chore(deps): bump hono and openclaw

[dependabot]

Bumps hono and openclaw. These dependencies needed to be updated together.
Updates hono from 4.12.12 to 4.13.7

Release notes

Sourced from hono's releases.

v4.13.7

Security fixes

This release includes a fix for the following security issue:

hono/jsx renders plain strings unescaped in boundary components, leading to XSS

Affects: Suspense, ErrorBoundary, and Context.Provider in hono/jsx, and renderToString() / renderToReadableStream() in hono/jsx/dom/server. Fixes missing HTML escaping for a plain string placed directly as a child or fallback of these components, or as the root value of the server rendering functions, so untrusted strings could be emitted as markup. GHSA-hxh3-vqpv-xpqv

---

Users who render untrusted strings inside Suspense, ErrorBoundary, or Context.Provider, or pass them directly to hono/jsx/dom/server, are strongly encouraged to upgrade to this version.

v4.13.6

What's Changed

• fix(client): keep a param value of "index" in $url() and $path() in honojs/hono#5297
• fix(client): normalize root WebSocket URLs in honojs/hono#5291
• fix(types): allow symbol keys in Context get and set fallbacks in honojs/hono#5300
• chore: bump editorconfig-checker in honojs/hono#5336
• refactor(on-handler): use forEach for consistent handler iteration in honojs/hono#5326

Full Changelog: honojs/hono@v4.13.5...v4.13.6

v4.13.5

Security fixes

This release includes fixes for the following security issues:

Query parser reads parameters after the URL fragment, causing cache-key and proxy interpretation differentials

Affects: Cache Middleware and applications behind a proxy, WAF, or logging layer that inspects query strings. Fixes query parsing that did not stop at the URL fragment, so a ? after a # was treated as the start of a query string and the application could read parameters that the other component never saw. GHSA-crvj-82cr-hjcx

Incomplete fix for CVE-2026-39408: toSSG() still writes files outside the output directory

Affects: toSSG() for Static Site Generation. Fixes a path normalization gap where consecutive parent-directory segments in ssgParams values were not fully collapsed, bypassing the containment check added in 4.12.12. GHSA-gqvv-2mrq-wpjv

Unbounded dot-notation nesting in parseBody() can cause memory exhaustion

Affects: parseBody() when dot-notation parsing is enabled. Fixes unbounded expansion of dot-separated field names, where a small request body could allocate a disproportionately large object graph and concurrent requests could exhaust the heap. GHSA-g6gw-c38x-mqfc

---

Users who use Cache Middleware, deploy behind a proxy or WAF that inspects query strings, use Static Site Generation, or use parseBody({ dot: true }) are strongly encouraged to upgrade to this version.

v4.13.4

What's Changed

• fix(request): handle params on unmatched requests in honojs/hono#5268
• fix(jsx/dom): execute previous ref cleanup when ref prop changes on re-render in honojs/hono#5264
• fix(reg-exp-router): associate wildcard middleware with matching routes in honojs/hono#5266
• perf(router): share null object creation in honojs/hono#5267

... (truncated)

Commits

• eebdf7b 4.13.7
• 2b8ed40 Merge commit from fork
• cac0c4d 4.13.6
• dac5d57 refactor(on-handler): use forEach for consistent handler iteration (#5326)
• ec648d6 chore: bump editorconfig-checker (#5336)
• e2740d5 fix(types): allow symbol keys in Context<any> get and set fallbacks (#5300)
• 499c35e fix(client): normalize root WebSocket URLs (#5291)
• 50b8788 fix(client): keep a param value of "index" in $url() and $path() (#5297)
• 06880c4 4.13.5
• 531e9c5 Merge commit from fork
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for hono since your current version.

Updates openclaw from 2026.4.10 to 2026.9.3

Release notes

Sourced from openclaw's releases.

openclaw 2026.9.3

2026.9.3

Highlights

• Safer updates: rehearse core and plugin changes in isolated candidate state before activation, support eligible 2026.9.2 migrations, and recover abandoned update records without stopping a healthy matching Gateway. Related #136997. (#138839, #141109, #141175, #141562)
• Performance: preserve warm prompt caches, reduce unnecessary work during cold session updates and memory search, and reuse worker builds between sessions. Related #140681. (#140449, #140730, #140799, #140840, #141141) Thanks @​justinkirklin-gif, @​NianJiuZst, and @​obviyus.
• Skill Workshop: keep skills in one persistent agent-owned collection across workspaces, compare complete skill instructions, and retire missing-draft suggestions safely through Doctor. Related #135291. (#135528, #139248, #140300, #141009) Thanks @​khaisis and @​obviyus.
• Browser tabs, live and native: watch agent pages repaint and open external links in native Mac tabs that remain with their window across chat switches. (#140988, #141031)
• Your provider accounts, together: manage connected accounts and supported account priority directly in Models settings. (#132451) Thanks @​jesse-merhi.
• Share selected conversations: explicitly publish a revocable read-only view of a session’s existing and future conversation text, accessible to anyone with its public link. (#139489)
• A searchable meeting library: browse saved notes, search full transcripts, download complete Markdown or JSONL archives, and manage capture sources from the Control UI. (#139875, #140084)
• Optional team activity reports: install and enable Team Reports to browse authenticated GitHub activity and explicitly configured Discord discussion, with stored history and optional model summaries. (#139850, #141327)

Changes

• Breaking — Node runtime: require Node 24.16.0 or newer on 24.x, or Node 26.1.0 or newer; Node 26 is recommended. Upgrade Node before OpenClaw to prevent SQLite text truncation: Node 22, Node 25, and earlier 24.x/26.x builds are no longer supported. Node-based CLI/Gateway installs on macOS 11–13.4 or official Linux ARMv7 provisioning need a supported host; see Node requirements. (#140672)
• Breaking — execution-policy SDK: move the retired exec-mode and comparator helpers from infra-runtime to execPolicy on openclaw/plugin-sdk/agent-harness-runtime; use resolveExecModePolicy and select the returned fields needed by the caller. See runtime utility migration.
• Breaking — approval SDK: import approval account-resolution helpers from approval-native-runtime, adapt session filtering to the full matchesApprovalRequestFilters contract, and replace the retired generic forwarding evaluator with native channel route gates and shared predicates rather than assuming a drop-in alias. See SDK migration.
• Breaking — SDK aliases: replace channel-inbound.buildChannelTurnMediaPayload with buildChannelInboundMediaPayload; infer the retained abortAndDrainAgentHarnessRun callable’s result instead of importing the removed AbortAndDrainAgentHarnessRunResult named type. The callable and its result data remain available. See SDK migration.
• Breaking — search result callbacks: read bounded Find/Grep text from details.content instead of details.truncation.content; the outer tool-message content remains unchanged. (#140008) Thanks @​ruel225.
• Breaking — directory result callbacks: use LsToolDetails.content and optional nextAfter in place of the retired truncation and entryLimitReached fields, and pass nextAfter as after to continue listing. See structured filesystem results.
• MCP prompt adapters: return the typed MCP GetPromptResult shape from SessionMcpRuntime.getPrompt, preserving its messages and image content; validate external responses instead of returning arbitrary unknown values. (#141421)
• Breaking — agent-owned Workshop skills: replace workspace ownership with one writable Workshop collection per agent and retire skills.workshop.allowSymlinkTargetWrites; startup and openclaw doctor --fix migrate proven legacy skills, while ambiguous ownership remains in place for review. (#135528) Thanks @​obviyus.
• Bounded update repair: supported candidate-validation failures can enter a bounded repair phase using configured inference in disposable rehearsal state; activate only after independent validation, and retain failure or rollback outcomes when repair cannot recover. Changes requiring configuration edits are reported for operator repair. (#139495)
• Update failure reports: submit a report from the failed-update action only after explicit consent, using the recorded update attempt and current owner. (#139704) Thanks @​fuller-stack-dev.
• Active sessions: show running and queued permitted sessions in Live activity on entry and reconnect, with a visible limit notice and connection status instead of claiming disconnected sessions are idle. (#141045) Thanks @​shakkernerd.
• Code Mode composition: retain the running JavaScript environment across fast tool replies, add optional TypeScript checks against available tools, and report original-source error locations with bounded console output; explicit yields and resource limits still checkpoint execution. Related #141261. (#141265) Thanks @​Takhoffman.
• Code Mode text encoding: provide sandboxed TextEncoder and TextDecoder instances that survive wait/resume for local text and byte transformations. (#140812) Thanks @​Takhoffman.
• Private-session link previews: copy social-preview links that show a generic OpenClaw card without reading private session content; opening the conversation still requires its normal authentication. (#139250)
• Public session transcripts: session owners and Gateway admins can explicitly publish existing and future conversation text to anyone with a public URL and revoke access later; the read-only view omits tools, reasoning, files, images, and executable widgets. Review the text before enabling access; private-session preview links remain separate. (#139489)
• Repository-backed cloud sessions: create sessions from a repository URL and ref with checkout, setup, and recoverable checkpoints owned by the cloud node; materialize a Gateway worktree only when explicitly moving there. (#138900)
• Persistent sessions and subagent runs: keep persistent sessions created with visible spawning editable and steerable in their parent tree. Subagent runs remain view-only, omit author avatars, and keep live progress in the parent conversation with inactive cards paused. (#139367, #139371, #139381, #139456, #141499)
• Provider account controls: add and remove individual accounts, manage supported account priority, and clear an agent’s custom order without disconnecting accounts; inherited and provider-managed order remains explicit. (#132451) Thanks @​jesse-merhi.
• Model fallback picker: choose ordered fallback models from a searchable dropdown, remove selections, and add custom references. Related #137410. (#141330) Thanks @​najef1979-code and @​shakkernerd.
• Prometheus runtime identity: identify the running process and loaded build behind metrics so operators can verify which runtime is serving a deployment. Related #139268. (#139280)
• Provider setup: keep provider detection passive until the user chooses a route, preserve consent and model choices through setup and OAuth failures, and leave generated catalog rows to discovery. Retain selected OpenAI credentials and supported Doctor model references; Baseten replace mode still includes the bundled catalog. Related #137033, #139207. (#137120, #139243, #139675, #139924, #139951, #140139, #140154, #140336, #141531, #141552) Thanks @​LiuwqGit, @​NovaUnboundAi, @​obviyus, @​shakkernerd, and @​vincentkoc.
• Browser panel: watch Agent browser tabs repaint live, with screenshot fallback when streaming is unavailable. In the macOS app, open external links as native WebKit Mac tabs in the same Browser panel, with navigation and one-shot Annotate/Inspect capture; Mac tabs belong to their window and survive chat switches. (#140988, #141031)
• iOS voice shortcuts: open the current chat and start Talk with the Start Live Voice App Shortcut; pairing, provider setup, microphone permission, unlock, and foreground requirements still apply. Related #140998. (#141003, #141152) Thanks @​shakkernerd.
• Team Reports: install the optional Team Reports plugin for authenticated daily, weekly, and monthly GitHub reports and explicitly selected Discord sources, with stored history, optional summaries, people timelines and calendars, coverage warnings, scheduler/source health, and theme-aware report pages. (#139850, #141327, #141384)
• Android folding layouts: keep content clear of separating hinges, show navigation beside content on book folds, and split transcript and composer across suitable tabletop panes while retaining drafts, cursor, and reading position; fall back when available space is insufficient. (#140614, #140710, #140802) Thanks @​vincentkoc.
• Native embedded settings: provide phone-width settings with safe-area handling and Back navigation while retaining existing Gateway scopes and native device capabilities. (#139492)
• Telegram photo albums: group consecutive eligible photos into native albums of up to ten while preserving order, captions, reply targets, and topics; single photos and messages with controls retain individual delivery. (#141398) Thanks @​obviyus.
• CLI and plugin discovery: limit displayed terminal or JSON documentation results with openclaw docs --limit, and let the system agent read installed-plugin inventory directly. Related #133122. (#131014, #133255) Thanks @​Alix-007 and @​shakkernerd.
• Recursive delegation: enable bounded recursive session spawning by default while retaining explicit depth and concurrency limits and existing sandbox restrictions. (#138059) Thanks @​fuller-stack-dev.
• Chat navigation: add a previewable position rail for long conversations, including hover previews and direct jumps. Related #138587. (#138603) Thanks @​brokemac79.
• Native dashboard reports: display bounded report data directly through show_widget and dashboard authoring without an iframe. Related #139263. (#139306)
• Chrome extension setup on Mac: request the official Chrome Store extension from the local Mac device settings or CLI after native setup is ready; Chrome still owns approval and uninstall decisions, and OpenClaw shows when setup remains pending. Related #139448. (#139466)
• CLI agents by default: show supported create-capable CLI agents in the new-session model picker without a separate opt-in; set gateway.cliAgents.enabled to false to disable CLI agents and native CLI session creation. (#139459)
• Device aliases: rename paired devices directly from the Control UI Devices page. Related #138099. (#138852) Thanks @​xialonglee.

... (truncated)

Commits

• 1391f7c chore(release): finalize 2026.9.3 notes and qualification fixes
• 65d735e fix(ci): seed frozen target before deepening release ancestry
• 6b56905 chore(release): freeze 2026.9.3 code qualification cut
• 28bb072 test(codex): await real root stop before injected quiescence
• 660726f fix(agents): unpublish retired relay endpoints before listener close
• cdda5ea test(doctor): preserve ownership expectations after roster deduplication
• c2baa24 fix(plugins): complete catalog and verify cached index reads
• c296ab1 test(exa): bind caller cancellation to transport entry
• 725b76a fix(skills): ground review reads in known Workshop skills
• c9e70b3 chore(release): prepare 2026.9.3 verification candidate
• Additional commits viewable in compare view

Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Assignees

The following users could not be added as assignees: exampleuser. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Large PR Detected

This PR is quite large (11644 lines changed across 1 files).

Consider breaking it into smaller PRs for easier review:

• ✅ Smaller PRs are reviewed faster
• ✅ Easier to identify bugs
• ✅ Safer to revert if needed

If this is intentional (refactor, major feature), feel free to ignore.

[github-actions]

🔍 Quality Preview

The full CI pipeline is running. Expected checks:

Check	Status
TypeScript	🔄 Running
ESLint	🔄 Running
Tests	🔄 Running
Coverage	🔄 Running

Check the CI workflow for details.

[github-actions]

This PR has been automatically marked as stale due to inactivity.

If this PR is still being worked on:

• Push new commits or add a comment
• Apply the pinned label

Otherwise, it will be closed in 7 days.

[github-actions]

This PR was closed due to inactivity.

Feel free to reopen when ready to continue.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.