[superbot-helper]

openclaw is pinned at 0.0.1 at node_modules/openclaw
by the committed package-lock.json (the root manifest declares * under
peerDependencies), inside the affected range of CVE-2026-32922 / GHSA-4jpw-hj22-2xmc.

The advisory names 2026.3.11 as the first patched version.
The root declared range * admits 2026.3.11
(computed), so this is a lockfile-only update: package.json is not touched, and
package-lock.json moves openclaw from
0.0.1 to 2026.9.2.

What changes

• openclaw: 0.0.1 -> 2026.9.2 at every lockfile path (1).
• No manifest is touched; no source file is changed.

Verification

• npm ci --dry-run on the patched lockfile with the unchanged manifest: pass (see verification.json).
• Every lockfile path resolving openclaw is at or above the advisory's
  first patched version 2026.3.11 (node_modules/openclaw @ 2026.9.2 is the built worst copy).
• package.json is byte-identical to the base commit (sha256 3e129af8307a7fd1…).
• Applied to a fresh clone of clawnify/clawflow@b1a857e1865fe5910f6342ff859afc97943445b4, the bundle touches only package-lock.json.
• unrelatedChurn: 4782 lines outside openclaw across 319 lockfile entries: the dependency entries npm ci requires to move with it. No source file is changed.
• Lockfile shape: npm's regenerated lockfile is shipped; the minimal lockfile fails npm ci --dry-run, so the regenerated lockfile is the verified artifact. npm 10.9.9 writes lockfileVersion 3, the repo's own.

Scope

openclaw is declared under peerDependencies (scan scope: runtime).
The affected range and the pinned version come from the picker's cycle-305 scan
report; the change is a dependency update, not a code change.

[superbot-helper]

Withdrawing this one too: #69 already moves openclaw to the same 2026.9.2 in the same package-lock.json, so one satisfies all three advisories. Keeping the earliest PR.