v2026.7.1-2OpenClawSecurityJuly 31, 2026

Sturdier channels and gateway recovery, a smarter doctor, and a broad security-hardening pass.

Spans OpenClaw 2026.6.9–2026.7.1. Message delivery gets noticeably more reliable across Telegram, Discord, and WhatsApp — richer formatting, stuck-message recovery, and correct reply attribution. A repeatedly crashing gateway now parks in a stable repair state instead of restarting forever, and doctor upgrades preserve your model tuning and refuse to clobber an unreadable config. Security work landed across every release in this span: secrets are redacted from more logs and debug output, trusted package sources reject lookalike paths, and unsafe downloads are blocked earlier. No action is needed on your part — all migrations are automatic.

New features

OpenClawNew `/fast auto` mode: short conversations start fast, longer work automatically returns to normal mode.

OpenClaw`openclaw attach` gives Claude Code temporary access to a selected session for hands-on debugging.

OpenClawScheduled jobs can clear a model override with `cron edit --clear-model`.

OpenClawSlack tokens and signing secrets can now be stored as SecretRefs instead of plain config values.

Improvements

OpenClawTelegram: richer HTML rendering with markdown preserved, better reply attribution, forum-topic routing, webhook resilience, and stuck-message recovery.

OpenClawDiscord: tool status reactions appear immediately, long replies no longer truncate at the character limit, and voice queues process reliably.

OpenClawWhatsApp: media failures recover automatically, group replies quote correctly, and GIFs keep their metadata.

OpenClawA gateway that keeps crashing now lands in a stable repair state instead of restarting indefinitely.

OpenClaw`openclaw doctor --fix` preserves model aliases, parameters, and runtime tuning when retired model names merge, and refuses to replace an unreadable config file.

OpenClawAgent recovery is more resilient thanks to retry logic and automatic session-history repair.

OpenClawCLI quality of life: global flags are accepted after subcommands, and `channels status --json` reports configured channels more reliably.

Fixes

OpenClawReasoning-level menus for local Ollama models show all supported options again.

OpenClawSession identity no longer carries over incorrectly between direct messages and channels.

OpenClawSQLite write-ahead logging is disabled on network filesystems, preventing store corruption.

Breaking changes

OpenClawOpenClaw now requires Node.js 22.22.3 or newer. Bot It Out instances are upgraded automatically; only relevant for self-managed installs.

Notes

SecuritySecurity hardening across the span: secrets redacted from debug/config output and more logs, trusted package sources reject lookalike sibling paths, package downloads no longer follow token-leaking cross-origin redirects, unsafe downloads and network requests are blocked earlier, and the Control UI sanitizer was patched (DOMPurify advisory).

OpenClawAuth profiles are automatically imported into per-agent storage on first start after the upgrade — no action needed.

← Older: v2026.6.8

Running an older version?

Upgrade your instance from the dashboard to get everything above.

Open dashboard