A new paper from researchers at Writer provides a solution that is accessible to engineering teams. The study takes a systematic look at optimizing the different components of the orchestration layer that wraps around the foundation model, aka the AI harness. 

By optimizing the harness, the researchers show dramatic reductions in tokens per task, a drop in cost-per-successful-task by up to 61%, and quality that holds steady, all without changing the underlying foundation model.

Because the harness is fully under the developer's control and requires no model fine-tuning, engineering teams can apply these findings to build highly cost-efficient AI applications.

The ROI crisis of tokenmaxxing

The current state of AI engineering is plagued by "tokenmaxxing," an industry trend where developers rely on massive context windows and brute-force token consumption as a substitute for good system design. 

Rather than engineering elegant workflows, developers have imported a reflex from traditional software development: generate, run, fail, stuff the error and more context back into the window, and retry. 

"Teams tokenmaxx because it's the cheapest fix in the moment, and because it's literally how most engineers work today," Waseem AlShikh, CTO and co-founder of Writer, told VentureBeat. Because this approach succeeds often enough on coding tasks, it has become the default reflex for every other agentic workload. The danger is that per-token price drops mask the underlying inefficiency. 

"Your invoice is tokens-per-task times price-per-token, and most teams only watch the second number," AlShikh said. "In agentic workloads, tokens-per-task compounds — every loop iteration re-transmits the growing context — and it compounds faster than prices fall. The price cut becomes an anesthetic. It masks the fact that the loop itself is bleeding."

Tokenmaxxing leads to several enterprise failure modes. Teams route simple tasks to premium frontier models by default. They use the LLM as a lazy search index, stuffing the context window with raw documents instead of retrieving exact answers. Most destructively, they build unconstrained agentic loops that spiral out of control when the model encounters an error. Because output tokens cost significantly more than input tokens across all major model providers, inefficient task execution acts as a silent budget killer.

The industry has introduced several efficiency techniques to curb these costs, but they largely fall short because they treat the model in isolation: 

• Prompt compression condenses input text to save space, but ignores how the system sequences those inputs across complex workflows. 

• Budgeted reasoning caps the computational steps a model can take, which often degrades output quality if the workflow isn't intelligently routed. 

• Terse coding forces models to output minimal code to save output tokens, but does nothing to solve inefficient tool calling. 

• Speculative decoding uses a smaller draft model to speed up a larger model's text generation, optimizing inference speed while failing to address bloated agent architectures.

These efforts fail because they optimize the engine while ignoring the transmission. They do not look at the orchestration layer, leaving underlying architectural inefficiencies unresolved.

Unpacking the harness: the levers of efficiency

The harness is the orchestration layer that routes, formats, and turns the underlying LLM into a working system.

The core levers of harness optimization include system prompt caching, interaction history compaction, tool management, retrieval strategies, and error management. These are the most accessible intervention points for engineering teams looking to improve AI performance. 

As the Writer researchers note in the study: “If the harness is the layer that composes model calls into work, it is also the layer that sets the price of work.”

Historically, developers have treated the harness as disposable glue code designed simply to connect an API to a user interface. The study signals that the harness must now be treated as a first-class object: a primary software artifact that requires its own testing, versioning, and rigorous design. 

For enterprises, this reframes the "own-versus-rent" decision. 

"Enterprises spend months on model evaluations and then rent their orchestration off the shelf — which means they're optimizing the smaller lever and outsourcing the bigger one," AlShikh said. "Whoever owns the harness owns your unit economics, and an open framework tuned for demos is not tuned for your invoice." 

Inside the experiments

To isolate the impact of the orchestration layer, the researchers ran experiments on six foundation models spanning multiple vendors and weight classes: Claude Sonnet 4.6, Gemini 3.1, Gemini Flash 3.5, Qwen 3.6, GLM 5.1, and Writer’s own model, Palmyra X6. 

Their experiments compared a frozen, conventional production agent loop against the finished Writer Agent Harness on the same 22 locked enterprise tasks, spanning capabilities like grounding and retrieval, multi-step workflows, tool use, and content generation. By holding the models and tasks constant, they could isolate the effects of the orchestration layer itself.

The optimized harness drove a significant drop in costs, cutting the blended cost per task by 41%, from 21 cents to 12 cents. This was largely achieved by slashing token consumption, with the number of tokens per task falling 38%, from 14.2k to 8.8k.

The harness is designed to delegate tasks like search to specialized sub-agents. A sub-agent receives only the tool and the specific query it needs, retrieves the exact data, and returns a capped, clean summary to the main agent — keeping the primary context window from filling up with raw search results.

Task success rates held steady even as token use fell — moving from 78% to 81%, a gain the researchers describe as directional rather than statistically significant at their sample size, meaning quality didn't suffer even as costs dropped.

End-to-end task latency also dropped significantly, reducing the median wall-clock time by 44%, from 48 seconds to 27 seconds, due to prompt caching and the elimination of dead-end reasoning loops.

However, the researchers also found limits to multi-agent orchestration. Smaller models like Gemini Flash 3.5 and Qwen 3.6 scored well below a usable reliability threshold on sub-agent delegation tasks (0.45 and 0.42, respectively) — the capability simply isn't dependable yet on lighter-weight models.

Sub-agent orchestration only crossed a usable reliability threshold on the two strongest models tested: Writer's own Palmyra X6 (0.86) and Claude Sonnet 4.6 (0.85).

The developer’s playbook: actionable takeaways and tradeoffs

The findings from the study translate into a playbook for enterprise developers building agentic workflows at scale. The first step is to implement what AlShikh calls the "Two-Zone Prompt" and "Context Offloading."

Structure for system prompt caching (The Two-Zone Prompt): Modern LLM APIs offer prompt caching, but developers must structure their payloads correctly to trigger it. Developers must separate the "stable zone" from the "volatile zone." Place static, unchanging elements (e.g., core rules, large tool schemas, and standard operating procedures) at the top of the prompt. Dynamic elements, such as the specific user query or recent conversational task state, must be appended at the bottom. This ordering allows the harness to reuse the cached prefix across hundreds of calls. "That single separation makes prompt caching actually work and stops you from re-paying for the same instructions on every one of an agent's thirty steps," AlShikh said.

Manage context with Context Offloading: Avoid context stuffing, where every turn of a loop is appended into a monolithic prompt until the window maxes out. Instead, move history and intermediate artifacts out of the window into retrievable storage, and pull back only what the current step needs. If possible, delegate tasks to single-purpose sub-agents to avoid context bloat. As AlShikh points out, "the biggest line item in agent spend isn't reasoning — it's re-sending things the model has already seen."

Build resilient loops and redefine KPIs: Unmanaged agent loops drain API budgets rapidly. Teams must begin tracking Completions Per Million tokens (CPM) to understand their true task costs, but the harness itself must contain physical guardrails. "The core principle is that you never ask the model to police its own spending," AlShikh said. "The fence has to live below the model, in code, on your side of the API." This requires three hard checks:

• Hard per-task token budgets: The run terminates when the budget is spent, no exceptions.

• Generation fencing: Caps on steps, tool calls, and recursion depth to stop non-converging agents. 

• Failure-spend governance: Cap what a run can spend after its first failed validation so a failing task doesn't become your most expensive task.

Avoid unnecessary complexity: Optimizing the orchestration layer comes with engineering overhead. If you're in the prototyping and exploration stage, that overhead isn't justified — iterate fast with a strong model and a light harness. Once you're scaling to millions of requests a day, the savings from harness optimization become substantial.

However, teams must be aware of "harness leverage." Adding structural scaffolding requires the model to hold and obey that context. If a model is too small, it will spend its limited capacity parsing the scaffolding instead of doing the task, causing accuracy to drop and tokens to rise. The rule for adding complex orchestration features is strictly mathematical: "If a feature adds more coordination tokens than it removes task tokens for that specific model, cut it," AlShikh said. "Nothing in the harness is free."

The future of the enterprise harness

The era of tokenmaxxing and treating context windows like bottomless buckets is coming to an end. Throwing more compute at poorly designed systems is not a viable strategy for companies that need to demonstrate a return on their AI investments. 

As foundation models evolve to absorb planning, tool selection, and multi-step reasoning natively into their weights, the role of the harness will shift from compensating for model weakness to enforcing enterprise policy.

"What never moves into the model is the 'allowed': budgets, permissions, data boundaries, audit trails, deterministic kill-switches," AlShikh said. "Five years from now, the harness will be thinner but more important. There will be less scaffolding and more governance. However capable the model gets, someone external to it still has to define what it may spend, see, and touch. That layer belongs to the enterprise, and it should never be rented."

Summary

SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.

The following versions of Siemens SINEC OS are affected:

• RUGGEDCOM RST2428P (6GK6242-6PA00) vers:intdot/<4.0 

Background

• Critical Infrastructure Sectors: Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, Government Services and Facilities
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Germany

Vulnerabilities

Acknowledgments

• Siemens ProductCERT reported these vulnerabilities to CISA.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Terms of Use

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Siemens ProductCERT SSA-253495 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Siemens ProductCERT directly for any questions regarding this advisory.

Revision History

• Initial Release Date: 2026-06-02

Legal Notice and Terms of Use

See the installation instructions for details, but it's easy:

• macOS: brew install ddev/ddev/ddev or just brew upgrade ddev.
• Linux: Use sudo apt-get update && sudo apt-get install ddev, see apt/yum installation
• Windows and WSL2: Download the Windows Installer; you can run it for install or upgrade.
  ⚠️ Traditional Windows users (not WSL2): If needed, the installer will prompt you to uninstall the previous system-wide installation to avoid conflicts with the new per-user installation.
• Consider ddev delete images or ddev delete images --all after upgrading to free up disk space used by previous Docker image versions. This does no harm.
• Consider ddev config --auto to update your projects to current configuration.

Highlights

Blog announcement: https://ddev.com/blog/release-v1-25-3/

• New Docker Compose library: Improved UX during ddev start and ddev stop; the separate ~/.ddev/bin/docker-compose binary is no longer needed and can be removed
• Faster ddev start: Reduced startup time by running post-healthcheck tasks concurrently, thanks to @jonesrussell
• Faster ddev stop: Fixed a bug in the webserver startup script that added an unnecessary ~10-second delay
• MariaDB 12.3 LTS support
• Podman and Docker rootless are no longer experimental: Both are now stable and ready for general use:
  • macOS (Podman rootless)
  • Linux/WSL2 (Docker rootless)
  • Linux/WSL2 (Podman rootless)

Breaking Changes

• Remove support for XDG_CONFIG_HOME, replaced by DDEV_XDG_CONFIG_HOME. Support for ~/.config/ddev on Linux is unchanged. This change was needed because some IDEs, such as PhpStorm, don't always see XDG_CONFIG_HOME set in the terminal (see this issue), which caused the IDE to recreate the ~/.ddev directory repeatedly
• Use stricter permissions for world-writable directories inside ddev-webserver. If you had post-start hooks that wrote to /usr/local/bin, update them to use ~/.local/bin instead, thanks to @AkibaAT
• Move N_PREFIX from /usr/local to /usr/local/n. This shouldn't affect most people, unless you referenced a full path such as /usr/local/bin/npm - the new location is /usr/local/n/bin/npm, or simply use npm without a full path
• Remove the ddev dr alias for ddev drush, since dr is now a built-in command for Drupal 11.4+

Features

• Node.js improvements: preserve nodejs_version in .ddev/config.yaml, and install several Node.js versions with n install <version> inside the web container
• Docker rootless on Linux no longer requires no-bind-mounts; disable it with ddev config global --no-bind-mounts=false
• Support the gvisor-tap-vsock network driver in Docker rootless
• Add new ddev dr command for Drupal 11.4+
• Allow using Mutagen together with ddev config global --use-hardened-images=true
• ddev version and ddev config now work even when Docker isn't running or is broken, and ddev poweroff shows progress output instead of appearing to hang
• Improve ddev list and ddev describe layout on narrow terminals
• Add OSC 8 terminal hyperlink support to ddev list, ddev describe, ddev add-on list, and ddev add-on search
• Show human-readable output when checking available disk space, thanks to @wolcen
• Always pull images when using ddev start --no-cache
• Respect the COMPOSER_NO_BLOCKING environment variable from the host in ddev composer
• Add ddev config global --docker-buildx-version to specify which Docker Buildx version to use (advanced use only)
• Respect docker-buildx installed via snap on Linux
• Support Debian, Kali, and eLxr WSL2 distros in the Windows installer, and avoid installing docker-ce over an existing Docker Desktop docker binary
• Add ddev utility addon-update-checker command for add-on maintainers
• Add #ddev-interactive option for add-on actions, thanks to @AkibaAT
• Add x-ddev.omit-ddev-labels extension to skip com.ddev.* label injection for specific services
• Support the Flatpak user binary for DBeaver on Linux, thanks to @nickchomey
• Add a quickstart for Drupal 12 (HEAD), thanks to @rpkoller
• Add troubleshooting for Let's Encrypt certificate failures, thanks to @jonpugh

Bug Fixes

• Windows installer: fix installation on WSL2 Ubuntu 26.04, which previously failed due to the deprecated wslu package
• Suppress 404 logs for favicon.ico and robots.txt; in some cases these caused Nginx to run a PHP script twice
• Prevent recursion in global web command wrappers
• Use the correct settings.ddev.php for each Drupal version
• Fix a bug where .ddev/apache/apache-site.conf went missing when using a custom Nginx config
• Detect a missing docker CLI, which is required when using Mutagen
• Limit the ENV HOME="" workaround for MySQL 8.x to the database context only
• Podman and macOS: restrict the keep-id userns setting to Linux only
• Use the nodejs_version set during the ddev-webserver image build; if you installed global npm packages in post-start hooks, move them to extra Dockerfiles instead
• Use wrapper scripts in ddev-dbserver to avoid mysql deprecation warnings with MariaDB 11.x+
• Warn when the CAROOT environment variable is set but the mkcert CA files (needed for HTTPS in your browser) are inaccessible
• Normalize OSTYPE detection on Linux, thanks to @Mikee-3000
• Avoid double-sourcing bashrc configuration in ddev ssh
• Skip OS-generated metadata files (.DS_Store, Thumbs.db, desktop.ini) during custom-config detection and in .ddev/.gitignore
• Restore path autocompletion for ddev add-on get
• Don't prompt to run ddev poweroff after updating ddev-ssh-agent
• Fix a case typo in ddev sequelace so Sequel Ace is detected on case-sensitive macOS filesystems, thanks to @mficzel

Internal Changes

• Migrate DDEV documentation from Material for MkDocs to Zensical
• Upgrade Bubble Tea (ddev tui) to v2
• Add light/dark/system preference variants for the brand logo
• Remove automated testing on macOS Intel; macOS amd64 binaries are still built and distributed, only CI testing on Intel hardware is removed
• Add automated testing for macOS Podman rootless
• Improve the test embargo system for Go, Bats, and CI workflows; tests can now be skipped when needed
• Add custom GitHub workflows to run tests on branches without opening a PR
• Rework local HTTP test helpers for clearer failure output
• Remove the build step for the Docker image used in ddev auth ssh
• Bump all Go dependencies

Minor Updates

• PHP 8.4.22 and 8.5.7

What's Changed

• test: Reenable Drupal 12 bats test (#8346) [skip ci] by @rpkoller in #8346
• chore(claude): fix PreToolUse hook matcher for git commit static analysis (#8345) [skip ci] by @stasadev in #8345
• docs(add-ons): Minor updates to creating-add-ons.md by @rfay in #8347
• perf: combined startup time optimizations, for #8096 by @jonesrussell in #8145
• fix(windows): remove wslu from installer, fixes #8326 by @stasadev in #8351
• fix(webserver): replace phar.io/filippo.io links with GitHub releases, improve Dockerfile, for #8012 by @stasadev in #8352
• docs(quickstart): add a quickstart for Drupal 12 (#8357) [skip ci] by @rpkoller in #8357
• feat(docker): always pull images with --no-cache by @stasadev in #8363
• fix(download-images): pull webserver image, for #8304 by @stasadev in #8358
• fix(start): use image digest for rebuild detection, fix rand and ssh-agent data races, for #8145 by @stasadev in #8359
• fix(test): skip TestCheckLiveConnectivityWithProject on Rancher/Colima/Lima, fix misleading WSL2 labels by @rfay in #8365
• docs(windows): add WSL2 installation step to Docker docs by @stasadev in #8355
• chore: fix claude hooks and update agent docs [skip ci] by @rfay in #8370
• chore: remove macOS amd64 CI testing (#8372) [skip ci] by @rfay in #8372
• fix(drupal): use configured project type for settings.php version selection by @rfay in #8366
• ci: run golangci-lint by @stasadev in #8375
• docs(mutagen): explain how to reset to the default mode, fixes #8367 by @silverham in #8368
• docs(configuration): Add ddev config --database=<database type>:<version> example command (#8387) [skip ci] by @silverham in #8387
• build: bump fuxingloh/multi-labeler from 4 to 5 (#8385) [skip ci] by @dependabot[bot] in #8385
• docs: clarify --cleanup --name for single snapshot deletion (#8384) [skip ci] by @CallMeLeon167 in #8384
• docs(add-ons): add real example for bats testing (#8377) [skip ci] by @stasadev in #8377
• fix(commands): normalize $OSTYPE detection for linux, fixes #8382 by @Mikee-3000 in #8383
• docs: Add Xcode iOS simulator info (#8371) [skip ci] by @jamesmacwhite in #8371
• feat(utility): add ddev utility addon-update-checker command by @stasadev in #8373
• fix(add-ons): autocomplete for path by @stasadev in #8376
• test(wsl2): fix TestHostDBPort by @stasadev in #8391
• test(windows): fix TestUtilityAddonUpdateCheckerCmd, for #8373 by @stasadev in #8394
• docs(quickstart): Add description to Drupal Git clone example by @gitressa in #8395
• fix(ddev-webserver): ddev stop takes 10s due to bash deferring SIGTERM during foreground cat, fixes #8295 by @rfay in #8396
• docs: unify homeadditions path resolution and Composer auth.json handling by @eiriksm in #8400
• docs(providers): align --environment examples and flags, fixes #8402 by @stasadev in #8403
• test(share): improve cloudflared debug output on unmarshal errors by @rfay in #8398
• ci(github): reorganize test jobs, add custom workflow_dispatch, remove unused workflows by @stasadev in #8401
• feat(add-on): add #ddev-interactive option for actions, fixes #8155 by @AkibaAT in #8381
• refactor(tui): upgrade bubbletea/bubbles/lipgloss to v2 by @stasadev in #8404
• ci: add DDEV_EMBARGO_PHP_VERSIONS to skip specific PHP versions in TestPHPConfig [skip ci] by @rfay in #8407
• feat: use docker-compose library, optionally download docker-buildx, fixes #7915, for #8295 by @stasadev in #8234
• ci(docs): add stable docs branch workflow, fixes #7862 by @stasadev in #8408
• ci(forks): fetch variables from public-variables branch by @stasadev in #8410
• ci(wsl2): read public-variables in pwsh, for #8410 by @stasadev in #8411
• ci: improve test embargo system for Go, bats, and CI workflows by @stasadev in #8413
• docs(config): improve wording for database and docker_buildx_version, for #8387 by @stasadev in #8409
• refactor: improve CheckAvailableSpace reliability and output, fixes #8388 by @wolcen in #8412
• ci(buildkite): fix MSYS path conversion breaking public-variables fetch on Windows, for #8410 by @stasadev in #8416
• docs(brand-guide): add light, dark, and auto logo variants to logos table, fixes #8417 by @stasadev in #8419
• feat(docs): migrate from mkdocs-material to zensical, fixes #7840, fixes #8216 by @stasadev in #8421
• docs(add-ons): mention #ddev-generated in quickstart by @chx in #8420
• ci(docs): enable zensical strict mode, use dynamic Pages base URL, for #8421 by @stasadev in #8423
• fix(ddev-dbserver): unlink stale socket before mysqld init by @stasadev in #8424
• test: add details to TestCmdAddonPHP by @stasadev in #8425
• chore(sponsors): update percentage and api link [skip ci] by @stasadev in #8427
• ci(pr): migrate to ddev/commit-message-checker@v3 by @stasadev in #8428
• test(lima): fix broken cleanup in TestCmdAddonPHP, for #8425 by @stasadev in #8430
• fix: replace remaining world writeable directories, fixes #8251 by @AkibaAT in #8379
• chore(composer): add COMPOSER_NO_BLOCKING by @stasadev in #8432
• fix(exec): allocate TTY only when stdout is also a terminal, for #8234 by @stasadev in #8431
• feat(docker-rootless): remove no-bind-mounts requirement, test gvisor-tap-vsock by @stasadev in #8426
• build: pin Node.js to 24.15.0, fixes #8436 by @stasadev in #8438
• test(linux): wait for nc to bind before asserting in port-diagnose tests by @stasadev in #8446
• test: rework local HTTP test helpers with clearer failure output by @stasadev in #8447
• fix(nodejs): move install to Dockerfile, add ~/n/bin to PATH, fixes #8414, fixes #8415 by @stasadev in #8443
• fix(zensical): retry strict build on false-positive "page does not exist" warnings by @stasadev in #8451
• ci(linux): use full homebrew formulae name, fixes #8450 by @stasadev in #8455
• test(quickstart): update asterios page check by @stasadev in #8454
• feat: add MariaDB 12.3 LTS support, fixes #8452 by @rfay in #8453
• fix(dbserver): use wrapper scripts for MariaDB 11.x+ MySQL compat, fixes #6861 by @stasadev in #8456
• test(buildkite): Fix brew upgrade to use -y for new 6.0.0 release, fix setup-homebrew by @rfay in #8469
• build(gnupg): Remove references to obsolete gnupg2 by @rfay in #8475
• fix: recreate service on ddev utility rebuild -s, support profile services by @stasadev in #8463
• fix(nodejs): preserve nodejs_version in config.yaml, fixes #8186 by @stasadev in #8462
• fix(nodejs): move N_PREFIX to /usr/local/n and make it writable, fixes #8465 by @stasadev in #8467
• fix(nginx): suppress favicon.ico and robots.txt 404 logs, fixes #7010 by @stasadev in #8461
• fix(ssh): use RawCmd to avoid double-sourcing bashrc, fixes #5232 by @stasadev in #8460
• docs: install util-linux-extra in Docker setup, fixes #8350 (#8480) [skip ci] by @rfay in #8480
• feat: improve ddev list/describe table layout, add OSC 8 terminal hyperlinks, fixes #5535, fixes #6113 (#8474) [skip ci] by @rfay in #8474
• fix: skip OS-generated metadata files in custom-config detection and .ddev/.gitignore, fixes #8418 (#8478) [skip ci] by @rfay in #8478
• fix(mutagen): detect missing docker CLI early, fixes #8457 by @rfay in #8479
• docs(docker): add troubleshooting for permission denied, for #8471 (#8483) [skip ci] by @stasadev in #8483
• test(quickstart): update shopware6 by @stasadev in #8482
• fix: warn when CAROOT is set but CA files are inaccessible, fixes #8485 (#8486) [skip ci] by @rfay in #8486
• fix(tui): prevent docker/cli stdin from consuming TUI shortcuts, fixes #8440 by @stasadev in #8489
• fix: add /usr/local/n/bin to sudo secure_path, fixes #8488 by @stasadev in #8490
• fix(start): show warnings from log-stderr.sh on start, fixes #8441 by @stasadev in #8481
• build(deps): bump go dependencies, migrate to go-github v88 by @stasadev in #8492
• test(quickstart): pin @sveltejs/adapter-node@5.5.4 by @stasadev in #8497
• test(docs): Ignore link check URLs [skip ci] by @rfay in #8499
• build: bump actions/checkout from 6 to 7 (#8504) [skip ci] by @dependabot[bot] in #8504
• fix: restrict XDG_CONFIG_HOME to Linux, add DDEV_XDG_CONFIG_HOME for cross-platform overrides, fixes #8493 by @rfay in #8494
• fix(webserver): prevent recursion in global web command wrappers, for #6902 by @stasadev in #8495
• fix(nodejs): always install gulp-cli and yarn, fixes #8496 (#8498) [skip ci] by @stasadev in #8498
• feat(windows): support Debian and Kali WSL2 distros in GUI installer, fixes #8439, fixes #8468 by @rfay in #8464
• build: Fix gomt error that crept in [skip ci] by @rfay in #8509
• test: Add script to compare start time performance [skip ci] by @rfay in #8510
• test(quickstart): remove pin for @sveltejs/adapter-node, for #8497 by @stasadev in #8511
• ci(github): add brew sandbox setup, remove obsolete env, for #8469 by @stasadev in #8512
• fix(mysql): guard ENV HOME injection to db context only, fixes #8508 by @stasadev in #8513
• fix(docker): do not cache build on start, fixes #8433 by @stasadev in #8506
• feat(drupal): Support new dr command built into drupal11.4+, fixes #8500 by @rfay in #8507
• fix(dbeaver): Add flatpak user binary path to search list, fixes #8517 by @nickchomey in #8518
• refactor(auth-ssh): remove build step, fixes #8501 by @stasadev in #8503
• feat: allow mutagen with use-hardened-images, for #3680 by @stasadev in #8491
• feat(docker): respect docker-buildx from snap on linux, fixes #8515 by @stasadev in #8519
• docs: replace newgrp with sg for docker group activation, fixes #8350 by @rfay in #8524
• fix(commands): correct case typo in ddev sequelace, fixes #8521 (#8522) [skip ci] by @mficzel in #8522
• build(deps): bump moby and docker-compose by @stasadev in #8523
• docs: skip codeberg, use stable link for docs in github workflows (#8528) [skip ci] by @stasadev in #8528
• build: remove pin for Node.js, for #8438 by @stasadev in #8527
• fix(start): do not ask for poweroff with new ddev-ssh-agent, fixes #8520 by @stasadev in #8525
• ci(podman): update workflow for Podman 6 by @stasadev in #8526
• fix(podman): restrict keep-id userns to Linux only, fixes #8223, fixes #8529 by @stasadev in #8516
• docs: Remove link to very old processwire thread (#8533) [skip ci] by @rfay in #8533
• fix: continue when #ddev-generated is missing in generate config functions, for #2305 by @stasadev in #8532
• docs: Ignore winaero.com, cert expired [skip buildkite] (#8537) [skip ci] by @rfay in #8537
• ci: add macOS Podman rootless Buildkite pipeline, for #8223 (#8530) [skip ci] by @rfay in #8530
• test(auth-ssh): harden ddevauthssh.expect against passphrase prompt race by @stasadev in #8536
• build: bump actions/cache from 5 to 6 (#8538) [skip ci] by @dependabot[bot] in #8538
• fix: stop honoring XDG_CONFIG_HOME on Linux too, use DDEV_XDG_CONFIG_HOME, fixes #8493 by @stasadev in #8531
• fix: correct typos in global and project config comment docs (#8541) [skip ci] by @stasadev in #8541
• test: fix TestCheckForMultipleGlobalDdevDirs on Windows, for #8531 (#8542) [skip ci] by @rfay in #8542
• feat: add x-ddev.omit-ddev-labels to skip com.ddev.* label injection, fixes #8389 by @stasadev in #8540
• build(docker): bump images to v1.25.3 for release, fixes #8544 by @stasadev in #8547
• ci(buildkite): trim podman machine and run maintenance post-test (#8551) [skip ci] by @stasadev in #8551
• docs(typo3): require Camino theme, drop empty distribution prompt (#8548) [skip ci] by @rfay in #8548
• docs(hosting): add guidance for Let's Encrypt failures by @jonpugh in #8543
• docs(docker): add Podman and Docker rootless setup, fixes #8434 by @stasadev in #8552
• ci(macos): untap pre-installed aws/tap before brew install by @rfay in #8559
• docs(wsl2): use Ubuntu-26.04 instead of Ubuntu-24.04, for #8326, for #8408 by @stasadev in #8553
• fix(webserver): restore nonstandard router port in HTTP_HOST for nginx-fpm, fixes #8554 by @rfay in #8555
• fix(router): temp pin for traefik:3.6.13, for #8562 by @stasadev in #8564
• fix(shopware): pin Twig <3.28 to work around admin HTTP 500 by @rfay in #8557
• docs: add TYPO3 special handling for ddev share, fixes #7799 by @rfay in #8556

New Contributors

• @silverham made their first contribution in #8368
• @CallMeLeon167 made their first contribution in #8384
• @Mikee-3000 made their first contribution in #8383
• @wolcen made their first contribution in #8412
• @chx made their first contribution in #8420
• @mficzel made their first contribution in #8522
• @jonpugh made their first contribution in #8543

Full Changelog: v1.25.2...v1.25.3

• Improve cluster file synchronization error handling by @TomasTurina in #36129
• Update trojan signatures to avoid false positives on modern distros by @Miguevrgo in #35927
• Improve cluster merged file parameter validation by @vikman90 in #36204
• Create a backup of local_rules.xml during execution of IT analysisd tier 0 1 by @Antoniogm03 in #36201
• Improve tmp_file path validation in cluster DAPI by @vikman90 in #36246
• Revert bump main branch by @wazuhci in #36303
• Bump 4.14.7 branch by @wazuhci in #36312
• Serialize procps access to prevent modulesd crash by @cborla in #36261
• Remove obsolete configuration blocks from API upload_configuration setting by @TomasTurina in #36252
• Restore working vulnerability scanner database workflow by @jotacarma90 in #36332
• Propagate agent merged_sum after hot reload in cluster by @jotacarma90 in #36164
• Merge 4.14.7 into main by @jotacarma90 in #36331
• Authd tier 0-1 flaky tests fix by @jotacarma90 in #36342
• Review agent info logs by @Antoniogm03 in #36234
• Fix the wazuh-manager-modules crash that occurs while downloading the feed by @Antoniogm03 in #36337
• Migrate FIM DB path queries to parameterized statements by @Darioortegaleyva in #36399
• Fix AlmaLinux 9/10 bootloader permissions SCA check regex and optional file handling by @vikman90 in #36396
• Cluster file processing parameter validation by @vikman90 in #36296
• Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs by @jotacarma90 in #36407
• Treat the absence of the hash document as expected, not an error by @juliancnn in #36355
• geo_point validation support all compatible formats by @LucioDonda in #36034
• Prevent Syscollector and SCA use-after-free on modulesd shutdown by @nbertoldo in #36359
• Add cluster security model and configuration documentation by @vikman90 in #36405
• Bump CB_SCAN_STARTED timeout and trigger ITs on wm_syscollector.c by @jr0me in #36446
• Fixed an issue in eBPF with LSM hooks and improved the health check by @MarcelKemp in #35838
• Validate cluster node name format by @vikman90 in #36460
• eBPF libraries updated by @MarcelKemp in #36467
• Bump 4.14.6 branch by @wazuhci in #36517
• Revert "Bump 4.14.6 branch" by @MARCOSD4 in #36518
• Bump 4.14.6 branch by @wazuhci in #36519
• Update changelog for 4.14.6 RC 1 by @jotacarma90 in #36562
• Fix policy evaluation errors by @fcontrerasc in #36449
• Release startup hash gate when the reload chain fails by @jr0me in #36302
• Revert "Add missing 4.10.2-4.10.5 and 4.8.2 entries to changelogs" by @MarcelKemp in #36591
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36624
• Restore event counter and classify received messages by @jotacarma90 in #36456
• Unify manager integration tests workflows by @ignaciogalle12git in #36235
• Remove unused Node.js 12 from arm64 deb agent builder by @Miguevrgo in #36156
• Remove unused Node.js 12 from arm deb agent builders (4.14.7) by @Miguevrgo in #36157
• SCA typo bug in SELinux SCA rule for CentOS 8/9/10 by @Miguevrgo in #36361
• Fix detect-changes glob to honour ** recursively and extract logic into a reusable action by @Nicogp in #36617
• Merge merge-4.14.6-into-4.14.7 into 4.14.7 [automated] by @wazuhci in #36623
• Reduce log noise when engine has no synchronized ruleset by @NahuFigueroa97 in #36356
• Update test modules paths by @rovogel in #36668
• Only download external deps when required by @TomasTurina in #36244
• Merge 4.14.7 into main by @jotacarma90 in #36664
• Mail forwarding and reporting 5.0 migration guide by @Ripdiegozz in #36357
• Added Ubuntu 26.04's SCA policy in the SPECS by @MarcelKemp in #36712
• Preliminary support new OSs - Ubuntu 26.04 - Add SCA content by @AwwalQuan in #36708
• Safeguards to inventory sync by @juliancnn in #36469
• Improve the method of detecting duplicates by @NahuFigueroa97 in #36344
• Fix race condition preventing inventory synchronization after agent reload by @nbertoldo in #36682
• Added API integration tests workflow by @MiguelazoDS in #36196
• Fix non-atomic write for file_status.json in logcollector by @nbertoldo in #36722
• Make agent-info shutdown waits interruptible by @lchico in #36719
• Validate IP address in ip-customblock active response by @vikman90 in #36730
• wazuh-agent remains active after uninstall on Fedora 44 / DNF5 by @Miguevrgo in #36727
• Use per-target rpath and remove redundant LD_LIBRARY_PATH/WAZUH_ENGINE_GROUP exports by @jotacarma90 in #36455
• Fix changelog chronological order and update bumper script by @Darioortegaleyva in #36729
• Monitoring a symlink without follow_symbolic_link by @Darioortegaleyva in #36081
• SCA policies migration guide from 4.x to 5.x by @jr0me in #36671
• Fix 5x wazuhdb integration tests by @ignaciogalle12git in #36713
• Downgrade transient manager-reported sync failures logs to debug by @jr0me in #36744
• Show sca timouts as Not Run by @jpcerrone in #36258
• Authd workflow creation for 5.x by @jepalfer in #36404
• Adapt remoted tests to 5.x by @Antoniogm03 in #36609
• Update unclassified event criteria by @LucioDonda in #36681
• use safeloader in yaml file loader by @LucioDonda in #36753
• Downgrade expected modulesd socket warnings/errors during agent restart to debug by @jr0me in #36755
• Documentation: Ciscat and openscap migration to SCA by @jpcerrone in #36723
• Document the deprecation of OSquery in order to use IT Hygiene in version 5.0 by @nbertoldo in #36756
• Preserve wazuh-syscheckd Full Disk Access attribution on macOS reload by @Nicogp in #36754
• Normalize severity Msg by @hernanvalenzuela in #36759
• Agent Groups 5x Migration Guide by @fcontrerasc in #36726
• Add NULL validation for optional FlatBuffer fields in inventory_sync by @vikman90 in #36773
• Fix agent keepalive scheduling after system clock rollback by @Darioortegaleyva in #36338
• Create integratord migration guide to 5.x by @Adman23 in #36750
• Syslog output (csyslogd) 5.0 migration guide by @gonzaarancibia in #36741
• Merge merge-4.14.7-into-main into main [automated] by @wazuhci in #36767
• Migration documentation: syslog input alternative by @rovogel in #36781
• Drop libcrypt dependency from Python dep by @jotacarma90 in #36782
• Change duplicated link to intented one by @Miguevrgo in #36794
• Add centralized input validation for active response framework by @vikman90 in #36745
• Fix sca check for etc/shadow by @Miguevrgo in #36795
• Align remoted metrics shipper with new field names by @jotacarma90 in #36740
• Fix wrap PolicyBanner stat in 'sh -c' so glob expands in macOS SCA check 41062 by @Nicogp in #36783
• Bump main branch by @wazuhci in #36801
• Defer module coordination while FIM first sync is in progress by @anromerom in #36762
• Revert "Bump main branch" by @MARCOSD4 in #36802
• Change log severity for recoverable and expected conditions by @hernanvalenzuela in #36786
• Prevent data race in schema validator factory concurrent initialization by @Nicogp in #36789
• Schema generation for dotted and nested field mappings by @jam300 in #36473
• Engine support null values in schema validation by @LucioDonda in #36470
• docs: add Active Response 4.x to 5.x migration guide by @jcorredor-spec in #36402
• Use env mappings for variable passing in builderpackage workflows by @Miguevrgo in #36738
• Adds 4.x to 5.x migration documentation. by @rjcausarano in #36785
• Fix AWS cross-account SQS queue URL when using iam_role_arn by @fcontrerasc in #36791
• Fix enrollment key validation and improve input handling by @vikman90 in #36807
• Lower agent_sync_protocol and module sync log levels to reduce false-alarm noise by @Nicogp in #36817
• Add unit tests for utils, aws_tools, DockerListener, gcloud and azure modules by @AnDumu in #36761
• Normalize numeric inode to string events (6960) by @hernanvalenzuela in #36837
• Prevent indexer consumer wait during shutdown by @jotacarma90 in #36836
• Update manager 5x documentation by @ignaciogalle12git in #36833
• Add bump-issue-link support to bumper workflow by @jotacarma90 in #36868
• Add guide for migrating manager coordinator from 4.x to 5.x by @jepalfer in #36829
• Add Wazuh Manager Configuration documentation from 4.x to 5.x by @Antoniogm03 in #36779
• Add documentation to migrate filebeat to indexer connector by @Antoniogm03 in #36866
• wazuh-manager: Benchmark and footprint by @juliancnn in #36145
• Update manager upgrade block message by @jotacarma90 in #36987
• 5.x PR workflows improvements by @ignaciogalle12git in #36766
• Add Manager 5.0 release notes and breaking changes by @ignaciogalle12git in #36850
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [main] by @jotacarma90 in #37012
• chore: update vulnerable Python framework dependencies by @jotacarma90 in #37024
• Add Manager 5.0 wazuh-manager.conf configuration reference by @jotacarma90 in #36999
• Add virustotal migration guide by @jepalfer in #37013
• Add VD migration documentation by @ignaciogalle12git in #37008
• Add documentation for wpk upgrade by @Antoniogm03 in #37015
• Migrate agent build workflows to AWS CodeBuild runners by @Nicogp in #37028
• XML Decoders migration to YAML by @jepalfer in #36959
• CDB to KVDB migration guide by @jepalfer in #36996
• Documentation of Agentless migration to 5.x by @Antoniogm03 in #37025
• Fix manager reload/restart silently fails by @ignaciogalle12git in #36962
• Randomize key generation for installation by @jepalfer in #36861
• Retry vulnerability feed validation failures promptly by @jotacarma90 in #36874
• Bump 5.0.0 branch by @wazuhci in #37040
• Fix agent permanently stuck when TCP connection is silently half-closed by @nbertoldo in #36790
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.6] by @jotacarma90 in #37010
• ci(gha): migrate server/manager workflows to AWS CodeBuild runners [4.14.7] by @jotacarma90 in #37011
• fix: correct blob URL refs for release branch by @jotacarma90 in #37046
• Use restricted wazuh-server user for Manager Indexer authentication by @jotacarma90 in #37061
• fix(packages): use wazuh-manager-control in manager init.d scripts by @jotacarma90 in #37059
• fix: Update the unclassified event doc by @juliancnn in #37126
• Skip vanished /proc entries during ports scan by @Nicogp in #36859
• Fix RBAC permission check to verify allow effect in update_config rules by @vikman90 in #37076
• Add destination confinement to worker non-merged and extra file sync paths by @jotacarma90 in #36998
• Patch cluster authentication by @ignaciogalle12git in #37039
• Lower stale-session indexer log to debug by @jotacarma90 in #37150
• Limit recursion depth in XML parser by @vikman90 in #37147
• Add status endpoint by @NahuFigueroa97 in #37022
• Add log collectors reference docs by @AnDumu in #37057
• Run the Windows MSI package test on the AWS CodeBuild runner by @nbertoldo in #37165
• Remove merged.mg hash cache to fix stale syscollector flush by @hernanvalenzuela in #37048
• Enrich MITRE fields with id and names by @fcontrerasc in #37054
• Reduce indexer connection warning noise by @jam300 in #37021
• Remove deprecated wazuh-dbd daemon by @vikman90 in #37035
• Bound decompressed size when processing sync archives by @jotacarma90 in #37119
• Bump 4.14.6 branch by @wazuhci in #37176
• Add libcrypt fix (#36782) to 4.14.6 changelog by @jotacarma90 in #37178
• Delay IndexerDownloader connection warnings until 3 failed attempts by @jotacarma90 in #37177
• Add parameterized target selection to Coverity scan workflow by @lchico in #37171
• Align remoted tier 2 CodeBuild setup by @jotacarma90 in #37155
• Add rules migration guide by @Jorgesnchz in #36305
• Migrate agent Linux/Windows test workflows to AWS CodeBuild runners by @Nicogp in #37051
• Silence spurious keepalive warnings on the Windows agent by @nbertoldo in #37187
• wazuh-engine: Improve log messages and logger by @juliancnn in #36995
• Set default indexer connector credentials by @TomasTurina in #37192
• Fix incorrect snprintf size calculation in winevtchannel decoder by @vikman90 in #37198
• Align VD feed-download log levels with indexer consumer state by @jotacarma90 in #37199
• Recognize renamed indexer consumer status in engine sync by @jotacarma90 in #37204
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37210
• Token replacement to avoid permission errors by @MarcelKemp in #37237
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37211
• Eliminate TOCTOU races in healthcheck file operations by @rjcausarano in #37160
• Sca file policy block standardization by @Johnng007 in #37179
• Bind agent index selection and scope deletes by cluster by @jotacarma90 in #37154
• Add Null Check for Inode and Dev Fields in FIM Whodata Event Handler by @vikman90 in #37245
• Docs/6764 logcollector whats new 5.0 by @AnDumu in #37056
• Repair RPM builder toolchain downloads by @jr0me in #37130
• Add cluster name validation by @TomasTurina in #37238
• Add cluster readiness endpoint by @NahuFigueroa97 in #37129
• Defer cluster payload buffer allocation until data is received by @jepalfer in #37280
• Indexer connector bulk size and flush interval configurable by @LucioDonda in #37158
• Enable shared-password enrollment by default by @ignaciogalle12git in #37151
• Fix unit test workflow paths and report handling by @jotacarma90 in #37317
• Migrate agent + server CI artifacts to S3 — 4.14.7 (#5300, #5298) by @jr0me in #37186
• Handle eol amazon inspector classic by @rovogel in #37194
• Fix wazuh-modulesd missing after macOS agent restart by @cborla in #37020
• Fix test_worker failing unit test by @jepalfer in #37314
• Improve log messages by @Antoniogm03 in #36876
• Improve changelog format by @jotacarma90 in #37332
• Lower log level of transient cluster IPC failures (#37277, #37276) by @jotacarma90 in #37326
• Fix TypeError when sorting agents by version with empty version strings by @TomasTurina in #37323
• Migrate agent + server CI artifacts to S3 — 5.0.0 (#5300, #5298) by @jr0me in #37185
• Validate asset resource names before policy promotion by @jam300 in #37172
• Revert wazuh-server indexer credentials and propagate log context in indexer connector by @jotacarma90 in #37333
• Add VD readiness status HTTP endpoint by @jotacarma90 in #37213
• Use github.workspace for wodles report paths by @Nicogp in #37342
• Skip FIM whodata cases on the tier-2 Linux job (CodeBuild) by @Nicogp in #37291
• Migrate 4.x Windows test runners to AWS CodeBuild by @Nicogp in #37193
• Lower log level of transient queue send failures in modulesd by @lchico in #37345
• Add changelog check workflow by @TomasTurina in #37343
• Add changelog check workflow for 5.0.0 by @TomasTurina in #37351
• Retry OS_SendUnix on ENOBUFS to stop dropping binary sync messages on macOS by @nbertoldo in #37349
• change: Allow null root_decoder as alias of empty string on policy cr… by @juliancnn in #37347
• Fix eBPF FIM whodata for Amazon Linux by @Miguevrgo in #37014
• Merge 4.14.6 into 4.14.7 by @jotacarma90 in #37358
• Bump 5.0.0 branch by @wazuhci in #37371
• Merge 4.14.7 into 5.0.0 by @jotacarma90 in #37360
• Migrate remaining CI artifacts to S3 for the 5.0.0 branch (#3502) by @jr0me in #37350

New Contributors

• @MARCOSD4 made their first contribution in #36518
• @Ripdiegozz made their first contribution in #36357
• @Adman23 made their first contribution in #36750
• @jcorredor-spec made their first contribution in #36402

Full Changelog: v5.0.0-beta2...v5.0.0-beta3

Introduce the torchcomms _single collective names on the C++ c10d::Backend and migrate the in-tree backends to define them, while keeping the old names fully working for backward compatibility.

Backend now declares all_gather_single, all_gather_single_coalesced, reduce_scatter_single, reduce_scatter_single_coalesced, and all_to_all_single alongside the existing _allgather_base, allgather_into_tensor_coalesced, _reduce_scatter_base, reduce_scatter_tensor_coalesced, and alltoall_base, which are kept as overridable, forwarding aliases.

Backward compatibility is preserved in both directions: each new method and its old-name alias forward to each other, so a Backend subclass may override EITHER name and a caller may invoke EITHER name. The old aliases simply forward to the canonical _single method; each canonical method opens with the C10D_BACKEND_FORWARDING_GUARD() macro, which installs a function-local thread-local re-entry flag using __func__ for the message. If a backend overrides neither name the mutual forwarding re-enters the canonical method, the flag trips, and it reports "does not support " instead of recursing forever. As a result, existing callers of the old names (first-party and out-of-tree) and existing out-of-tree backends that override the old names both keep working unchanged. Removing the old overrides outright would have broken out-of-tree backends on the dispatch path, and dropping the old caller-facing names would have broken direct callers; the bidirectional forwarding avoids both.

The old names are intentionally NOT marked C10_DEPRECATED_MESSAGE in this change. PyTorch's open-source build compiles the bundled third_party/torch-xpu-ops submodule with -Werror -Wdeprecated, and its XPU collective op registration (xccl/Register.cpp) still calls the old Backend names, so a compile-time deprecation turns into a hard build error there. The deprecation will be reintroduced in a follow-up once those callers (and any other out-of-tree backends that are built in-tree) are migrated to the _single names and the submodule pin is bumped.

The in-tree backends are migrated to define the new names: ProcessGroupNCCL, ProcessGroupGloo, ProcessGroupMPI, ProcessGroupUCC, ProcessGroupWrapper, FakeProcessGroup, NCCLXStub, and the torch_openreg (ProcessGroupOCCL) test backend. The dispatcher op implementations in Ops.cpp, ProcessGroupWrapper's forwarders, and the Backend pybind bindings in init.cpp use the new names.

The underlying aten / c10d dispatcher op names (c10d::_allgather_base_, c10d::alltoall_base_, etc.), their schema strings, the IMPL_* macro names in Ops.cpp, and the OpType enum values are intentionally left unchanged for backward compatibility.

Suggested review order: Backend.hpp (the new/old method pairs and the bidirectional forwarding + ForwardingGuard), then the per-backend subclass renames, then the Ops.cpp / ProcessGroupWrapper / init.cpp call sites.

This diff was authored with the assistance of an AI coding agent (Claude).

Test Plan:
This revision only removes the compile-time deprecation annotations (C10_DEPRECATED_MESSAGE), their -Wdeprecated-declarations suppressions, and the now-unused <c10/util/Deprecated.h> include. The _single rename and the bidirectional forwarding/recursion guard are unchanged, so there is no runtime or codegen change -- dropping the annotations only removes deprecation warnings.

Verified by open-source CI on the exported commit: the full libtorch build across platforms, the linux-noble-xpu-n-py3.10 / build-osdc job (which compiles the bundled torch-xpu-ops xccl/Register.cpp with -Werror -Wdeprecated and previously failed on -Werror=deprecated-declarations), and the lintrunner-clang format jobs.

Reviewed By: kapilsh

Differential Revision: D108364288

Summary

Hitachi Energy is aware of vulnerabilities that affect ITT600 Explorer product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. The vulnerabilities only affect Hitachi Energy Integrated Testing Tool ITT600 SA Explorer without affecting IEC 61850 system endpoints. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.

The following versions of Hitachi Energy ITT600 Explorer are affected:

• ITT600 Explorer vers:ITT600_Explorer/<2.1_SP6, vers:ITT600_Explorer/<=2.1_SP6, 2.1_SP6 (CVE-2024-8176, CVE-2025-59375)

Background

• Critical Infrastructure Sectors: Energy
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Switzerland

Vulnerabilities

Acknowledgments

• Hitachi Energy Internal Team reported this vulnerability to CISA. 

Notice

The information in this document is subject to change without notice and should not be construed as a commitment by Hitachi Energy. Hitachi Energy provides no warranty, express or implied, including warranties of merchantability and fitness for a particular purpose, for the information contained in this document, and assumes no responsibility for any errors that may appear in this document. In no event shall Hitachi Energy or any of its suppliers be liable for direct, indirect, special, incidental or consequential damages of any nature or kind arising from the use of this document, or from the use of any hardware or software described in this document, even if Hitachi Energy or its suppliers have been advised of the possibility of such damages. This document and parts hereof must not be reproduced or copied without written permission from Hitachi Energy and the contents hereof must not be imparted to a third party nor used for any unauthorized purpose. All rights to registrations and trademarks reside with their respective owners.

Support

For additional information and support please contact your product provider or Hitachi Energy service organization. For contact information, see https://www.hitachienergy.com/contact-us/ for Hitachi Energy contact-centers.

General Mitigation Factors

Recommended security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system. Proper password policies and processes should be followed. Additional information on Industrial Control Systems Cybersecurity Best Practices can be found in the following Hitachi Energy Cybersecurity Notification. Cybersecurity Advisory - Industrial Control Systems Cybersecurity Best Practices

SSVC

SSVCv2/E:N/A:Y/2026-05-26T08:58:04Z/

Legal Notice and Terms of Use

This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

Advisory Conversion Disclaimer

This ICSA is a verbatim republication of Hitachi Energy PSIRT 8DBD000241 from a direct conversion of the vendor's Common Security Advisory Framework (CSAF) advisory. This is republished to CISA's website as a means of increasing visibility and is provided "as-is" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory. Further, CISA does not endorse any commercial product or service. Please contact Hitachi Energy PSIRT directly for any questions regarding this advisory.

Revision History

• Initial Release Date: 2026-05-26

Legal Notice and Terms of Use

Thousands of Malicious GitHub Actions Commits Detected Within Hours 

Megalodon Malware Targeted CI/CD Secrets and Cloud Credentials 

Searchers Links Megalodon Campaign to Compromised Open-Source Packages 

Changes

• iMessage: support thumb-approval reactions — 👍 (Like tapback) resolves an approval as allow-once and 👎 resolves as deny, with the explicit-approver allowlist read from channels.imessage.allowFrom; allow-always stays on the manual /approve <id> allow-always text fallback. Mirrors the WhatsApp behavior from #85477.
• Gateway/perf: reuse process-stable channel catalog reads, avoid repeated bundled-channel boundary checks, and rotate gateway watch CPU profiles so benchmark runs do not accumulate unbounded artifacts.
• Gateway/perf: cache stable install-record, channel-catalog, bundled-channel, and Telegram session-store metadata during process-local hot paths to reduce repeated JSON and manifest reads.
• Gateway/perf: reuse immutable plugin metadata snapshots across startup, config, model, channel, setup, and secret metadata readers so hot paths avoid repeated plugin file stats and manifest registry reloads.
• Talk/realtime: let WebUI and Discord voice callers ask for active OpenClaw run status, cancel, steer, or queue follow-up work while a consult is still running. (#84231) Thanks @Solvely-Colin.
• Discord/voice: add realtime wake-name gating with agent-name defaults and raise profile bootstrap context budget for longer USER.md/SOUL.md files.
• Gateway/perf: lazy-load startup-idle plugin work, core gateway method handlers, and the embedded ACPX runtime so Gateway health and ready signals no longer wait on unused handler trees or ACPX probes.
• Gateway/perf: cache plugin SDK public-surface alias maps and skip irrelevant macOS Linuxbrew PATH probes so Gateway startup avoids repeated filesystem walks and slow missing-directory stats.
• Image tool: add adaptive model-aware image compression with an agents.defaults.imageQuality preference for choosing token-efficient, balanced, or high-detail media handling.
• Meeting Notes: add a source-only external meeting-notes plugin and SDK source-provider contract outside the core npm package, with auto-start capture config, manual transcript imports, read-only openclaw meeting-notes CLI access, and Discord voice as the first live source.
• Meeting Notes/Discord: release channel account startup before meeting-notes auto-capture, wait for the Discord voice manager during gateway boot, and stop plugin services before channel shutdown so voice capture state remains available during startup and cleanup.
• Docs/channels/config: add Signal configPath, Telegram wildcard topic defaults, local-time backup archive names, Termux home fallback, include-path validation, secret-scanner-safe placeholder guidance, Gemini CLI/Antigravity media guidance, and macOS VM auto-login guidance. Thanks @NorseGaud, @yudistiraashadi, @huangqian8, @VibhorGautam, @maweibin, @tianxingleo, @IgnacioPro, and @xzcxzcyy-claw.
• Docs: clarify model-usage portability, Codex migration prerequisites, status bootstrap wording, thread-bound subagent limits, hook ownership, and config-preserving safety guidance. Thanks @aniruddhaadak80, @leno23, @TomDjerry, @matthewxmurphy, @vincentkoc, and @stablegenius49.
• Docs: clarify README onboarding and Gateway startup paths, WhatsApp QR/408 recovery, cron output language prompts, skill advanced features, gateway upstream 403 troubleshooting, and plugin fallback override guidance. Thanks @deepujain, @Zacxxx, @Jah-yee, @neyric, @usimic, @Renu-Cybe, @BigUncle, and @SeashoreShi.
• Docs: clarify context-pruning ratio bounds, local dashboard recovery, CLI env markers, remote onboarding token behavior, and Peekaboo Bridge permissions for subprocess agents. Thanks @ayesha-aziz123, @dishraters, @hougangdev, and @brandonlipman.
• Docs: clarify browser CDP diagnostics, Plugin SDK allowlist imports, status-reaction timing defaults, queue steering behavior, limited-tool troubleshooting, cron HEARTBEAT handling, Telegram multi-agent groups, Bitwarden SecretRef setup, and EasyRunner deployments. Thanks @Quratulain-bilal, @mbelinky, @Mickey-, @vancece, @xenouzik, @posigit, @surlymochan, @janaka, and @choiking.
• CLI/models: let openclaw models auth login store a single returned provider auth profile under a requested --profile-id, and document named Codex OAuth profile setup. (#49315) Thanks @DanielLSM.
• Crabbox/Testbox: run clean sparse-checkout Testbox syncs from a temporary full checkout and route remote changed gates through Corepack pnpm.
• Docs: clarify IPv4-only Gateway BYOH binding, trusted-proxy scope clearing, Android pairing approval, macOS Accessibility grants, Zalo profile env vars, password-store SecretRef setup, and Chinese memory navigation. Thanks @itskai-dev, @gwh7078, @longstoryscott, @MoeJaberr, and @yuaiccc.
• Docs: consolidate GLM under Z.AI, add the Upstash Box install guide and Gateway exposure runbook, clarify MEDIA directives, Copilot and Voyage setup, config path quoting, real behavior proof, and memory-file write guidance. Thanks @BobDu, @alitariksahin, @Jefsky, @musaabhasan, @OmerZeyveli, @leno23, @WuKongAI-CMU, @luoyanglang, and @majin1102.
• Docs: clarify media provider credentials, Codex/OpenClaw code-mode boundaries, Slack and Telegram ack reactions, Feishu dynamic agents, secrets plaintext boundaries, memory guidance, and Chinese glossary terms. Thanks @nielskaspers, @cosmopolitan033, @drclaw-iq, @alexgduarte, @zccyman, @chengoak, and @cassthebandit.
• Packaging: exclude documentation images and assets from the npm tarball, reducing published package size without affecting runtime docs search or CLI behavior. Thanks @SebTardif.
• Media understanding: stop auto-probing Gemini CLI and use Antigravity CLI only as a lower-priority image/video fallback after configured provider APIs.
• Diagnostics: emit sanitized secrets.prepare timeline spans for Gateway secret preparation so operators can distinguish secret startup latency without exposing provider names, secret ids, or secret values. (#83019) Thanks @samzong.
• Diagnostics: export bounded skill usage metrics/spans and tool source/owner labels for core, plugin, MCP, and channel tool execution without exposing raw paths or session identifiers. (#80370) Thanks @gauravprasadgp.
• Agents/subagents: limit default sub-agent bootstrap context to AGENTS.md and TOOLS.md, keeping persona, identity, user, memory, heartbeat, and setup files out of delegated workers by default. (#85283) Thanks @100yenadmin.
• Maintainer skills: require clean autoreview before surfacing bug-sweep PR URLs and treat changelog-only conflicts as routine busy-main churn.
• Maintainer skills: exclude plugin SDK/API boundary work from openclaw-landable-bug-sweep so bugbash sweeps stay focused on small paper-cut fixes.
• QA-Lab/diagnostics: extend the OpenTelemetry smoke harness to prove trace, metric, and log export, and add first-class Prometheus and observability smoke aliases.
• Plugin SDK: add a generic channel-message poll sender so channel plugins can expose poll delivery without depending on channel-specific SDK facades.
• Plugin SDK/cron delivery: route cron delivery through the modern target resolver and outbound session-route APIs, deprecate parser-backed target helpers and plugin-sdk/messaging-targets, and move bundled callers to plugin-sdk/channel-targets.
• Crabbox: keep the local wrapper's provider validation synced with the installed Crabbox binary while preserving supported aliases such as docker and blacksmith. (#85302) Thanks @hxy91819.
• Maintainer skills: add openclaw-landable-bug-sweep for producing five small, reviewed, CI-green OpenClaw bugfix PRs from issue/PR sweeps.
• Control UI/chat: add search and Load More pagination to the chat session picker, keeping initial session loads bounded while making older conversations reachable. (#85237) Thanks @amknight.
• CLI/onboarding: start classic onboarding when bare openclaw runs before an authored config exists, while keeping configured installs on Crestodian. (#72343) Thanks @fuller-stack-dev.
• Discord: allow configuring a bounded agentComponents.ttlMs callback registry lifetime for long-running component workflows, with per-account overrides and a 24-hour cap. (#84189) Thanks @100menotu001.
• xAI/Grok: reuse xAI OAuth auth profiles for Grok web_search, thread active-agent auth through web search, add Grok model aliases, and let media providers declare default operation timeouts. (#85182) Thanks @fuller-stack-dev.
• Plugin SDK: add row-level session workflow helpers and deprecate loadSessionStore so plugins can read and patch sessions without depending on the legacy whole-store shape. (#84693) Thanks @efpiva.
• Gateway/plugins: reuse a compatible Gateway startup plugin registry during dispatch so safe plugin dispatches avoid redundant registry loading. (#84324) Thanks @ai-hpc.
• Plugins/SDK: add a general embeddingProviders capability contract and registration API so embeddings can become a reusable provider surface outside memory-specific adapters.
• Dependencies: refresh provider, plugin, UI, and tooling packages, update protobufjs to 8.4.0 to clear the current npm advisory, and carry the Claude ACP completion patch forward to @agentclientprotocol/claude-agent-acp 0.36.1.
• Agents/tools: remove the old sender-owner tool gating path so configured tools stay visible for trusted sessions while command and channel-action auth still carry real sender identity.
• QA-Lab: add curated mock JSONL replay fixtures and first-drift reporting for runtime-parity audits. (#80323, refs #80176) Thanks @100yenadmin.
• QA-Lab: add a QA bus tool-trace visibility scenario for sanitized tool-call assertions.
• QA-Lab: replace generic evidence framing in seeded scenario prompts with concrete observed QA behavior.
• QA-Lab: list named scenario packs in the coverage report so personal-agent privacy coverage stays visible in audits.
• QA-Lab: list live transport lane membership in the coverage report so real transport checks stay separate from seeded qa-channel scenarios.
• Release/package: run package integrity checks before package acceptance lanes so public install/update validation fails before private QA assets can leak into the package.
• QA-Lab: include the optional 100-turn runtime parity soak in release-soak artifacts so long-run Codex/Pi transcript drift stays visible outside the default gate. (#80395) Thanks @100yenadmin.
• QA-Lab: add a live-only long-context progress watchdog scenario for Codex app-server timeout and stalled-run sentinels. (#80323) Thanks @100yenadmin.
• QA-Lab: tag gateway restart recovery and streaming final-integrity scenarios as live-only runtime parity lanes. (#80323) Thanks @100yenadmin.
• QA-Lab: add a personal-agent failure recovery scenario that checks honest partial status, retry boundaries, and local recovery artifacts. (#83872) Thanks @iFiras-Max1.
• QA-Lab: include an opt-in update.run package self-upgrade sentinel for destructive latest-package recovery checks.
• QA-Lab: add Codex plugin lifecycle and auth-profile fixture coverage for missing installs, pinned-version drift, first-turn install ordering, and doctor migration safety. (#80323, refs #80174) Thanks @100yenadmin.
• Models/perf: pre-warm the provider auth-state map at gateway startup so /models and every model-listing call short-circuits the per-provider plugin / external-CLI discovery on the hot path. Per-call cost drops from ~20 s to ~5 ms (~4,100×); the one-time startup warm resets and re-warms after hot reloads. (#84816) Thanks @sjf.
• Release/security: ship the root npm package and OpenClaw-owned npm plugins with generated shrinkwrap, support bundled plugin runtime dependencies for suitable plugin tarballs, and require review for lockfile/shrinkwrap changes so published installs use locked dependency graphs.
• Tests/perf: isolate doctor core health check unit coverage from real skills/workspace discovery so doctor-core-checks no longer dominates unit perf while keeping one real skills-readiness smoke. (#84493) Thanks @frankekn.

Fixes

• Gateway/update: avoid fetching unrelated tags during dev-channel git updates so moved release tags do not block branch-based updates. (#84737) Thanks @rubencu.
• CLI/update: suppress the expected future-config warning while an old update parent hands off to the freshly installed post-core process.
• MiniMax: store OAuth token expiry as an absolute millisecond timestamp so OAuth profiles no longer appear expired on every request. (#83480) Thanks @NianJiuZst.
• Agents/Anthropic: strip missing or blank thinking signatures for signed-thinking providers even when recovery supplies a narrow replay policy without signature preservation. Fixes #84430. (#84448) Thanks @NianJiuZst.
• Agents/channels: send a visible notice when an aborted main session cannot be resumed after restart, including Telegram group targets. (#85805) Thanks @pfrederiksen.
• Discord/voice: serialize overlapping voice joins, retry aborted startup readiness within the configured timeout, upgrade meeting-notes-only sessions to realtime when the normal follow join arrives, detach promoted meeting-notes ownership without leaving voice, and include OpenClaw in default realtime wake names.
• Gateway/restart: honor the configured restart drain budget for embedded runs and avoid spending the deferral timeout twice after forced restart timeouts. (#85708) Thanks @Kaspre.
• Gateway/boot: run BOOT.md startup checks in an isolated boot session so gateway restarts do not overwrite the agent's main session mapping. (#85479)
• Meeting Notes: include a speaker-labeled transcript section in generated summaries so Discord group voice captures show who said each captured utterance.
• Discord/voice: recover stale realtime playback state when Discord stream-close/player-idle events do not arrive, and keep generated runtime plugin aliases available after postbuild rewrites.
• Discord/voice: keep realtime playback running when meeting notes attaches to an existing voice session or a realtime consult starts, and route realtime user transcripts into meeting notes.
• Config/secrets: preflight active runtime SecretRefs before root and include config writes persist, and roll back unchanged file/env state when post-write refresh fails. Fixes #46531. (#84454) Thanks @samzong.
• CLI/models: preserve SecretRef-backed custom provider apiKey markers when models status regenerates models.json, avoiding resolved plaintext secrets on disk. Fixes #84632. (#84658) Thanks @NianJiuZst.
• WhatsApp/auto-reply: deliver deferred media replies through the foreground reply fence so overlapping no-reply turns no longer hide already visible responses. (#85517) Thanks @cavit99.
• Sessions/security: replace agent-to-agent wildcard allowlist regexes with a precompiled linear matcher so cross-agent access checks avoid backtracking-prone patterns. (#85849) Thanks @SebTardif.
• WebChat: keep the run-complete indicator in progress until deferred history replay renders the assistant reply, so Done no longer appears before response text. (#85374) Thanks @neeravmakwana.
• Agents/tools: give timed-out or cancelled process trees a bounded SIGTERM cleanup window before SIGKILL while preserving tree-aware cancellation. Fixes #66399. (#85865) Thanks @IWhatsskill.
• Agents/subagents: treat aborted subagent stop reasons as killed terminal failures so parent sessions get error announcements instead of silent success. Fixes #72293. (#85860) Thanks @IWhatsskill.
• Agents/providers: clamp proxy-like OpenAI Chat Completions output caps against the final request payload so strict local/API-compatible servers no longer reject prompts that already consume part of the context window. Fixes #83086. (#85889) Thanks @rendrag-git.
• Agents/compaction: skip agent-harness preflight for provider-owned CLI runtime sessions so over-threshold Claude CLI sessions continue through normal compaction instead of failing on a missing harness. Fixes #84857. (#84878) Thanks @zhangguiping-xydt.
• Codex/app-server: keep successful native hook relays available through a short post-turn grace window so late Codex hook subprocesses can finish policy enforcement without clearing a replacement relay. (#83987) Thanks @Kaspre.
• Control UI/config: save form-mode edits from the source config snapshot so runtime-only provider defaults like empty models.providers.<id>.baseUrl are not written back and rejected. Fixes #85831. Thanks @garyd9.
• Browser/existing-session: launch Chrome DevTools MCP with usage statistics disabled by default so its telemetry watchdog stays off unless an operator explicitly opts in. (#85886) Thanks @rohitjavvadi.
• Telegram: normalize legacy durable group retry targets before retry sends, polls, and pins so group retries keep using the real chat id. (#85656) Thanks @luoyanglang.
• Agents/PDF: route MiniMax PDF fallback policy through plugin metadata so MiniMax uses text extraction instead of VLM image fallback. (#85590, fixes #85575) Thanks @neeravmakwana.
• CLI/plugins: tighten timeout, numeric option, media payload, permission, profile/TLS, plugin metadata, JSON, and remote URL handling; prevent stuck progress/app-server/IRC/Synology/Twitch waits; and keep imported chat history ordering stable.
• Telegram/config: suppress the missing accounts.default warning when channels.telegram.defaultAccount names a configured account that also sorts first. Fixes #83948. Thanks @crypto86m.
• Telegram: serialize visible topic replies through core reply-lane admission so heartbeat and queued follow-up turns cannot continue ownerless or misroute responses. (#85709) Thanks @jalehman.
• WebChat: summarize internal message-tool source replies so tool cards no longer duplicate the visible reply body. (#84773) Thanks @jason-allen-oneal.
• Gateway/WebChat: hide duplicate gateway-injected assistant rows when Cursor ACP already persisted the same acp-runtime reply. Fixes #85741. Thanks @lxf-lxf.
• WebChat: scope the visible attachment button to its own composer file input so clicking Upload reliably opens the file picker. (#83952, fixes #47983) Thanks @jason-allen-oneal.
• Gateway: preserve deferred lifecycle-error cleanup across later non-terminal events so provider timeouts can persist failed session state instead of leaving sessions stuck running. (#85256, fixes #63819) Thanks @samzong.
• Gateway/update: stop treating inherited macOS XPC_SERVICE_NAME values as launchd supervision during update respawn, so GUI-spawned gateways use detached respawn instead of exiting for a missing LaunchAgent. Fixes #85224. Thanks @richardmqq.
• Agents/subagents: report tool-only child progress during timeout summaries instead of showing no visible output.
• Telegram/ACP: preserve explicit :topic: conversation suffixes when inbound ACP targets do not carry a separate thread id.
• Browser/proxy: bypass the managed proxy for the exact local managed Chrome CDP readiness and DevTools WebSocket endpoints, so openclaw browser start works when the operator proxy blocks loopback egress. (#83255) Thanks @lightcap.
• Ollama: bypass the managed proxy for configured local embedding origins while keeping SSRF guardrails on unconfigured targets. Thanks @Kaspre.
• OpenAI/images: route Codex API-key image generation through the native OpenAI Images API instead of the Codex OAuth streaming backend, avoiding 401s from valid API keys.
• Agents/OpenAI completions: omit empty tool payload fields for proxy-like OpenAI-compatible endpoints so strict vLLM-style servers accept tool-free turns. (#85835) Thanks @rendrag-git.
• Sandbox: keep workspace skill mounts read-only for remote container-cwd file operations and reject symlinked skill roots before creating protected overlays. (#85591) Thanks @jason-allen-oneal.
• Scripts/Windows: route remaining QA, release, profile, and live-media pnpm launches through the managed runner so native Windows avoids brittle .cmd execution and shell-argv warnings.
• Release: align generated config/API baselines and the meeting-notes plugin version so release preflight stays green on native Windows.
• Install/Windows: run Git hook setup through a Node prepare helper so native Windows installs no longer print POSIX shell errors.
• Checks/Windows: chunk and serialize extension oxlint shards on native Windows so changed gates avoid Go-backed linter memory spikes.
• Release/Windows: run installed openclaw.cmd verification through explicit cmd.exe wrapping so npm prepublish/postpublish checks avoid Node shell-argv warnings.
• Release/Windows: run release-check npm pack/install/root probes through the shared npm runner so native Windows avoids bare npm lookup and .cmd shell-argv handling.
• Release/Windows: run cross-OS release check .cmd shims through explicit cmd.exe wrapping so native Windows install and gateway probes avoid Node shell-argv handling.
• Control UI/Windows: run i18n Pi, npm, and pnpm helper commands through explicit Windows runners so native Windows translation sync avoids brittle .cmd launches.
• Scripts/Windows: run the Z.AI fallback repro through the shared pnpm runner so native Windows avoids raw .cmd launches.
• Codex/Windows: run app-server protocol formatting through the shared pnpm runner so native Windows avoids raw .cmd launches.
• Plugins/Windows: run plugin npm package staging through the shared npm runner so native Windows release checks avoid bare npm lookup and .cmd shell-argv handling.
• Checks/Windows: route full pnpm check stage commands through the managed child runner so Windows avoids Node shell-argv deprecation warnings there too.
• Agents/fs: allow workspace-only host write/edit tools to write through in-workspace symlink directory parents while preserving outside-workspace symlink rejection. Fixes #84696. Thanks @garbagenetwork.
• Checks/Windows: run managed child commands through explicit cmd.exe wrapping instead of Node shell mode with argv, avoiding Node 24 subprocess deprecation warnings during changed checks.
• Gateway: omit internal stream-error placeholder entries from agent prompt history so failed assistant turns are not replayed as model-authored text. (#85652) Thanks @anyech.
• Sessions: enforce the session write-lock max-hold policy during lock acquisition so long-held locks can be reclaimed before the stale-lock window. (#85764) Thanks @njuboy11.
• Sessions/status: preserve user-facing model, fallback, usage, and cost attribution when internal subagent handoff runs use fallback models. (#85726, fixes #85082) Thanks @brokemac79.
• Install/update: honor OPENCLAW_HOME when deriving default dev checkout and installer onboarding paths, while keeping explicit OPENCLAW_GIT_DIR and OPENCLAW_CONFIG_PATH overrides authoritative. Fixes #54014. Thanks @robertPiro.
• Models: prune retired Groq, GitHub Copilot, OpenAI, xAI, and old Claude catalog entries, with doctor migration to upgrade existing configs to current provider refs.
• Plugins/Gateway: treat non-empty return values from plugin gateway method handlers as successful responses so openclaw gateway call no longer times out after completed plugin work. Fixes #59470. Thanks @HTMG23.
• Doctor/update: recognize junction-backed source checkouts as git installs by comparing canonical paths before showing package-manager update guidance. Fixes #82215. Thanks @igormf.
• Channels: honor /verbose on for tool/progress summaries across direct chats, groups, channels, and forum topics while preserving quiet default behavior. (#85488) Thanks @kurplunkin.
• Update: keep the detached gateway restart handoff best-effort when the restart script process cannot be spawned. (#83892) Thanks @davinci282828.
• Telegram: persist the prompt-context message cache through plugin state and record bot-authored replies after sends and draft streaming so later turns can include prior assistant replies without relying on the JSON sidecar. (#85231) Thanks @keshavbotagent.
• Agents/subagents: keep Codex persona and user workspace files turn-scoped so native Codex subagents inherit only shared tool guidance by default. (#85811) Thanks @lastguru-net.
• CLI/skills: show an all-ready note with next-step commands when skill setup has no missing dependencies to install. (#85032) Thanks @aniruddhaadak80.
• Microsoft Foundry: route DeepSeek V4 Pro and Flash models through the Foundry Responses API while keeping older DeepSeek models on their existing path. (#85549) Thanks @roslinmahmud.
• Status/usage: show configured cost estimates for AWS SDK models in full usage output while keeping token-only usage replies cost-free. (#85619) Thanks @ItsOtherMauridian.
• Agents/OpenAI Responses: retry non-visible reasoning-only turns for OpenAI Responses API families instead of treating them as empty failed turns. (#85603) Thanks @SebTardif.
• Directive tags: preserve message and content-part object identity when display stripping makes no directive-tag changes. (#85682) Thanks @willamhou.
• Telegram: send local path/filePath and structured attachment media from sendMessage actions instead of dropping them or sending text-only messages. (#85219) Thanks @keshavbotagent.
• Sessions/status: show the estimated context budget when fresh provider usage is unavailable and clear stale estimates across session resets and compaction boundaries. (#84830) Thanks @giodl73-repo.
• Gateway/config: pin relative OPENCLAW_STATE_DIR overrides to an absolute path at startup so later working-directory changes cannot retarget gateway state. (#52264) Thanks @PerfectPan.
• Checks/Parallels: make changed-lane scripts, shrinkwrap generation, and Parallels package smoke host commands run through native Windows-safe paths and npm/pnpm shims.
• Release/package: run npm release, prepublish, and postpublish verification through Windows-safe npm command shims so native Windows checks can execute npm.cmd instead of treating it as a binary.
• Agents/harness: pass CLI runtime aliases through harness selection so provider-owned CLI aliases no longer get rejected before reaching the right runtime. (#85631) Thanks @potterdigital.
• Secrets: show the irreversible apply warning after interactive secrets configure confirmation so confirmed migrations still get the final safety prompt. (#85638) Thanks @alkor2000.
• Agents/CLI output: ignore cumulative Claude stream-json result usage when assistant usage events are present, preventing inflated cache-read accounting. (#85625) Thanks @zhouhe-xydt.
• CLI: keep waitForever() alive by leaving its keep-alive interval ref'd so the public helper no longer exits immediately with Node's unsettled-await code. (#85694) Thanks @m1qaweb.
• Agents/bootstrap: guard bootstrap name checks against missing file names so malformed bootstrap entries warn and truncate instead of crashing. Fixes #85523. (#85615) Thanks @zhouhe-xydt.
• CLI/tasks: reject partially numeric openclaw tasks audit --limit values so audit limits must be real positive integers instead of accepting strings like 5abc. (#84901) Thanks @jbetala7.
• Status/diagnostics: bound deep Docker audit probes so openclaw status --deep reports slow container checks instead of hanging behind unbounded inspection. (#85476) Thanks @giodl73-repo.
• Providers/Anthropic: migrate 1M context handling to GA-capable Claude 4.x models by sizing eligible models at 1M without the retired context-1m-2025-08-07 beta, ignoring that retired beta in older configs, and preserving OAuth-required Anthropic beta headers. (#45613) Thanks @haoyu-haoyu.
• Cron/Telegram: parse forum-topic delivery targets through the Telegram plugin instead of cron core, including :topic: and :topicId forms for announce delivery. Thanks @etticat.
• Twitch: keep stale message-handler cleanup callbacks from removing newer handler registrations for the same account, preserving inbound message delivery after reconnects. Fixes #83888. (#85425) Thanks @alkor2000.
• Control UI/chat: keep light-mode model, thinking, config, and agents select arrows visible without tiling background icons. Fixes #85713. Thanks @Linux2010.
• Memory/LanceDB: expose public memory artifacts through the active memory provider bridge so memory-wiki imports durable memory files, daily notes, dream reports, and event logs without depending on memory-core internals. Fixes #83604. (#85060) Thanks @brokemac79.
• Crabbox: keep AWS hydration compatible with local Actions replay by inlining the hydrate workflow's Node/pnpm setup instead of invoking repo-local composite actions.
• Agents/subagents: simplify native sub-agent completion handoff so children report their latest visible assistant result to the requester without using message, while keeping parent-owned message-tool delivery policy intact. Fixes #85070. (#85089) Thanks @brokemac79.
• Docker setup: stop printing the Gateway bearer token in setup logs and printed follow-up commands.
• Gateway: defer channel account startup work until HTTP readiness and remove startup model prewarm, avoiding startup event-loop stalls and timer-delay warnings.
• Models/perf: reuse plugin metadata during models.json planning, keep bundled catalog augmentation manifest/static, and use static provider catalogs for metadata-only startup discovery so provider model normalization, auth discovery, and Gateway startup metadata do not reload broad plugin runtimes.
• Agents: let embedded compaction fallback retries proceed when PI-compatible candidates do not need agent harness plugin preparation.
• Agents/tools: honor configured custom provider API keys when deciding whether media, image-generation, video-generation, music-generation, and PDF tools are available. (#85570)
• StepFun: stop advertising stale generic API key auth choices so onboarding only offers runtime-backed Standard and Step Plan choices.
• Diagnostics: keep OpenTelemetry log bodies behind explicit content capture and scrub scoped agent-session keys from OpenTelemetry and Prometheus labels while preserving bounded queue-lane prefixes.
• Windows installer: fail Git checkout installs when pnpm install or pnpm build fails instead of writing a wrapper to a missing CLI build.
• Sessions: surface previous-transcript archive failures during /new rotation so disk rename errors are logged instead of silently hiding stranded transcript files. Fixes #81984. (#85586, from #82081) Thanks @0xghost42.
• TUI/agents: mirror internal-ui message-tool replies into final chat output so message-tool-only agents remain visible in openclaw tui. Fixes #85538. Thanks @danpolasek.
• Gateway/TUI: preserve source-reply metadata through reply normalization and emit message-tool-only agent replies over the live chat stream so openclaw tui renders Codex replies without waiting for a history refresh. Thanks @shakkernerd.
• Codex/TUI: keep long source-reply runs alive after Codex reasoning completes so delayed visible message calls can still reach openclaw tui. Thanks @shakkernerd.
• TUI: keep quiet active runs busy after the response watchdog notice instead of reopening the prompt and encouraging duplicate submissions while the backend turn is still running. Thanks @shakkernerd.
• Agents: preserve the latest assistant thinking blocks while stripping invalid replay signatures from older turns, and retry Anthropic thinking failures without thinking replay. Fixes #85557. Thanks @bryanbaer.
• Agents: keep parallel OpenAI-compatible tool-call deltas in separate argument buffers so interleaved tool calls no longer corrupt streamed arguments. (#82263) Thanks @luna-system.
• Telegram: avoid false pairing prompts after transient pairing-store read failures while preserving configured allowFrom and per-DM pairing authorization. (#85555)
• Memory/doctor: report missing or unusable QMD workspace directories as workspace failures instead of generic binary failures. (#63167) Thanks @sercada.
• Debug proxy: record CONNECT client-socket errors and destroy the paired upstream socket so abrupt client disconnects no longer leak tunnel resources. (#82444) Thanks @SebTardif.
• Diffs: continue hydrating later diff cards when one card fails so a single broken card no longer blanks the whole diff viewer. (#84775) Thanks @cosmopolitan033.
• Mac app: use the native settings sidebar window chrome so the sidebar toggle stays on the left and content no longer clips under oversized titlebar padding.
• QA-Lab/Codex: bundle auth/plugin fixture imports for flow scenarios and let terminal async media tools end Codex app-server turns without timing out. (#80397, refs #80323) Thanks @100yenadmin.
• WhatsApp: persist inbound message delivery state through plugin state before dispatch and delay read receipts until handler completion, so retryable failures can redeliver without adding a plugin-local disk cache. Thanks @samzong.
• Gateway/agents: preserve fresh session overrides and metadata when stale cached agent-session entries race with store updates, so subagent model/provider overrides and routing policy survive concurrent writes. (#19328) Thanks @CodeReclaimers.
• Control UI/chat: keep chat session search inline with the session selector so the header no longer shows a duplicate standalone search row.
• Control UI/chat: collapse focused-mode header chrome and suppress hidden-header scroll updates so focus mode no longer jumps while scrolling. Thanks @amknight.
• Codex app-server: restart the native app-server and retry once when server-side compaction times out, so preflight compaction stalls recover instead of failing every dispatch. (#85500)
• Restore Control UI gateway token pairing [AI]. (#85459) Thanks @pgondhi987.
• OpenAI video: honor configured provider request private-network opt-in for local/custom video endpoints so explicitly trusted mock and self-hosted providers are not blocked. Thanks @shakkernerd.
• OpenAI video: send uploaded video edit requests to the documented /videos/edits endpoint with a video file instead of posting MP4 references to /videos. Thanks @shakkernerd.
• Agents/channels: preserve message-tool delivery evidence through gateway agent completion handoffs so successful generated media sends are not followed by false failure messages. Thanks @shakkernerd.
• CLI/update: repair managed npm plugin openclaw peer links during post-core convergence and reject stale or wrong-target peer links before restart. (#83794) Thanks @fuller-stack-dev.
• CLI/agents: default new omitted-account bindings to all accounts when the channel has multiple configured accounts, and clarify account-scope docs. (#49769) Thanks @Gcaufy.
• Codex app-server: let authorized /codex control commands such as /codex detach escape plugin-owned conversation bindings while keeping unknown or unauthorized slash text routed to the bound plugin. Fixes #85157. (#85188) Thanks @TurboTheTurtle.
• Auto-reply/models: keep /models browse replies fast by sharing the bounded read-only catalog path with Gateway model listing. (#84735) Thanks @safrano9999.
• Browser/Doctor: read macOS Chrome app bundle versions from Info.plist before spawning Chrome and extend the fallback version probe timeout, avoiding false cold-cache warnings from Gatekeeper latency. Fixes #85418. Thanks @davidcittadini.
• Codex app-server: disable native Code Mode when the effective exec host is node and keep OpenClaw exec/process available, so /exec host=node routes shell commands through the selected node instead of the gateway. Fixes #85012. (#85090) Thanks @sahilsatralkar.
• Agents: bound embedded auto-compaction session write-lock watchdogs to the compaction timeout instead of the full run timeout, so stuck compaction cannot hold the live session lock for the whole run window. (#84949) Thanks @luoyanglang.
• Gateway/agents: return phase-aware agent.wait timeout attribution and only cool auth profiles on provider-started timeouts. Refs #65504. Thanks @100yenadmin.
• Gateway/systemd: launch managed update handoff helpers in a transient user scope so systemd-supervised Update Now flows survive the gateway unit restart. Fixes #84068.
• Gateway: defer provider auth-state prewarm until after startup readiness so early gateway tool/session requests are not blocked by provider auth discovery. (#85272) Thanks @dutifulbob.
• Gateway/models: coalesce provider auth-state rewarms after auth-profile failures and log event-loop delay for warm/rewarm work, so provider auth bursts no longer stack full auth sweeps behind channel replies.
• Gateway/models: stop cancelled provider auth-state prewarms from continuing full provider sweeps, so reload and auth-failure bursts no longer keep startup busy.
• Agents/Codex: show the first plan update as a transient chat status notice without counting it as final assistant content.
• CLI/update: walk the macOS process ancestry and honor the inherited Gateway runtime PID before package updates stop the managed Gateway service, so nested in-band updater children can refuse instead of killing the LaunchAgent-supervised Gateway that owns them. Fixes #85120.
• Gateway/LaunchAgent: wait for launchd reload bootout to finish and fall back to kickstart when bootstrap races, so reload handoff does not leave the service deregistered. Fixes #84630. (#84641) Thanks @NianJiuZst.
• Gateway/LaunchAgent: treat a concurrent launchd bootstrap as a successful restart when the service is already loaded, avoiding false macOS Gateway restart failures. Fixes #84721. (#84722) Thanks @googlerest.
• Gateway/service: include the active openclaw command bin directory in managed service PATH generation and doctor audit expectations for npm-global macOS installs. Fixes #84201. (#84475) Thanks @jbetala7.
• Control UI/chat: disable the thinking selector for known non-reasoning models instead of showing duplicate Off choices. Fixes #84069. Thanks @DrippingMellow.
• Memory: expand ~ in configured extra memory paths before resolving them, so home-relative folders are not treated as workspace-relative. Fixes #58026. Thanks @stadman.
• Skills: treat openclaw.os: macos as Darwin when checking skill requirements, so macOS-only skills no longer report as missing on macOS hosts. Fixes #61338. Thanks @Jessecq1995.
• Control UI/logs: strip ANSI escape sequences from displayed Gateway log messages so color codes no longer appear as raw text. Fixes #64399. Thanks @guguangxin-eng.
• Docker: pre-create the workspace and auth-profile config mount points with node ownership so first-run named volumes do not start root-owned. Fixes #85076. Thanks @Noerr.
• Telegram: pass configured markdown table mode through outbound markdown chunking so chunked sends render tables consistently. Fixes #85085. Thanks @ShuaiHui.
• Diagnostics/OTel: drop snake_case diagnostic id attributes alongside camelCase ids so exported telemetry cannot leak run, session, message, chat, trace, or tool-call identifiers. (#72645) Thanks @Lion0710.
• CLI/update: preserve managed Gateway service environment during package cutovers so macOS LaunchAgent repair/restart reads the pre-update service state instead of caller shell state. (#83026)
• Agents/providers: honor per-model api and baseUrl overrides in custom provider auth hooks and transport selection. Fixes #80487. (#80488) Thanks @huveewomg.
• Gateway/restart: eager-load the lifecycle runtime before in-place upgrade signal handling so package replacement does not deadlock restart imports. (#84890) Thanks @myps6415.
• CLI/update: start managed Gateway update handoff helpers from a stable existing directory and tolerate deleted cwd/package roots during macOS LaunchAgent handoff. Fixes #83808. (#83875) Thanks @jason-allen-oneal.
• Skills: watch each shared skill directory once across agent workspaces instead of once per agent, preventing file-descriptor exhaustion (EMFILE) that disposed bundle-mcp processes and stalled sessions on multi-agent gateways. Fixes #84968. (#85130) Thanks @openperf.
• Release/security: keep generated npm shrinkwrap package versions inside the pnpm lock graph so published package locks cannot bypass pnpm dependency age and override policy.
• Cron: honor cron.retry.retryOn: ["network"] for common network error codes such as EAI_AGAIN, EHOSTUNREACH, and ENETUNREACH.
• Gateway chat: broadcast returned agent-run error payloads after an agent starts so ACP/WebChat clients receive terminal idle-timeout errors. Fixes #84945.
• Gateway chat display: preserve OpenAI-compatible prompt_tokens, completion_tokens, and total_tokens usage fields in sanitized chat history so llama.cpp sessions keep context counts. Fixes #77992. Thanks @MarTT79.
• Dashboard/CLI: allow macOS browser launching through open even when SSH environment variables are present, while preserving Linux SSH no-display protection. Fixes #67088. Thanks @theglove44.
• Codex app-server: keep native web search observations out of mirrored chat transcripts while preserving available action query metadata in tool progress telemetry. Fixes #85109. Thanks @ugitmebaby.
• OpenCode Go: strip unsupported Kimi reasoning replay fields before provider requests so repeated kimi-k2.6 turns do not fail schema validation. Fixes #83812. Thanks @Sleeck.
• Browser/CDP: add a WSL2 portproxy self-loop hint when Chrome DevTools endpoints accept connections but return an empty HTTP reply. Fixes #59209. Thanks @Owlock.
• Agents/tools: add bounded tool-policy audit log entries that identify which allow/deny rule removed tools or blocked a sandboxed tool call. Fixes #55801. Thanks @justinjkline.
• CLI/logs: read implicit local Gateway logs through the passive backend client path so openclaw logs --follow does not register as a paired device, and use the active Linux systemd journal instead of stale configured-file fallbacks when live local RPC is unavailable. Fixes #83656 and #66841.
• Agents/OpenAI: preserve structured provider error code, type, and redacted body metadata on boundary-aware transport failures.
• Doctor/Codex: point native Codex asset warnings at the canonical openclaw migrate plan codex preview command. Fixes #84948. Thanks @markoa.
• CLI/models: make capability model auth logout --agent remove auth profiles from the selected non-default agent store. Fixes #85092. Thanks @islandpreneur007.
• Gateway/models: reuse prepared provider auth metadata during model-listing auth checks so repeated lookups avoid broad plugin discovery while preserving synthetic local auth.
• CLI/status: suppress systemd user-service setup hints when openclaw status --deep can already reach a running Gateway RPC service. Fixes #85094. Thanks @islandpreneur007.
• CLI/devices: recover local approval when a same-device repair request replaces the request ID being approved.
• CLI/agents: retry transient normal-close Gateway handshakes before falling back to embedded openclaw agent execution.
• CLI/update: keep managed Gateway service stop/restart status lines out of openclaw update --json stdout so package-update automation can parse the JSON payload.
• Plugins: resolve OpenClaw plugin SDK subpaths for native external plugin runtimes without mutating package installs or broadening process-wide module resolution.
• Agents/OpenAI: preserve Responses and Chat Completions reasoning_tokens usage metadata without double-counting it in aggregate output tokens. (#85319)
• Control UI/chat: convert pasted data:image/...;base64,... clipboard text into an image attachment instead of dumping the payload into the composer. Fixes #62604. Thanks @cpwilhelmi.
• Providers/Gemini: strip fractional seconds from web-search time range filters so Gemini accepts freshness-bound search requests. (#85071) Thanks @Noerr.
• OpenAI Codex: preserve image input support for sparse openai-codex/gpt-5.5 catalog rows. (#85095) Thanks @sercada.
• CLI/models: add a piped or pasted API-key path for OpenAI Codex auth and warn when API keys are pasted into token-mode auth. (#85533) Thanks @joshavant.
• Telegram: dead-letter missing-harness isolated ingress failures so a poisoned spooled update no longer blocks later same-lane messages. Fixes #85470. (#85605) Thanks @joshavant.
• Plugins/discovery: strip -plugin package suffixes when deriving plugin id hints so package names line up with manifest ids. (#85170) Thanks @JulyanXu.
• Tlon: stop advertising a non-existent agent tool contract in the plugin manifest.
• Telegram: preserve fenced code block languages through Markdown rendering so Telegram receives language-* code classes. (#85209) Thanks @leno23.
• Windows installer: run npm and Corepack command shims from a Windows-local directory so installs launched from WSL2 UNC paths do not fail before OpenClaw is installed.
• Windows updates: roll back git-backed updates to the previous checkout when dependency install, build, UI build, or doctor repair fails.
• Windows installer: persist user-local portable Git on PATH and activate the repo-pinned pnpm version for git-backed installs and updates.
• Windows installer: bootstrap a user-local portable Node.js when native Windows has no Node and no winget, Chocolatey, or Scoop, so first-run installs can continue on raw hosts.
• Windows installer: extract the downloaded portable Node.js directory with native tar before falling back to .NET zip extraction, avoiding PowerShell 5.1 archive and path-length failures.
• fix(integrations): enforce channel read target allowlists [AI]. (#84982) Thanks @pgondhi987.
• Agents/heartbeat: route single-owner session.dmScope=main direct-message exec and cron event wakes back to the agent main session so async completions no longer strand context in orphan direct-DM queues. Fixes #71581. (#83743) Thanks @Kaspre.
• Agents/code-mode: expose outer code-mode exec source through the command hook alias with toolKind/toolInputKind discriminators so exec-shaped policies can distinguish code-mode cells. (#83483) Thanks @Kaspre.
• Agents/code mode: return structured timeout and runtime-unavailable error codes for known worker failures. Fixes #83389. (#83444) Thanks @Kaspre.
• QA-Lab: isolate multi-scenario suite workers when scenarios need startup config patches, preventing message-routing config from leaking into unrelated scenarios.
• QA-Lab: make the commitments heartbeat-target-none scenario request an immediate heartbeat instead of waiting for the next scheduled heartbeat.
• Codex/Plugin SDK: deliver Codex-native subagent completions through a generic harness task runtime so harness-backed plugins can mirror durable task lifecycle and completion delivery without Codex-specific SDK imports. (#83445) Thanks @bryanpearson.
• Gateway CLI: surface local post-challenge connect assembly failures immediately instead of waiting for the wrapper timeout. Fixes #68944. (#85253) Thanks @samzong.
• Messages: strip unsupported web-search citation control markers from outbound replies before they reach WebChat or external channels. Fixes #85193. (#85204) Thanks @neeravmakwana.
• Agents/exec: treat denied exec approvals as terminal instead of feeding them back into agent follow-up work, and recognize Chinese stop phrases in abort handling. Fixes #69386. (#85194) Thanks @samzong.
• CLI/agents: abort accepted Gateway-backed openclaw agent runs on SIGINT/SIGTERM so cron and supervisor timeouts do not leave remote agent work alive. Fixes #71710. (#84381) Thanks @Kaspre.
• Codex app-server: retry replay-safe stdio client-close turns once using structured failure metadata, while surfacing idle turn/completed timeouts instead of blindly replaying active shared-server turns. Thanks @VACInc.
• Codex app-server: reject command overrides that embed Node or package-manager arguments and point users to appServer.args, so Windows startup avoids shell parsing failures. (#84417) Thanks @TurboTheTurtle.
• Agents/Copilot: drop unsafe GitHub Copilot Responses reasoning replay items before send so Telegram direct sessions no longer fail on overlong replay IDs. Fixes #85197. (#85198) Thanks @galiniliev.
• UI: add accessible tooltips to the topbar color-mode buttons so System, Light, and Dark choices are labeled on hover and focus. (#85227) Thanks @amknight.
• fix: constrain Windows task script names [AI]. (#85064) Thanks @pgondhi987.
• Control UI: keep the chat session picker from hiding older or cross-agent configured conversations while preserving the bounded configured-agent refresh. (#85211) Thanks @amknight.
• Agents/Anthropic: preserve unsafe integer tool-call input values in streamed Anthropic tool-use JSON, preventing Discord-style IDs from being rounded before dispatch. Fixes #47229. (#83063) Thanks @leno23.
• Agents/Codex: estimate tool-heavy prompt pressure at the LLM boundary before provider submission, so persistent sessions compact before overflowing context windows. (#85541) Thanks @fuller-stack-dev and @joshavant.
• Agents/hooks: wait for local one-shot CLI and Codex agent_end plugin hooks before process cleanup so terminal observability flushes reliably. (#85007)
• Providers/Google: preserve Gemini 3 cron thinkingDefault: "low" when stale catalog metadata says reasoning:false, so scheduled runs keep provider-supported thinking instead of downgrading to off. (#85185) Thanks @neeravmakwana.
• CLI/agents: allow openclaw agent --session-key to target explicit session keys, including agent-scoped legacy keys. (#85121) Thanks @Kaspre.
• Auto-reply/ACP: wait for same-channel block reply delivery before starting tool work, while still honoring ACP dispatch aborts so stopped turns do not wait on slow channel sends. (#83722) Thanks @IWhatsskill.
• Codex/ACP: mark required child-run completions that only report progress, omit a final deliverable, or fail requester delivery as blocked while preserving real final reports. (#85110) Thanks @IWhatsskill.
• Channels: treat bare abort messages such as stop, abort, and wait as immediate control commands in inbound debounce paths so stop requests are not delayed behind pending message coalescing. (#83348) Thanks @IWhatsskill.
• Channels/message tool: resolve configured external channel plugins during in-agent channel selection, so openclaw agent --local message-tool sends no longer report an available channel as unavailable. (#85022) Thanks @Kaspre.
• Agents/heartbeat: honor group/channel message_tool visible-reply policy and model-specific Codex runtime config for scheduled heartbeat runs, so failed internal tool output stays private. Fixes #85310. (#85357) Thanks @neeravmakwana.
• Gateway/ACP: close child ACP sessions spawned via sessions_spawn when their parent session is reset or deleted, instead of leaving orphaned claude-agent-acp processes that accumulate and exhaust memory. Fixes #68916. (#85190) Thanks @openperf.
• Codex app-server: block native execution paths when OpenClaw exec resolves to a node host while preserving the first-party CLI node binding path. Fixes #85012. (#85534) Thanks @joshavant.
• Diagnostics: bound cleanup timeout detail logs, emit drop summaries when async diagnostic bursts exceed the queue cap, and surface async queue drops through diagnostic telemetry.
• Agents/subagents: surface blocked child-run completions as errors instead of successful subagent finishes. (#80886) Thanks @TurboTheTurtle.
• Context engines: fail closed with a descriptive error when the selected agent runtime cannot satisfy declared context-engine host requirements.
• Agents/Pi: treat accepted embedded sessions_spawn child-session handoffs as terminal progress so parent turns no longer report false non-deliverable failures. (#85054) Thanks @samzong.
• CLI/models: resolve openclaw models set aliases from the runtime config while keeping authored aliases ahead of runtime-only defaults. (#83262) Thanks @IWhatsskill.
• Doctor: show personal Codex CLI asset notices as info instead of warnings. Fixes #84859.
• WhatsApp: update Baileys to 7.0.0-rc13 and drop the obsolete logger type patch.
• CLI/update: pre-pack GitHub/git package update targets before the staged npm install, restoring openclaw update --tag main for one-off package updates. (#81296) Thanks @fuller-stack-dev.
• Gateway: mirror successful same-source message-tool sends into session transcripts so delivered replies stay in later history/context. (#84837) Thanks @iFiras-Max1.
• Media generation: keep image, music, and video completion delivery from duplicating or losing task ownership when generated media finishes through active session replies. (#84006) Thanks @fuller-stack-dev.
• CLI/doctor: remove stale bundled plugin load paths from old versioned OpenClaw package roots after pnpm/npm upgrades. Fixes #58626. Thanks @solink7.
• Infra/json: retry transient File changed during read races while loading JSON state so config and state reads recover instead of failing the turn. (#84285)
• Plugins/providers: fail closed for workspace provider plugins during setup-mode discovery unless explicitly trusted, preventing untrusted workspace plugin code from running during provider setup. (#81069) Thanks @mmaps.
• Providers/Ollama: resolve configured Ollama Cloud OLLAMA_API_KEY markers to the real discovery key so cloud provider entries keep authenticated model catalog access. (#85037)
• Discord: keep persistent component registry fallback warnings actionable by forwarding structured error and cause metadata through the runtime logger. Fixes #84185. (#84190) Thanks @100menotu001.
• Gateway/sessions: preserve compatible session auth profile overrides when switching models within the same provider, including provider-auth aliases. Fixes #81837. (#81886) Thanks @TurboTheTurtle.
• Gateway/status: surface inbound delivery telemetry counters and transport-liveness warnings in openclaw status --all. Fixes #49577. (#72724)
• Docker: prune package-excluded plugin source workspaces and dependency closures so runtime images do not keep packages for plugins that were not opted in.
• Providers/Ollama: treat Docker/OrbStack host aliases as local Ollama endpoints so ollama-local marker auth works when OpenClaw runs inside a VM/container and Ollama runs on the host. Fixes #84875.
• QA-Lab: keep explicitly searchable/deferred OpenClaw dynamic tool rows report-only by default so tool-coverage gates do not treat mock discovery gaps as hard product failures. (#80319) Thanks @100yenadmin.
• Agents/config: keep non-Google provider model refs from being rewritten by Google Gemini preview-id normalization. (#84762) Thanks @zhangguiping-xydt.
• Installer: require a real controlling terminal before launching onboarding so headless curl | bash installs finish cleanly after installing the CLI.
• Agents/Codex: promote a completed final assistant response when a prompt timeout races Codex app-server completion instead of returning an empty timeout envelope. Refs #84516.
• Codex app-server: keep interrupted turn statuses from being treated as OpenClaw aborts by themselves, so tool-only turns remain eligible for no-visible-answer recovery. Fixes #84492.
• Agents: cap heartbeat model bleed context hints by the stored session window when runtime model metadata is unavailable, so overflow recovery advice does not suggest a larger window than the active session actually has.
• Control UI/Web Push: use https://openclaw.ai as the generated default VAPID subject instead of the old localhost mailbox so iOS PWA push setup uses an Apple-acceptable subject when OPENCLAW_VAPID_SUBJECT is unset. Fixes #83134. (#83317) Thanks @IWhatsskill.
• Control UI: distinguish inherited thinking-off settings from explicit Off selections so the thinking selector no longer shows two identical Off rows. (#85223) Thanks @amknight.
• Agents/Pi: keep embedded session transcript writes from tripping false takeover detection after packaged npm onboarding agent turns.
• Codex/TUI: surface Codex-native post-turn compaction failures instead of continuing uncompacted, and keep successful native compaction serialized before local idle/next-turn handling. Fixes #84305. (#85160) Thanks @joshavant.
• Memory/search: stop recall tracking from writing dreaming side-effect artifacts when dreaming.enabled=false, while preserving normal search results. Fixes #84436. (#84444) Thanks @NianJiuZst.
• Diffs: render viewer toolbar icons from a closed icon-name map instead of HTML strings, removing the toolbar icon XSS sink. (#83955) Thanks @tanshanshan.
• QA: keep pnpm qa:e2e self-check runs inside the private QA runtime envelope even when inherited shell env disables bundled plugins.
• fix(config): validate browser sandbox bind sources [AI]. (#84799) Thanks @pgondhi987.
• doctor: constrain legacy plugin cleanup paths [AI]. (#84801) Thanks @pgondhi987.
• Update/doctor: prune stale local bundled plugin install records that point at old compiled bundled output so current bundled plugin schemas win after upgrade. (#84863) Thanks @fuller-stack-dev.
• Providers/Ollama: preserve native Ollama tool-call IDs across assistant replay so Gemini over Ollama Cloud can keep its hidden function-call thought-signature handle.
• Discord: keep session recovery and /stop abort ownership on the source dispatch lane while bound ACP turns continue routing to their target session, so stalled pre-run work and late replies are cleared instead of leaking after stop. Fixes #84477. (#85100) Thanks @joshavant.
• Discord/voice-call: keep forced realtime voice consult diagnostics in debug logs instead of agent prompts, so callers do not hear OpenClaw policy text when the provider misses openclaw_agent_consult. (#84411) Thanks @fuller-stack-dev.
• Codex app-server: mark missing turn completion after observed execution as replay-unsafe and release the session so follow-up turns can run. Fixes #84076. (#85107) Thanks @joshavant.
• Codex app-server: give visible message dynamic tool sends a longer timeout budget so slow channel delivery can return its own result or error instead of hitting the 30-second Codex wrapper. (#85216) Thanks @amknight.
• Codex app-server: add a dedicated post-tool raw assistant completion idle timeout config so trusted heavy turns can wait longer after tool handoff without weakening final assistant release.
• Matrix: keep explicitly configured two-person rooms on the room route before stale m.direct or strict two-member DM fallback can bypass mention gating. Fixes #85017. (#85137) Thanks @joshavant.
• Agents/subagents: require explicit subagent allowlist targets to be configured agents so stale deleted-agent ids are omitted from agents_list and rejected by sessions_spawn. Fixes #84811. (#85154) Thanks @joshavant.
• PDF tool: time out idle remote PDF body reads after 120 seconds so stalled remote documents return an error instead of wedging the session. Fixes #68649. (#84768) Thanks @luoyanglang.
• Diagnostics/OpenTelemetry plugin: suppress handled OTLP exporter promise rejections so collector shutdowns no longer crash the Gateway. (#81085) Thanks @luoyanglang.
• Agents/exec: omit raw command text and env values from denied exec failure logs while keeping safe correlation metadata. Fixes #85049. (#85140) Thanks @joshavant.
• Media-understanding: restore the 4096-token default for image descriptions so reasoning-capable vision models no longer truncate before returning text, while preserving smaller model caps. (#84932) Thanks @scotthuang.
• Media/audio: skip empty structured sherpa-onnx transcripts instead of treating the raw JSON payload as spoken text. (#84667) Thanks @TurboTheTurtle.
• Agents/exec: preserve inherited XDG base-directory environment values for subprocesses while still rejecting agent-supplied XDG overrides. Fixes #84854. (#85139) Thanks @joshavant.
• Node/Linux: keep OPENCLAW_GATEWAY_TOKEN out of generated systemd unit files by writing node service token values to a node-specific env file. (#84408)
• Memory-core/dreaming: reuse stable narrative subagent session keys per workspace and phase while keeping per-run idempotency and bounded cleanup, so stale dreaming-narrative-* sessions do not accumulate. Fixes #68252, #69187, and #70402. (#70464) Thanks @chiyouYCH.
• Trajectory/support: tolerate partial skill snapshot entries when building support metadata so rejected skill path scans no longer abort trajectory capture. (#71185) Thanks @lukeboyett.
• TUI: coalesce repeated idle Esc abort notices into a single no active run xN system row instead of appending duplicate rows.
• Telegram: honor channels.telegram.pollingStallThresholdMs in the default isolated polling path, restarting silent workers instead of leaving inbound updates wedged. Fixes #83950. (#84861) Thanks @joshavant.
• Telegram: dedupe replayed message dispatches by Telegram chat/message identity so isolated-ingress replays do not trigger duplicate model dispatches. Fixes #84886. (#85208) Thanks @joshavant.
• Slack: suppress reasoning payloads before reply delivery and dispatch accounting, so Slack monitor, slash-command, fallback, and direct reply paths do not leak model reasoning. Fixes #84319. (#84322) Thanks @ffluk3 and @joshavant.
• Slack: deliver native plugin approval prompts and updates when Slack native approvals are enabled, while keeping plugin approval authorization separate from exec approvers.
• Slack: keep native plugin approval prompts in the originating app conversation thread when the live Slack turn source is a D... conversation.
• Agents/Pi: disable the embedded pi-coding-agent runtime auto-retry so OpenClaw's own retry and failover loop does not replay failed tool calls through a nested SDK retry. Fixes #73781. (#74434) Thanks @yelog.
• CLI/perf: keep setup --help, onboard --help, and configure --help out of the full wizard runtime while preserving the existing help output. (#84488) Thanks @frankekn.
• CLI/perf: keep agents --help out of agents action/runtime imports so help, completion, and command discovery paths avoid loading the full agents runtime. (#84483) Thanks @frankekn.
• CLI/perf: keep secrets --help and nodes --help on the precomputed help path so parent help avoids loading action-heavy command runtime modules. (#84818) Thanks @frankekn.
• CLI/perf: serve doctor, gateway, models, and plugins parent help from startup metadata so common subcommand help avoids full CLI program construction. (#84786) Thanks @frankekn.
• Codex/Lossless: keep context-engine history on the canonical run session when Telegram DMs use per-peer runtime policy keys. Fixes #84936. (#84954) Thanks @neeravmakwana.
• Codex: keep heartbeat response tool schemas durable without exposing dynamic tools disabled by turn policy, so heartbeat wakeups can reuse threads while scoped tool allowlists stay enforced. (#84681) Thanks @jalehman.
• Auth/OAuth: skip the refresh adapter when a stored OAuth credential has no refresh token so agent turns fail fast on missing-key instead of waiting on the 120s refresh timeout. Thanks @RomneyDa.
• Auth/Codex: load legacy OAuth sidecar credentials in the embedded runner's secrets-runtime auth loaders so Telegram replies, cron-triggered turns, and other isolated sub-agent lanes can reach the existing #83312 refresh-and-rewrite migration instead of failing with No API key found for provider "openai-codex" until the user runs openclaw doctor. Thanks @Totalsolutionsync and @RomneyDa.
• Codex/failover: classify deactivated_workspace as a permanent auth failure so configured fallback models can advance when a Codex workspace is deactivated. (#55893) Thanks @litang9.
• Exec: keep configured tools.exec.pathPrepend entries ahead of user shell startup PATH changes on POSIX gateway runs. (#81403) Thanks @medns.
• Gateway/sessions: allow shared-secret bearer callers to read and stream session history without an explicit scope header. (#81815) Thanks @medns.
• Agents/embedded runner: classify HTML auth provider responses as auth_html and return a re-authentication hint instead of the CDN-blocked copy that upstream_html returns. Cloudflare Access login pages, nginx basic-auth challenges, and gateway login walls all produce HTML auth bodies that were previously misdiagnosed as transient CDN blocks. (#79900) Thanks @martingarramon.
• TUI/streaming watchdog: dismiss the This response is taking longer than expected notice as soon as a chat event for the same run arrives, so the message no longer sits next to the recovered response when the run was only briefly silent. Refs #67052, #69081 (closed), prior attempt #69026. Thanks @jpruit20 and @RomneyDa.
• Agents/Pi: tolerate OpenClaw-owned transcript writes while embedded prompts are released for model I/O, keeping long-running Feishu, Slack, Telegram, and cron turns from failing with false session-takeover errors. Fixes #84059. (#84250) Thanks @tianxiaochannel-oss88.

Fixes #156437

Generated by my agent

Pull Request resolved: #184077
Approved by: https://github.com/ezyang

Adds ObjectSpec and extends lookup_spec_from_dynamo_source so the spec system can address tensors reached via Python attribute access (obj.weight, nn.Module params/buffers, self.x inside an instance method).

import torch
from torch.fx.experimental.dynamic_spec import (
    ObjectSpec, ParamsSpec, ShapesSpec, ShapeVar, TensorSpec,
)

class Model(torch.nn.Module):
    def __init__(self):
        super().__init__()
        self.weight = torch.nn.Parameter(torch.randn(4, 3))
    def forward(self):
        return self.weight + 1

torch.compile(
    Model(),
    shapes_spec=ShapesSpec(
        params=ParamsSpec(
            {"self": ObjectSpec({"weight": TensorSpec([ShapeVar("h"), None])})}
        )
    ),
)

What changed

torch/fx/experimental/dynamic_spec.py

• ObjectSpec — attribute-keyed container.
  • Constructor: ObjectSpec({name: IntermediateSpec, ...}). Values may be leaves (TensorSpec / IntVar / int / None) or another ObjectSpec for recursion.
  • Implements __getitem__ / __contains__ / __iter__ / __len__ / items() for dict-like access.
  • __repr__ matches the module's existing style (object_spec:\n .name: ...); nested children indent recursively.
  • to_jsonable() mirrors the pattern used by other spec types — recurses into spec children, passes raw leaves through.
• IntermediateSpec type alias updated to LeafSpec | ObjectSpec so containers can hold mixed leaf and nested-spec values.

torch/_dynamo/variables/builder.py

• lookup_spec_from_dynamo_source — extended to walk Source chains:

  • LocalSource(name, is_input=True) — the root of any walk.
  • AttrSource(base, member) — descends ObjectSpec._fields[member].
  • NNModuleSource (and subclasses) — transparently unwrapped (guard-semantics marker, not an access step).
  • DictGetItemSource(UnspecializedParamBufferSource(_, '_parameters' | '_buffers'), key) — dynamo internally rewrites self.weight as self._parameters["weight"]; the walk collapses that pair into a single ("attr", key) step so the user-facing attribute name matches the spec.
  • Other source kinds return None — later container PRs (DictSpec / ListSpec) extend this dispatch.

• wrap_module — the pre-marking loop that calls mark_static_input on each named_parameter / named_buffer now skips entries with a spec. Without this, the static stamp would be applied before wrap_tensor's spec-aware bypasses get a chance to fire, and the Parameter would still be lifted as a graph attribute.

Combined effect: nn.Parameter attributes participate in spec-driven dynamism end-to-end.

Test plan — python test/dynamo/test_dynamic_spec.py

• TestObjectSpec (data class) — empty / dict-construction / iter+items / recursive nesting / repr (none-leaf / nested-tensor / nested-objectspec) / to_jsonable.
• TestObjectSpecLookup (lookup walk, ordered simplest → most complex):
  • test_local_source_root_returns_top_level_spec — bare LocalSource returns the ObjectSpec itself.
  • test_attr_descends_into_objectspec — AttrSource(LocalSource(...), "weight").
  • test_nested_objectspec_walk — three-level model.inner.weight.
  • test_missing_attr_returns_none — attr not present in ObjectSpec.
  • test_attr_against_non_objectspec_returns_none — type mismatch (top-level is TensorSpec, source asks for an attr).
  • test_nn_module_source_is_unwrapped — AttrSource(NNModuleSource(LocalSource(...)), "weight").
• TestObjectSpecCompile (e2e):
  • test_attr_tensor_dim_dynamic — plain Python container, obj.w + 1, asserts SymInt at dim 0 and no recompile across dim-0 changes.
  • test_nn_module_parameter_dim_dynamic — realistic case: nn.Parameter reached via self.weight. Exercises NNModuleSource unwrap, UnspecializedParamBufferSource collapse, module-wrapping pre-mark skip, and wrap_tensor spec-aware bypasses.

Pull Request resolved: #182764
Approved by: https://github.com/laithsakka

Summary

ABB became aware of vulnerability in the product versions listed as affected in the advisory. An update is available that replaces an outdated third-party component. Although no successful exploitation was observed during testing of the affected B&R products, the identified vulnerabilities could present potential attack vectors that might enable unauthorized access, data exposure, or remote code execution.

The following versions of ABB B&R Automation Studio are affected:

• B&R Automation Studio <6.5, 6.5 (CVE-2025-6965, CVE-2025-3277, CVE-2023-7104, CVE-2022-35737, CVE-2020-15358, CVE-2020-13632, CVE-2020-13631, CVE-2020-13630, CVE-2020-13435, CVE-2020-13434, CVE-2020-11656, CVE-2020-11655, CVE-2019-19646, CVE-2019-19645, CVE-2019-8457, CVE-2018-20506, CVE-2018-20505, CVE-2018-20346, CVE-2018-8740, CVE-2017-10989, CVE-2016-6153, CVE-2015-6607, CVE-2015-5895, CVE-2015-3717, CVE-2015-3416)

Background

• Critical Infrastructure Sectors: Energy
• Countries/Areas Deployed: Worldwide
• Company Headquarters Location: Switzerland

Vulnerabilities