chore(deps): bump tar and openclaw

[dependabot]

Removes tar. It's no longer used after updating ancestor dependency openclaw. These dependencies need to be updated together.

Removes tar

Updates openclaw from 2026.4.10 to 2026.7.1

Release notes

Sourced from openclaw's releases.

openclaw 2026.7.1

2026.7.1

OpenClaw v2026.7.1 brings major Control UI and onboarding overhauls, major updates to the official iOS, Android, and macOS apps, expanded model and provider support including GPT-5.6 compatibility, Tencent Hy3, and Meta Muse Spark 1.1, and stronger Codex and connected coding-agent workflows. Telegram, Slack, Discord, and Apple Messages each receive substantial updates, while Gateway crash loops, scheduled work, remote browser control, workspace terminals, sessions, and goals also improve. There are also many general fixes and refinements throughout OpenClaw.

Read the full release notes

This release brings together 3,063 contributions from 532 contributors.

Highlights

• Control UI overhaul: conversations are easier to organize and work with side by side, with live Tasks, clearer chat controls, better usage and cost views, files, downloads, pairing, approvals, and Gateway health kept close to the conversation.
• Easier setup from install to first chat: guided setup provides clearer steps toward a working first chat, checks connections before saving them, and preserves earlier choices when setup is interrupted.
• Official app updates: iOS and iPadOS, Android, and macOS received substantial work across setup, navigation, chat, voice, permissions, localization, files, scheduled work, offline reading, queued sends, connection recovery, and native session controls.
• Models and providers: GPT-5.6 compatibility improves across supported OpenAI and Codex routes, Tencent Hy3 gains a complete setup path, Meta Model API adds Muse Spark 1.1, and broader Claude, Ollama, ClawRouter, LongCat, and provider work expands choice and reliability.
• Codex and connected coding agents: openclaw attach gives Claude Code temporary access to a selected session, Codex delegation and native subagents return tracked results more reliably, Copilot gains broader provider choices, and long-running sessions and goals are easier to resume.
• Telegram: live progress, photos and documents, topics, commands, retries, account routing, setup, and delivery all received substantial work.
• Slack: threads, cards, progress, identity, reactions, and duplicate prevention improve, while longer conversations avoid more unnecessary waits.
• Discord: replies, attachments, voice sessions, progress, reconnects, and multi-account behavior improve, with better unread cues and recovery from repeated session-resume failures.
• Apple Messages: replies, typing, media, routing, setup guidance, and chat continuity improve across supported bridge setups.
• Gateway crashes stop restarting forever: repeatedly failing Gateways now leave a stable repair path instead of restarting indefinitely.
• Scheduled work, remote browser control, and workspace terminals: scheduled work can wake only when something changes, selected signed-in browser tabs can pair remotely and save completed downloads safely, and guarded terminals are available across web, iOS, and Android.

Changes

• Channels and messaging: expanded native capabilities, clearer progress and delivery behavior, stronger media handling, and broader controls across Telegram, Slack, Discord, Signal, WhatsApp, Apple Messages, Teams, Matrix, Feishu, and other channels.
• Models and providers: more models can be discovered, selected, authenticated, and used across cloud, managed, and local routes, with clearer reasoning controls and provider-specific setup.
• Memory, sessions, and state: session groups, titles, unread state, checkpoints, context handling, goals, and recovery paths are more consistent across web, mobile, CLI, and connected agents.
• Tools and automation: browser control, downloads, cron jobs, terminals, files, search, fetch, MCP, and background task workflows gain new capabilities and clearer controls.
• Account, device, and data protection: passwords and tokens stay out of more logs, sensitive controls remain limited to approved users, device pairing is clearer, and unsafe downloads, files, and network requests are blocked earlier.
• Plugins and packaging: bundled and external plugins gain improved installation, discovery, updates, compatibility, diagnostics, and distribution behavior.
• CLI, setup, and administration: onboarding, Doctor, updates, configuration, status, diagnostics, node management, backup, and deployment workflows are easier to inspect and recover.

Fixes

• Chat delivery and replies: messages, progress updates, quoted replies, media, and final results stay tied to the intended conversation more reliably across reconnects, restarts, retries, and channel-specific limits.
• Control UI and native apps: fixes cover session state, stale completions, responsive layouts, scrolling, focus, accessibility, localization, pairing, voice, offline chat, and mobile recovery.
• Gateway and provider reliability: startup, restart, migration, authentication, fallback, streaming, model discovery, and oversized-response failures now stop or recover more cleanly.
• Sessions and memory: transcript, compaction, checkpoint, cache, rotation, search, and persistence fixes reduce lost state, stale views, and cross-session confusion.
• Browser, tools, and automation: browser actions, downloads, fetches, searches, scheduled jobs, terminals, subprocesses, and MCP calls now handle cancellation, malformed input, timeouts, and broken streams more safely.
• Setup, updates, and packaging: installers, containers, plugin updates, runtime checks, temporary files, and platform-specific launch paths receive recovery and compatibility fixes.
• Security and credentials: additional hardening protects tokens, secrets, approval scopes, local paths, network destinations, attachments, archives, and untrusted provider or plugin responses.

Pull requests

The expandable groups below list all 2,018 public and credited pull requests represented in these release notes. Direct commits and detailed contributor credits remain available in the full release notes.

... (truncated)

Commits

• 2d2ddc4 fix(codex): update managed app-server to 0.144.3 [AI] (#106098)
• 2b4232e docs(changelog): refresh 2026.7.1 notes
• e0ce125 test(installer): dedupe cleanup coverage
• 5bbf27e fix(installer): clean temporary files on failure (#103725)
• b2569f9 test(daemon): remove stale release mocks
• d57704f docs(changelog): finalize SQLite runtime safety
• 28db140 fix(installer): validate upgraded Windows SQLite runtime
• c86285f fix(sqlite): reject runtimes vulnerable to WAL corruption (#106065)
• 3010140 docs(changelog): finalize 2026.7.1 stable notes
• 970bbc7 chore(release): prepare 2026.7.1
• Additional commits viewable in compare view

Install script changes

This version adds preinstall script that runs during installation. Review the package contents before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Assignees

The following users could not be added as assignees: exampleuser. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Large PR Detected

This PR is quite large (18146 lines changed across 1 files).

Consider breaking it into smaller PRs for easier review:

• ✅ Smaller PRs are reviewed faster
• ✅ Easier to identify bugs
• ✅ Safer to revert if needed

If this is intentional (refactor, major feature), feel free to ignore.

[github-actions]

🔍 Quality Preview

The full CI pipeline is running. Expected checks:

Check	Status
TypeScript	🔄 Running
ESLint	🔄 Running
Tests	🔄 Running
Coverage	🔄 Running

Check the CI workflow for details.