🔒 GitHub Release: openclaw/openclaw v2026.9.34 (24.10.2026)

GitHub Release: openclaw/openclaw v2026.9.34 (24.10.2026)

Release v2026.9.34 von openclaw/openclaw auf GitHub: This is a gateway-only extended-stable release, which is our current equivalent to LTS. This release is…

IT Security Downloads GitHub · openclaw/openclaw 24.10.2026, 13:38 Uhr 4 Min. Lesezeit KRITIS / Energie

🛡️ Security Fix openclaw/openclawv2026.9.3424.10.2026@github-actions[bot]

This is a gateway-only extended-stable release, which is our current equivalent to LTS. This release is OpenClaw from the end of September 2026, plus critical security updates, reliability and performance fixes, and features like new model support. The latest version of OpenClaw at the time of this release is 2026.10.6

2026.9.34

Highlights

Safer agent file edits: apply_patch now validates an ordered envelope before mutating the workspace, so a later invalid hunk cannot delete files changed by an earlier operation. (#160409) Thanks @masatohoshino, @obviyus, and @RomneyDa.

More reliable managed upgrades: app-owned updates now converge official plugins alongside core and retain repair diagnostics. Fixes #174120. (#174257) Thanks @kazuyuki-eguchi and @RomneyDa.

Memory Wiki data safety: OKF concept re-imports now preserve human-authored notes. Fixes #175700. (#175707) Thanks @YangManBOBO and @RomneyDa.

Reliable model startup and selection: Gateway startup now survives model-refresh ownership replacement, and catalog readiness honors the effective primary model's configured account pin. Fixes #178502. (#173366, #178522) Thanks @ericcaiwx-star, @eduardonunesfreire-rgb, and @RomneyDa.

Gateway and integration stability: log rotation no longer spins on a deleted /tmp, Buzz relay closure no longer exits the Gateway during authentication, and OpenRouter onboarding accepts valid credentials. Fixes #147269. (#160433, #170591, #173292) Thanks @masatohoshino, @jarvis-modern-mail, @chandraveshchaudhari, @RomneyDa, and @WadeOwenWatts.

Plugin hooks restored: before_tool_call hooks now run under openclaw agent exec. Fixes #158824. (#159333) Thanks @joseairosa and @RomneyDa.

Changes

Managed update convergence: official plugins are reconciled to the app-managed core version during upgrades, with diagnostics retained for repair paths. Fixes #174120. (#174257) Thanks @kazuyuki-eguchi and @RomneyDa.

Fixes

Agent patch atomicity: preflight ordered apply_patch envelopes before mutation so later invalid hunks cannot destroy earlier files. (#160409) Thanks @masatohoshino, @obviyus, and @RomneyDa.

Memory Wiki note preservation: retain human-authored notes when OKF concepts are imported again. Fixes #175700. (#175707) Thanks @YangManBOBO and @RomneyDa.

Model lifecycle and auth selection: keep startup alive through model-refresh replacement and honor the configured primary account pin during catalog readiness. Fixes #178502. (#173366, #178522) Thanks @ericcaiwx-star, @eduardonunesfreire-rgb, and @RomneyDa.

Gateway logging and Buzz stability: avoid deleted-log-target CPU spin and prevent NIP-42 relay closure from exiting the Gateway. Fixes #147269. (#160433, #170591) Thanks @masatohoshino, @jarvis-modern-mail, @RomneyDa, and @WadeOwenWatts.

OpenRouter onboarding: accept valid API keys during route verification. (#173292) Thanks @chandraveshchaudhari and @RomneyDa.

Agent plugin hooks: restore before_tool_call execution for openclaw agent exec. Fixes #158824. (#159333) Thanks @joseairosa and @RomneyDa.

Cross-release updater compatibility: retain the 2026.10.1 launchd observation and updater runtime exports during extended-stable replacement, and conservatively refuse immutable-install mutation on this older release line. (#160663) Thanks @RomneyDa.

Patched Node runtime floors: require Node >=24.22.1 <25 || >=26.12.1 across install, update, Docker images, and the macOS app runtime check, so upgrades refuse vulnerable runtimes with a clear next step. (#181073) Thanks @RomneyDa.

Dependency advisories: patch zod (GHSA-mrhx-c7xc-m3w5), body-parser, and other production advisories on this release line. (#181341) Thanks @RomneyDa.

Session durability: skip empty transcript archive materialization and fence the first creation during transcript reconciliation. (#170122) Thanks @RomneyDa.

Claude CLI session continuity: subagent completions no longer reset the Claude CLI session and lose prior context. (#178955) Thanks @Marvinthebored and @RomneyDa.

Update recovery: complete interrupted update recovery safely and preserve admission interruption reasons for Doctor follow-up. (#181503, #181870) Thanks @RomneyDa.

Backup, Linux, and macOS repairs: carry backup and platform service repairs needed by this release line, including the legacy macOS Gateway status path. (#181466) Thanks @RomneyDa.

Release validation compatibility: reconcile branch-native update admission, declaration surfaces, safety baselines, and test fixtures required by the current full-release validation toolchain. (#180988) Thanks @RomneyDa.

Complete contribution record

The expanded maintenance audit covers all 743 selected source rows from the

2026.10 stable and beta release lines after v2026.9.33: 596 unique numbered

PRs and 105 unnumbered release companions. The final source-row dispositions

are 142 applied, 82 branch-adapted, 128 already covered, and 391 explicitly

excluded.

The complete deduplicated PR inventory, mixed source-row sequences, unnumbered

companions, and exclusion reasons are preserved in the

2026.9.34 extended-stable backport audit.

The grouped notes above remain the user-impact summary rather than repeating

the hundreds-row audit.