chore(deps): bump openclaw/clawhub/.github/workflows/package-publish.yml from 0.12.0 to 0.20.0

[dependabot]

Bumps openclaw/clawhub/.github/workflows/package-publish.yml from 0.12.0 to 0.20.0.

Release notes

Sourced from openclaw/clawhub/.github/workflows/package-publish.yml's releases.

clawhub 0.20.0

0.20.0 - 2026-06-06

Changes

• CLI/API: replace local clawhub scan uploads with stored submitted-version scan report downloads, including owner-authorized clawhub scan download <name> --version <version> support for blocked skill and plugin submissions.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.20.0
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.20.0.tgz
• integrity: sha512-iOkDmFwjGgznPoRQV6ERCfhfJ2Xwdy7JHDTSxxsWcLUfv7FX1drLIQQOpMIZmPfg9G3R9P7RhBN5AFlNcL/P6w==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/27077674748
• npm publish: https://github.com/openclaw/clawhub/actions/runs/27077690357

clawhub 0.19.2

0.19.2 - 2026-06-05

Fixes

• CLI: accept the legacy clawhub skill verify --json flag as a hidden compatibility no-op while continuing to print JSON by default.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.19.2
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.19.2.tgz
• integrity: sha512-9pAE2iylrOuJSmeP+rlSnjTj68xUziaCutqOBbpcB+WmNiDek5ay2mc3UNwSUBlMclb2bSBEWNeZSckQ+Ivqgg==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/27045531597
• npm publish: https://github.com/openclaw/clawhub/actions/runs/27045559478

clawhub 0.19.1

0.19.1 - 2026-06-05

Fixes

• CLI: install source-backed GitHub skills from the deployed /api/v1/skills/:slug/install resolver so clawhub install works for skills without hosted ClawHub versions.

Release Proof

• npm: https://www.npmjs.com/package/clawhub/v/0.19.1
• tarball: https://registry.npmjs.org/clawhub/-/clawhub-0.19.1.tgz
• integrity: sha512-CLaA6h+I5ccT0BwieaC9FVtNBT0mc7srwtGRn2Gz4TKCvN3BNjiCq5A2z5byCinKrScMlRup02pDj2j0h2wGqQ==
• npm preflight: https://github.com/openclaw/clawhub/actions/runs/26991633072
• npm publish: https://github.com/openclaw/clawhub/actions/runs/26991665201

clawhub 0.19.0

0.19.0 - 2026-06-03

Changes

... (truncated)

Changelog

Sourced from openclaw/clawhub/.github/workflows/package-publish.yml's changelog.

0.20.0 - 2026-06-06

Changes

• CLI/API: replace local clawhub scan uploads with stored submitted-version scan report downloads, including owner-authorized clawhub scan download <name> --version <version> support for blocked skill and plugin submissions.

0.19.2 - 2026-06-05

Fixes

• CLI: accept the legacy clawhub skill verify --json flag as a hidden compatibility no-op while continuing to print JSON by default.

0.19.1 - 2026-06-05

Fixes

• CLI: install source-backed GitHub skills from the deployed /api/v1/skills/:slug/install resolver so clawhub install works for skills without hosted ClawHub versions.

0.19.0 - 2026-06-03

Changes

• CLI/API: add authenticated clawhub scan submit/poll support for ephemeral local skill bundles and owner-authorized published skill scans, including JSON output and report ZIP downloads (#2479).

Fixes

• Auth/Ops: keep GitHub account-age lookups on immutable numeric IDs, retry without auth when a configured GitHub token is rejected, and add an operator backfill for missing cached account ages.
• API/CLI: report Skill Card verification with flattened skill/version metadata, ClawScan verdict fields at security.*, and supporting scanner evidence under security.signals.

0.18.0 - 2026-05-25

Changes

• CLI/API: add Skill Card verification surfaces, including clawhub skill verify <slug> JSON output and --card Markdown retrieval (#2382).
• Web/API: surface an "API key required" attribute on skills so listings, cards, and detail views show whether a skill needs an LLM API key, with publish-time inference from skill prompts and metadata (#2353) (thanks @​momothemage).

Fixes

• API: fix GET /api/v1/skills pagination so cursor advances to the next page instead of repeating the first page for supported non-trending sorts (#2275) (thanks @​vyctorbrzezowski, @​enerj).
• Web: block collaborative membership on personal publishers while allowing the linked owner to clean up stale extra membership rows (thanks @​vyctorbrzezowski).
• Security/API: hide owned package/plugin catalog entries, revoke package publish tokens, and restore only matching ban-hidden packages on user unban (thanks @​vyctorbrzezowski).
• API: block public raw skill files when moderation already blocks downloads and reject skill tags that point at another skill's version (thanks @​vyctorbrzezowski).
• Web: stop stale unban restore batches from reactivating skills after the owner is banned again or deactivated (thanks @​vyctorbrzezowski).
• Security/API: reject direct skill owner transfers when the skill is hidden, suspicious, or malicious (thanks @​vyctorbrzezowski).
• Security/API: revalidate package publish actor, owner, and owner publisher active state in the final release insert (thanks @​vyctorbrzezowski).

0.17.0 - 2026-05-19

• CLI/API: add self-serve org publisher creation with clawhub publisher create <handle> and scoped package publish errors that point to the command.

... (truncated)

Commits

• 8e1bad4 feat: improve account appeal notifications (#2520)
• 8f7c21a test: cover account recreation after deletion (#2540)
• 999131e fix: purge auth-locked deleted accounts
• 571cc70 test: limit local-auth playwright retries (#2538)
• 3ead985 fix: restore post-merge CI gates (#2537)
• 1117aa4 feat: add cohort temporal abuse scoring (#2536)
• 9ce5e70 feat: hard delete account-owned resources (#2533)
• c632b69 fix: hide banned user publisher profiles (#2528)
• d2525b1 fix: stop copying publisher ids to skill embeddings (#2532)
• 8ebae39 feat: add temporal publisher abuse scan (#2531)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.