---
title: "v2026.10.9"
summary: "Security remediations and fixes for updates, database recovery, sessions and model refreshes."
description: "OpenClaw v2026.10.9 patch release notes covering security remediations, update recovery, agent data, workspace permissions and reliability fixes."
keywords:
  - OpenClaw
  - v2026.10.9
  - release notes
---

# v2026.10.9

AI agents and tools can read these release notes as [plain Markdown](https://raw.githubusercontent.com/openclaw/openclaw/main/CHANGELOG/2026.10.9.md).

**Security release:** v2026.10.9 adds remediations for vulnerable dependencies and repairs credential handling and workspace restrictions. Update OpenClaw to receive these fixes.

This is a patch release with no new features. It fixes problems that could leave OpenClaw stopped after an update, prevent recovery of intact agent data, or send tools to the wrong project folder, alongside smaller reliability fixes.

**Release scale:** 38 pull requests, 8 direct commits, and 22 contributors.

The pull-request count includes source work brought in through backports, without counting the backport wrappers twice.

## Installation and Onboarding

- Fixes service commands failing to find a compatible Node runtime when launched from the filesystem root, including macOS launchd jobs.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Applies when a compatible runtime is available through the supported recovery paths. [#178112](https://github.com/openclaw/openclaw/pull/178112). Thanks to [@steipete](https://github.com/steipete) and [@downingkeys](https://github.com/downingkeys).

  </details>

## Updates and Maintenance

- Fixes large compressed conversation archives blocking [Doctor migrations](/cli/doctor) and preventing OpenClaw from starting.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Archives are processed one record at a time rather than expanded into one archive-sized string. Unchanged archives keep their original bytes. [#170853](https://github.com/openclaw/openclaw/pull/170853). Thanks to [@iamonlv426](https://github.com/iamonlv426) and [@steipete](https://github.com/steipete).

  </details>

- Agents can accept new writes after you free disk space, without restarting the Gateway, once cleanup and integrity checks succeed. Interrupted writes are not automatically replayed.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  [#176902](https://github.com/openclaw/openclaw/pull/176902). Thanks to [@steipete](https://github.com/steipete).

  </details>

- Failed updates of a Git checkout now preserve detected edits and untracked files instead of deleting them during rollback. If rollback is refused, save your changes before following the printed recovery commands.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  The updater still attempts to restore the previous runtime. [#185201](https://github.com/openclaw/openclaw/pull/185201). Thanks to [@wr-web](https://github.com/wr-web) and [@syxscott](https://github.com/syxscott).

  </details>

- Windows package-update rollbacks now retry temporary file-lock failures. If the installed package is still missing, the error identifies the retained recovery folders and where to move them after closing the processes holding those files.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  [#187277](https://github.com/openclaw/openclaw/pull/187277), adapting [#185160](https://github.com/openclaw/openclaw/pull/185160). Thanks to [@RomneyDa](https://github.com/RomneyDa), [@LiuwqGit](https://github.com/LiuwqGit) and [@syxscott](https://github.com/syxscott).

  </details>

- Fixes some failed same-version updates and repairs leaving the Gateway stopped even though the installed core is unchanged and safe to restart. The original update failure is still reported.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Recovery remains blocked when data or ownership checks do not permit a restart. [Released change](https://github.com/openclaw/openclaw/commit/06a5d2b6aa2daa340402e875b906875f77bf733d), with bounded recovery work from [#172784](https://github.com/openclaw/openclaw/pull/172784). Thanks to [@steipete](https://github.com/steipete), [@RomneyDa](https://github.com/RomneyDa) and [@SMF12138](https://github.com/SMF12138).

  </details>

- Fixes startup and Doctor recovery treating stale search indexes as damaged agent data after a Node or SQLite upgrade. Eligible, otherwise intact databases can be backed up and repaired in place. See the [update and recovery guidance](/install/updating).

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Update snapshots can also copy these stale indexes without repairing the source. Activation-time backup support requires the installed updater to contain this fix; copying and repairing remain separate operations. [Released change](https://github.com/openclaw/openclaw/commit/f26441b055b0ff98d32d01eea56a1e64f7194821), combining bounded work from [#176234](https://github.com/openclaw/openclaw/pull/176234), [#176833](https://github.com/openclaw/openclaw/pull/176833) and [#181206](https://github.com/openclaw/openclaw/pull/181206). Thanks to [@steipete](https://github.com/steipete), [@RomneyDa](https://github.com/RomneyDa) and [@ndakota79](https://github.com/ndakota79).

  </details>

- Fixes repair failing on interrupted package updates after a filesystem remount.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Repair recognizes the published launcher while continuing to reject a replacement launcher. [Released change](https://github.com/openclaw/openclaw/commit/7987c2feeb3565356b84eae7b7fbbdd9ddcd5cb6), adapting [#186557](https://github.com/openclaw/openclaw/pull/186557). Thanks to [@ericcaiwx-star](https://github.com/ericcaiwx-star), [@RomneyDa](https://github.com/RomneyDa) and [@sennyhoney](https://github.com/sennyhoney).

  </details>

## Skills

- Skill icons and required-tool metadata now load correctly when an inline YAML value has a trailing comment.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Quoted hash characters remain part of the value. [Released change](https://github.com/openclaw/openclaw/commit/72a0be25c7b962563df4c5101feff589aa95a1bd), from [#171224](https://github.com/openclaw/openclaw/pull/171224). Thanks to [@zhangguiping-xydt](https://github.com/zhangguiping-xydt), [@Takhoffman](https://github.com/Takhoffman) and [@RomneyDa](https://github.com/RomneyDa).

  </details>

## Native Apps

- Fixes the Mac app reporting a false Gateway failure when a remote or inactive profile has no local service to stop.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  [#181257](https://github.com/openclaw/openclaw/pull/181257). Thanks to [@shakkernerd](https://github.com/shakkernerd).

  </details>

## Models and Providers

- Fixes chat and model-list requests failing when one sign-in refresh overtakes another, and keeps required plugins available while the refreshed model list is prepared.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Redundant sign-in refresh work is also skipped when another refresh has already completed it. [#179144](https://github.com/openclaw/openclaw/pull/179144) and the [release follow-up](https://github.com/openclaw/openclaw/commit/c588551320392196ce26df360d9bcedc7c6e8e31). Thanks to [@steipete](https://github.com/steipete) and [@RomneyDa](https://github.com/RomneyDa).

  </details>

- Video-generation results now show options that the provider ignored, in both text and JSON output.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  [Released change](https://github.com/openclaw/openclaw/commit/a25939610a992b3ec5bf43954fdec7572b17a3f4), from [#171172](https://github.com/openclaw/openclaw/pull/171172). Thanks to [@ly85206559](https://github.com/ly85206559), [@obviyus](https://github.com/obviyus) and [@RomneyDa](https://github.com/RomneyDa).

  </details>

- Images sent while steering an active Codex turn now resolve from that session’s workspace, rather than incorrectly accepting a shared-workspace image or rejecting the intended one.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  This repairs the session-scoped image path when `tools.fs.workspaceOnly` is false. [#181528](https://github.com/openclaw/openclaw/pull/181528). Thanks to [@RomneyDa](https://github.com/RomneyDa).

  </details>

## Plugins and Integrations

- New ACP sessions now run tools in the project folder you requested, including after a session reset, instead of silently using the default workspace.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Use an absolute folder path on the Gateway host. Sessions selected by an existing key or label keep their saved folder. [#176852](https://github.com/openclaw/openclaw/pull/176852). Thanks to [@yinx65588-boop](https://github.com/yinx65588-boop), [@obviyus](https://github.com/obviyus) and [@crappier](https://github.com/crappier).

  </details>

- Connected nodes no longer disconnect when you reapprove their capabilities while a command is being prepared.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Commands approved under the previous pairing generation remain refused. [Released change](https://github.com/openclaw/openclaw/commit/1300a3c317884fb29cefe55939f4c16373cb92a8), carried by [#187461](https://github.com/openclaw/openclaw/pull/187461). Thanks to [@RomneyDa](https://github.com/RomneyDa) and [@steipete](https://github.com/steipete).

  </details>

## Security and Privacy

- MCP tools now reject malformed addresses in their input definitions and follow valid relative links correctly.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  This adds remediations for the affected URI-parser vulnerabilities by updating fast-uri to 4.2.3. Malformed schema identifiers that were previously accepted may now fail validation. [#187284](https://github.com/openclaw/openclaw/pull/187284). Thanks to [@RomneyDa](https://github.com/RomneyDa).

  </details>

- Microsoft Teams and affected Azure sign-ins now receive remediations for a library flaw that could send application credentials to the wrong destination.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  The fix is included in managed plugin installations and upgrades. MSAL Node 7.1.1 is scoped to the affected Teams apps and Azure Identity versions. [#187294](https://github.com/openclaw/openclaw/pull/187294). Thanks to [@RomneyDa](https://github.com/RomneyDa), with upstream remediation by [@Robbie-Microsoft](https://github.com/Robbie-Microsoft).

  </details>

- Fixes IMAP sender checks accepting a spoofed message when a trusted address is hidden inside nested comments in its From header.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  This applies when IMAP uses a token tied to a particular sender to decide which email may reach your agent. The affected address parsers now use Nodemailer 10.1.4. [#187302](https://github.com/openclaw/openclaw/pull/187302). Thanks to [@RomneyDa](https://github.com/RomneyDa).

  </details>

- Canvas/A2UI and Discord Activity now avoid unnecessary processing by rejecting oversized collections of data when a size limit is defined.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  The patches apply to arrays and sets with declared upper bounds in the stable Zod 3 package and Discord’s separately embedded parser. Oversized-input errors can contain fewer individual item errors. [#187303](https://github.com/openclaw/openclaw/pull/187303) and [#187296](https://github.com/openclaw/openclaw/pull/187296). Thanks to [@RomneyDa](https://github.com/RomneyDa).

  </details>

- Workspace-only restrictions now apply to Gateway-built delegation and media tools, so restricted setting changes require approval and media reads stay within the allowed folders.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Explicit policy overrides and read-only attachment exceptions retain their existing behavior. [#187276](https://github.com/openclaw/openclaw/pull/187276), adapting [#185094](https://github.com/openclaw/openclaw/pull/185094). Thanks to [@eleqtrizit](https://github.com/eleqtrizit) and [@RomneyDa](https://github.com/RomneyDa).

  </details>

- MCP command-line inspection now hides recognized credentials instead of exposing them in terminal output and captured transcripts. Scripts reading these inspection results receive redaction placeholders rather than secret values.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Saved credentials remain intact, including supported inspect, edit and save round trips. [#180321](https://github.com/openclaw/openclaw/pull/180321). Thanks to [@brandon-julio-t](https://github.com/brandon-julio-t), [@wr-web](https://github.com/wr-web) and [@steipete](https://github.com/steipete).

  </details>

- Google sign-in client secrets are now masked in console and log-tail output. Raw local log files and model-visible tool output are unchanged.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  [#183193](https://github.com/openclaw/openclaw/pull/183193). Thanks to [@LeizhenZhang](https://github.com/LeizhenZhang), [@steipete](https://github.com/steipete) and [@osher86](https://github.com/osher86).

  </details>

## Quality-of-Life Improvements

- Remote Gateway probes now respect an explicitly requested SSH port 22 instead of switching to the port configured for an SSH alias.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  Targets without an explicit port still use their SSH configuration. [Released change](https://github.com/openclaw/openclaw/commit/5db1cacbae4622f71ae6ad611e3a7ab7d2bb9903), from [#171092](https://github.com/openclaw/openclaw/pull/171092). Thanks to [@zhangguiping-xydt](https://github.com/zhangguiping-xydt), [@obviyus](https://github.com/obviyus) and [@RomneyDa](https://github.com/RomneyDa).

  </details>

- Command errors now preserve warnings when OpenClaw cannot confirm that process cleanup finished, along with the command output and exit details.

  <details class="release-source-toggle release-source-inline">
  <summary>More details</summary>

  [#187272](https://github.com/openclaw/openclaw/pull/187272), adapting [#184270](https://github.com/openclaw/openclaw/pull/184270). Thanks to [@shakkernerd](https://github.com/shakkernerd) and [@RomneyDa](https://github.com/RomneyDa).

  </details>