From 1f95cbb0d9e4ad9bf0a2a12d86490cd4841740a7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 15 Sep 2026 04:53:33 +0000 Subject: [PATCH 1/2] build(deps): Bump yaml from 2.9.0 to 2.9.1 Bumps [yaml](https://github.com/eemeli/yaml) from 2.9.0 to 2.9.1. - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](https://github.com/eemeli/yaml/compare/v2.9.0...v2.9.1) --- updated-dependencies: - dependency-name: yaml dependency-version: 2.9.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] --- bun.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bun.lock b/bun.lock index d8078aaa..07414b01 100644 --- a/bun.lock +++ b/bun.lock @@ -1274,7 +1274,7 @@ "yallist": ["yallist@3.1.1", "", {}, "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="], - "yaml": ["yaml@2.9.0", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA=="], + "yaml": ["yaml@2.9.1", "", { "bin": { "yaml": "bin.mjs" } }, "sha512-3NxN8+78OdzbT7C/WjGsyfPAtJaN3FNDsWxv7Y7mcDsT/oOmgW8BpyQQFFBnvZE3j9Y2Sdz1ULFLezL7Eb2yFw=="], "yocto-queue": ["yocto-queue@0.1.0", "", {}, "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q=="], From 49f2b1c8e60f266183d22a688f281368998c9e35 Mon Sep 17 00:00:00 2001 From: NiveditJain Date: Tue, 15 Sep 2026 10:38:37 +0530 Subject: [PATCH 2/2] build(deps): Bump rustls from 0.23.43 to 0.23.45 (RUSTSEC-2026-0285) OSV-Scanner flags rustls 0.23.43 (RUSTSEC-2026-0285, CVSS 5.3, fixed in 0.23.45), which fails the Supply Chain gate on main and on every PR. rustls is transitive-only, via reqwest in failproofaid and fpai-collect. `cargo update -p rustls --precise 0.23.45` also moves rustls-webpki 0.103.13 -> 0.103.15, which the new rustls requires. Also opens the 1.0.6-beta.0 changelog section for this PR's entry. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_017HpjSQY3i7mJj9UWHXgacg --- CHANGELOG.md | 6 ++++++ Cargo.lock | 18 +++++++++--------- 2 files changed, 15 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac3d7328..2b4e197a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,11 @@ # Changelog +## 1.0.6-beta.0 — 2026-09-15 + +### Dependencies + +- yaml 2.9.0 → 2.9.1, and rustls 0.23.43 → 0.23.45 (with rustls-webpki 0.103.13 → 0.103.15) in `Cargo.lock`, closing RUSTSEC-2026-0285 (5.3, fixed in 0.23.45). The advisory turned the Supply Chain gate red on `main` itself, not through any PR's change; rustls is transitive-only, via `reqwest` in `failproofaid` and `fpai-collect` (#803) + ## 1.0.5 — 2026-09-13 Stable OpenClaw 2026.9 compatibility release, validated against default profiles, named profiles, multiple agents, live policy enforcement, local dashboard rendering, and end-to-end ingestion. diff --git a/Cargo.lock b/Cargo.lock index 5d5d3bd0..bc17f05d 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -197,7 +197,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] @@ -1028,7 +1028,7 @@ dependencies = [ "once_cell", "socket2", "tracing", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] @@ -1240,14 +1240,14 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] name = "rustls" -version = "0.23.43" +version = "0.23.45" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0283386ce02abc0151e1761d08802dfe86c173b0b494af5cbc086574e453da06" +checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634" dependencies = [ "once_cell", "ring", @@ -1269,9 +1269,9 @@ dependencies = [ [[package]] name = "rustls-webpki" -version = "0.103.13" +version = "0.103.15" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e" +checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2" dependencies = [ "ring", "rustls-pki-types", @@ -1490,7 +1490,7 @@ dependencies = [ "getrandom 0.4.3", "once_cell", "rustix", - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]] @@ -1905,7 +1905,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.52.0", + "windows-sys 0.60.2", ] [[package]]