chore: update dependencies except carbon

extensions/diagnostics-otel/package.json

@@ -5,15 +5,15 @@
   "type": "module",
   "dependencies": {
     "@opentelemetry/api": "^1.9.0",
-    "@opentelemetry/api-logs": "^0.212.0",
+    "@opentelemetry/api-logs": "^0.213.0",
-    "@opentelemetry/exporter-logs-otlp-proto": "^0.212.0",
+    "@opentelemetry/exporter-logs-otlp-proto": "^0.213.0",
-    "@opentelemetry/exporter-metrics-otlp-proto": "^0.212.0",
+    "@opentelemetry/exporter-metrics-otlp-proto": "^0.213.0",
-    "@opentelemetry/exporter-trace-otlp-proto": "^0.212.0",
+    "@opentelemetry/exporter-trace-otlp-proto": "^0.213.0",
-    "@opentelemetry/resources": "^2.5.1",
+    "@opentelemetry/resources": "^2.6.0",
-    "@opentelemetry/sdk-logs": "^0.212.0",
+    "@opentelemetry/sdk-logs": "^0.213.0",
-    "@opentelemetry/sdk-metrics": "^2.5.1",
+    "@opentelemetry/sdk-metrics": "^2.6.0",
-    "@opentelemetry/sdk-node": "^0.212.0",
+    "@opentelemetry/sdk-node": "^0.213.0",
-    "@opentelemetry/sdk-trace-base": "^2.5.1",
+    "@opentelemetry/sdk-trace-base": "^2.6.0",
     "@opentelemetry/semantic-conventions": "^1.40.0"
   },
   "openclaw": {

extensions/memory-lancedb/package.json

@@ -7,7 +7,7 @@
   "dependencies": {
     "@lancedb/lancedb": "^0.26.2",
     "@sinclair/typebox": "0.34.48",
-    "openai": "^6.25.0"
+    "openai": "^6.27.0"
   },
   "openclaw": {
     "extensions": [

extensions/tlon/package.json

@@ -4,8 +4,8 @@
   "description": "OpenClaw Tlon/Urbit channel plugin",
   "type": "module",
   "dependencies": {
-    "@tloncorp/api": "git+https://github.com/tloncorp/api-beta.git#7eede1c1a756977b09f96aa14a92e2b06318ae87",
+    "@tloncorp/api": "github:tloncorp/api-beta#7eede1c1a756977b09f96aa14a92e2b06318ae87",
-    "@tloncorp/tlon-skill": "0.1.9",
+    "@tloncorp/tlon-skill": "0.2.2",
     "@urbit/aura": "^3.0.0",
     "zod": "^4.3.6"
   },

package.json

@@ -332,10 +332,10 @@
     "ui:install": "node scripts/ui.js install"
   },
   "dependencies": {
-    "@agentclientprotocol/sdk": "0.14.1",
+    "@agentclientprotocol/sdk": "0.15.0",
-    "@aws-sdk/client-bedrock": "^3.1000.0",
+    "@aws-sdk/client-bedrock": "^3.1004.0",
     "@buape/carbon": "0.0.0-beta-20260216184201",
-    "@clack/prompts": "^1.0.1",
+    "@clack/prompts": "^1.1.0",
     "@discordjs/voice": "^0.19.0",
     "@grammyjs/runner": "^2.0.3",
     "@grammyjs/transformer-throttler": "^1.2.1",
@@ -357,11 +357,11 @@
     "cli-highlight": "^2.1.11",
     "commander": "^14.0.3",
     "croner": "^10.0.1",
-    "discord-api-types": "^0.38.40",
+    "discord-api-types": "^0.38.41",
     "dotenv": "^17.3.1",
     "express": "^5.2.1",
     "file-type": "^21.3.0",
-    "grammy": "^1.41.0",
+    "grammy": "^1.41.1",
     "https-proxy-agent": "^7.0.6",
     "ipaddr.js": "^2.3.0",
     "jiti": "^2.6.1",
@@ -390,18 +390,18 @@
     "@lit/context": "^1.1.6",
     "@types/express": "^5.0.6",
     "@types/markdown-it": "^14.1.2",
-    "@types/node": "^25.3.3",
+    "@types/node": "^25.3.5",
     "@types/qrcode-terminal": "^0.12.2",
     "@types/ws": "^8.18.1",
-    "@typescript/native-preview": "7.0.0-dev.20260301.1",
+    "@typescript/native-preview": "7.0.0-dev.20260307.1",
     "@vitest/coverage-v8": "^4.0.18",
     "jscpd": "4.0.8",
     "lit": "^3.3.2",
-    "oxfmt": "0.35.0",
+    "oxfmt": "0.36.0",
-    "oxlint": "^1.50.0",
+    "oxlint": "^1.51.0",
-    "oxlint-tsgolint": "^0.15.0",
+    "oxlint-tsgolint": "^0.16.0",
     "signal-utils": "0.21.1",
-    "tsdown": "0.21.0-beta.2",
+    "tsdown": "0.21.0",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"

src/cli/daemon-cli/install.integration.test.ts

@@ -72,10 +72,11 @@ describe("runDaemonInstall integration", () => {
     runtimeLogs.length = 0;
     runtimeErrors.length = 0;
     vi.clearAllMocks();
-    delete process.env.OPENCLAW_GATEWAY_TOKEN;
+    // Keep these defined-but-empty so dotenv won't repopulate from local .env.
-    delete process.env.CLAWDBOT_GATEWAY_TOKEN;
+    process.env.OPENCLAW_GATEWAY_TOKEN = "";
-    delete process.env.OPENCLAW_GATEWAY_PASSWORD;
+    process.env.CLAWDBOT_GATEWAY_TOKEN = "";
-    delete process.env.CLAWDBOT_GATEWAY_PASSWORD;
+    process.env.OPENCLAW_GATEWAY_PASSWORD = "";
+    process.env.CLAWDBOT_GATEWAY_PASSWORD = "";
     serviceMock.isLoaded.mockResolvedValue(false);
     await fs.writeFile(configPath, JSON.stringify({}, null, 2));
     clearConfigCache();

src/memory/qmd-manager.test.ts

@@ -1626,7 +1626,12 @@ describe("QmdMemoryManager", () => {
 
   it("retries mcporter search with bare command on Windows EINVAL cmd-shim failures", async () => {
     const platformSpy = vi.spyOn(process, "platform", "get").mockReturnValue("win32");
+    const previousPath = process.env.PATH;
     try {
+      const shimDir = await fs.mkdtemp(path.join(tmpRoot, "mcporter-shim-"));
+      await fs.writeFile(path.join(shimDir, "mcporter.cmd"), "@echo off\n");
+      process.env.PATH = `${shimDir};${previousPath ?? ""}`;
+
       cfg = {
         ...cfg,
         memory: {
@@ -1682,6 +1687,7 @@ describe("QmdMemoryManager", () => {
       await manager.close();
     } finally {
       platformSpy.mockRestore();
+      process.env.PATH = previousPath;
     }
   });
 

ui/package.json

@@ -14,7 +14,7 @@
     "@noble/ed25519": "3.0.0",
     "dompurify": "^3.3.2",
     "lit": "^3.3.2",
-    "marked": "^17.0.3",
+    "marked": "^17.0.4",
     "signal-polyfill": "^0.2.2",
     "signal-utils": "^0.21.1",
     "vite": "7.3.1"