v9.3.624

What Changed

• fix(security): don't return String(err) of arbitrary throws in HTTP errors (CodeQL #138) (#1457) @joshuaswarren

Contributors

@joshuaswarren

v9.3.623

What Changed

• fix(security): eliminate polynomial-ReDoS regexes in text parsing (CodeQL ×20) (#1456) @joshuaswarren

Contributors

@joshuaswarren

v9.3.622

What Changed

• No user-facing changes in this cycle.

Contributors

@github-actions[bot]

v9.3.621

What Changed

• fix(security): don't leak stack traces via better-sqlite error messages (CodeQL #138) (#1454) @joshuaswarren
• fix(security): prevent path traversal via namespace + objective-state writes (CodeQL #100/#101/#140) (#1455) @joshuaswarren

Contributors

@github-actions[bot] and @joshuaswarren

v9.3.620

What Changed

• fix(deps): bump react-router-dom 7.14.1 → 7.17.0 (RCE + DoS advisories) (#1453) @joshuaswarren

Contributors

@joshuaswarren

v9.3.619

What Changed

🧪 Maintenance

• fix(ci): make CodeQL default-branch scan pass (timeout + on.push) (#1452) @joshuaswarren

Contributors

@joshuaswarren

v9.3.618

What Changed

• fix(openclaw): use >=2026.4.1 compat range, not a ||-list (#1450) (#1451) @joshuaswarren

Contributors

@joshuaswarren

v9.3.617

What Changed

• fix(plugin-pi): cap startup Remnic probes (#1449) @ramarivera

Contributors

@ramarivera

v9.3.616

What Changed

🧪 Maintenance

• fix(ci): publish GitHub release before best-effort ClawHub publish (unstick releases) (#1447) @joshuaswarren

Contributors

@joshuaswarren

v9.3.615

What's Changed

• fix(mcp): project-scope writes from cwd/projectTag (supersedes #1435, fixes #1434) by @joshuaswarren in #1444

Full Changelog: v9.3.614...v9.3.615