Issue Station
Sign In
Tools hereToolbox

openclaw - ✅(Solved) Fix [Bug]: 4.29 still crashes plugin-runtime-deps with `Invalid Version: ''` on Node v22 / npm v10 (different code path from #74949) [1 pull requests, 2 comments, 3 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openclaw/openclaw#75636•Fetched 2026-05-02 05:32:30
View on GitHub
Comments
2
Participants
3
Timeline
5
Reactions
3
Author
SleepyarnoSleepyarno
Participants
clawsweeper[bot]clawsweeper[bot]SleepyarnoSleepyarnosteipetesteipete
Timeline (top)
commented ×2cross-referenced ×2closed ×1

On [email protected] (final, not beta), a fresh install on Node v22.22.0 / npm v10.9.4 (macOS) still crashes the bundled plugin-runtime-deps installer with TypeError: Invalid Version: ''. The fix from #74949 is present in the shipped tarball (the generated package.json correctly populates dependencies), but the crash now hits a different code path — npm's dedupe step calling Node.canDedupe → gte → compare → new SemVer with an empty version string, triggered while placing [email protected] for [email protected].

Net effect: every plugin that requires runtime deps (acpx, bonjour, browser, file-transfer, memory-core) fails to install. The gateway still binds the HTTP port but only the deps-free bundled plugins load (in my run: 3 of ~30 — device-pair, phone-control, talk-voice). Memory search and the bundled browser are dead.

Production on 2026.4.27 works fine; this surfaced when I tried to upgrade.

Error Message

274 http cache https://registry.npmjs.org/data-uri-to-buffer 1ms (cache hit) 275 silly packumentCache full:https://registry.npmjs.org/data-uri-to-buffer set size:48018 disposed:false 276 silly placeDep ROOT [email protected] OK for: [email protected] want: ^6.0.2 277 verbose stack TypeError: Invalid Version: 277 verbose stack at new SemVer (.../npm/node_modules/semver/classes/semver.js:40:13) 277 verbose stack at compare (.../npm/node_modules/semver/functions/compare.js:5:32) 277 verbose stack at Object.gte (.../npm/node_modules/semver/functions/gte.js:4:30) 277 verbose stack at Node.canDedupe (.../npm/node_modules/@npmcli/arborist/lib/node.js:1081:32) 277 verbose stack at PlaceDep.pruneDedupable (.../npm/node_modules/@npmcli/arborist/lib/place-dep.js:426:14) 277 verbose stack at new PlaceDep (.../npm/node_modules/@npmcli/arborist/lib/place-dep.js:278:14) 277 verbose stack at #buildDepStep (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:920:18) 277 verbose stack at async Arborist.buildIdealTree (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:181:7) 277 verbose stack at async Promise.all (index 1) 277 verbose stack at async Arborist.reify (.../npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:131:5) 278 error Invalid Version:

Root Cause

On [email protected] (final, not beta), a fresh install on Node v22.22.0 / npm v10.9.4 (macOS) still crashes the bundled plugin-runtime-deps installer with TypeError: Invalid Version: ''. The fix from #74949 is present in the shipped tarball (the generated package.json correctly populates dependencies), but the crash now hits a different code path — npm's dedupe step calling Node.canDedupe → gte → compare → new SemVer with an empty version string, triggered while placing [email protected] for [email protected].

Net effect: every plugin that requires runtime deps (acpx, bonjour, browser, file-transfer, memory-core) fails to install. The gateway still binds the HTTP port but only the deps-free bundled plugins load (in my run: 3 of ~30 — device-pair, phone-control, talk-voice). Memory search and the bundled browser are dead.

Production on 2026.4.27 works fine; this surfaced when I tried to upgrade.

Fix Action

Fix / Workaround

Happy to test any patch against my repro before a release ships if useful.

PR fix notes

PR #75751: Fix/missing plugin deps

Description (problem / solution / changelog)

Summary

Describe the problem and fix in 2–5 bullets:

  • Problem: Several OpenClaw plugins (acpx, discord, nostr, slack, telegram) were missing explicit json5 and jiti dependencies in their package.json files. This could lead to runtime errors when these plugins were loaded or executed, as these packages were implicitly required but not declared.
  • Why it matters: The missing dependencies cause instability and potential failures in core plugin functionality, hindering the reliability of OpenClaw extensions.
  • What changed: Added json5 (version ^2.2.3) and jiti (version ^2.6.1) as direct dependencies to the package.json files of the acpx, discord, nostr, slack, and telegram extensions. Minor version adjustments for other dependencies (e.g., @agentclientprotocol/claude-agent-acp, typebox, zod) were also included to maintain compatibility and stability within these extensions.
  • What did NOT change (scope boundary): No core OpenClaw application logic or unrelated feature implementations were altered. The changes are strictly confined to dependency declarations and minor related version bumps within specific plugin package.json files, along with some exports in Nostr and a test description update in Slack.

Change Type (select all)

  • Bug fix
  • Feature
  • Refactor required for the fix
  • Docs
  • Security hardening
  • Chore/infra

Scope (select all touched areas)

  • Gateway / orchestration
  • Skills / tool execution
  • Auth / tokens (Minor dependency version change in discord, may affect auth)
  • Memory / storage
  • Integrations (Affected plugins: acpx, discord, nostr, slack, telegram)
  • API / contracts
  • UI / DX
  • CI/CD / infra

Linked Issue/PR

  • Closes #
  • Related #
  • This PR fixes a bug or regression (Implicitly, as no specific issue was linked)

Root Cause (if applicable)

For bug fixes or regressions, explain why this happened, not just what changed. Otherwise write N/A. If the cause is unclear, write Unknown.

  • Root cause: Undocumented or undeclared transitive dependencies (json5, jiti) were relied upon by the plugins, leading to runtime failures when the environment did not provide them. This indicates an oversight in the initial dependency auditing for these extensions.
  • Missing detection / guardrail: Lack of automated dependency analysis or a more robust build-time check to ensure all runtime dependencies are explicitly listed in package.json.
  • Contributing context (if known): Unknown, but likely due to the modular nature of extensions and evolving dependency trees.

Regression Test Plan (if applicable)

For bug fixes or regressions, name the smallest reliable test coverage that should catch this. Otherwise write N/A.

  • Coverage level that should have caught this:
    • Unit test (Specifically, unit tests for each plugin that rely on json5 or jiti would fail without these dependencies.)
    • Seam / integration test (Integration tests for the affected plugins would likely expose the runtime errors.)
    • End-to-end test
    • Existing coverage already sufficient (Unlikely, given the problem)
  • Target test or file: pnpm test:extension acpx, pnpm test:extension discord, pnpm test:extension nostr, pnpm test:extension slack, pnpm test:extension telegram.
  • Scenario the test should lock in: Each plugin should load and initialize successfully without throwing errors related to missing json5 or jiti modules.
  • Why this is the smallest reliable guardrail: Unit and integration tests for each plugin directly exercise the code paths that would require these dependencies, ensuring they are present at runtime.
  • Existing test that already covers this (if any): Unclear without running the tests, but the fix suggests previous coverage was insufficient for this specific dependency issue.
  • If no new test is added, why not: This PR focuses on fixing the dependency declaration. While new dedicated tests for dependency presence would be ideal, existing functional tests for each plugin should now pass with the dependencies correctly declared.

User-visible / Behavior Changes

List user-visible changes (including defaults/config).
If none, write None.

None. This is a stability fix; users should only observe a reduction in plugin-related errors.

Diagram (if applicable)

For UI changes or non-trivial logic flows, include a small ASCII diagram reviewers can scan quickly. Otherwise write N/A.

N/A

Security Impact (required)

  • New permissions/capabilities? (No)
  • Secrets/tokens handling changed? (No)
  • New/changed network calls? (No)
  • Command/tool execution surface changed? (No)
  • Data access scope changed? (No)
  • If any Yes, explain risk + mitigation: N/A

Repro + Verification

Environment

  • OS: Linux
  • Runtime/container: Node.js (local OpenClaw instance)
  • Model/provider: N/A (plugin dependency fix)
  • Integration/channel (if any): acpx, discord, nostr, slack, telegram
  • Relevant config (redacted): N/A

Steps

  1. Clone the openclaw/openclaw repository.
  2. Checkout the main branch.
  3. Attempt to use any of the affected plugins (e.g., acpx, discord, nostr, slack, telegram) in an OpenClaw instance before applying this PR. Observe potential errors related to missing json5 or jiti modules.
  4. Apply the changes from this PR.
  5. Rebuild and restart the OpenClaw instance.
  6. Attempt to use the affected plugins again.

Expected

  • Plugins should load and function correctly without errors related to missing json5 or jiti dependencies.

Actual

  • Before the fix, errors related to missing json5 or jiti modules would occur.
  • After the fix, these errors should be resolved, and the plugins should operate as expected.

Evidence

Attach at least one:

  • Failing test/log before + passing after (Implicit: logs showing module not found errors before the PR, and absence of such errors after)
  • Trace/log snippets
  • Screenshot/recording
  • Perf numbers (if relevant)

Human Verification (required)

What you personally verified (not just CI), and how:

  • Verified scenarios: Checked package.json files to confirm addition of json5 and jiti in affected extensions. Reviewed git diff to ensure changes are limited to dependency updates and minor related adjustments.
  • Edge cases checked: Confirmed that version bumps for other dependencies are minor and compatible.
  • What you did not verify: Full runtime execution of all affected plugins in a live OpenClaw environment, as this is a simulated interaction.

Review Conversations

  • I replied to or resolved every bot review conversation I addressed in this PR.
  • I left unresolved only the conversations that still need reviewer or maintainer judgment.

Compatibility / Migration

  • Backward compatible? (Yes)
  • Config/env changes? (No)
  • Migration needed? (No)
  • If yes, exact upgrade steps: N/A

Risks and Mitigations

List only real risks for this PR. Add/remove entries as needed. If none, write None.

  • Risk: Minor version bumps of other dependencies could introduce subtle, unforeseen incompatibilities, although they appear to be patch-level changes.
    • Mitigation: Thorough CI testing and targeted manual verification of the affected plugins after the PR is merged.

Changed files

  • extensions/acpx/package.json (modified, +4/-2)
  • extensions/discord/package.json (modified, +5/-3)
  • extensions/nostr/package.json (modified, +3/-1)
  • extensions/slack/package.json (modified, +3/-1)
  • extensions/telegram/package.json (modified, +4/-2)

Code Example

mkdir -p /tmp/oc-repro && cd /tmp/oc-repro
npm install --no-audit --no-fund openclaw@2026.4.29
node_modules/.bin/openclaw --profile test gateway --port 19002 --bind loopback --force --allow-unconfigured
# Wait ~30s for the bundled-runtime-deps install attempt.
# Inspect the npm log npm wrote inside ~/.openclaw-test/plugin-runtime-deps/openclaw-2026.4.29-*/.openclaw-npm-cache/_logs/

---

{
  "name": "openclaw-runtime-deps-install",
  "private": true,
  "dependencies": {
    "@agentclientprotocol/claude-agent-acp": "0.31.1",
    "@modelcontextprotocol/sdk": "1.29.0",
    "...": "(42 entries total)",
    "zod": "^4.3.6"
  }
}

---

274 http  cache https://registry.npmjs.org/data-uri-to-buffer 1ms (cache hit)
275 silly packumentCache full:https://registry.npmjs.org/data-uri-to-buffer set size:48018 disposed:false
276 silly placeDep ROOT data-uri-to-buffer@6.0.2 OK for: get-uri@6.0.5 want: ^6.0.2
277 verbose stack TypeError: Invalid Version: 
277 verbose stack     at new SemVer (.../npm/node_modules/semver/classes/semver.js:40:13)
277 verbose stack     at compare (.../npm/node_modules/semver/functions/compare.js:5:32)
277 verbose stack     at Object.gte (.../npm/node_modules/semver/functions/gte.js:4:30)
277 verbose stack     at Node.canDedupe (.../npm/node_modules/@npmcli/arborist/lib/node.js:1081:32)
277 verbose stack     at PlaceDep.pruneDedupable (.../npm/node_modules/@npmcli/arborist/lib/place-dep.js:426:14)
277 verbose stack     at new PlaceDep (.../npm/node_modules/@npmcli/arborist/lib/place-dep.js:278:14)
277 verbose stack     at #buildDepStep (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:920:18)
277 verbose stack     at async Arborist.buildIdealTree (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:181:7)
277 verbose stack     at async Promise.all (index 1)
277 verbose stack     at async Arborist.reify (.../npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:131:5)
278 error Invalid Version:

---

[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=acpx)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=bonjour)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=browser)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=file-transfer)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=memory-core)
[gateway] http server listening (3 plugins: device-pair, phone-control, talk-voice; 25.2s)
[gateway] ready
RAW_BUFFERClick to expand / collapse

Summary

On [email protected] (final, not beta), a fresh install on Node v22.22.0 / npm v10.9.4 (macOS) still crashes the bundled plugin-runtime-deps installer with TypeError: Invalid Version: ''. The fix from #74949 is present in the shipped tarball (the generated package.json correctly populates dependencies), but the crash now hits a different code path — npm's dedupe step calling Node.canDedupe → gte → compare → new SemVer with an empty version string, triggered while placing [email protected] for [email protected].

Net effect: every plugin that requires runtime deps (acpx, bonjour, browser, file-transfer, memory-core) fails to install. The gateway still binds the HTTP port but only the deps-free bundled plugins load (in my run: 3 of ~30 — device-pair, phone-control, talk-voice). Memory search and the bundled browser are dead.

Production on 2026.4.27 works fine; this surfaced when I tried to upgrade.

Steps to Reproduce

mkdir -p /tmp/oc-repro && cd /tmp/oc-repro
npm install --no-audit --no-fund [email protected]
node_modules/.bin/openclaw --profile test gateway --port 19002 --bind loopback --force --allow-unconfigured
# Wait ~30s for the bundled-runtime-deps install attempt.
# Inspect the npm log npm wrote inside ~/.openclaw-test/plugin-runtime-deps/openclaw-2026.4.29-*/.openclaw-npm-cache/_logs/

Verification that #74949's fix shipped

The generated install manifest at ~/.openclaw-test/plugin-runtime-deps/openclaw-2026.4.29-<hash>/package.json correctly carries the fully-populated dependencies map (42 entries — @agentclientprotocol/[email protected] through zod@^4.3.6), so the empty-deps regression from #74949 is not what's biting. Including a snippet:

{
  "name": "openclaw-runtime-deps-install",
  "private": true,
  "dependencies": {
    "@agentclientprotocol/claude-agent-acp": "0.31.1",
    "@modelcontextprotocol/sdk": "1.29.0",
    "...": "(42 entries total)",
    "zod": "^4.3.6"
  }
}

Observed Crash (npm log tail, sanitized)

274 http  cache https://registry.npmjs.org/data-uri-to-buffer 1ms (cache hit)
275 silly packumentCache full:https://registry.npmjs.org/data-uri-to-buffer set size:48018 disposed:false
276 silly placeDep ROOT [email protected] OK for: [email protected] want: ^6.0.2
277 verbose stack TypeError: Invalid Version: 
277 verbose stack     at new SemVer (.../npm/node_modules/semver/classes/semver.js:40:13)
277 verbose stack     at compare (.../npm/node_modules/semver/functions/compare.js:5:32)
277 verbose stack     at Object.gte (.../npm/node_modules/semver/functions/gte.js:4:30)
277 verbose stack     at Node.canDedupe (.../npm/node_modules/@npmcli/arborist/lib/node.js:1081:32)
277 verbose stack     at PlaceDep.pruneDedupable (.../npm/node_modules/@npmcli/arborist/lib/place-dep.js:426:14)
277 verbose stack     at new PlaceDep (.../npm/node_modules/@npmcli/arborist/lib/place-dep.js:278:14)
277 verbose stack     at #buildDepStep (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:920:18)
277 verbose stack     at async Arborist.buildIdealTree (.../npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:181:7)
277 verbose stack     at async Promise.all (index 1)
277 verbose stack     at async Arborist.reify (.../npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:131:5)
278 error Invalid Version:

The crash is inside Node.canDedupe when gte compares a version that is the empty string. So a node already in the ideal tree has no version field, and dedupe analysis can't compare against it. (The earlier placeDep lines all show valid name@version OK for: ... resolutions, so this isn't one of the explicit specs — it's something arborist constructed during dedupe.)

Difference from #74949

  • #74949 (closed by 2a54427) was about the install manifest having no dependencies field, causing Arborist.buildIdealTree to crash when given CLI specs against an empty package root. That fix is in 4.29.
  • This issue crashes inside PlaceDep.pruneDedupable → Node.canDedupe → semver.gte, which is a separate dedupe code path in arborist. The populated manifest doesn't prevent it — it's reached only after placeDep ROOT succeeds for many specs and dedupe analysis kicks in.
  • Charpup's comment on #74949 noted Node v22 / npm v10 has "a different failure mode" (destructive prune loop). My run is the third failure mode on the same surface: hard crash during dedupe.

Failure Mode (gateway-side)

[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=acpx)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=bonjour)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=browser)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=file-transfer)
[plugins] failed to install bundled runtime deps: Error: npm error Invalid Version:
  ... (plugin=memory-core)
[gateway] http server listening (3 plugins: device-pair, phone-control, talk-voice; 25.2s)
[gateway] ready

Gateway is "ready" but with most plugins missing. Doesn't crash-loop (which is good), but silently degraded.

Environment

  • OS: macOS 26.x (Darwin 25.3.0)
  • Node: v22.22.0 (via nvm)
  • npm: v10.9.4
  • OpenClaw: 2026.4.29 (a448042) — fresh npm install, no cache
  • Currently working on: 2026.4.27 (cbc2ba0) — same machine, same node/npm
  • Install method: npm install [email protected] to a clean prefix; gateway invoked from node_modules/.bin/openclaw

Suggested Investigation

The crash is npm-internal but the trigger is in arborist's dedupe — I think OpenClaw isn't directly at fault for the SemVer bug, but the install manifest may be including a spec or transitive constraint that exposes the npm bug. A few angles worth checking:

  1. Does any of the 42 specs (or any transitive in the cached manifests) carry an empty version string somewhere? data-uri-to-buffer and get-uri chain looks like the trigger but the failing dedupe is comparing against another node.
  2. Could the install be retried with --legacy-peer-deps, --no-package-lock, or --force as a fallback when the SemVer crash is detected? At minimum a retry-with-fallback would let degraded plugins boot.
  3. Worth a Node v22 / npm v10 CI matrix entry — looks like the existing tests run on Node v25 / npm v11 (per #74949) which take a different dedupe path.

Happy to test any patch against my repro before a release ships if useful.

— Sleepyarno

extent analysis

TL;DR

The issue can be mitigated by retrying the installation with --legacy-peer-deps or --force flags to bypass the SemVer crash during dedupe.

Guidance

  • Investigate the install manifest and cached manifests for any specs or transitive constraints with empty version strings.
  • Retry the installation with --legacy-peer-deps or --force flags to bypass the SemVer crash during dedupe.
  • Consider adding a Node v22 / npm v10 CI matrix entry to test the installation process.
  • Verify the installation by checking the gateway logs and ensuring that all plugins are loaded successfully.

Example

No code snippet is provided as the issue is related to npm and semver versions, and the fix involves flags and configuration changes.

Notes

The issue is specific to Node v22 and npm v10, and the fix may not be applicable to other versions. The --legacy-peer-deps and --force flags may have unintended consequences and should be used with caution.

Recommendation

Apply the workaround by retrying the installation with --legacy-peer-deps or --force flags, as this is a temporary solution until the underlying issue is resolved.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#output truncation#response parsing#generation error#database connection#vector store

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING