chore(deps-dev): bump openclaw from 2026.6.1 to 2026.6.5

[dependabot]

Bumps openclaw from 2026.6.1 to 2026.6.5.

Release notes

Sourced from openclaw's releases.

openclaw 2026.6.5

2026.6.5

Highlights

• Safer channel output: QQBot strips model reasoning and thinking scaffolding before native delivery, so users see the final answer rather than raw internal markup. (#89913, #90132) Thanks @​openperf, @​dygg2001, @​Takhoffman, and @​vincentkoc.
• MCP results no longer poison sessions: resource_link, audio, malformed images, and future non-text blocks are normalized before provider conversion, avoiding Anthropic 400s and broken follow-up history. (#90710, #90728) Thanks @​RanSHammer, @​849261680, and @​Takhoffman.
• Anthropic extended thinking recovers after restarts: prompt-cache expiry and early-signature failures wait for a real message start, so they reach the existing retry path rather than ending a turn. (#90667, #90697) Thanks @​openperf, @​MIHHHMIH, @​Takhoffman, @​vincentkoc, @​itsuzef, and @​mcaxtr.
• Parallel web search is bundled: API-key discovery, guarded endpoint handling, cache-safe session IDs, onboarding, and documentation make it a first-class search provider. (#85158) Thanks @​NormallyGaussian.
• Better Matrix and Vertex reliability: Matrix voice notes and threaded conversations retain their context, while Google Vertex ADC models regain static catalog and runtime resolution. (#78016, #90415, #90506, #90609) Thanks @​849261680, @​frankdierolf, and @​paulogogs.
• Safer upgrades and restarts: cron JSON stores migrate before runtime, service env placeholders stop masking secrets, and macOS avoids unnecessary direct-Gateway reconnect churn. (#90072, #90208, #90668, #90815) Thanks @​MonkeyLeeT, @​sallyom, @​vrurg, @​wlassalle724, @​jalehman, @​Takhoffman, @​zhangguiping-xydt, @​joshavant, and @​vincentkoc.

Changes

• Search/providers: add the Parallel bundled web-search plugin, registration contracts, onboarding integration, and guarded api.parallel.ai/v1/search support. (#85158) Thanks @​NormallyGaussian and @​vincentkoc.
• Matrix/channels: add voice-message preflight and thread-aware read/reply behavior. (#78016, #90415) Thanks @​frankdierolf.
• Skills/ClawHub: install ClawHub skills backed by GitHub repositories through the resolved install API, download the pinned GitHub commit, keep install-policy checks, and report install telemetry after success. (#90478) Thanks @​Patrick-Erichsen, @​vincentkoc, @​itsuzef, and @​mcaxtr.
• Google Chat/channels: add native approval card actions and click handling so Google Chat approvals use platform-native cards instead of generic message flow.
• Mobile: Android provider/model screens now surface expiring, unavailable, unresolved, and attention states more clearly, while iOS settings and Talk tabs keep diagnostics, gateway rows, attachment labels, and unavailable Talk controls reachable. Thanks @​joshavant and @​shakkernerd.
• Memory: QMD search can use the new rerank toggle, and memory adapter status uses the resolved default model identity when checking plain status. (#61834) Thanks @​kouka-t0yohei and @​vincentkoc.
• QQBot: add /bot-group-allways on|off slash command (with named-account and default-account support) to toggle whether group messages require an @mention before the bot replies, and clear the runtime config snapshot after the write so the new account-level defaultRequireMention takes effect immediately without restart. (#91423) Thanks @​cxyhhhhh, @​joshavant, @​vincentkoc, @​itsuzef, @​mcaxtr, and @​jacobtomlinson.

Fixes

• Agents: sessions_send now honors an explicit sessionKey when stale label metadata is also present, and denied session-id sends no longer echo the resolved canonical session key. Fixes #64699; refs #74009 and #41199 Thanks @​Mintalix, @​RevisitMoon, @​Mocha-s, @​chouxiaozi1989, @​sunxq1017-hash, @​vincentkoc, and @​joshavant.
• Channel content boundaries: QQBot now strips reasoning/thinking tags before sending, preserving final answers while hiding internal model narration from users. (#89913, #90132) Thanks @​openperf, @​Takhoffman, @​dygg2001, and @​vincentkoc.
• Agents/MCP/providers: coerce non-text/image MCP tool-result blocks before they reach provider converters, preserving valid images and turning richer MCP content into text instead of malformed image blocks. (#90710, #90728) Thanks @​RanSHammer, @​849261680, @​Takhoffman, @​vincentkoc, and @​LiuwqGit.
• Anthropic/Codex/ACP/agent recovery: defer Anthropic stream start events until message_start, strip stale compaction thinking signatures before Anthropic replay, detect unsigned thinking-only stalls, refresh prompt fences after compaction writes, reject empty completion handoffs, preserve parent streaming-off overrides/shared progress commentary, forward heartbeat metadata to context-engine hooks, and cover Codex session/thread migration edge cases. (#90667, #90697, #90163, #90108, #89874, #89505, #90632, #89302, #90729, #90317, #90319) Thanks @​openperf, @​100yenadmin, @​ooiuuii, @​johnib, @​Takhoffman, @​MIHHHMIH, @​dexiosmb, @​zenglingbiao, @​jalehman, @​huangxun375-stack, @​holgergruenhagen, @​vincentkoc, @​joshavant, and @​ArthurusDent.
• Provider/model resolution: preserve Google Vertex ADC auth markers in generated catalogs, re-probe a single-provider primary after cooldown, share Codex model visibility, fail closed for unknown model auth, preserve Codex alias availability, keep unresolved profile refs unknown, and avoid resolving auth while listing models. (#90506, #90609, #90717, #90702) Thanks @​849261680, @​paulogogs, @​brtkwr, and @​vincentkoc.
• Gateway/macOS/mobile: avoid duplicate Gateway probe warnings by identity, rate-limit node pairing requests while preserving paired-node reconnects, keep macOS node mode on a healthy direct Gateway session, keep iOS diagnostics and gateway rows reachable, and avoid Linux ARM Gradle resource tasks during Android builds. (#85791, #90147, #90668, #90815) Thanks @​giodl73-repo, @​vrurg, @​pgondhi987, @​Takhoffman, @​zhangguiping-xydt, @​vincentkoc, @​joshavant, and @​shakkernerd.
• TUI/chat/Workboard/auto-reply: optimistic user messages stay stable across stale history reloads, runId reassignment, and abort windows instead of disappearing, jumping, or lingering as ghost rows; Workboard stale lifecycle bulk updates no longer overwrite newer status/provenance; message-tool sends now count as delivery. (#86205, #89600, #88592, #90123) Thanks @​RomneyDa, @​BunsDev, @​kzclaw, @​mcaxtr, @​vincentkoc, @​joshavant, and @​LiuwqGit.
• Cron/update/service env: doctor config preflight now migrates legacy cron JSON stores into SQLite before runtime reads, service env planning skips unresolved placeholders that would mask state-dir .env values, and session transcript rewrites keep registry markers/discriminants consistent. (#90072, #90208, #90277, #90488) Thanks @​MonkeyLeeT, @​sallyom, @​Kvikkulf, @​jalehman, @​wlassalle724, @​shakkernerd, and @​vincentkoc.
• Security/config/tooling: guard MCP HTTP redirects, protect global agent config defaults, and keep malformed operational limits bounded and explicit. (#89732, #90145) Thanks @​pgondhi987, @​vincentkoc, and @​joshavant.
• Channels: WhatsApp restarts when per-account config changes, bounds background startup waits, closes failed sockets, and preserves reconnect behavior; Mattermost slash commands keep their state on globalThis; Feishu streaming cards preserve full merged content; voice-call tracks Twilio streams after connect; ClickClack reply tools respect toolsAllow. (#87951, #87965, #90486, #68113, #90534, #90181, #90607, #89500) Thanks @​MukundaKatta, @​mcaxtr, @​infoanton, @​mushuiyu886, @​sahibzada-allahyar, @​borntobefree2-cmyk, @​Takhoffman, @​mmaps, @​MMMMSSSS8899, @​ly85206559, @​sliverp, @​vincentkoc, @​joshavant, @​LiuwqGit, @​itsuzef, @​wjm7220, and @​donkeykong91.
• Feishu: retry transient send rate-limit errors (HTTP 429, per-chat code 230020, tenant-level code 11232) with linear backoff, including SDK responses that fulfill with rate-limit bodies instead of throwing, and route streaming-card sends through the retry wrapper. (#89659) Thanks @​ladygege, @​AxelHu, @​marshallm-create, @​sliverp, @​joshavant, @​vincentkoc, @​itsuzef, and @​mcaxtr.
• Memory: keep doctor REM harness previews aligned with live REM by dropping short-term recall snippets whose source files disappeared before rendering preview output. Thanks @​samzong, @​frankekn, and @​vincentkoc.

Complete contribution record

This audited record covers the complete v2026.6.2-beta.1..v2026.6.5 history: 142 merged PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

• PR #89102 refactor(auth): store auth profiles in SQLite.
• PR #90028 docs: clarify legacy openai-codex auth. Thanks @​jalehman.
• PR #89600 Fix Workboard status persistence. Related #88592. Thanks @​BunsDev and @​kzclaw.
• PR #90067 fix(workboard): isolate stale lifecycle bulk patches. Thanks @​BunsDev.
• PR #88585 Pin official npm plugin install records. Thanks @​zhuisDEV.
• PR #90053 fix: hide Skill Workshop revision handoff from chat. Thanks @​shakkernerd.
• PR #90123 fix(auto-reply): count message tool sends as delivery. Thanks @​mcaxtr.

... (truncated)

Commits

• 5181e4f chore(release): prep 2026.6.5 stable
• 8b2937b fix(mattermost): keep default replies in existing threads
• 810a821 fix(release): harden Parallels smoke validation
• 1514dc7 test(release): refresh beta prompt snapshots
• 53fcfb5 docs(release): update beta 6 changelog
• 5f42bfb fix(release): avoid rescue pre-read for active session stores
• db71170 fix(release): allow QA capability restore patch
• cd50c56 chore(release): prepare 2026.6.5 beta 6
• d71d3d5 fix(release): restore beta sqlite sessions on downgrade
• a2f95d5 docs(release): update beta changelog
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

🦙 MegaLinter status: ✅ SUCCESS

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ COPYPASTE	jscpd	yes		no	no	1.75s
✅ EDITORCONFIG	editorconfig-checker	1		0	0	0.31s
✅ JSON	jsonlint	1		0	0	0.38s
✅ JSON	npm-package-json-lint	yes		no	no	0.33s
✅ JSON	v8r	1		0	0	7.17s
✅ REPOSITORY	git_diff	yes		no	no	0.27s
✅ REPOSITORY	secretlint	yes		no	no	0.7s
✅ REPOSITORY	syft	yes		no	no	3.44s
✅ REPOSITORY	trivy	yes		no	no	8.92s
✅ REPOSITORY	trivy-sbom	yes		no	no	1.19s
✅ REPOSITORY	trufflehog	yes		no	no	22.91s

See detailed report in MegaLinter reports
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff