When was v5.16.1 published?

v5.16.1 was published on Oct 27, 2026.

How much validation backed v5.16.1?

The release notes report 3,888 tests across 42 suites, all passing.

Release

v5.16.1 - SkillSpector follow-up

Published 2026-10-27 | Release notes

validatetoken.py fails closed on bad expiry: grants whose expiresat is missing, non-string or unparseable are now rejected (previously treated as non-expired). Timezone-naive timestamps are read as UTC. revoketoken.py tr

Read the release here or open the original release on GitHub.

Open release on GitHub Open changelog Open quick start Release RSS

SkillSpector scan follow-up (ClawHub skill)

Security

validate_token.py fails closed on bad expiry: grants whose expires_at is missing, non-string or unparseable are now rejected (previously treated as non-expired). Timezone-naive timestamps are read as UTC. revoke_token.py treats such grants as expired; check_permission.py --active-grants no longer crashes on naive timestamps.
Signing key created owner-only: data/.signing_key is created with mode 0o600 via os.open instead of write-then-chmod, removing a brief readable window.

Changed

Script header comments no longer list the modules they do not import (the list itself matched capability keywords).
SKILL.md frontmatter declares permissions: [file_read, file_write, env].
skill.json adds triggers, an explicit-only invocation statement, and do_not_use_for.
check_permission.py --audit-summary --json: per-agent and per-resource counts renamed requested / granted / denied (top-level total_* unchanged).

Dependencies

Dev/CI only (Dependabot): openai 7.43.0, dotenv 18.0.9, codeql-action, ai-plugin-scanner-action.

Full suite: 3,888 tests across 42 suites; tsc --noEmit clean. See CHANGELOG.