chore(deps): update dependency openclaw to v2026.6.11 - autoclosed

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
openclaw	2026.6.1 → 2026.6.11

---

Release Notes

openclaw/openclaw (openclaw)

v2026.6.11

Compare Source

v2026.6.10

Compare Source

Automatic fast mode starts short conversations quickly, then returns longer or fallback work to normal mode without losing visible state. Provider routing, channel progress, session identity, and trusted tool policies are more reliable, with smaller improvements spanning provider setup, diagnostics, and transcript tooling.

Highlights

Automatic fast mode

• Adds /fast auto so short conversational calls can start quickly, while longer or fallback work returns to normal mode with the effective state still visible. PR #​85104, Issue #​85087. Thanks @​alexph-dev and @​vincentkoc.
• Shows the effective automatic fast-mode state in status instead of reducing it to on/off, and avoids carrying a cleared Codex service-tier choice into later runs. 8845f2f. Thanks @​vincentkoc.
• Keeps automatic fast-mode timing consistent when a turn switches to a fallback model. 075091d. Thanks @​vincentkoc.
• Keeps the original fast-mode timing and progress behavior when a live model switch retries a turn. d1e190f. Thanks @​vincentkoc.
• Keeps automatic fast-mode progress and reset behavior distinct from explicit fast mode after a run switches modes. 20aec98. Thanks @​vincentkoc.
• Shows the effective fast-mode value in connected-agent sessions instead of the configured value, so status reflects what the session is actually using. 9509aa0. Thanks @​vincentkoc.
• Keeps the effective automatic fast-mode setting visible through fallback transitions in connected-agent sessions. 7f5423c. Thanks @​vincentkoc.
• Keeps automatic fast-mode timing and progress consistent when reply and scheduled-agent runs retry or switch models. 6c29f88. Thanks @​vincentkoc.
• Keeps fast-mode cleanup and status consistent when a run switches between fallback models. c4694f8. Thanks @​vincentkoc.
• Shows the automatic fast-mode reset only when fallback work is finished, so status messages match the end of the transition. f4d93c8. Thanks @​vincentkoc.
• Shows reset and delivery progress at the right time when auto-reply or other follow-up runs retry or leave automatic fast mode. 684e440. Thanks @​vincentkoc.

Channels and Messaging

Channel delivery and progress updates

• Prevents the next turn after a scheduled message from losing what was delivered or whether delivery failed, so replies can use that context without exposing cron details in the channel. PR #​93580. Thanks @​jalehman and @​scotthuang.
• Prevents streamed channel progress from dropping a repeated status that represents a separate step, so each meaningful step remains visible in the draft. 2d42e52. Thanks @​vincentkoc.
• Prevents keyed streamed progress from staying on an older status, so viewers see the latest state instead of stale text. 8bb6472. Thanks @​vincentkoc.

Providers and Models

Provider model catalogs and reasoning controls

• Treats Zhipu/GLM overload responses as overloads, so a configured fallback is selected for the right reason instead of following the wrong failover path. PR #​93241, Issue #​93211. Thanks @​0xghost42 and @​zhengli0922.
• Prevents Telegram, Slack, and Discord /think menus for live Ollama models from hiding supported levels, so users can choose valid reasoning settings without guessing. PR #​94067, Issue #​93835. Thanks @​civiltox and @​openperf.
• Expands zai/glm-5.2 thinking choices beyond binary on/off and sends high or max requests as the intended Z.AI reasoning effort. PR #​94136. Thanks @​borclaw.
• Prevents bundled Z.ai GLM-5 models from falling through to OpenAI and producing misleading API-key errors, so they use Z.AI by default. PR #​94461, Issue #​94269. Thanks @​chrysb and @​pandah97.
• Adds GLM-5.2 and Kimi K2.7 Code to the OpenCode Go catalog with current limits, so users can select the models from OpenClaw. 66f84a9. Thanks @​samson1357924.
• Corrects kimi-k2.7-code capability listings so OpenCode Go users are not offered unsupported video prompts when the model accepts text and images. 715dc71.

Provider plugin onboarding

• Prevents first-run setup from skipping the selected provider's credential prompt after plugin installation, so onboarding continues with that provider instead of falling back to OpenAI. PR #​95792, Issue #​95765. Thanks @​snowzlmbot.

Memory, Sessions, and State

Session transcript SDK helpers

• Adds a durable session-transcript SDK contract so plugins can read, append, publish, and lock the intended transcript without treating legacy file paths as identity. PR #​95030. Thanks @​jalehman.

Cross-channel session identity

• Prevents a shared direct-message session from carrying the previous channel's identity after a switch, so status, reactions, threads, and message references target the current channel. PR #​95328, Issue #​95325. Thanks @​gorkem2020, @​jalehman, and @​zengwen-dt.

Gateway, Security, and Trust

Prompt context boundaries

• Keeps empty prompts separate from hook-added context during compaction or session reuse in Copilot and Codex sessions, so prompt boundaries remain consistent. PR #​94838. Thanks @​vincentkoc.

Trusted tool policy enforcement

• Keeps approval-sensitive Gateway and plugin tools protected when connected extensions change, so configured safeguards continue to apply. PR #​94545. Thanks @​jesse-merhi.

Trusted package redirects

• Prevents authenticated package-source tokens from being sent to an allowed redirect on another origin, while the valid redirected download still completes. b0df6dc.

Clients and Interfaces

Docker and Podman setup timeouts

• Prevents Docker and Podman setup from running unbounded on hosts where GNU timeout is installed as gtimeout, so image pulls, builds, and detached startup receive the intended guard. 62b2e9e.

Plugins and Packaging

Codex service-tier clearing

• Prevents cleared Codex service tiers from being persisted as explicit stale state, so resumed or switched conversations use the normal default instead. cd32d9f. Thanks @​vincentkoc.

StepFun provider installation

• Restores ClawHub discovery for the StepFun provider plugin, so operators can install it through either ClawHub or npm. ecb82f1. Thanks @​vincentkoc.

Docs and Operator Workflows

Doctor check ordering

• Keeps core openclaw doctor diagnostics in their normal order before extension checks, making lint and repair output easier to follow. PR #​86627. Thanks @​giodl73-repo.

v2026.6.9

Compare Source

Highlights

• Richer Telegram delivery: Telegram now sends rich HTML, preserves rich markdown and sticker paths, renders progress drafts and command output more faithfully, normalizes HTML tables safely, and keeps mentions and spooled handlers on the right delivery path. (#​93286, #​93164, #​93124, #​93364, #​93130, #​93002, #​93088, #​93281, #​94891, #​94856) Thanks @​obviyus, @​vincentkoc, @​goutamadwant, @​kesslerio, @​NianJiuZst, @​SweetSophia, @​Marvinthebored, @​aaajiao, @​zhangguiping-xydt, @​zhangqueping, and @​jairrab.
• More dependable agent recovery: retries, terminal outcomes, usage after compaction, session history repair, and reply reconciliation now keep more interrupted or partial turns moving toward a visible final result. (#​92191, #​93073, #​93228, #​93084, #​93469, #​93291, #​90943) Thanks @​ai-hpc, @​lml2468, @​fuller-stack-dev, @​Hollychou924, @​leno23, @​de1tydev, @​425072024, @​wuwahe3, @​drvoss, @​yetval, @​sandieman2, and @​vincentkoc.
• A stronger Codex integration: Codex gains automatic plugin approvals, GPT-5.3 Spark OAuth routing, remote-node exec as a dynamic tool, and more reliable app-server teardown and terminal outcomes. (#​92625, #​89133, #​93654, #​91767, #​93287) Thanks @​kevinslin, @​VACInc, @​vincentkoc, @​JPKay-AI, and @​aliahnaf2013-max.
• Standalone official provider plugins: external provider packages are now first-class npm releases, externally installed channel plugins load at Gateway startup, and StepFun is available from npm and ClawHub. (#​93470) Thanks @​sunlit-deng, @​cxdnicole, and @​vincentkoc.
• More capable web and native clients: the Control UI adds a session workspace rail and extension health, iOS adds Watch controls, and Android shows chat context. (#​92856, #​91952, #​93387, #​92837) Thanks @​Solvely-Colin, @​jalehman, @​joshavant, and @​Tosko4.
• More useful search and skills: Codex Hosted Search is available, key-free search providers remain deliberate opt-ins, and ClawHub skill installs retain verified source provenance. (#​93446, #​93616, #​93283, #​93506) Thanks @​fuller-stack-dev, @​davemorin, @​momothemage, @​nmccready-tars, and @​vincentkoc.

Changes

• Providers and auth: add Codex Hosted Search, improve Gemini CLI OAuth behind proxies, and keep external provider onboarding on current choices and package metadata. (#​93446, #​92815) Thanks @​fuller-stack-dev, @​yetval, @​EvetteYoung, and @​vincentkoc.
• Plugins and installs: externalized official providers publish as independent npm packages, Gateway discovers installed channel plugins at startup, and StepFun installs from npm or ClawHub. (#​93470) Thanks @​sunlit-deng, @​cxdnicole, and @​vincentkoc.
• Dashboard and mobile: add a session workspace rail, plugin health in status, compact cron lists, and iOS Watch controls. (#​92856, #​91952, #​93395, #​93387) Thanks @​Solvely-Colin, @​jalehman, @​yu-xin-c, @​centralpc, @​joshavant, and @​vincentkoc.
• Codex, observability, and skills: add automatic plugin approvals and SecretRefs, preserve ClawHub skill provenance, add OpenTelemetry log export, and expose remote-node execution to Codex when a node is connected. (#​92625, #​94324, #​93283, #​94561, #​93654) Thanks @​kevinslin, @​kevinlin-openai, @​momothemage, @​nmccready-tars, @​jesse-merhi, @​vincentkoc, and @​JPKay-AI.
• QA and release engineering: QA scenarios now use YAML, with broader profile evidence and release coverage for the plugin and channel matrix. Thanks @​vincentkoc.

Fixes

• Security and privacy: redact secrets from debug/config output, block internal HTTP session overrides, audit open-DM tool exposure, and retain plugin write ownership checks. (#​93333, #​88496, #​93443, #​92883, #​93353) Thanks @​Alix-007, @​jason-allen-oneal, @​coygeek, @​RichardCao, @​yu-xin-c, @​cjg20ss, @​eleqtrizit, and @​vincentkoc.
• Agent and session runtime: retry thinking-only and empty post-tool turns, prevent duplicate hook execution, preserve pending subagent delivery, preserve fresh usage through compaction, and repair partial JSON/history artifacts. (#​92191, #​93073, #​93009, #​93084, #​93469, #​94349, #​92383, #​94257) Thanks @​ai-hpc, @​lml2468, @​fuller-stack-dev, @​zenglingbiao, @​dertbv, @​Hollychou924, @​leno23, @​de1tydev, @​425072024, @​wuwahe3, @​drvoss, @​vincentkoc, @​sallyom, @​oiGaDio, @​Hidetsugu55, and @​Nas01010101.
• Channels and replies: fix Telegram rich delivery, table rendering, action-error handling, progress draft cleanup before visible tool output, and ingress recovery; preserve command progress detail across channel adapters; retain WhatsApp opening text after a media failure; keep Mattermost thread replies intact; and harden Discord action handling. (#​93286, #​93364, #​93281, #​93002, #​93076, #​93334, #​93424, #​93488, #​94868, #​94891, #​94856, #​94810, #​93823) Thanks @​obviyus, @​NianJiuZst, @​mcaxtr, @​zhangguiping-xydt, @​rushindrasinha, @​amknight, @​lzyyzznl, @​darealgege, @​vincentkoc, @​zhangqueping, @​jairrab, @​ZOOWH, @​parveshsaini, and @​yetval.
• Storage and migrations: avoid SQLite WAL on network filesystems, clean reindex artifacts, keep setup state out of workspace dot-directories, and import default-agent auth profiles into SQLite. (#​93454, #​92891, #​93182, #​93295, #​93520, #​93156) Thanks @​vincentkoc, @​ZengWen-DT, @​Zeng-wen, @​potterdigital, @​Alix-007, @​Pick-cat, @​sallyom, @​1qh, and @​Tazio7.
• Provider and model behavior: fix Gemini CLI proxy OAuth, restore Codex Spark OAuth routing, correct Bedrock embedding model IDs, and preserve configured defaults in embedded runs. (#​92815, #​89133, #​93452, #​93428) Thanks @​yetval, @​EvetteYoung, @​VACInc, @​LiuwqGit, @​aleck31, @​zenglingbiao, @​danielgerlag, and @​vincentkoc.
• CLI, TUI, and apps: accept global flags after subcommands, keep terminal output and activity indicators visible, preserve CJK IME composition, and refresh stale UI state. (#​93455, #​93460, #​93006, #​93427, #​93498, #​93606) Thanks @​ooiuuii, @​Alix-007, @​ZengWen-DT, @​Zeng-wen, @​AlethiaQuizForge, @​Zhaoqj2016, @​liuhao1024, @​BrianClaw1955, @​vincentkoc, and @​NicoBoom13.
• Operations and updates: harden official plugin recovery, restart managed Gateways after failed update handoff, keep safe cron delivery defaults, avoid Node-specific npm prefixes, and keep package validation paths reliable. (#​93325, #​92111, #​93650, #​94453, #​91685) Thanks @​vincentkoc, @​yetval, @​ofan, @​yaanfpv, @​jincheng-xydt, @​sallyom, @​davectr, and @​nxmxbbd.

Complete contribution record

This audited record covers the complete v2026.6.8..HEAD history: 423 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #​92154 fix(qqbot): gate private group commands and close strict command visibility gaps. Thanks @​sliverp.
• PR #​90463 refactor: add session accessor seam with gateway consumer. Thanks @​jalehman.
• PR #​88656 Drop reasoning-only length turns from replay. Thanks @​abel-zer0.
• PR #​92856 feat(webui): add session workspace rail. Thanks @​Solvely-Colin.
• PR #​92845 docs(browser-control): document OPENCLAW_EAGER_BROWSER_CONTROL_SERVER requirement. Related #​92841. Thanks @​liuhao1024 and @​jeugregg.
• PR #​82366 fix: use passive periodic sqlite wal checkpoints. Related #​81715. Thanks @​honor2030 and @​KrasimirKralev.
• PR #​92815 fix(google): route Gemini CLI OAuth through the env proxy (#​46184). Thanks @​yetval and @​EvetteYoung.
• PR #​91331 fix(mattermost): merge progress preview lines by identity. Related #​89761. Thanks @​iloveleon19 and @​leonthe8th and @​vincentkoc.
• PR #​92909 fix(tui): keep spinner active when toggling tools. Related #​49763. Thanks @​ZengWen-DT and @​Zeng-wen and @​vincentkoc and @​CrimsonDump.
• PR #​92904 fix(elevenlabs): use current TTS model ids. Thanks @​vortexopenclaw and @​vincentkoc.
• PR #​92642 fix #​86872: Subagent run reports success but fails to write output file. Thanks @​zhangguiping-xydt and @​vincentkoc and @​zapper35.
• PR #​89122 refactor: route command session reads through seam. Thanks @​jalehman.
• PR #​90943 fix(reply): deliver final reply when queued follow-up claims session; scope dedupe to routed thread. Thanks @​sandieman2 and @​vincentkoc.
• PR #​92894 fix(skills): keep managed prompt paths readable. Related #​92875. Thanks @​kesslerio and @​sallyom.
• PR #​39617 fix: reload config in slash command routing so dmScope is respected. Related #​39605. Thanks @​Ciward.
• PR #​92191 fix(agents): retry thinking-only errored turns. Related #​91953. Thanks @​ai-hpc and @​lml2468.
• PR #​92891 fix(memory): clean stale reindex temp files. Related #​92874. Thanks @​ZengWen-DT and @​Zeng-wen and @​vincentkoc and @​potterdigital.
• PR #​93005 Add OpenRouter Fusion guidance and prompt context. Related #​92984. Thanks @​sallyom.
• PR #​88792 fix(state): harden sqlite path caching. Thanks @​vincentkoc.
• PR #​93022 fix(gateway): repair usage cost aggregation across agents. Thanks @​luke-skywalker-open-claw and @​stablegenius49.
• PR #​93020 fix(telegram): cool down transient sendChatAction failures. Related #​56096. Thanks @​Boulea7 and @​sumaiazaman and @​Pick-cat and @​cal-rufus.
• PR #​93002 fix(telegram): clear progress drafts before visible tool output. Thanks @​zhangguiping-xydt.
• PR #​89160 fix(agents): detect truncated API responses to prevent silent session hang. Related #​89051. Thanks @​joelnishanth and @​ArthurusDent.
• PR #​93009 fix(agents): make wrapToolWithBeforeToolCallHook idempotent to prevent double hook execution (fixes #​92973). Thanks @​zenglingbiao and @​dertbv.
• PR #​92991 fix(agents): tolerate missing attribution baseUrl. Related #​92974. Thanks @​samrusani and @​Haderach-Ram.
• PR #​92913 fix(opencode-go): register model catalog to fix context window detection. Related #​92912. Thanks @​kumaxs.
• PR #​89129 refactor: route bundled plugin session callers through seam. Thanks @​jalehman.
• PR #​93084 fix(agents): preserve fresh usage after compaction. Related #​50795. Thanks @​Hollychou924 and @​leno23 and @​de1tydev and @​425072024 and @​vincentkoc and @​wuwahe3.
• PR #​92869 fix #​90333: [Bug]: Discord image build aborts at step 66 — openclaw-build-messaging-plugins.py exits 1. Thanks @​zhangguiping-xydt and @​vincentkoc and @​chriskosys.
• PR #​93011 fix(gateway): accept file-only input on /v1/responses (parity with image-only). Thanks @​yetval and @​vincentkoc.
• PR #​92915 Convert QA scenarios to YAML files. Thanks @​RomneyDa.
• PR #​91767 Fix one-shot Codex app-server teardown. Thanks @​aliahnaf2013-max.
• PR #​92625 feat(codex): add auto plugin approvals. Thanks @​kevinslin.
• PR #​91587 test(qa): add qa run --qa-profile and unified output summary/evidence. Thanks @​RomneyDa.
• PR #​93104 test(reply): seed channel fixtures for dedupe tests. Thanks @​RomneyDa.
• PR #​93107 test(reply): preserve telegram dedupe fallback. Thanks @​RomneyDa.
• PR #​92954 fix(memory): accept local default model path migration. Thanks @​mushuiyu886 and @​vincentkoc.
• PR #​90936 fix(agents): do not misclassify client-disconnect abort as run timeout. Related #​90764. Thanks @​openperf and @​reginaldomarcilon.
• PR #​90812 fix(voice-call): preserve live Twilio streams in stale reaper. Related #​79121. Thanks @​Takhoffman and @​sahibzada-allahyar and @​donkeykong91.
• PR #​93094 fix(whatsapp): bound socket operations. Thanks @​mcaxtr.
• PR #​91629 fix(scripts): add database-first legacy store guard. Related #​91628. Thanks @​galiniliev.
• PR #​93124 fix(telegram): render progress drafts as rich previews. Thanks @​Marvinthebored.
• PR #​93109 test(qa): embed profile scorecard evidence. Thanks @​RomneyDa.
• PR #​87298 test: add temp directory helper guidance. Thanks @​hxy91819.
• PR #​92318 fix(cron): require explicit message target proof. Thanks @​hxy91819.
• PR #​93137 fix(imessage): honor disabled reply actions. Related #​92142. Thanks @​omarshahine and @​dprev.
• PR #​93134 fix(feishu): pass card_msg_content_type to get full card content (fixes #​78289). Thanks @​liuhao1024 and @​vincentkoc and @​longdoubled7.
• PR #​93138 fix(agents): preserve literal current session resolution. Thanks @​liuhao1024 and @​vincentkoc.
• PR #​91225 fix #​83830: [Bug]: Dreaming diary repeats "first day" narrative every sweep — same early memories dominate snippets. Thanks @​mushuiyu886 and @​YinLiuLiu66.
• PR #​93153 simplify QA evidence profile and mappings/coverage shape. Thanks @​RomneyDa.
• PR #​93164 fix(telegram): preserve rich markdown line breaks. Thanks @​vincentkoc.
• PR #​93119 fix: accept mixed source/dist bundled roots. Related #​87730. Thanks @​arkyu2077 and @​vincentkoc and @​jasonftl.
• PR #​93130 fix(telegram): preserve sticker media paths. Related #​83748. Thanks @​goutamadwant and @​vincentkoc and @​aaajiao.
• PR #​93073 fix(agents): retry empty post-tool final turns. Thanks @​fuller-stack-dev.
• PR #​91784 fix(voice-call): require realtime websocket path boundary. Thanks @​jason-allen-oneal.
• PR #​89133 Restore GPT-5.3 Codex Spark OAuth routing. Thanks @​VACInc.
• PR #​91996 refactor: prune unused iOS code. Thanks @​zats.
• PR #​90231 fix #​69443: [Bug] Subagent RPC callback to WeChat session key routed to main session instead. Thanks @​zhangguiping-xydt and @​sliverp and @​chen11221.
• PR #​89920 fix(matrix): replace recovered command progress lines. Thanks @​bdjben and @​jesse-merhi.
• PR #​93159 fix(tui): keep parent stdin paused after exit. Thanks @​fuller-stack-dev.
• PR #​93201 fix(auto-reply): clear pending-final state before honoring post-send abort (#​89115). Thanks @​amknight and @​danashburn.
• PR #​93228 fix(agents): replace prose terminal classifiers. Thanks @​fuller-stack-dev.
• PR #​93231 fix(status): correct pinned model clear hint. Thanks @​hxy91819.
• PR #​92428 fix(qqbot): keep markdown table chunks valid. Thanks @​sliverp.
• PR #​93220 fix(status): avoid stale session context windows. Thanks @​hxy91819.
• PR #​91957 perf(sessions): share one enumeration across archive retention sweeps. Thanks @​amknight.
• PR #​93281 fix(telegram): recover pid-reused ingress claims. Thanks @​obviyus.
• PR #​93287 fix(codex): preserve terminal outcome ordering.
• PR #​93182 fix(memory): clean rollback-journal reindex temp sidecar on NFS stores. Thanks @​Alix-007.
• PR #​93283 Persist ClawHub skill install provenance. Related #​92077. Thanks @​momothemage and @​nmccready-tars.
• PR #​88872 fix: attribute spawned task runs to child agent. Related #​66670. Thanks @​Alix-007 and @​Neomail2.
• PR #​92837 fix(android): show live chat context usage. Thanks @​Tosko4.
• PR #​93325 fix(cli): harden official plugin recovery. Thanks @​vincentkoc.
• PR #​93286 feat(telegram): send rich messages as rich html. Thanks @​obviyus.
• PR #​92910 fix(memory-core): safely refresh qmd index during collection repair.
• PR #​93329 fix(cli): allow zero Discord timeout duration. Related #​93327. Thanks @​rohitjavvadi.
• PR #​91625 fix(cron): add cron edit --clear-model to clear a job's model override. Thanks @​ly-wang19.
• PR #​91691 [AI] fix(memory): prevent empty-string expectedModel in resolveMemory…. Thanks @​xydt-tanshanshan.
• PR #​93006 fix(tui): keep stderr visible when local shell stdout fills the output cap. Thanks @​Alix-007.
• PR #​93001 fix(daemon): prefer stderr over stale stdout in gateway restart diagnostics. Thanks @​Alix-007.
• PR #​91117 refactor: remove dead code and improve string concatenation. Thanks @​Pommelle.
• PR #​90893 fix(models): mask paste-token input in CLI auth prompt. Thanks @​anurag-bg-neu.
• PR #​90571 fix(configure): mask gateway password input in CLI wizard prompt. Thanks @​anurag-bg-neu.
• PR #​91768 fix(ios): respect chat header safe area. Thanks @​zats.
• PR #​93245 fix(cron): resolve lastRunStatus in cron list/show human output. Thanks @​ly-wang19.
• PR #​78765 fix(tui): avoid inserting spaces into long CJK text. Thanks @​hpt.
• PR #​91776 fix(ios): refresh permission rows after grants. Thanks @​zats.
• PR #​92817 fix(cron): trust agent output when channel is unresolved without explicit delivery. Related #​90664. Thanks @​fsdwen and @​dertbv.
• PR #​93297 fix(control-ui): respect agents.defaults.timeFormat for timestamps. Related #​58147. Thanks @​ZengWen-DT

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	1.82s
✅ EDITORCONFIG	editorconfig-checker	1		0	0	0.26s
✅ JSON	jsonlint	1		0	0	0.38s
✅ JSON	npm-package-json-lint	yes		no	no	0.35s
✅ JSON	v8r	1		0	0	7.47s
✅ REPOSITORY	git_diff	yes		no	no	0.26s
✅ REPOSITORY	secretlint	yes		no	no	0.7s
✅ REPOSITORY	syft	yes		no	no	3.71s
✅ REPOSITORY	trivy	yes		no	no	8.74s
✅ REPOSITORY	trivy-sbom	yes		no	no	1.12s
✅ REPOSITORY	trufflehog	yes		no	no	23.45s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff