fix(security): close managed runtime audit gaps

[jyaunches]

Summary

Close the high-severity npm audit gaps in the managed OpenClaw and mcporter production boundaries.
This keeps the existing OpenClaw 2026.7.1 product scope and replaces only reviewed vulnerable dependency identities.
PR #8126 is merged into this branch so San Dang and Apurv Kumaria retain their original root-remediation commits and authorship.

Changes

• Upgrade the OpenClaw locked runtime to brace-expansion@5.0.9, fast-uri@3.1.5, undici@8.10.0, and ip-address@10.3.1 with exact registry URLs and SRI values.
• Upgrade the mcporter lock to fast-uri@3.1.5 and ip-address@10.3.1 through exact manifest overrides.
• Remediate Discord's direct and bundled undici@8.5.0 across its manifest, shrinkwrap, bundledDependencies, and physical node_modules tree.
• Fail closed when any reviewed source identity, dependency edge, engine, replacement archive, deterministic tree digest, or committed lock digest changes.
• Update the security review records and regression contracts for the final advisory set and audit evidence.

Type of Change

• Code change (feature, bug fix, or refactor)
• Code change with doc updates
• Doc only (prose changes, no code sample modifications)
• Doc only (includes code sample changes)

Quality Gates

• Tests added or updated for changed behavior
• Existing tests cover changed behavior — justification:
• Tests not applicable — justification:
• Docs updated for user-facing behavior changes
• Docs not applicable — justification:
• Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging)
• Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: nine-category review completed on the exact diff; dependency provenance warnings are recorded below and no code-security blocker was found.
• Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: no exception is currently recorded; required CI is authoritative on exact head 1d28516eac51effbd690f8bf1847e59571ac5118.

Documentation Writer Review

• Documentation writer subagent reviewed the completed changes
• Result: docs-updated
• Evidence: agents/openclaw/dependency-review.md, docs/security/openclaw-2026.7.1-dependency-review.md, and docs/security/sandbox-base-2026-07-25-dependency-review.md; their content is unchanged from the exact head where npm run docs passed. The final doctor-boundary test passed 1/1, the load-timed-out setup test passed 1/1 in isolation, and normal pre-commit and commit-msg hooks passed. The final test-only hardening requires no additional documentation.
• Agent: Codex Desktop

Dependency Review

Concern	Verdict	Evidence
brace-expansion@5.0.9	PASS	Exact registry archive, SRI, corrected Node engine, source range, and deterministic lock/tree boundaries verified.
fast-uri@3.1.5	WARNING	Full source range and exact BSD-3-Clause no-dependency archive verified; registry signature is valid, but the archive has no registry attestation.
undici@8.10.0	WARNING	Exact MIT no-dependency archive, signatures, SLSA provenance, and source ranges verified. Upstream release CI had one flaky Node 24 test; 1,502 tests and the Node 22, types, lint, fuzz, release, and Scorecard lanes passed. NemoClaw's exact runtime tests and audit provide compensating proof.
ip-address@10.3.1	WARNING	Full non-shallow v10.2.0..v10.3.1 range, exact MIT no-dependency archive, two registry signatures, SLSA provenance, content-identical source build, and 3,571 upstream tests verified. The annotated tag is unsigned.
Trusted lock transition	PASS	PR #8165 merged the governance-approved transition into main. The OpenClaw lock 759b31779f40867f35f15065b582eb1d3efb8fddb1fe43c207507c905fa2a421 and mcporter lock 962dee34f6b0a493521d1619d1cf030e2630cbdfce8bf0598217202f57078793 are now each the sole trusted lockSha256; temporary successor fields were removed.

Licenses remain compatible: MIT, BSD-3-Clause, and the existing graph licenses. No replacement adds a runtime dependency or lifecycle script.

Security Review

Category	Verdict	Evidence
Secrets and Credentials	PASS	No secret-bearing values or credential paths changed; gitleaks passed.
Input Validation and Data Sanitization	PASS	Archive paths, package identities, dependency edges, engines, bundled trees, deterministic tree hashes, and lock hashes reject drift.
Authentication and Authorization	PASS	No authentication or authorization behavior changed.
Dependencies and Third-Party Libraries	WARNING	Every affected production graph is outside the disclosed high-severity ranges; upstream signing and release-CI limitations are recorded in the concern ledger.
Error Handling and Logging	PASS	Failures identify the exact source, replacement, tree, or lock boundary without exposing secrets.
Cryptography and Data Protection	PASS	SHA-512 artifact integrity and SHA-256 lock binding remain mandatory; registry signatures and available provenance were verified.
Configuration and Security Headers	PASS	Docker guards and reviewed-audit policy use the exact new locks; users, permissions, ports, and headers are unchanged.
Security Testing	PASS	Source-shape rejection, physical bundled-tree replacement, deterministic tree integrity, installed-lock verification, registry audit, and signature checks passed.
System Security	PASS	Managed images remove the high findings without weakening sandbox isolation or image hardening.

DGX Station Hardware Evidence

• Tested on DGX Station
• Tested commit:
• Station profile/scenario:
• Result:
• Supporting evidence:

Verification

• PR description includes a Signed-off-by: line and every pushed commit appears as Verified in GitHub
• Normal pre-commit, commit-msg, and pre-push hooks passed, or npm run validate:pr passed after refreshing origin/main when hooks were skipped or unavailable
• Targeted behavior tests pass for the current change set — 105/105 exact-head focused integration tests passed after merging fix(security): bound reviewed lock transition #8165; 57/57 dependency and audit-documentation tests passed again after the final remote/main reconciliation. The package-contract probe also passed after increasing its Mac-local npm pack timeout from 90 to 120 seconds.
• Applicable broad gate passed — npm test for broad runtime/test-harness changes; npm run check for repo-wide validation/coverage changes — command/result: not applicable to the reviewed dependency and integrity-boundary update; required CI remains authoritative.
• Quality Gates section completed with required justifications or waivers
• No secrets, API keys, or credentials committed
• npm run docs builds without warnings (doc changes only) — 0 errors and 2 existing hidden Fern warnings.
• Doc pages follow the style guide (doc changes only)
• New doc pages include SPDX header and frontmatter (new pages only)

Additional validation:

• Exact Node 22.23.1 reviewed npm audit exited 0:
  • reviewed archive graph: 0 high, 0 critical, 13 moderate;
  • OpenClaw locked graph: 0 high, 0 critical, 7 moderate;
  • mcporter locked graph: 0 high, 0 critical, 1 moderate.
• Registry signature checks completed for both locked graphs; mcporter reports 120/120 signed packages and 14 attestations.
• npm run build:cli, npm run typecheck:cli, npm run checks:repository, focused documentation tests, and npm run docs passed.
• Normal pre-commit and commit-message hooks passed, including Biome, hadolint, gitleaks, markdownlint, repository checks, and source/test budgets.
• Live E2E was not run locally. Required image-build CI provides the platform-specific proof.
• PR fix(security): bound reviewed lock transition #8165 merged the base-trusted audit transition. This head removes the temporary successor hashes and retains each remediated lock as the sole trusted lockSha256.

---

Signed-off-by: Julie Yaunches jyaunches@nvidia.com
Signed-off-by: Prekshi Vyas prekshiv@nvidia.com

Summary by CodeRabbit

• Security

  • Updated bundled and runtime dependencies to patched versions, including brace-expansion, fast-uri, undici, and ip-address.
  • Expanded protection for additional runtime and Discord-related dependencies.
  • Refreshed vulnerability reviews, integrity metadata, provenance records, and audit results.

• Bug Fixes

  • Improved dependency validation and fail-closed checks for affected package versions.

• Tests

  • Expanded coverage for patched packages, lockfile integrity, remediation behavior, and supply-chain validation.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change updates npm remediation to newer reviewed versions, adds OpenClaw Discord graph patching, refreshes lockfile and package integrity metadata, and expands security documentation and tests.

Changes

OpenClaw dependency remediation

Layer / File(s)	Summary
brace-expansion remediation scripts/patch-bundled-npm-brace-expansion.mts, Dockerfile*, agents/*/Dockerfile.base, docs/security/sandbox-base-2026-07-25-dependency-review.md, test/*brace-expansion*	Updates the fixed package to brace-expansion@5.0.9 and accepts 5.0.8 as a reviewed previous version.
OpenClaw and Discord patching scripts/lib/openclaw-npm-remediation.mts	Adds undici remediation, ip-address validation, and Discord package-graph patching.
Integrity and review records Dockerfile*, ci/reviewed-npm-audit.json, agents/openclaw/*, docs/security/openclaw-2026.7.1-dependency-review.md	Refreshes lock hashes, dependency overrides, package metadata, provenance records, and remediation boundaries.
Validation coverage test/openclaw-npm-remediation.test.ts, test/openclaw-locked-install.test.ts, test/openclaw-dependency-review.test.ts, test/mcporter-supply-chain.test.ts	Verifies updated versions, integrity values, package graphs, Discord patching, and rejection of unreviewed graphs.

Estimated code review effort: 4 (Complex) | ~45 minutes

Possibly related PRs

• NVIDIA/NemoClaw#8126: Upgrades undici to 8.10.0 in a related remediation context.
• NVIDIA/NemoClaw#8157: Updates the reviewed lock-digest policy and related OpenClaw validation.
• NVIDIA/NemoClaw#8164: Updates the same reviewed lock-digest data and OpenClaw lock-transition tests.

Suggested labels: integration: openclaw, bug-fix

Suggested reviewers: cv, senthilr-nv

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the PR's primary change: remediating security audit gaps in managed runtimes.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@scripts/patch-bundled-npm-brace-expansion.mts`:
- Around line 28-32: Update inspectBundledNpmBraceExpansion to accept
brace-expansion version 5.0.8 as a valid replaceable input, while retaining
5.0.9 as the only replacement output. Extend the associated tests to cover the
5.0.8-to-5.0.9 transition.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 277e9169-fef3-4860-8eff-967321502a43

📥 Commits

Reviewing files that changed from the base of the PR and between c63e7eb and 0e191e7.

⛔ Files ignored due to path filters (1)

• agents/openclaw/openclaw-runtime/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (12)

• Dockerfile
• Dockerfile.base
• agents/hermes/Dockerfile.base
• agents/langchain-deepagents-code/Dockerfile.base
• ci/reviewed-npm-audit.json
• docs/security/openclaw-2026.7.1-dependency-review.md
• docs/security/sandbox-base-2026-07-25-dependency-review.md
• scripts/lib/openclaw-npm-remediation.mts
• scripts/patch-bundled-npm-brace-expansion.mts
• test/bundled-npm-brace-expansion-dockerfile-contract.test.ts
• test/openclaw-locked-install.test.ts
• test/openclaw-npm-remediation.test.ts

[github-actions]

PR Review Advisor — No blocking findings reported

Advisor assessment: No blocking advisor findings reported
Next action: No advisor follow-up needed.
Findings: 0 blockers · 0 warnings · 0 suggestions

Model lanes

• GPT-5.6 Terra (primary): Completed · high confidence · 0 blockers · 0 warnings · 0 suggestions
• Nemotron 3 Ultra (second opinion): Failed after a partial review · low confidence · 3 blockers · 3 warnings · 1 suggestion

Second-opinion terminology and E2E selections are advisory. They do not change the primary assessment or E2E / PR Gate.

2 semantic terminology decisions

Terminology decisions are advisory. They affect the assessment only when a separate finding identifies concrete semantic impact.

• established — remediated package tree at docs/security/openclaw-2026.7.1-dependency-review.md:50: Keep this established term for the validated replacement tree.
• justified — reviewed dependency remediation at docs/security/openclaw-2026.7.1-dependency-review.md:24: Keep the modifier because it identifies the review boundary.

E2E guidance

Advisory only. E2E / PR Gate selects and runs jobs independently.

Recommended E2E: cloud-inference, cloud-onboard, full-e2e, hermes-e2e, hermes-inference-switch, security-posture, ubuntu-repo-cloud-langchain-deepagents-code

Workflow run details

This automated review informs maintainers. Warnings and suggestions do not require a response. A maintainer decides whether to merge.

[senthilr-nv]

Approved. Verified brace-expansion 5.0.9 across the OpenClaw locked runtime and npm-private copy used by OpenClaw, Hermes, and Deep Agents Code. The exact registry SRI and lock guards match, the 5.0.8-to-5.0.9 transition is covered, focused tests pass (45/45), and the CodeRabbit finding is resolved. No blocking security findings; remaining CI must complete successfully.

[senthilr-nv]

Follow-up: the managed-image production remediation looks correct, but this is not merge-ready yet. reviewed-npm-audit fails because trusted base policy expects OpenClaw lock SHA 82489f62..., while this PR correctly produces fdbee91a.... Please update the supported audit/control-plane path so the new reviewed lock can be validated. Also, if the intended scope is literally all repository copies, root package-lock.json still contains brace-expansion 5.0.5, 5.0.6, and 2.1.0; the current PR covers the shipped image/runtime copies only.

[senthilr-nv]

Blocking until the requested remediation is complete. The managed-image copies are updated, but root package-lock.json still resolves affected brace-expansion 5.0.5, 5.0.6, and 2.1.0 instead of the fixed 5.0.9/2.1.4 boundaries. The required reviewed-npm-audit check also fails because the trusted base expects the previous OpenClaw lock SHA. Please resolve both scope and audit-gate issues before merge.

[cv]

Commit SHA 1e30bc1a4 still has two blocking issues.

1. The committed OpenClaw runtime lock records brace-expansion@5.0.9 with engines.node = "18 || 20 || >=22".
   The published 5.0.9 package uses 20 || >=22.
   Correcting that exact entry changes the runtime lock SHA-256 from fdbee91a3f3a0222ec2e8e34864d09dfcff4711e86ac6bfa4d475af0593acd51 to 847f68ac46f18d17efcd47dd3d8a5944b9dbcd205bc4d1e821ff82aa543eec20.
   The Docker guards, audit configuration, remediation validation, documentation, and tests must use the corrected artifact identity.

2. The latest commit adds root package-lock.json remediation and root-lock tests.
   The later maintainer direction on fix(security): upgrade vulnerable production dependencies #8126 assigns the root production-lock update to fix(security): upgrade vulnerable production dependencies #8126 and trusted root-audit enforcement to a separate follow-up: fix(security): upgrade vulnerable production dependencies #8126 (comment).
   Please keep this PR scoped to the managed-image and OpenClaw runtime remediation, and remove the overlapping root-lock changes.

PR #8157 currently authorizes the stale fdbee91a... digest and its reviewed-npm-audit check fails on GHSA-rgw5-rvv9-x895 in the base lock.
That exposes a circular gate: the transition policy PR audits the vulnerable base lock, while this PR cannot introduce the corrected lock until the policy is in the base SHA.
Do not bypass or waive that failed security check.
The trusted-policy bootstrap path needs explicit repository-governance direction before either PR can merge.

[ericksoa]

Addressed at exact head 5a8f3f85aac41c9564ecde0a68c0473c0db7da05.

• OpenClaw now uses the published brace-expansion@5.0.9 engine (20 || >=22), fast-uri@3.1.5, undici@8.10.0, and ip-address@10.3.1. The last item closes GHSA-mwp4-54f8-5fhr, which was published after the original review comment.
• Discord's direct and bundled undici@8.5.0 copies are replaced as well; the manifest, shrinkwrap, bundledDependencies, and physical package tree are all checked fail-closed.
• Final committed lock SHA-256 values are OpenClaw 759b31779f40867f35f15065b582eb1d3efb8fddb1fe43c207507c905fa2a421 and mcporter 962dee34f6b0a493521d1619d1cf030e2630cbdfce8bf0598217202f57078793.
• Canonical remediated tree digests are OpenClaw sha512-ugtX/U1jNS+ZlZqEXa+Y9nN+wlhPxeZJrx6tJZFLcGspWPFhsC5qOjTkzBbOda9lEZF6TWKt6wU9m9p2tidqdQ== and Discord sha512-w+F8FrRl0wPd0EN2RnLyu6yfixel7BT8Iex4wLLQDvfIac8rLhuksNpFU4uZa8W9wXgh47hguq0F9NSN0BZfOQ==.
• PR fix(security): upgrade vulnerable production dependencies #8126 is merged into this branch, so San Dang's and Apurv Kumaria's original commits and authorship are retained.
• PR fix(security): bound reviewed lock transition #8165 has landed on main; this branch now records each final lock as the sole trusted lockSha256. No audit exception, bootstrap bypass, or waiver was added.

I did not use the proposed OpenClaw lock hash 2631dd...: reproducing it required changing the balanced-match@4.0.4 engine metadata while leaving the brace-expansion@5.0.9 engine stale. The final lock above preserves balanced-match's published 18 || 20 || >=22 metadata and applies 20 || >=22 only to brace-expansion.

Validation on the reconciled head:

• exact Node 22.23.1/npm 10.9.4 reviewed audit exited 0: archive graph 0 high/critical (13 moderate), OpenClaw 0 high/critical (7 moderate), mcporter 0 high/critical (1 moderate), with registry signature verification;
• 105/105 focused integration tests passed, followed by 57/57 dependency/audit-documentation tests after the final remote/main reconciliation;
• npm run validate:pr, npm run docs, the package-contract probe, and the independent documentation review passed.

Thanks for catching the engine metadata and the moving advisory set.

[apurvvkumaria]

Re-reviewed the expanded dependency-remediation revision at head 5a8f3f8. Registry URLs and SHA-512 identities are pinned; archive extraction rejects traversal, duplicate, symlink, and special-file entries; package identities, engines, and dependency edges are checked; replacement is transactional and revalidated. The trusted-base schema-2 audit transition permits only the old and new exact lock digests, so this branch does not self-authorize its own audit evidence. Focused changed-area validation passed 57 tests. Current CI is still running; the visible coordination failure belongs to a cancelled superseded attempt. Any recurrence of the fake npm-pack fixture failure is nonblocking test-infrastructure work, not supported-product breakage. No blocking correctness, security, compatibility, or regression defect found.

[ericksoa]

CI follow-up: the target-tree audit result above is reproducible, but the authoritative PR job correctly runs the remediator and exception registry from the base SHA. That trusted-base run still materializes undici@8.5.0 in the archive graph and blocks GHSA-4cwx-7wf7-3272 (1 high); I am therefore not treating the PR as green.

The repository-governed bridge is #8172 at exact head 4d2d5709aba270dfd5f700883f0f207382721ee2. It adds seven exact, expiring transition entries for the currently deployed graphs, fails closed on unused or mismatched entries, and requires #8156 to remove them when the already authorized successor locks and updated archive remediator land. I reviewed that exact head and its focused policy/docs/MCP contract suite passes 50/50.

#8156 remains blocked on that base-trusted transition landing. After it lands, this branch must merge the new main, retain the empty exception registry from #8156, rerun the exact-head trusted audit, and only then request final review.

Dismissed as stale after the requested scope and trusted-audit changes landed. The root production lock now uses brace-expansion 5.0.9 and 2.1.4; the remaining 5.0.6 entry is dev-only, consistent with the later npm audit --omit=dev scope recorded on #8126. Merged #8165 supplies the base-owned schema-2 lock authority, and the current trusted run accepts both final locks: OpenClaw and mcporter locked graphs are clean. The remaining reviewed archive-graph failure is a separate trusted-base bootstrap issue, not the previous lock-SHA mismatch; this dismissal does not waive that CI check.

[apurvvkumaria]

Re-reviewed the test-hardening delta at head ced321f. It makes the trusted locked-graph contract exact, applies legacy-field rejection to every graph, and independently exercises the OpenClaw core and Discord shrinkwrap and bundled-undici validation paths. The delta changes tests only and directly closes the current automated-review coverage gaps; it does not alter runtime behavior. No blocking correctness, security, compatibility, or regression defect found. CI remains authoritative while the new run completes.

[senthilr-nv]

Approved at verified head ced321f. The independent Undici shrinkwrap and bundled-package rejection paths now have direct coverage, and the reviewed lock authority rejects extra or duplicate graphs while checking every entry. Focused integration tests pass 47/47, npm run validate:pr passes, npm run docs passes, the documentation writer receipt matches this head, and no blocking security finding remains. The current DGX Station revoked-host-key installer test failure is outside this PR's changed paths; required CI remains authoritative for merge.