Agent Breaking Changes_

← OpenClaw

OpenClaw openclaw 2026.9.35

breakingsecuritymodel

2026-10-27 · official notes

Summary

Full notes

This is a gateway-only `extended-stable` release, which is our current equivalent to LTS. This release is OpenClaw from the end of September 2026, plus critical security updates, reliability and performance fixes, and features like new model support. The latest version of OpenClaw at the time of this release is [2026.10.7](https://github.com/openclaw/openclaw/releases#release-v2026.10.7)

## 2026.9.35

### Highlights

- **Steadier memory under service managers:** worker heap caps now apply even when the Gateway service passes a process-wide `--max-old-space-size`, idle Codex app-server clients retire after 30 seconds, and archive workers are reused between session deletes, so long-running Gateways stop accumulating memory. Fixes #179515, #169797, #165663. (#166581, #171490, #168387, #171156, #175091) Thanks @valkyriweb and @RomneyDa.
- **Updates finish more often:** update-time Doctor now removes leftover unknown config keys after migrations, accepts a missing legacy OAuth directory, keeps a valid config that lacks `meta`, settles a completed package publication that already serves the candidate, and no longer overflows on very large session histories. Fixes #174618, #183479. (#175404, #180174, #183703, #180414)
- **Gateway stays responsive:** crafted Microsoft Teams HTML, replies shaped like tool calls, and long streamed HTML or JSX answers no longer stall the Gateway event loop for seconds at a time. (#183438, #183252, #174833, #175472, #180765) Thanks @LeizhenZhang and @JasonBuildAI.
- **Replies reach the user:** the message tool stays directly visible under Tool Search, model fallback works after an unexecuted tool call and for compaction, timed-out MCP sessions no longer break the next turn, and Claude CLI turns that hit the output limit fail fast instead of stalling for 15 minutes. Fixes #176045. (#179450, #183282, #182189, #159931) Thanks @hehuang139, @pstarkgit, @aniketkrs, and @Terwox.
- **Codex native subagents settle correctly:** parents are no longer blocked after native children finish, are interrupted, or complete a follow-up; undeliverable completions are not resurrected; and completed grandchildren no longer replay after a Gateway restart. (#173018, #175246, #179050, #179099, #177577, #181839) Thanks @quqi1599, @wtfichigo, @linancn, and @sunlit-deng.
- **Safer by default:** `test -v` exec operands now require approval in allowlist mode, browser proxy commands are refused through generic node invoke, generated-video downloads use the SSRF guard, and `openclaw mcp list`/`show` plus logs redact credentials. (#180880, #179880, #182425, #180321, #183193) Thanks @eleqtrizit, @brandon-julio-t, and @LeizhenZhang.
- **SQLite 3.54 data safety:** Doctor and update snapshots now repair stale full-text indexes left by the SQLite tokenizer change instead of quarantining agent databases. Fixes #176220. (#176234, #181206)

### Changes

- **Kimi K3.1 Pro:** `moonshot/kimi-k3.1-pro`, `kimi/k3.1-pro`, and their Highspeed variants get the K3 thinking, effort, and video controls; K3.1 rejects `off` locally instead of returning a provider 400. (#181923) Thanks @obviyus.
- **Known-issue documentation:** documented the `--preserve-symlinks` plugin capture workaround, the 2026.8.35 updater's schema warning, and recovery after a publication-journal device-number change. Related #175591, #170031. (#184143) Thanks @RomneyDa.

### Fixes

- **Credential and content boundaries:** require approval for `test`/`[` `-v` operands, refuse browser proxy commands on generic node invoke, guard generated-video downloads, redact MCP inspection output and Google OAuth client secrets, keep commentary out of turns whose replies are disabled, and keep private media out of silent turns. (#180880, #179880, #182425, #180321, #183193, #178518, #129244) Thanks @eleqtrizit, @brandon-julio-t, @LeizhenZhang, and @obviyus.
- **Reply delivery and fallback:** keep the message tool visible under Tool Search, allow model fallback after unexecuted tool calls and for compaction, fall back immediately on exhausted Anthropic usage caps, recover unfinished tool work after empty `length` stops, and keep rejected Claude CLI drafts out of final replies. Fixes #176045, #176179. (#169091, #179450, #183282, #176186, #153728, #168764) Thanks @hehuang139, @pstarkgit, @sunlit-deng, @zhangguiping-xydt, and @ruel225.
- **Gateway responsiveness:** bound regex and tag scans for Microsoft Teams HTML, tool-call-shaped replies, and long streamed markup. (#183438, #183252, #174833, #175472, #180765) Thanks @LeizhenZhang and @JasonBuildAI.
- **Claude CLI sessions:** ignore request echoes when checking for orphaned tool calls, classify rejected resume checkpoints as an expired session, end output-limit stalls promptly, and stop announce wakes from resetting CLI chats. (#172026, #159931, #181308, #176218) Thanks @Terwox, @mushuiyu886, and @eliavb43.
- **Agent runtime:** release completed attempt callbacks, finish parent handoff after cancelling child tasks, cap large subagent completion batches, preserve memory captures during concurrent session resets, load skills when macOS workspace casing differs, and stop thinking-only replies from utility models, including custom GLM title models. (#183884, #178893, #172068, #181081, #181236, #169920, #172580) Thanks @brianmcguire and @jason-allen-oneal.
- **Codex:** retire idle unowned app-server clients, keep native tool declarations stable on completion turns, keep native liveness during host work, and settle native subagent completions, interruptions, follow-ups, and restart replay. Fixes #165663. (#168387, #183286, #181839, #173018, #175246, #179050, #179099, #177577) Thanks @sunlit-deng, @quqi1599, @wtfichigo, and @linancn.
- **Channels:** recover Slack socket mode from an isolated `invalid_auth` and Slack relay connections from silent network drops, tag only Matrix control commands with a command source, keep Telegram offset checkpoints working on Bun, keep the realtime voice transport runtime for callbacks, and keep channel accounts restarting after an exited run is cancelled. Fixes #179398. (#181056, #182368, #179506, #178909, #179462, #182433) Thanks @mushuiyu886, @xiaopan-xydt, @brianmcguire, and @shoaibulhaque.
- **MCP and GitHub tools:** let concurrent agents read a fresh shared MCP OAuth credential without the exclusive lease, and accept GitHub PR publishing from operators whose profile attaches after connect. (#179997, #169400) Thanks @maliv2 and @Gigaxel.
- **Gateway, state, and readiness:** answer trusted-proxy readiness probes without forwarded headers, bound channel-identity admission waits so stalled admission cannot pin WAL checkpoints, keep queued startup work off temporary SQLite reader scopes, avoid writer stalls during initial host admission, preserve live state-lock owners while recovering stale Linux locks, and finish worker shutdown after inventory retirement. Related #143524. (#182823, #172244, #182615, #171549, #175118, #168862) Thanks @ericcaiwx-star, @xialonglee, and @xiaopan-xydt.
- **Update, install, and Doctor:** remove unowned config keys during updates, accept a missing legacy OAuth directory, keep a valid config that lacks `meta`, route debug logs off JSON stdout during admission, bound the post-activation Doctor step and update baseline checks, recover the Node runtime when started from `/`, accept unchanged dist files with extra execute bits, tolerate absent optional packages in Windows swaps, launch SQLite helpers hidden on Windows, create the state directory `0700` regardless of umask, admit group-writable plugin secret resolvers, allow SQLite readers during stopped backups, import transcripts whose filename differs from the header, read cron history identities before payloads, avoid stack overflow on very large session histories, settle a completed package publication that already serves the candidate, and refuse a registry update before staging when the Gateway's Node does not satisfy the target's `engines.node` instead of crash-looping after the switch. Fixes #174618, #183479, #183149. (#180769, #175404, #180174, #183703, #182850, #173862, #181906, #178112, #181141, #181596, #174969, #179538, #181127, #180827, #178146, #174530, #180414) Thanks @jalehman and @wangmiao0668000666.
- **Plugins:** replace dangling dependency junctions instead of refusing plugin migration, copy native captures across filesystems, and tolerate ctime-only stat drift in native companion admission. (#179549, #179445, #179949) Thanks @coaiMax.
- **SQLite full-text indexes:** repair stale FTS indexes after the SQLite 3.54 tokenizer change in Doctor and update snapshots instead of quarantining agent data. Fixes #176220. (#176234, #181206)
- **Release validation compatibility:** carry the release-retrospective batch 5 tooling (admission pins, compact reuse plans, Plugin SDK revision rendering) needed by current full-release validation. (#181920) Thanks @RomneyDa.

### Complete contribution record

The 2026.9.35 maintenance audit covers all 3,595 `main` commits from
`beaee570a5d4` (2026-10-21) through `f227543e4815`, plus open P0/P1 issues and
operator-requested PRs. 78 fixes from 77 numbered PRs and 3 branch-specific
repairs were applied or adapted; the rest were classified as not affected,
already covered, or excluded with a reason.

The complete PR inventory, adaptations, exclusions, and corrections to the
2026.9.34 audit are preserved in the
[2026.9.35 extended-stable backport audit](../docs/releases/2026.9.35-backport-audit.md).
The grouped notes above remain the user-impact summary.

### Release verification

- npm package: https://www.npmjs.com/package/openclaw/v/2026.9.35
- registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.9.35.tgz
- integrity: `sha512-1wVhWrYXsEgy4iVHAg0CEd4J7Vp4blc8XvIKVg463UYNxYVgUitg3pWdCKPxDIRgetQ6t5ViEftSn5J0UI7x9A==`
- release SHA: `2ff91b9c5ed26aff603c6d5466fc642ae9d50e72`
- full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.9.35/release-evidence.md
- release publish: https://github.com/openclaw/openclaw/actions/runs/40430868801
- npm preflight: https://github.com/openclaw/openclaw/actions/runs/40416259133
- full release validation: https://github.com/openclaw/openclaw/actions/runs/40415713477
- plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/40431530924
- plugin ClawHub publish: no normal OIDC candidates
- plugin ClawHub bootstrap: not needed
- OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/40433786628
- npm Telegram beta E2E: not supplied
Weekly digest: every breaking change, retirement and price change across 23 coding agents, one email.

Form not loading? Subscribe here.