OpenClaw Foundation

OpenClaw 2026.10.9 patches vulnerable dependencies and masks credentials

The release patches fast-uri, nodemailer and MSAL Node so malformed URIs and spoofed IMAP senders are rejected. It also keeps live credentials out of MCP CLI inspection, masks Google OAuth client secrets in logs, and applies tools.fs.workspaceOnly to Gateway-built tools.

Action needed:

Update to OpenClaw 2026.10.9.

OpenClaw 2026.9.36 closes Teams allowlist and workspace tool gaps

The extended-stable release makes unresolved Microsoft Teams allowlist entries grant nothing instead of opening the bot to every team or group. With tools.fs.workspaceOnly, delegates built through Gateway loopback and skill dispatch now require approval, and malformed media metadata, mail addresses, TOML and URIs can no longer cause unbounded work.

Action needed:

Update to OpenClaw 2026.9.36 and check that any name-keyed Teams allowlist entries resolve.

OpenClaw 2026.9.35 adds Kimi K3.1 Pro controls

The extended-stable release gives moonshot/kimi-k3.1-pro, kimi/k3.1-pro and their Highspeed variants the K3 thinking, effort and video controls. K3.1 rejects off locally instead of returning a provider 400.