chore(deps): bump brace-expansion and openclaw

[dependabot]

Bumps brace-expansion and openclaw. These dependencies needed to be updated together.
Updates brace-expansion from 5.0.5 to 5.0.9

Commits

• fbcf8ec 5.0.9
• f6f3939 test: cover dropping empties when only some prefixes are empty
• 688a99e Merge commit from fork
• c66e5f9 docs: make the maxLength example produce a non-empty result (#137)
• 473d3e9 Bump linkify-it from 5.0.1 to 5.0.2 (#128)
• 96a63c0 5.0.8
• a1bd339 Merge commit from fork
• 592a36f Bump tar from 7.5.16 to 7.5.20 (#127)
• bd14690 Bump brace-expansion from 2.0.2 to 2.1.2 (#126)
• e729ba6 Bump ws from 8.19.0 to 8.21.1 (#124)
• Additional commits viewable in compare view

Updates openclaw from 2026.4.10 to 2026.7.1-2

Release notes

Sourced from openclaw's releases.

openclaw 2026.7.1-beta.6

2026.7.1

Highlights

• New models and providers: add Featherless, Claude Sonnet 5 and Mythos 5, Meta Muse Spark 1.1, and ClawRouter; make GPT-5.6 the new-setup default with /think ultra for Sol and Terra plus max for Luna, honor Z.AI max, and refresh model availability after OAuth renewal. (#101092, #98254, #101238, #102873, #103070, #103163, #99658, #99759, #98333, #103581, #98021, #104778, #102289) Thanks @​vincentkoc, @​vortexopenclaw, @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, @​steipete-oai, @​bdjben, @​obviyus, @​sallyom, @​anyech, @​100yenadmin, and @​fuller-stack-dev.
• Control UI and native macOS chat: make sessions primary with a minimal searchable sidebar, compact context ring, reasoning-effort slider, cleaner dashboard chrome, and a native macOS session browser with model and thinking pickers, slash commands, transcript export, and context usage. (#99289, #99838, #100386, #101103, #101497)
• Conversational onboarding: Crestodian now runs a real agent-loop setup across the CLI, web install, and macOS app, with AI-guided provider setup, model-judged approvals bound to exact operations, masked credential prompts, and deterministic fallback when no model is available. (#99935, #100029, #100656, #101887) Thanks @​fuller-stack-dev.
• Offline and spoken mobile chat: iOS and Android now pre-paint bounded per-gateway session and transcript caches offline; Apple Watch gains full voice turns, and iOS can speak replies through configured Gateway TTS with on-device fallback. (#100219, #100227, #100283, #100770, #100771)
• Session organization and generated titles: generate concise session titles through utility-model routing and add Gateway-backed groups, unread state, rename, fork, archive, and delete controls, plus group management across web, iOS, and Android. (#87643, #100814, #101117, #101234) Thanks @​zhangguiping-xydt and @​Juliangsm.
• Telegram and Codex continuity: pair Codex through private /login, steer active runs with /steer and /tell, preserve messages when transcript acknowledgement is missing, adopt durable turns safely, and recover final sends across Telegram formatting and flood-wait failures. (#98006, #98126, #98786, #103664, #103916) Thanks @​100yenadmin, @​Kyzcreig, @​obviyus, and @​jalehman.
• Startup and upgrade recovery: run container migrations before Gateway readiness, stop recoverable legacy state from blocking startup, and enter control-plane-safe mode after repeated unclean boots instead of restart flapping. (#101881, #104529) Fixes #98565 Thanks @​sallyom, @​jacobtomlinson, @​bdjben, @​obviyus, and @​shakkernerd.

Changes

• Meta provider: add bundled muse-spark-1.1 Responses API support with streaming, tool calls, encrypted reasoning replay, onboarding, exact-model live validation, and standalone npm/ClawHub distribution as @openclaw/meta-provider. (#102873, #103070, #103163) Thanks @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, and @​vincentkoc.

• Android chat agent selector: switch the active agent directly from the live chat screen while keeping chat, Talk mode, and home canvas on the same canonical session. (#80422) Thanks @​bcperry and @​joshavant.

• Gateway host status: show the connected Gateway's host, network address, OS, runtime, uptime, CPU, memory, and disk details in Control UI Settings. (#100478)

• Gateway crash-loop recovery: persist boot outcomes, enter control-plane-safe mode after repeated unclean starts, hold transport and provider activation until recovery, and exit with EX_CONFIG for fatal configuration errors so systemd and launchd stop restart flapping. Thanks @​obviyus.

• iOS offline chat: pre-paint recent sessions and canonical transcripts from a protected, bounded per-gateway cache, keep sending disabled offline, and purge cached conversation text when pairing is reset. (#100219)

• Slack progress indicators: use Slack's native assistant thread status and rotating loading messages by default while keeping acknowledgement reactions static; lifecycle reaction updates now require messages.statusReactions.enabled: true.

• Control UI Talk controls: keep voice, model, sensitivity, and other realtime defaults in Settings → Communications → Talk, and use the composer microphone caret to select any browser audio input. (#101046)

• Cron model selection: choose an agent-turn model in Control UI Quick Create and show configured or default models in cron job rows and details. (#95341) Thanks @​ly85206559.

• Control UI GitHub previews: show issue and pull request state, title, author, activity, comments, and change statistics in hover and keyboard-focus cards. (#100434)

• Logbook work journal: add a disabled-by-default bundled plugin that turns paired-node screen snapshots into a private timeline, daily standup, and timeline-grounded Q&A in a plugin-contributed Control UI tab. (#99930)

• Control UI message context: reveal per-message token, context, and model details from the timestamp on hover or activation instead of showing a separate Context button.

• Control UI session titles: reveal truncated recent-session names with a reduced-motion-safe hover animation.

• Control UI sidebar navigation: show a small customizable pinned destination set, keep the remaining pages under More, move Settings to the footer, and persist sidebar customization in the browser. (#100296) Thanks @​vincentkoc.

• Control UI sidebar usage: remove the provider usage quota row from the expanded sidebar while keeping usage details available in the chat composer and Usage page. Thanks @​shakkernerd.

• Android chat code highlighting: render fenced Kotlin, Swift, TypeScript, JavaScript, Python, Bash, and JSON blocks with bounded, theme-aware syntax colors while preserving plain rendering for unknown, partial, or oversized blocks. (#100217)

• Gateway TTS playback: add an operator-scoped tts.speak RPC that returns configured-provider speech as inline whole-clip audio for remote clients. (#100770)

• Control UI context usage: show context-window progress, latest-run input/output tokens, and the active model when the chat context ring is opened.

• Apple Watch voice turns: dictate a message from the Watch chat and hear the new OpenClaw reply spoken on the Watch, with explicit silent-message and stop-speaking controls. (#100224) Thanks @​vincentkoc.

• Conversational onboarding: add a real agent-loop Crestodian setup flow across the CLI, Gateway, web install, and macOS app, with typed operations, exact approval binding, masked credential prompts, isolated session transcripts, and safe handoff to the normal agent. Thanks @​vincentkoc.

• Generated session titles: name new Control UI sessions from their first message, and add default/per-agent utilityModel routing for lower-cost session, topic, and thread title generation. Thanks @​Juliangsm, @​zhangguiping-xydt, and @​vincentkoc.

• ClawRouter routing and quotas: add the bundled ClawRouter provider plugin with credential-scoped dynamic model discovery, OpenAI-compatible and native Anthropic/Gemini transports, and managed budget reporting across OpenClaw usage surfaces. (#99658)

• Model and provider coverage: add GPT-5.6 support, use Nemotron Super's 1M context window, and preserve explicit OpenRouter authentication headers. (#98333, #98726, #98187) Thanks @​steipete-oai, @​eleqtrizit, @​sunlit-deng, @​laurencebrown, and @​shakkernerd.

• CLI and node workflows: add openclaw attach, node context-path support, actionable device-approval recovery guidance, soft-resume CLI sessions when prompt metadata changes, and clearer plugin install exit diagnostics. (#96454, #97679, #98115, #98146, #98497, #99822) Thanks @​anagnorisis2peripeteia, @​obviyus, @​wm0018, @​welfo-beo, @​RomneyDa, @​Sanjays2402, and @​vincentkoc.

• Cron and usage: add exit-triggered schedules, detached session-targeted runs, and an in-flight job doctor warning, while making the existing usage footer easier to wrap on Telegram. (#92037, #98755, #98620, #92877) Thanks @​anagnorisis2peripeteia, @​obviyus, @​EthanSK, @​masatohoshino, @​Marvinthebored, and @​vincentkoc.

• Native apps and localization: modernize iOS presentation, Chat, Talk, onboarding, and reconnect flows; add Gateway speech providers; improve QR onboarding and protocol recovery; install the local Gateway from macOS; localize core Apple and Android surfaces; and add Swedish mobile localization. (#98452, #98736, #99243, #98376, #98302, #98385, #99767, #97110, #97111, #97112, #97113, #98043) Thanks @​jcooley8, @​Tony-ooo, @​joelnishanth, @​cursoragent, @​joshavant, @​vincentkoc, and @​yeager.

• Messaging capabilities: add native iMessage polls, Telegram Codex pairing and steering, Telegram multi-lane progress summaries, and Signal target aliases. (#98421, #98006, #98126, #98907, #95738) Thanks @​omarshahine, @​lobster, @​100yenadmin, @​Kyzcreig, @​Marvinthebored, and @​jesse-merhi.

• Local inference and chat controls: auto-discover Ollama inference nodes, add Control UI session-first navigation, reasoning controls, and command picking, and keep OpenClaw control tools available when deferred tool search selects the wrong tool family. (#99234, #99289, #99426, #99838, #99561) Thanks @​100yenadmin, @​joshavant, @​VicZhang6, @​Solvely-Colin, and @​vincentkoc.

• Doctor and diagnostics: expose auth-profile, workspace, device-pairing, channel-plugin, memory-provider, systemd exhaustion, and Windows LAN firewall findings. (#97125, #97358, #97366, #97496, #97968, #98291, #98666) Thanks @​giodl73-repo, @​masatohoshino, and @​joshavant.

• Policy repair previews: show review-required Gateway bind and denied node-command changes during doctor --fix without applying them or counting the findings as repaired. (#99776) Thanks @​giodl73-repo.

• Conversation and review controls: prepare scoped conversation capability profiles and add Cursor Agent as an autoreview engine. (#98536, #97348) Thanks @​hxy91819.

Fixes

• Codex runtime switching: accept the bundled Codex runtime for both codex/* and openai/* model routes while keeping unsupported provider/runtime pairs rejected. (#103762)

... (truncated)

Commits

• See full diff in compare view

Install script changes

This version adds preinstall script and modifies prepare script that run during installation. Review the package contents before updating.

Attestation changes

This version has no provenance attestation, while the previous version (2026.4.10) was attested. Review the package versions before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Assignees

The following users could not be added as assignees: exampleuser. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Large PR Detected

This PR is quite large (18148 lines changed across 1 files).

Consider breaking it into smaller PRs for easier review:

• ✅ Smaller PRs are reviewed faster
• ✅ Easier to identify bugs
• ✅ Safer to revert if needed

If this is intentional (refactor, major feature), feel free to ignore.

[github-actions]

🔍 Quality Preview

The full CI pipeline is running. Expected checks:

Check	Status
TypeScript	🔄 Running
ESLint	🔄 Running
Tests	🔄 Running
Coverage	🔄 Running

Check the CI workflow for details.

[github-actions]

This PR has been automatically marked as stale due to inactivity.

If this PR is still being worked on:

• Push new commits or add a comment
• Apply the pinned label

Otherwise, it will be closed in 7 days.