OpenClaw v2026.9.36 - 更新日志

这是一个仅限网关的 `extended-stable` 版本，相当于我们目前的 LTS。此版本基于截至 2026 年 9 月底的 OpenClaw，并加入了关键安全更新、可靠性与性能修复，以及新模型支持等功能。此版本发布时，OpenClaw 的最新版本是 [2026.10.9](https://github.com/openclaw/openclaw/releases#release-v2026.10.9) ## 2026.9.36 ### 亮点 - **更新失败后仍可恢复：** npm 回滚失败后不再导致已安装的软件包丢失；更新检查会保留 Doctor 恢复指引、停止重复复制私有预演数据库，并且不再重新打开已由候选版本迁移的状态。修复 #184889。（#185160、#186177）感谢 @syxscott、@LiuwqGit 和 @RomneyDa。 - **工作区限制覆盖由 Gateway 构建的工具：** 启用 `tools.fs.workspaceOnly` 后，通过 Gateway 回环和技能分派构建的 `openclaw` 委托现在会按预期要求批准，媒体工具也会保持在工作区内。（#185094）感谢 @eleqtrizit 和 @RomneyDa。 - **Microsoft Teams 允许列表保持严格限制：** 无法解析的、以名称为键的 `teams` 或 `groupAllowFrom` 条目现在不会授予任何权限，而不是向所有团队或群组开放机器人。（#184989）感谢 @eleqtrizit、@RomneyDa 和 @shakkernerd。 - **限制不受信任输入的处理范围：** 格式错误的媒体元数据、入站邮件地址、TOML、URI、自定义 A2UI 架构和 Discord 嵌入式 SDK 中的超大集合，以及由响应控制的 Microsoft 身份验证路由，现在都无法再引发无界工作或更改身份。（#187288、#187282、#187283、#187305、#187289、#187287）感谢 @RomneyDa 和 @cyyynthia。 - **回复文本保持完整：** 表情符号及其他辅助平面字符之后的比较性文本不再从出站回复中被移除。（#187415）感谢 @RomneyDa。 ### 变更 - **证书信任与 Docker 镜像：** 已应用 eMudhra 信任问题修复，并且 Docker 发布镜像现在携带与源码和版本绑定的证据，同时提供更可靠的架构构建。（#186639）感谢 @RomneyDa。 ### 修复 - **凭据与内容边界：** 为 Gateway 构建的 OpenClaw 工具派生文件系统策略；确保未解析的 Microsoft Teams 允许列表保持关闭；并将修补后的 MSAL 限定用于受影响的 Teams 和 Azure Identity 使用方。（#185094、#184989、#187287）感谢 @eleqtrizit、@RomneyDa 和 @shakkernerd。 - **不受信任内容的解析：** 限制 Matrix 媒体元数据与 IMAP 邮件解析、TOML 键解析器、URI 解析，以及自定义 A2UI 架构和 Discord 嵌入式 SDK 中超大 Zod 集合的处理范围。（#187288、#187282、#187283、#187305、#187289）感谢 @RomneyDa 和 @cyyynthia。 - **回复投递：** 在出站清理器中保留辅助平面字符之后的比较性文本。（#187415）感谢 @RomneyDa。 - **xAI：** 对于不支持配置推理强度的旧模型，允许使用 `off`，而不是将其作为无效的思考级别予以拒绝。（#187425）感谢 @RomneyDa。 - **更新、安装与 Doctor：** 在回滚重命名被拒绝后恢复已安装软件包的根目录；保留 Doctor 恢复指引和迁移回滚限制；在缓冲命令结果中保留清理状态的不确定性；不再将更新兼容性清单包含在已发布的软件包中；并停止在每次清理扫描时重试损坏的工作树元数据。修复 #184889、#184237。（#185160、#186177、#184270、#187424、#187475）感谢 @syxscott、@shakkernerd、@LiuwqGit 和 @RomneyDa。 - **节点上传：** 打开暂存上传快照后重新检查取消状态，因此已取消的上传不再抛出 `AbortError`。（#162567）感谢 @RomneyDa。 - **依赖项：** 更新此版本线上的 ClawHub `undici` 固定版本、Vercel 工具链软件包和 Vitest 相关组件。（#187261、#187258、#187275）感谢 @RomneyDa。 ### 完整贡献记录这份经审计的记录涵盖完整的 v2026.9.35..d04a9bec6c286f60f106d6f61354bad4e8b9a057 历史：范围内的 28 个 PR + 0 个保留的仅种子 PR = 28 个唯一 PR。生成清单还提供了直接提交，作为编辑输入；上方的分组说明优先突出对用户的影响。 #### 拉取请求 - **PR #185537** 感谢 @RomneyDa。 - **PR #186639** 感谢 @RomneyDa。 - **PR #186643** 感谢 @RomneyDa。 - **PR #162567** 感谢 @RomneyDa。 - **PR #186177** 感谢 @RomneyDa。 - **PR #187258** 感谢 @RomneyDa。 - **PR #187261** 感谢 @RomneyDa。 - **PR #185160** 关联 #184889。感谢 @LiuwqGit、@RomneyDa 和 @syxscott。 - **PR #184270** 关联 #184237。感谢 @shakkernerd 和 @RomneyDa。 - **PR #187283** 感谢 @RomneyDa。 - **PR #187289** 感谢 @RomneyDa。 - **PR #187282** 感谢 @RomneyDa 和 @cyyynthia。 - **PR #187288** 感谢 @RomneyDa。 - **PR #187275** 感谢 @RomneyDa。 - **PR #185094** 感谢 @eleqtrizit 和 @RomneyDa。 - **PR #184989** 感谢 @eleqtrizit、@RomneyDa 和 @shakkernerd。 - **PR #185484** 感谢 @shakkernerd、@RomneyDa 和 @eleqtrizit。 - **PR #187287** 感谢 @RomneyDa。 - **PR #187305** 感谢 @RomneyDa。 - **PR #187424** 感谢 @RomneyDa。 - **PR #187425** 感谢 @RomneyDa。 - **PR #187415** 感谢 @RomneyDa。 - **PR #187472** 感谢 @RomneyDa。 - **PR #187471** 感谢 @RomneyDa。 - **PR #187475** 感谢 @RomneyDa。 - **PR #187518** 感谢 @RomneyDa。 - **PR #187476** 感谢 @RomneyDa。 - **PR #161504** ### 发布验证 - npm 软件包：https://www.npmjs.com/package/openclaw/v/2026.9.36 - 注册表 tarball：https://registry.npmjs.org/openclaw/-/openclaw-2026.9.36.tgz - 完整性校验：`sha512-lf5bdnWiPleye2eGaaN6HIOI2g96rFJnNFqwuEPVdz+AHlOya8nTSSaXN9Ql9xlkYBCE3ANV6jqhPvJzCpXqVw==` - 发布 SHA：`70c40e4bdcbc4e9952d30121e8de86eeb0781618` - 完整发布 CI 报告：https://github.com/openclaw/releases/blob/main/evidence/2026.9.36/release-evidence.md - 发布流程：https://github.com/openclaw/openclaw/actions/runs/40943247206 - npm 预检：https://github.com/openclaw/openclaw/actions/runs/40908158349 - 完整发布验证：https://github.com/openclaw/openclaw/actions/runs/40907200138 - 插件 npm 发布：https://github.com/openclaw/openclaw/actions/runs/40944417335 - 插件 ClawHub 发布：没有常规 OIDC 候选项 - 插件 ClawHub 引导：不需要 - OpenClaw npm 发布：https://github.com/openclaw/openclaw/actions/runs/40938440703/attempts/1 - npm Telegram Beta 端到端测试：未提供

This is a gateway-only `extended-stable` release, which is our current equivalent to LTS. This release is OpenClaw from the end of September 2026, plus critical security updates, reliability and performance fixes, and features like new model support. The latest version of OpenClaw at the time of this release is [2026.10.9](https://github.com/openclaw/openclaw/releases#release-v2026.10.9) ## 2026.9.36 ### Highlights - **Failed updates stay recoverable:** a failed npm rollback no longer leaves the installed package missing, and update checks keep Doctor recovery guidance, stop recopying private rehearsal databases, and no longer reopen candidate-migrated state. Fixes #184889. (#185160, #186177) Thanks @syxscott, @LiuwqGit, and @RomneyDa. - **Workspace restrictions reach Gateway-built tools:** with `tools.fs.workspaceOnly`, `openclaw` delegates built through Gateway loopback and skill dispatch now require approval as intended, and media tools stay inside the workspace. (#185094) Thanks @eleqtrizit and @RomneyDa. - **Microsoft Teams allowlists stay restrictive:** name-keyed `teams` or `groupAllowFrom` entries that do not resolve now grant nothing instead of opening the bot to every team or group. (#184989) Thanks @eleqtrizit, @RomneyDa, and @shakkernerd. - **Untrusted input is bounded:** malformed media metadata, inbound mail addresses, TOML, URIs, oversized collections in custom A2UI schemas and Discord's embedded SDK, and response-controlled Microsoft authentication routing can no longer cause unbounded work or alter identity. (#187288, #187282, #187283, #187305, #187289, #187287) Thanks @RomneyDa and @cyyynthia. - **Replies keep their text:** comparison prose after emoji and other astral characters is no longer stripped from outbound replies. (#187415) Thanks @RomneyDa. ### Changes - **Certificate trust and Docker images:** the eMudhra trust remediation is applied, and Docker release images carry source/version-bound evidence with more reliable architecture builds. (#186639) Thanks @RomneyDa. ### Fixes - **Credential and content boundaries:** derive the filesystem policy for Gateway-built OpenClaw tools, keep unresolved Microsoft Teams allowlists closed, and scope the patched MSAL to the affected Teams and Azure Identity consumers. (#185094, #184989, #187287) Thanks @eleqtrizit, @RomneyDa, and @shakkernerd. - **Untrusted parsing:** bound Matrix media metadata and IMAP mail parsing, the TOML key parser, URI parsing, and oversized Zod collections in custom A2UI schemas and Discord's embedded SDK. (#187288, #187282, #187283, #187305, #187289) Thanks @RomneyDa and @cyyynthia. - **Reply delivery:** keep comparison prose after astral characters in the outbound sanitizer. (#187415) Thanks @RomneyDa. - **xAI:** allow `off` for older models without configurable reasoning effort instead of rejecting it as an invalid thinking level. (#187425) Thanks @RomneyDa. - **Update, install, and Doctor:** restore the installed package root after a denied rollback rename, keep Doctor recovery guidance and migration rollback restrictions, preserve cleanup uncertainty in buffered command results, keep the update compatibility inventory out of published packages, and stop retrying broken worktree metadata on every cleanup sweep. Fixes #184889, #184237. (#185160, #186177, #184270, #187424, #187475) Thanks @syxscott, @shakkernerd, @LiuwqGit, and @RomneyDa. - **Node uploads:** recheck cancellation after opening a staged upload snapshot so a cancelled upload no longer surfaces an `AbortError`. (#162567) Thanks @RomneyDa. - **Dependencies:** update the ClawHub `undici` pin, Vercel toolchain packages, and the Vitest cohort on this line. (#187261, #187258, #187275) Thanks @RomneyDa. ### Complete contribution record This audited record covers the complete v2026.9.35..d04a9bec6c286f60f106d6f61354bad4e8b9a057 history: 28 in-range PRs + 0 retained seed-only PRs = 28 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact. #### Pull requests - **PR #185537** Thanks @RomneyDa. - **PR #186639** Thanks @RomneyDa. - **PR #186643** Thanks @RomneyDa. - **PR #162567** Thanks @RomneyDa. - **PR #186177** Thanks @RomneyDa. - **PR #187258** Thanks @RomneyDa. - **PR #187261** Thanks @RomneyDa. - **PR #185160** Related #184889. Thanks @LiuwqGit and @RomneyDa and @syxscott. - **PR #184270** Related #184237. Thanks @shakkernerd and @RomneyDa. - **PR #187283** Thanks @RomneyDa. - **PR #187289** Thanks @RomneyDa. - **PR #187282** Thanks @RomneyDa and @cyyynthia. - **PR #187288** Thanks @RomneyDa. - **PR #187275** Thanks @RomneyDa. - **PR #185094** Thanks @eleqtrizit and @RomneyDa. - **PR #184989** Thanks @eleqtrizit and @RomneyDa and @shakkernerd. - **PR #185484** Thanks @shakkernerd and @RomneyDa and @eleqtrizit. - **PR #187287** Thanks @RomneyDa. - **PR #187305** Thanks @RomneyDa. - **PR #187424** Thanks @RomneyDa. - **PR #187425** Thanks @RomneyDa. - **PR #187415** Thanks @RomneyDa. - **PR #187472** Thanks @RomneyDa. - **PR #187471** Thanks @RomneyDa. - **PR #187475** Thanks @RomneyDa. - **PR #187518** Thanks @RomneyDa. - **PR #187476** Thanks @RomneyDa. - **PR #161504** ### Release verification - npm package: https://www.npmjs.com/package/openclaw/v/2026.9.36 - registry tarball: https://registry.npmjs.org/openclaw/-/openclaw-2026.9.36.tgz - integrity: `sha512-lf5bdnWiPleye2eGaaN6HIOI2g96rFJnNFqwuEPVdz+AHlOya8nTSSaXN9Ql9xlkYBCE3ANV6jqhPvJzCpXqVw==` - release SHA: `70c40e4bdcbc4e9952d30121e8de86eeb0781618` - full release CI report: https://github.com/openclaw/releases/blob/main/evidence/2026.9.36/release-evidence.md - release publish: https://github.com/openclaw/openclaw/actions/runs/40943247206 - npm preflight: https://github.com/openclaw/openclaw/actions/runs/40908158349 - full release validation: https://github.com/openclaw/openclaw/actions/runs/40907200138 - plugin npm publish: https://github.com/openclaw/openclaw/actions/runs/40944417335 - plugin ClawHub publish: no normal OIDC candidates - plugin ClawHub bootstrap: not needed - OpenClaw npm publish: https://github.com/openclaw/openclaw/actions/runs/40938440703/attempts/1 - npm Telegram beta E2E: not supplied