chore: prepare 0.16.0 release

CHANGELOG.md

@@ -2,51 +2,34 @@
 
 ## Unreleased
 
-### Changes
-
-- Security: move upload ClawScan classification to a GitHub Actions Codex worker, treat VirusTotal as telemetry-only signal, and trust verified `@openclaw/*` plugin packages by default.
-- Admin/Ops: audit profile syncs, self-service account/profile changes, personal
-  publisher syncs, and org trusted-publisher changes so slug and ownership
-  investigations have a complete ledger.
-- CLI/API: include skill owner handles in search results so duplicate/common
-  slugs are easier to disambiguate (thanks @vyctorbrzezowski).
-- Web: let skill publishers pick a curated lucide icon for cards and listings (#2174) (thanks @momothemage).
-- Web/API: add keyword-based plugin categories plus API-backed plugin search
-  sorting for recently updated, newest, and name (#2118) (thanks
-  @vyctorbrzezowski).
-- Web: polish the starred skills page with grid/list controls, sorting, and
-  optimistic unstar behavior (#2159) (thanks @vyctorbrzezowski).
-- API/docs: expand the v1 OpenAPI contract with package/plugin catalog
-  endpoints and align documented rate limits with the server constants (#2186)
-  (thanks @vyctorbrzezowski).
-- Dependencies: update production `@clack/prompts`, `tailwind-merge`, and
-  `yaml` dependencies (#2198).
+## 0.16.0 - 2026-05-18
 
 ### Fixes
 
+- CLI/API: make package publishes robust under parallel same-publisher release jobs by avoiding unnecessary shared publisher writes, retrying transient Convex contention, and labeling contention separately from package validation failures (#2291).
+- Security: move upload ClawScan classification to a GitHub Actions Codex worker, treat VirusTotal as telemetry-only signal, and trust verified `@openclaw/*` plugin packages by default.
 - Security: cancel pending skill ownership transfers before rejecting accept attempts when the requester is inactive or the skill is hidden, removed, or malicious (#2276, #2277) (thanks @vyctorbrzezowski).
-- Web/API: keep search results limited to items with match evidence, preserve
-  trust and popularity as tie-breakers, and show `N+` counts without exact
-  count queries (#2206) (thanks @vyctorbrzezowski).
-- API: return `400` for invalid known public package filters and invalid skill
-  list sort values, while continuing to ignore unknown query parameters (#2184).
-- API/docs: document v1 plain-text error responses and expose owner metadata in
-  the OpenAPI search result schema (#2187) (thanks @vyctorbrzezowski).
-- Web: preserve `ownerHandle` through legacy skill publish redirects so org
-  admins land in the correct new-version owner context (#2177).
-- Auth: show a visible error if the GitHub sign-in request fails before the
-  provider redirect starts (#2197).
-- Schema: include `.tsv`, `.conf`, `.properties`, and `.dat` in the exported
-  text-file allowlist and regenerate the committed schema package runtime
-  (#2172, #874) (thanks @alexuser).
-- Settings: save display name/bio changes even when a legacy personal publisher
-  handle conflict prevents publisher profile sync (#1199).
-- API: return a clear 400 for `/api/v1/packages/search` without a non-empty
-  `q` instead of treating `search` as a package name (thanks @vyctorbrzezowski).
+- API/CLI: fix package delete returning 500 for packages with capability tags when no capability search digest row existed yet (#2212) (thanks @momothemage).
+- API: return a clear 400 for `/api/v1/packages/search` without a non-empty `q` instead of treating `search` as a package name (thanks @vyctorbrzezowski).
+- Web/API: keep search results limited to items with match evidence, preserve trust and popularity as tie-breakers, and show `N+` counts without exact count queries (#2206) (thanks @vyctorbrzezowski).
+- Web: preserve `ownerHandle` through legacy skill publish redirects so org admins land in the correct new-version owner context (#2177).
+- Settings: save display name/bio changes even when a legacy personal publisher handle conflict prevents publisher profile sync (#1199).
+- Auth: show a visible error if the GitHub sign-in request fails before the provider redirect starts (#2197).
+- Schema: include `.tsv`, `.conf`, `.properties`, and `.dat` in the exported text-file allowlist and regenerate the committed schema package runtime (#2172, #874) (thanks @alexuser).
+- API: return `400` for invalid known public package filters and invalid skill list sort values, while continuing to ignore unknown query parameters (#2184).
+- API/docs: document v1 plain-text error responses and expose owner metadata in the OpenAPI search result schema (#2187) (thanks @vyctorbrzezowski).
 - Web: rank publisher card preview items by downloads instead of recent publish order (thanks @vyctorbrzezowski).
 - Web: keep skill/plugin detail tabs at mobile-friendly touch target height.
-- API/CLI: fix package delete returning 500 for packages with capability tags
-  when no capability search digest row existed yet (#2212) (thanks @momothemage).
+
+### Changes
+
+- CLI/API: include skill owner handles in search results so duplicate/common slugs are easier to disambiguate (thanks @vyctorbrzezowski).
+- Web: let skill publishers pick a curated lucide icon for cards and listings (#2174) (thanks @momothemage).
+- Web/API: add keyword-based plugin categories plus API-backed plugin search sorting for recently updated, newest, and name (#2118) (thanks @vyctorbrzezowski).
+- Web: polish the starred skills page with grid/list controls, sorting, and optimistic unstar behavior (#2159) (thanks @vyctorbrzezowski).
+- API/docs: expand the v1 OpenAPI contract with package/plugin catalog endpoints and align documented rate limits with the server constants (#2186) (thanks @vyctorbrzezowski).
+- Admin/Ops: audit profile syncs, self-service account/profile changes, personal publisher syncs, and org trusted-publisher changes so slug and ownership investigations have a complete ledger.
+- Dependencies: update production `@clack/prompts`, `tailwind-merge`, and `yaml` dependencies (#2198).
 
 ## 0.15.0 - 2026-05-12
 

bun.lock

@@ -79,7 +79,7 @@
     },
     "packages/clawhub": {
       "name": "clawhub",
-      "version": "0.15.0",
+      "version": "0.16.0",
       "bin": {
         "clawdhub": "bin/clawdhub.js",
         "clawhub": "bin/clawdhub.js",

packages/clawhub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "clawhub",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "ClawHub CLI \\u2014 install, update, search, and publish skills plus OpenClaw packages.",
   "homepage": "https://clawhub.ai",
   "bugs": {

packages/schema/dist/packages.d.ts

@@ -51,6 +51,7 @@ export declare const PackageVerificationSummarySchema: import("arktype/internal/
     sourceCommit?: string | undefined;
     sourceTag?: string | undefined;
     hasProvenance?: boolean | undefined;
+    trustedOpenClawPlugin?: boolean | undefined;
     scanStatus?: "clean" | "suspicious" | "malicious" | "pending" | "not-run" | undefined;
 }, {}>;
 export type PackageVerificationSummary = (typeof PackageVerificationSummarySchema)[inferred];
@@ -339,6 +340,7 @@ export declare const ApiV1PackageResponseSchema: import("arktype/internal/varian
             sourceCommit?: string | undefined;
             sourceTag?: string | undefined;
             hasProvenance?: boolean | undefined;
+            trustedOpenClawPlugin?: boolean | undefined;
             scanStatus?: "clean" | "suspicious" | "malicious" | "pending" | "not-run" | undefined;
         } | null | undefined;
         artifact?: {
@@ -427,6 +429,7 @@ export declare const ApiV1PackageVersionResponseSchema: import("arktype/internal
             sourceCommit?: string | undefined;
             sourceTag?: string | undefined;
             hasProvenance?: boolean | undefined;
+            trustedOpenClawPlugin?: boolean | undefined;
             scanStatus?: "clean" | "suspicious" | "malicious" | "pending" | "not-run" | undefined;
         } | null | undefined;
         artifact?: {

packages/schema/dist/packages.js

@@ -59,6 +59,7 @@ export const PackageVerificationSummarySchema = type({
     sourceCommit: "string?",
     sourceTag: "string?",
     hasProvenance: "boolean?",
+    trustedOpenClawPlugin: "boolean?",
     scanStatus: '"clean"|"suspicious"|"malicious"|"pending"|"not-run"?',
 });
 export const PackageStatsSchema = type({