chore: update dependencies flagged by security audits

ATTRIBUTIONS-Node.md

@@ -5325,7 +5325,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.```
 
-## body-parser - 2.3.0
+## body-parser - 2.4.0
 **Repository URL**: https://github.com/expressjs/body-parser
 **License Type(s)**: MIT
 ### License: https://spdx.org/licenses/MIT.html
@@ -7399,7 +7399,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
 FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
 DEALINGS IN THE SOFTWARE.```
 
-## fast-uri - 3.1.8
+## fast-uri - 3.1.9
 **Repository URL**: https://github.com/fastify/fast-uri
 **License Type(s)**: BSD-3-Clause
 ### License: https://spdx.org/licenses/BSD-3-Clause.html
@@ -13156,7 +13156,7 @@ The above copyright notice and this permission notice shall be included in all c
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.```
 
-## qs - 6.16.0
+## qs - 6.16.1
 **Repository URL**: https://github.com/ljharb/qs
 **License Type(s)**: BSD-3-Clause
 ### License: https://spdx.org/licenses/BSD-3-Clause.html
@@ -15781,7 +15781,7 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.```
 
-## undici - 8.10.2
+## undici - 8.12.2
 **Repository URL**: https://github.com/nodejs/undici
 **License Type(s)**: MIT
 ### License: https://spdx.org/licenses/MIT.html
@@ -16470,7 +16470,7 @@ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.```
 
-## zod - 4.4.3
+## zod - 4.6.6
 **Repository URL**: https://github.com/colinhacks/zod
 **License Type(s)**: MIT
 ### License: https://spdx.org/licenses/MIT.html

ATTRIBUTIONS-Python.md

@@ -2145,7 +2145,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 ```
 
-## filelock (3.25.2)
+## filelock (4.2.4)
 
 ### Licenses
 License: `MIT`
@@ -8289,7 +8289,7 @@ Apache License
    limitations under the License.
 ```
 
-## virtualenv (21.14.12)
+## virtualenv (21.14.13)
 
 ### Licenses
 License: `MIT`

ATTRIBUTIONS-Rust.md

@@ -50085,7 +50085,7 @@ freely, subject to the following restrictions:
 
 ```
 
-## tokio - 1.51.1
+## tokio - 1.53.3
 
 **Repository URL**: https://github.com/tokio-rs/tokio
 **License Type(s)**: MIT

Cargo.toml

@@ -58,6 +58,7 @@ nemo-relay-cli = { version = "0.10.0", path = "crates/cli" }
 opentelemetry = { version = "0.32", default-features = false }
 opentelemetry-semantic-conventions = { version = "0.32.1", default-features = false, features = ["semconv_experimental"] }
 opentelemetry_sdk = { version = "0.32.1", default-features = false }
+tokio = { version = "1.53.3", default-features = false }
 uuid = "=1.18.1"
 
 [workspace.lints.rust]

crates/adaptive/Cargo.toml

@@ -22,7 +22,7 @@ serde_json = "1"
 chrono = { version = "0.4", features = ["serde"] }
 thiserror = "2"
 tdigest = { version = "0.2", features = ["use_serde"] }
-tokio = { version = "1", features = ["rt", "macros", "sync", "time"] }
+tokio = { workspace = true, default-features = true, features = ["rt", "macros", "sync", "time"] }
 tokio-stream = { version = "0.1", default-features = false, features = ["sync"] }
 regex = "1"
 serde_json_canonicalizer = "0.3"
@@ -37,7 +37,7 @@ __skip-implicit-config = ["nemo-relay/__skip-implicit-config"]
 
 [dev-dependencies]
 nemo-relay = { workspace = true, features = ["__test-plugin-host"] }
-tokio = { version = "1", default-features = false, features = ["rt", "macros", "sync", "time", "test-util", "rt-multi-thread"] }
+tokio = { workspace = true, default-features = false, features = ["rt", "macros", "sync", "time", "test-util", "rt-multi-thread"] }
 
 [[test]]
 name = "redis_integration"

crates/cli/Cargo.toml

@@ -66,7 +66,7 @@ strum = { version = "0.27", features = ["derive"] }
 subtle = "2"
 tar = "0.4"
 thiserror = "2"
-tokio = { version = "1", features = ["io-std", "io-util", "macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
+tokio = { workspace = true, default-features = true, features = ["io-std", "io-util", "macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "tls12"] }
 tokio-tungstenite = { version = "0.29", default-features = false, features = ["connect", "rustls-tls-native-roots"] }
 toml = "0.9"
@@ -92,5 +92,5 @@ opentelemetry_sdk = { workspace = true, features = ["trace", "testing"] }
 shell-words = "1"
 syn = { version = "2", features = ["full", "visit"] }
 tempfile = "3"
-tokio = { version = "1", features = ["test-util"] }
+tokio = { workspace = true, default-features = true, features = ["test-util"] }
 tower = { version = "0.5", features = ["util"] }

crates/core/Cargo.toml

@@ -64,7 +64,7 @@ chrono = { version = "0.4", features = ["serde"] }
 bitflags = { version = "2", features = ["serde"] }
 thiserror = "2"
 strum = { version = "0.27", features = ["derive"] }
-tokio = { version = "1", default-features = false, features = ["rt", "rt-multi-thread", "macros", "sync", "time"] }
+tokio = { workspace = true, default-features = false, features = ["rt", "rt-multi-thread", "macros", "sync", "time"] }
 tokio-stream = { version = "0.1", default-features = false, features = ["sync"] }
 typed-builder = "0.23.2"
 futures-util = "0.3"
@@ -104,7 +104,7 @@ rustix = { version = "1.1.4", features = ["fs", "param"] }
 windows-sys = { version = "0.61", features = ["Wdk_Foundation", "Wdk_Storage_FileSystem", "Win32_Foundation", "Win32_Security", "Win32_Security_Authorization", "Win32_Storage_FileSystem", "Win32_System_Diagnostics_ToolHelp", "Win32_System_IO", "Win32_System_JobObjects", "Win32_System_ProcessStatus", "Win32_System_Threading"] }
 
 [dev-dependencies]
-tokio = { version = "1", features = ["rt", "macros", "sync", "test-util", "rt-multi-thread", "time"] }
+tokio = { workspace = true, default-features = true, features = ["rt", "macros", "sync", "test-util", "rt-multi-thread", "time"] }
 futures = "0.3"
 opentelemetry_sdk = { workspace = true, features = ["trace", "logs", "metrics", "testing"] }
 opentelemetry-proto = { version = "0.32", default-features = false, features = ["gen-tonic", "logs", "metrics"] }

crates/core/tests/fixtures/native_plugin/Cargo.toml

@@ -15,4 +15,4 @@ crate-type = ["cdylib"]
 futures = "0.3"
 nemo-relay-plugin = { path = "../../../../plugin" }
 serde_json = "1"
-tokio = { version = "1", features = ["io-util", "time"] }
+tokio = { workspace = true, default-features = true, features = ["io-util", "time"] }

crates/core/tests/fixtures/worker_plugin/Cargo.toml

@@ -15,5 +15,5 @@ path = "src/main.rs"
 [dependencies]
 nemo-relay-worker = { path = "../../../../worker" }
 serde_json = "1"
-tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "rt-multi-thread"] }
 tokio-stream = "0.1"

crates/ffi/Cargo.toml

@@ -28,7 +28,7 @@ libc = "0.2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 uuid = { workspace = true, features = ["v7"] }
-tokio = { version = "1", features = ["rt-multi-thread"] }
+tokio = { workspace = true, default-features = true, features = ["rt-multi-thread"] }
 tokio-stream = "0.1"
 
 [build-dependencies]

crates/node/Cargo.toml

@@ -29,7 +29,7 @@ napi = { version = "2", features = ["napi6", "async", "serde-json", "tokio_rt"]
 napi-derive = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["rt-multi-thread", "sync"] }
+tokio = { workspace = true, default-features = true, features = ["rt-multi-thread", "sync"] }
 tokio-stream = { version = "0.1", features = ["sync"] }
 uuid = { workspace = true, features = ["v7"] }
 

crates/pii-redaction/Cargo.toml

@@ -30,7 +30,7 @@ schemars = { version = "0.8", optional = true }
 nemo-relay = { workspace = true, features = ["__test-plugin-host"] }
 futures = "0.3"
 opentelemetry = { workspace = true, features = ["trace"] }
-tokio = { version = "1", features = ["rt", "macros", "sync", "test-util", "rt-multi-thread", "time"] }
+tokio = { workspace = true, default-features = true, features = ["rt", "macros", "sync", "test-util", "rt-multi-thread", "time"] }
 opentelemetry_sdk = { workspace = true, features = ["trace", "testing"] }
 opentelemetry-proto = { version = "0.32", default-features = false, features = ["gen-tonic", "metrics"] }
 prost = "0.14"

crates/plugin/Cargo.toml

@@ -17,5 +17,5 @@ futures = "0.3"
 nemo-relay-types.workspace = true
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["io-util", "macros", "net", "rt-multi-thread", "sync", "time"] }
+tokio = { workspace = true, default-features = true, features = ["io-util", "macros", "net", "rt-multi-thread", "sync", "time"] }
 tokio-util = { version = "0.7", features = ["rt"] }

crates/python/Cargo.toml

@@ -30,7 +30,7 @@ pythonize = "0.29.0"
 serde_json = "1"
 serde = "1"
 uuid = { workspace = true, features = ["v7"] }
-tokio = { version = "1", features = ["full"] }
+tokio = { workspace = true, default-features = true, features = ["full"] }
 tokio-stream = "0.1"
 chrono = "0.4"
 

crates/worker/Cargo.toml

@@ -20,7 +20,7 @@ nemo-relay-worker-proto.workspace = true
 serde_json = "1"
 serde = "1"
 thiserror = "2"
-tokio = { version = "1", features = ["macros", "net", "rt-multi-thread", "sync"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "net", "rt-multi-thread", "sync"] }
 tokio-stream = { version = "0.1", features = ["net", "sync"] }
 tonic = { version = "0.14.2", default-features = false, features = ["codegen", "router", "transport"] }
 tower = { version = "0.5", features = ["util"] }

examples/language-binding-plugin/rust/Cargo.toml

@@ -13,4 +13,4 @@ futures = "0.3"
 nemo-relay = { workspace = true, default-features = true }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "rt-multi-thread", "sync"] }

examples/rust-grpc-worker-plugin/Cargo.toml

@@ -14,14 +14,14 @@ futures-util = "0.3"
 nemo-relay-worker.workspace = true
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["macros", "rt-multi-thread"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "rt-multi-thread"] }
 
 [dev-dependencies]
 nemo-relay = { workspace = true, default-features = true, features = ["worker-grpc", "__skip-implicit-config"] }
 sha2 = "0.11"
 tempfile = "3"
 toml = "0.9"
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "rt-multi-thread", "sync"] }
 uuid = { version = "1", features = ["v7"] }
 
 [lib]

examples/rust-native-plugin/Cargo.toml

@@ -18,11 +18,11 @@ futures = "0.3"
 nemo-relay-plugin.workspace = true
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-tokio = { version = "1", features = ["io-util", "macros", "time"] }
+tokio = { workspace = true, default-features = true, features = ["io-util", "macros", "time"] }
 
 [dev-dependencies]
 nemo-relay = { workspace = true, default-features = true, features = ["__skip-implicit-config"] }
 sha2 = "0.11"
 tempfile = "3"
 toml = "0.9"
-tokio = { version = "1", features = ["macros", "rt-multi-thread", "sync"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "rt-multi-thread", "sync"] }

package.json

@@ -19,7 +19,9 @@
   "overrides": {
     "ip-address": "^10.7.4",
     "openclaw": {
-      "@modelcontextprotocol/sdk": "1.32.1"
+      "@modelcontextprotocol/sdk": "1.32.1",
+      "zod": "4.6.6",
+      "undici": "8.12.2"
     }
   }
 }

scripts/latency_benchmark/daemon_transport/Cargo.toml

@@ -26,7 +26,7 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 sha2 = "0.11"
 tempfile = "3"
-tokio = { version = "1", features = ["macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
+tokio = { workspace = true, default-features = true, features = ["macros", "net", "process", "rt-multi-thread", "signal", "sync", "time"] }
 toml = "0.9"
 tower-service = "0.3"