OpenClaw Signals: Dependency Hygiene, Unsafe Path Escapes, and the Test Harness Gap

Tools

PR #328: Dependency Audit Automation Pipeline

Automates vulnerability scanning on every PR merge. Saves you from shipping transitive CVEs you never knew about, which is table stakes if you're running this in production.

PR #327: Filesystem Boundary Enforcement for Plugin Directories

The follow-up fix to the path traversal issue. Adds strict chroot-style boundaries so plugins can only touch their own directories. Good defense-in-depth, but the real lesson is validating inputs before they hit the filesystem layer.

PR #325: Retry Edge Case Coverage for Timeout Collisions

Covers the case where a task times out right as a retry fires, which previously caused duplicate executions. Solid catch. If you're relying on at-least-once semantics, this patch removes a real footgun.

PR #326: Lock Lease Extension During Long-Running Tasks

Extends lock leases dynamically when tasks exceed the default TTL. Prevents the classic problem of a slow task getting its lock stolen and two workers processing the same thing. Simple fix, big reliability win.

News

Issue #1560: Unsafe Path Traversal in Plugin Loader

Someone found that plugin paths weren't sanitized, meaning a malicious plugin could escape its sandbox and read arbitrary files. Critical security fix that should have been caught earlier. If you're running untrusted plugins, patch immediately.

Analysis

Issue #1558: Test Harness Doesn't Simulate Orchestrator Failures

Points out that the current test setup never kills the orchestrator mid-task. Without chaos-style testing you're flying blind on recovery behavior. Worth tracking if you care about uptime under partial failure.