Repository navigation
Highlights: Patch certificate validation in release binaries and verify signed macOS packages on Xcode 27.
-
Build with Go 1.27.3 to fix the reachable GO-2026-6809 crypto/x509 certificate-validation vulnerability while retaining the Go 1.27.1 source minimum.
-
Move macOS CI and release verification to Xcode 27 with Rosetta for x86_64 and retain the existing macOS 13 minimum in both release and npm binaries.
-
Keep mocked scanner/context tests independent of an installed Docker CLI while preserving sandbox enforcement checks.
-
Refresh bundled Cisco, Snyk, Socket, Claude Code, and Codex tools while retaining the existing Node.js and Python runtime floors and two-day dependency cooldown.
-
Preserve Docker sandbox paths containing commas or quotation marks without changing read-only or writable mount permissions. Thanks @SebTardif (#64).
-
Use one shared autoreview installation from
openclaw/agent-skills; repository entrypoints now receive upstream fixes without copied helpers or test suites. -
Use Codex with high reasoning for both bundled ClawHub judges and forward SkillSpector model/reasoning and optional A.I.G reasoning settings into scanner sandboxes.
Verification
- npm: @openclaw/clawscan 0.2.1, published as
latest. - Registry tarball: https://registry.npmjs.org/@openclaw/clawscan/-/clawscan-0.2.1.tgz
- npm integrity:
sha512-N4VFUCSa3o7TudIXGmuii24NkeW4iAcXUlBiNDY0GDtTuIJJRmFQ/Xke8Qmk2uKKt33AYPjx4wYdD6kh3K9fCg== - Exact-source CI, signed release dry run, and release publication passed.
- All six downloaded platform binaries report Go 1.27.3; archive and npm checksums match. Both macOS binaries pass Foundation Developer ID and online notarization checks.
- Homebrew update passed with matching archive checksums; the Go proxy resolves the signed tag.
