chore(deps): bump pdfjs-dist and openclaw

[dependabot]

Removes pdfjs-dist. It's no longer used after updating ancestor dependency openclaw. These dependencies need to be updated together.

Removes pdfjs-dist

Updates openclaw from 2026.4.10 to 2026.7.1-2

Release notes

Sourced from openclaw's releases.

openclaw 2026.7.1-2

Fixes

• npm plugin updates: accept singleton-array metadata from newer npm clients so tracked official plugins can install and update to correction releases. (#108336)

openclaw 2026.7.1-1

Fixes

• Codex progress replies: keep app-server turns running after delivered progress messages so GPT/Codex reaches its authoritative terminal response instead of stopping mid-turn. (#106961, #108487) Thanks @​joshavant.
• Memory Core startup repair: recover derived legacy-index and cache-sidecar conflicts without trapping the Gateway in a fatal restart loop, while keeping structural vector-store corruption retryable. (#107220, #108652) Thanks @​goutam-adwant.
• WSL state permissions: tolerate EROFS from guarded chmod operations only when the existing state path is already private, preserving fail-closed handling for broad permissions. (#108250, #108258)
• Legacy migration recovery: keep reviewed migration residue nonfatal during startup instead of blocking otherwise healthy upgrades. (#106101)
• Managed plugin updates: recover stale npm lock metadata so official managed plugins can update cleanly. (#107294, #107866)

openclaw 2026.7.1-beta.6

2026.7.1

Highlights

• New models and providers: add Featherless, Claude Sonnet 5 and Mythos 5, Meta Muse Spark 1.1, and ClawRouter; make GPT-5.6 the new-setup default with /think ultra for Sol and Terra plus max for Luna, honor Z.AI max, and refresh model availability after OAuth renewal. (#101092, #98254, #101238, #102873, #103070, #103163, #99658, #99759, #98333, #103581, #98021, #104778, #102289) Thanks @​vincentkoc, @​vortexopenclaw, @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, @​steipete-oai, @​bdjben, @​obviyus, @​sallyom, @​anyech, @​100yenadmin, and @​fuller-stack-dev.
• Control UI and native macOS chat: make sessions primary with a minimal searchable sidebar, compact context ring, reasoning-effort slider, cleaner dashboard chrome, and a native macOS session browser with model and thinking pickers, slash commands, transcript export, and context usage. (#99289, #99838, #100386, #101103, #101497)
• Conversational onboarding: Crestodian now runs a real agent-loop setup across the CLI, web install, and macOS app, with AI-guided provider setup, model-judged approvals bound to exact operations, masked credential prompts, and deterministic fallback when no model is available. (#99935, #100029, #100656, #101887) Thanks @​fuller-stack-dev.
• Offline and spoken mobile chat: iOS and Android now pre-paint bounded per-gateway session and transcript caches offline; Apple Watch gains full voice turns, and iOS can speak replies through configured Gateway TTS with on-device fallback. (#100219, #100227, #100283, #100770, #100771)
• Session organization and generated titles: generate concise session titles through utility-model routing and add Gateway-backed groups, unread state, rename, fork, archive, and delete controls, plus group management across web, iOS, and Android. (#87643, #100814, #101117, #101234) Thanks @​zhangguiping-xydt and @​Juliangsm.
• Telegram and Codex continuity: pair Codex through private /login, steer active runs with /steer and /tell, preserve messages when transcript acknowledgement is missing, adopt durable turns safely, and recover final sends across Telegram formatting and flood-wait failures. (#98006, #98126, #98786, #103664, #103916) Thanks @​100yenadmin, @​Kyzcreig, @​obviyus, and @​jalehman.
• Startup and upgrade recovery: run container migrations before Gateway readiness, stop recoverable legacy state from blocking startup, and enter control-plane-safe mode after repeated unclean boots instead of restart flapping. (#101881, #104529) Fixes #98565 Thanks @​sallyom, @​jacobtomlinson, @​bdjben, @​obviyus, and @​shakkernerd.

Changes

• Meta provider: add bundled muse-spark-1.1 Responses API support with streaming, tool calls, encrypted reasoning replay, onboarding, exact-model live validation, and standalone npm/ClawHub distribution as @openclaw/meta-provider. (#102873, #103070, #103163) Thanks @​HamidShojanazeri, @​davemorin, @​Solvely-Colin, @​jalehman, and @​vincentkoc.

• Android chat agent selector: switch the active agent directly from the live chat screen while keeping chat, Talk mode, and home canvas on the same canonical session. (#80422) Thanks @​bcperry and @​joshavant.

• Gateway host status: show the connected Gateway's host, network address, OS, runtime, uptime, CPU, memory, and disk details in Control UI Settings. (#100478)

• Gateway crash-loop recovery: persist boot outcomes, enter control-plane-safe mode after repeated unclean starts, hold transport and provider activation until recovery, and exit with EX_CONFIG for fatal configuration errors so systemd and launchd stop restart flapping. Thanks @​obviyus.

• iOS offline chat: pre-paint recent sessions and canonical transcripts from a protected, bounded per-gateway cache, keep sending disabled offline, and purge cached conversation text when pairing is reset. (#100219)

• Slack progress indicators: use Slack's native assistant thread status and rotating loading messages by default while keeping acknowledgement reactions static; lifecycle reaction updates now require messages.statusReactions.enabled: true.

• Control UI Talk controls: keep voice, model, sensitivity, and other realtime defaults in Settings → Communications → Talk, and use the composer microphone caret to select any browser audio input. (#101046)

• Cron model selection: choose an agent-turn model in Control UI Quick Create and show configured or default models in cron job rows and details. (#95341) Thanks @​ly85206559.

• Control UI GitHub previews: show issue and pull request state, title, author, activity, comments, and change statistics in hover and keyboard-focus cards. (#100434)

• Logbook work journal: add a disabled-by-default bundled plugin that turns paired-node screen snapshots into a private timeline, daily standup, and timeline-grounded Q&A in a plugin-contributed Control UI tab. (#99930)

• Control UI message context: reveal per-message token, context, and model details from the timestamp on hover or activation instead of showing a separate Context button.

• Control UI session titles: reveal truncated recent-session names with a reduced-motion-safe hover animation.

• Control UI sidebar navigation: show a small customizable pinned destination set, keep the remaining pages under More, move Settings to the footer, and persist sidebar customization in the browser. (#100296) Thanks @​vincentkoc.

• Control UI sidebar usage: remove the provider usage quota row from the expanded sidebar while keeping usage details available in the chat composer and Usage page. Thanks @​shakkernerd.

• Android chat code highlighting: render fenced Kotlin, Swift, TypeScript, JavaScript, Python, Bash, and JSON blocks with bounded, theme-aware syntax colors while preserving plain rendering for unknown, partial, or oversized blocks. (#100217)

• Gateway TTS playback: add an operator-scoped tts.speak RPC that returns configured-provider speech as inline whole-clip audio for remote clients. (#100770)

• Control UI context usage: show context-window progress, latest-run input/output tokens, and the active model when the chat context ring is opened.

• Apple Watch voice turns: dictate a message from the Watch chat and hear the new OpenClaw reply spoken on the Watch, with explicit silent-message and stop-speaking controls. (#100224) Thanks @​vincentkoc.

... (truncated)

Commits

• 0790d9f fix(plugins): accept singleton npm view metadata
• 81ac4f3 docs: add 2026.7.1-1 release notes
• 6987ed4 fix(state): tolerate guarded WSL EROFS chmod failures
• f47a2e0 fix(memory): recover derived sidecar conflicts
• ad80754 fix(codex): continue turns after progress replies
• 0129eb5 fix: recover managed npm lock metadata (#107294)
• 311d9bc fix(release): keep reviewed migration residue nonfatal (#106101)
• 09229c7 feat(macos): refresh DMG installer artwork (#107149)
• 2b294a0 fix(chat): keep proof decision out of actor closure
• 2d2ddc4 fix(codex): update managed app-server to 0.144.3 [AI] (#106098)
• Additional commits viewable in compare view

Install script changes

This version adds preinstall script and modifies prepare script that run during installation. Review the package contents before updating.

Attestation changes

This version has no provenance attestation, while the previous version (2026.4.10) was attested. Review the package versions before updating.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Assignees

The following users could not be added as assignees: exampleuser. Either the username does not exist or it does not have the correct permissions to be added as an assignee.

Labels

The following labels could not be found: npm. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[github-actions]

⚠️ Large PR Detected

This PR is quite large (18146 lines changed across 1 files).

Consider breaking it into smaller PRs for easier review:

• ✅ Smaller PRs are reviewed faster
• ✅ Easier to identify bugs
• ✅ Safer to revert if needed

If this is intentional (refactor, major feature), feel free to ignore.

[github-actions]

🔍 Quality Preview

The full CI pipeline is running. Expected checks:

Check	Status
TypeScript	🔄 Running
ESLint	🔄 Running
Tests	🔄 Running
Coverage	🔄 Running

Check the CI workflow for details.