[dependabot]

Bumps @openclaw/carapace from v0.6.2 to v0.6.3.

Release notes

Sourced from @​openclaw/carapace's releases.

v0.6.3

0.6.3 — 2026-10-20

Highlights: Recover safely from malformed chart hover data, with refreshed preview dependencies and Bun 1.4.3 validation.

• Prevent malformed chart hover data from throwing during pointer movement, and allow initialization after empty or invalid data is corrected.
• Route official OpenClaw support to the support forum.
• Update the pinned Bun toolchain to 1.4.3 while retaining Bun 1.3.0 compatibility.
• Update the terminal preview library to 0.3.10, Lucide to 1.59.0, React to 19.3.1, and CodeQL to 4.39.0; add a manual release validation that packs without publishing. Thanks @​dependabot[bot].
• Update Lucide to 1.57.0 for the preview icon library. Thanks @​dependabot[bot].
• Update Vite to 8.3.3 for HTML and development-server fixes, and Lucide to 1.53.0. Thanks @​dependabot[bot].
• Update the terminal preview library to 0.3.9, Lucide to 1.52.0, and Vite to 8.3.2. Thanks @​dependabot[bot].
• Refresh the terminal preview, icons, Vite, and CodeQL dependencies. Thanks @​dependabot[bot].
• Refresh preview dependencies and the Bun toolchain, update CodeQL, and correct the Pages artifact action version labels.

Changelog

Sourced from @​openclaw/carapace's changelog.

0.6.3 — 2026-10-20

Highlights: Recover safely from malformed chart hover data, with refreshed preview dependencies and Bun 1.4.3 validation.

• Prevent malformed chart hover data from throwing during pointer movement, and allow initialization after empty or invalid data is corrected.
• Route official OpenClaw support to the support forum.
• Update the pinned Bun toolchain to 1.4.3 while retaining Bun 1.3.0 compatibility.
• Update the terminal preview library to 0.3.10, Lucide to 1.59.0, React to 19.3.1, and CodeQL to 4.39.0; add a manual release validation that packs without publishing. Thanks @​dependabot[bot].
• Update Lucide to 1.57.0 for the preview icon library. Thanks @​dependabot[bot].
• Update Vite to 8.3.3 for HTML and development-server fixes, and Lucide to 1.53.0. Thanks @​dependabot[bot].
• Update the terminal preview library to 0.3.9, Lucide to 1.52.0, and Vite to 8.3.2. Thanks @​dependabot[bot].
• Refresh the terminal preview, icons, Vite, and CodeQL dependencies. Thanks @​dependabot[bot].
• Refresh preview dependencies and the Bun toolchain, update CodeQL, and correct the Pages artifact action version labels.

Commits

• c3d76bc chore(release): prepare 0.6.3
• c792b6b build(deps): update Bun to 1.4.3
• 93a85c1 docs: route official OpenClaw support to the support forum (#103)
• 610086e build(deps): refresh preview dependencies and CodeQL (#102)
• 09d3707 ci: make ClawSweeper dispatch keyless (OIDC intake)
• f822352 build(deps): update Lucide to 1.57.0
• 5463792 build(deps-dev): bump lucide (#97)
• 8bacd4d build(deps): bump actions/create-github-app-token (#96)
• c49c89c build(deps-dev): bump the development group with 2 updates (#94)
• 3c22cdd build(deps): bump the actions group with 2 updates (#95)
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

Codex review: needs maintainer review before merge.

What this changes

Updates the dashboard’s Carapace dependency to 0.6.3 and consolidates Better Auth’s JOSE dependency onto 6.2.13.

Example: An operator opens the dashboard after installing the updated dependencies.

• Before: Dashboard styles come from Carapace 0.6.2.
• After: Dashboard styles come from Carapace 0.6.3; the consumed CSS is unchanged.

Review scores

Measure	Result	What it means
Overall readiness	🐚 platinum hermit (4/6)	A compatible maintenance update supported by source inspection and passing head checks, with no actionable findings.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; source comparison verifies unchanged consumed CSS, and existing checks pass without constituting live runtime proof.
Patch quality	🐚 platinum hermit (4/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: The dashboard remains pinned to an older stable release of its shared design-system dependency.
Reason: This follows the established dependency-upgrade path without adding product behavior, configuration, or a parallel implementation.

Merge readiness

✅ Ready for maintainer review

Keep this PR open: main still uses Carapace 0.6.2, and this compatible dependency update has no actionable findings and passing checks for the reviewed head.

Priority: P3
Reviewed head: cb1ba136d9dedcbde754c8862fe99248d7ae6f32

Before merge

None.

Findings

None.

Agent review details

How this fits together

The dashboard imports Carapace CSS through Vite to render operator controls, while the workspace lockfile also resolves JOSE for Worker authentication.

flowchart LR
  A[Workspace lockfile] --> B[Carapace CSS]
  B --> C[Vite dashboard build]
  C --> D[Operator browser]
  A --> E[JOSE]
  E --> F[Worker authentication]

Loading

Technical review

Best possible solution:

Land the compatible dependency update through the existing repository checks and normal merge process.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance; the upstream malformed-hover defect is outside the dashboard’s imported CSS surface.

Is this the best way to solve the issue?

The existing Git-tag dependency and generated lockfile are the appropriate owners for this update, and the consumed CSS contract remains unchanged.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 7d6ec50510d6.

Provenance checked

• Carapace dependency ownership keeps the original intent (9907718: Consume canonical upstream styles instead of maintaining copied tokens, making later upgrades a version bump.)
• Carapace 0.6.2 pin keeps the original intent (59f724c: Refresh compatible dependencies while preserving runtime support, SDK exports, schema, and dependency cooldown.)
• Better Auth JOSE resolution keeps the original intent (7d6ec50: Refresh compatible dependencies while keeping Better Auth runtime and schema generator aligned.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

What I checked:

• Exact introduced change and current main: The pinned diff changes only the dashboard manifest and lockfile; current main remains at Carapace 0.6.2. (apps/admin/package.json:14, cb1ba136d9de)
• Actual dependency consumption: The dashboard imports Carapace tokens, themes, typography, and component CSS; no Carapace chart JavaScript import was found, establishing the relevant dependency contract and policy scope. (apps/admin/src/app.css:7, 7d6ec50510d6)
• Consumer compatibility and supply chain: The release comparison contains no CSS changes; package export paths and the Bun minimum remain unchanged, with no added install lifecycle hook. The annotated v0.6.3 tag resolves to the exact commit pinned in the lockfile. The dependency’s full root AGENTS.md was read. (package.json, c3d76bc75504)
• JOSE consolidation: The base already resolves the API’s direct JOSE dependency to 6.2.13; this PR removes the separate 6.2.12 resolution used by Better Auth without changing Better Auth or database schema versions. (pnpm-lock.yaml:98, 7d6ec50510d6)
• Authentication dependency review: The 6.2.13 release documents terminology alignment and preservation of underlying error causes; inspected verification and remote-JWKS hunks do not introduce an authorization fallback or relax signature validation. (src/jwks/remote.ts, 316b7f2cb41b)
• Feature history and original intent: The Carapace integration originated in commit 9907718 and merged in feat: consume Carapace as the design system for the admin console #44 to replace copied styles with upstream assets; chore(deps): refresh workspace and GitHub Actions dependencies #85 subsequently advanced it to 0.6.2. Some older blobs prevent complete local blame, but the introduction diff and merged PR rationale were independently read. (apps/admin/package.json:14, 9907718adfd1)

Labels

Label changes:

• add P3: Routine compatible dependency maintenance with no demonstrated dashboard failure or urgent regression.
• add rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• add status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Label justifications:

• P3: Routine compatible dependency maintenance with no demonstrated dashboard failure or urgent regression.
• rating: 🐚 platinum hermit: Overall readiness is 🐚 platinum hermit; proof is 🌊 off-meta tidepool and patch quality is 🐚 platinum hermit.
• status: 👀 ready for maintainer look: ClawSweeper has no concrete contributor-facing blocker left for this PR.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 23, 2026, 2:51 PM ET / 18:51 UTC.

[steipete]

Carapace 0.6.3 is included in #171, which passed independent review and exact-head CI. Closing this superseded dependency update; thanks for the update.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.