Repository navigation
chore(deps): trust OpenClaw 2026.9.1 manifests #11504
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
prekshivyas
merged 6 commits into
main
from
nemopatch/openclaw-upgrade/6c5c49fdcbd04393/trust
Sep 13, 2026
Merged
Changes from 2 commits
Commits
Show all changes
6 commits
Select commit
Hold shift + click to select a range
afffb39
chore(deps): trust openclaw 2026.9.1 manifests
prekshivyas bbf9d2a
merge(openclaw): sync relevant trust base
prekshivyas 6ddd807
Merge remote-tracking branch 'origin/main' into nemopatch/openclaw-up…
prekshivyas 7b9b722
fix(ci): match trusted OpenClaw lock digest
prekshivyas e9d272b
Merge branch 'main' into nemopatch/openclaw-upgrade/6c5c49fdcbd04393/…
prekshivyas c62c911
fix(ci): keep reviewed OpenClaw graph coherent
prekshivyas File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
[P1] Keep the locked-graph identity coherent with the referenced lock. This entry declares
openclaw@2026.9.1, butdirectorypluslockSha256authenticate the exact-head lock whose root dependency and top-level OpenClaw record are both2026.7.1. Once merged, the main/base-image audit runs this configuration against that same tree, andverifyReviewedNpmLockrejects the root before the network audit, blocking every dependent image build. The green PR audit does not cover this transition because it deliberately loads the base commit's audit configuration. For the stated prerequisite-only scope, retain the locked-graph identity at 2026.7.1 while adding separately reviewed 2026.9.1 archive identities; otherwise migrate the runtime package, lock, and all version owners atomically. Add a contract test that loads the committed audit configuration and checks each locked graph's root/top-level identity, SRI, tarball, and digest so the post-merge path cannot diverge again.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Fixed in c62c911. The openclaw-runtime locked graph now remains at 2026.7.1 and matches the referenced committed lock. The 2026.9.1 entries remain candidate archive identities only. A table-driven contract test now runs verifyReviewedNpmLock for every committed locked graph and checks its root version, top-level version, integrity value, registry URL, and lock digest. The focused audit workflow suite passed all 41 cases. The maintainer scope decision is recorded at #11504 (comment).