Files

T

Teknium 7537de9e74 fix(deps): patch 31 known CVEs across Python and npm lockfiles

OSV weekly scan reported 50 known vulnerabilities in pinned deps.
This bumps everything with a released, semver-compatible fix:

Python (uv.lock):
- aiohttp 3.14.1 -> 3.14.3 (GHSA-cq5v-8q36-5273, GHSA-mfx4-hv73-q22v,
  GHSA-mq44-7p77-q5h7)
- h2 4.3.0 -> 4.4.1 (CVE-2026-71554 request smuggling; exclude-newer
  exception documented in pyproject, remove after 2026-08-17)

npm (root workspace):
- brace-expansion 5.0.8 -> 5.0.9, undici 6.27->6.28 / 7.28->7.29,
  js-yaml 4.3.1, nanoid 3.3.17/3.3.18, ip-address 10.4.0,
  mermaid 11.16.1 + dompurify 3.4.13 (root overrides so the
  streamdown transitive copy is pinned too)
- electron 40.10.2 -> 40.10.6 (GHSA-r4w5-6pfg-jxp5; the 41.x major
  for GHSA-9f4c-93c8-jc8g is deferred to its own PR)

npm (website): mermaid, dompurify, js-yaml, nanoid, fast-uri 3.1.5,
postcss 8.5.23, undici 7.29.0
npm (photon sidecar): @opentelemetry/core 2.8.0 via override, undici
npm (whatsapp-bridge): body-parser 1.20.6

min-release-age excludes added to .npmrc/website/.npmrc for the
sub-2wk CVE-fix releases, each with a removal date.

Remaining findings are blocked upstream: cryptography <49 cap
(alibabacloud-tea-openapi), image-size (no fixed release), tar 6.x
transitive majors, electron 41.

Local rescan: 50 -> 19 known vulns, 0 introduced.

2026-08-08 14:06:48 -07:00

docs

docs: explain model refusal attribution

2026-08-08 12:44:18 -07:00

i18n/zh-Hans/docusaurus-plugin-content-docs/current

fix(sessions): prevent oversized transcripts from exhausting memory

2026-08-08 13:36:08 +05:30

scripts

fix(skills-hub): include owner in ClawHub source URLs and add retry on 429 (#51236 )

2026-07-31 22:33:11 -07:00

src

refactor: remove the claude-marketplace skill source (redundant Marketplace hub tab)

2026-07-28 23:16:27 -07:00

static

feat(models): add qwen3.8-max to Nous portal + OpenRouter catalogs, replacing qwen3.7-max

2026-08-03 17:19:49 -07:00

.gitignore

feat(skills-hub): health checks, freshness badge, and a watchdog cron (#32345 )

2026-05-25 23:10:45 -07:00

.npmrc

fix(deps): patch 31 known CVEs across Python and npm lockfiles

2026-08-08 14:06:48 -07:00

docusaurus.config.ts

feat(docs): replace local lunr search with Algolia DocSearch

2026-08-08 11:14:13 -07:00

package-lock.json

fix(deps): patch 31 known CVEs across Python and npm lockfiles

2026-08-08 14:06:48 -07:00

package.json

feat(docs): replace local lunr search with Algolia DocSearch

2026-08-08 11:14:13 -07:00

README.md

docs: replace ASCII diagrams with Mermaid/lists, add linting note

2026-03-21 17:58:30 -07:00

sidebars.ts

chore(skills/social-media-content-calendar): tighten to hardline standards, ship optional

2026-08-08 12:05:19 -07:00

tsconfig.json

change(tooling): typecheck in CI, update ts to 6

2026-06-10 11:59:34 -04:00

README.md

Website

This website is built using Docusaurus, a modern static website generator.

Installation

yarn

Local Development

yarn start

This command starts a local development server and opens up a browser window. Most changes are reflected live without having to restart the server.

Build

yarn build

This command generates static content into the build directory and can be served using any static contents hosting service.

Deployment

Using SSH:

USE_SSH=true yarn deploy

Not using SSH:

GIT_USER=<Your GitHub username> yarn deploy

If you are using GitHub pages for hosting, this command is a convenient way to build the website and push to the gh-pages branch.

Diagram Linting

CI runs ascii-guard to lint docs for ASCII box diagrams. Use Mermaid (````mermaid`) or plain lists/tables instead of ASCII boxes to avoid CI failures.