On this page
On this page
Release notes
v2026.10.9
v2026.10.9
AI agents and tools can read these release notes as plain Markdown.
Security release: v2026.10.9 adds remediations for vulnerable dependencies and repairs credential handling and workspace restrictions. Update OpenClaw to receive these fixes.
This is a patch release with no new features. It fixes problems that could leave OpenClaw stopped after an update, prevent recovery of intact agent data, or send tools to the wrong project folder, alongside smaller reliability fixes.
Release scale: 38 pull requests, 8 direct commits, and 22 contributors.
The pull-request count includes source work brought in through backports, without counting the backport wrappers twice.
Installation and Onboarding
-
Fixes service commands failing to find a compatible Node runtime when launched from the filesystem root, including macOS launchd jobs.
More details
Applies when a compatible runtime is available through the supported recovery paths. #178112. Thanks to @steipete and @downingkeys.
Updates and Maintenance
-
Fixes large compressed conversation archives blocking Doctor migrations and preventing OpenClaw from starting.
More details
Archives are processed one record at a time rather than expanded into one archive-sized string. Unchanged archives keep their original bytes. #170853. Thanks to @iamonlv426 and @steipete.
-
Agents can accept new writes after you free disk space, without restarting the Gateway, once cleanup and integrity checks succeed. Interrupted writes are not automatically replayed.
-
Failed updates of a Git checkout now preserve detected edits and untracked files instead of deleting them during rollback. If rollback is refused, save your changes before following the printed recovery commands.
-
Windows package-update rollbacks now retry temporary file-lock failures. If the installed package is still missing, the error identifies the retained recovery folders and where to move them after closing the processes holding those files.
-
Fixes some failed same-version updates and repairs leaving the Gateway stopped even though the installed core is unchanged and safe to restart. The original update failure is still reported.
More details
Recovery remains blocked when data or ownership checks do not permit a restart. Released change, with bounded recovery work from #172784. Thanks to @steipete, @RomneyDa and @SMF12138.
-
Fixes startup and Doctor recovery treating stale search indexes as damaged agent data after a Node or SQLite upgrade. Eligible, otherwise intact databases can be backed up and repaired in place. See the update and recovery guidance.
More details
Update snapshots can also copy these stale indexes without repairing the source. Activation-time backup support requires the installed updater to contain this fix; copying and repairing remain separate operations. Released change, combining bounded work from #176234, #176833 and #181206. Thanks to @steipete, @RomneyDa and @ndakota79.
-
Fixes repair failing on interrupted package updates after a filesystem remount.
More details
Repair recognizes the published launcher while continuing to reject a replacement launcher. Released change, adapting #186557. Thanks to @ericcaiwx-star, @RomneyDa and @sennyhoney.
Skills
-
Skill icons and required-tool metadata now load correctly when an inline YAML value has a trailing comment.
More details
Quoted hash characters remain part of the value. Released change, from #171224. Thanks to @zhangguiping-xydt, @Takhoffman and @RomneyDa.
Native Apps
-
Fixes the Mac app reporting a false Gateway failure when a remote or inactive profile has no local service to stop.
More details
#181257. Thanks to @shakkernerd.
Models and Providers
-
Fixes chat and model-list requests failing when one sign-in refresh overtakes another, and keeps required plugins available while the refreshed model list is prepared.
More details
Redundant sign-in refresh work is also skipped when another refresh has already completed it. #179144 and the release follow-up. Thanks to @steipete and @RomneyDa.
-
Video-generation results now show options that the provider ignored, in both text and JSON output.
More details
Released change, from #171172. Thanks to @ly85206559, @obviyus and @RomneyDa.
-
Images sent while steering an active Codex turn now resolve from that session’s workspace, rather than incorrectly accepting a shared-workspace image or rejecting the intended one.
Plugins and Integrations
-
New ACP sessions now run tools in the project folder you requested, including after a session reset, instead of silently using the default workspace.
More details
Use an absolute folder path on the Gateway host. Sessions selected by an existing key or label keep their saved folder. #176852. Thanks to @yinx65588-boop, @obviyus and @crappier.
-
Connected nodes no longer disconnect when you reapprove their capabilities while a command is being prepared.
More details
Commands approved under the previous pairing generation remain refused. Released change, carried by #187461. Thanks to @RomneyDa and @steipete.
Security and Privacy
-
MCP tools now reject malformed addresses in their input definitions and follow valid relative links correctly.
-
Microsoft Teams and affected Azure sign-ins now receive remediations for a library flaw that could send application credentials to the wrong destination.
More details
The fix is included in managed plugin installations and upgrades. MSAL Node 7.1.1 is scoped to the affected Teams apps and Azure Identity versions. #187294. Thanks to @RomneyDa, with upstream remediation by @Robbie-Microsoft.
-
Fixes IMAP sender checks accepting a spoofed message when a trusted address is hidden inside nested comments in its From header.
-
Canvas/A2UI and Discord Activity now avoid unnecessary processing by rejecting oversized collections of data when a size limit is defined.
-
Workspace-only restrictions now apply to Gateway-built delegation and media tools, so restricted setting changes require approval and media reads stay within the allowed folders.
More details
Explicit policy overrides and read-only attachment exceptions retain their existing behavior. #187276, adapting #185094. Thanks to @eleqtrizit and @RomneyDa.
-
MCP command-line inspection now hides recognized credentials instead of exposing them in terminal output and captured transcripts. Scripts reading these inspection results receive redaction placeholders rather than secret values.
More details
Saved credentials remain intact, including supported inspect, edit and save round trips. #180321. Thanks to @brandon-julio-t, @wr-web and @steipete.
-
Google sign-in client secrets are now masked in console and log-tail output. Raw local log files and model-visible tool output are unchanged.
More details
#183193. Thanks to @LeizhenZhang, @steipete and @osher86.
Quality-of-Life Improvements
-
Remote Gateway probes now respect an explicitly requested SSH port 22 instead of switching to the port configured for an SSH alias.
More details
Targets without an explicit port still use their SSH configuration. Released change, from #171092. Thanks to @zhangguiping-xydt, @obviyus and @RomneyDa.
-
Command errors now preserve warnings when OpenClaw cannot confirm that process cleanup finished, along with the command output and exit details.
More details
#187272, adapting #184270. Thanks to @shakkernerd and @RomneyDa.
