00

tsdown-build.mjs

build: reduce build log noise

2026-03-08 04:12:32 +00:00

ui.js

fix(scripts): harden Windows UI spawn behavior

2026-02-16 20:49:09 -05:00

update-clawtributors.ts

fix: agent-only announce path, BB message IDs, sender identity, SSRF allowlist (#23970)

2026-03-01 22:52:11 -08:00

update-clawtributors.types.ts

fix: agent-only announce path, BB message IDs, sender identity, SSRF allowlist (#23970)

2026-03-01 22:52:11 -08:00

watch-node.d.mts

chore: Fix types in tests 33/N.

2026-02-17 15:50:07 +09:00

watch-node.mjs

fix(gateway): remove watch-mode build/start race (#18782)

2026-02-17 11:24:08 +09:00

write-build-info.ts

chore: Enable linting in scripts.

2026-01-31 21:29:14 +09:00

write-cli-compat.ts

fix (cli): harden daemon compat shim for minimal bundle exports

2026-02-14 20:53:32 -08:00

write-cli-startup-metadata.ts

CLI: add root --help fast path and lazy channel option resolution (#30975)

2026-03-01 14:23:46 -08:00

write-plugin-sdk-entry-dts.ts

Plugin SDK: add full bundled subpath wiring

2026-03-04 02:35:12 -05:00

zai-fallback-repro.ts

chore: apply local workspace updates (#9911)

2026-02-05 16:54:44 -05:00