Build DeepSeek Harness from the immutable 0.2.2-rc.1 source and refresh
Caddy, npm, Docker CLI, Buildx and reviewed runtime dependencies.
Accept the expanded Caddy CEL import layout and await the asynchronous
session-log service in smoke checks without changing the opt-out policy.
Redact generated access-token URLs in failure diagnostics.
Repair OpenClaw's Zod 4.6.7 compatibility pin and replace vulnerable Joi
18.2.9 with the integrity-checked 18.3.1 package. Preserve pnpm consumers,
A2UI's v3 entry and the bounded-container protections.
Remove the development-only native compiler retained through optional peers before the final runtime copy. Keep TypeScript 5, fail closed on runtime dependencies or unsafe paths, and retain the existing image security gates.
Upgrade verified MCP SDK/client/core packages together, preserve pnpm dependencies, and check cross-issuer rejection plus normal CJS/ESM operation. Fix CVE-2026-104850 without relaxing the scan policy. Document migration for legacy OAuth credentials.
Support the verified http-cache-semantics 4.3.0 source patch and replace source-map-js with official 1.2.2, with real-package security and compatibility regressions.
Repair CVE-2026-93748 in the actual http-cache-semantics copies with source-hash and runtime regression checks. Keep one exact, expiring scanner exception for the locally patched upstream version. Native build, smoke and security scan passed.
Reject unsafe workstation credentials, fix native ARM64 Java, and remove duplicate extensions, caches and temporary tool layers.
Pin OpenCode's baseline and Gemini's source/runtime inputs; refresh maintained browser and OS packages; fix Nginx and vendored ZIP vulnerabilities. Verify real login, default plugins, browser/CDP persistence and isolated OpenClaw sandbox operations.
Build each platform once and bind release publication to the tested config and manifest digests. Keep service-specific vulnerability gates and refresh DSH APT stages during PR verification.
Validation: all 13 PR verification jobs passed, including native amd64/arm64 workstations and DSH variants, plus both browser variants and OpenClaw on amd64. Publication jobs were skipped for PR verification.
Centralize component inputs and scoped Trivy policies. Replace the Buildx
source patch with compiled package-graph evidence.
Verify native amd64/arm64 images and publish the tested artifacts without
a second build. Add an explicit APT refresh path that reuses source caches.
Replace the brittle release-specific patch with an idempotent semantic Dockerfile transformation. Preserve the upstream package-manager version, reuse an existing npm refresh, and fail closed when required runtime anchors disappear.
Resolve the highest published DSH version, add scheduled component update checks, rebalance the workstation toolset, and retain the existing runtime and workstation targets.
Remove Rust/Cargo, restore pinned npm, add checksum-pinned development tools, build actionlint with the pinned Go toolchain, and reduce the workstation image by about 505 MiB while preserving cross-platform node-pty assets.
Validated by component-pin checks, runtime/workstation builds and smoke tests, dependency audits, Caddy checks, and Trivy gates.
Build committed amd64 runtime and workstation inputs without publishing, then exercise the existing dependency, smoke, Caddy, toolchain, and Trivy gates. Pin the Docker-socket Trivy fallback image by digest across the DeepSeek Harness workflows.
okxlin