65 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-27
stories 62

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Bounded SSE and Google Chat reads prevent OOM; Codex waits for native tool completion

By RepoJournal · Filed · About OpenClaw

OpenClaw patches memory-exhaustion vectors in SSE transport and Google Chat while fixing a race that caused Codex to send failed tool results for tools still running.

OpenClaw hardened two unbounded-read paths against out-of-memory crashes. The provider-transport-fetch SSE handler now bounds its buffer [1], and the Google Chat extension replaced its local unbounded `response.json()` calls with the SDK helper `readProviderJsonResponse`, capping JSON bodies at 16 MiB to match 15+ other extensions [2][3]. Both changes close the same class of bug: a hostile or malfunctioning endpoint could exhaust process memory during parsing.

The Codex integration now waits for native tool completion before firing the completion-idle watchdog [4]. Previously, Codex Computer Use routed through Discord could abort a running `computer-use.get_app_state` MCP tool and then synthesize a failed `tool.result` with `missing_tool_result` even though the tool was still active. Tool-display truncation was also fixed to cut on code-point boundaries, preventing truncated strings from ending in a lone high surrogate when emoji or astral characters are present [5].

The docs repo restored its full translation workflow with guardrails: full translation is now weekly-plus-manual only, a manual `target_locale` allows rerunning a single failed locale, and control logic moved out of YAML heredocs into a tested `.github/scripts/i18n/` directory [6][7]. A repair-scope guard snapshots pre-repair locale files to RUNNER_TEMP and rejects staged repair changes or non-locale edits, so the repair action cannot rewrite the trusted baseline [8].

Action items

References

  1. [1] fix(provider-transport-fetch): bound SSE buffer to prevent OOM (#96989) ↗ openclaw/openclaw
  2. [2] fix(googlechat): replace unbounded response.json() with readProviderJsonResponse (#96772) ↗ openclaw/openclaw
  3. [3] fix(googlechat): replace unbounded response.json() with readProviderJsonResponse ↗ openclaw/openclaw
  4. [4] fix(codex): wait for native tool completion ↗ openclaw/openclaw
  5. [5] fix(agents): truncate tool-display detail on code-point boundaries ↗ openclaw/openclaw
  6. [6] ci: recover full docs translation workflow ↗ openclaw/docs
  7. [7] chore(i18n): extract translation workflow control scripts ↗ openclaw/docs
  8. [8] fix(ci): guard translated MDX repair scope ↗ openclaw/docs

Quick answers

What shipped in OpenClaw on June 27, 2026?
OpenClaw patches memory-exhaustion vectors in SSE transport and Google Chat while fixing a race that caused Codex to send failed tool results for tools still running. In total, 40 commits and 22 pull requests landed.
Who contributed to OpenClaw on June 27, 2026?
5 developers shipped this update, including wangmiao0668000666, zhangguiping-xydt, Bartok9, hxy91819, and Vincent Koc.
What were the notable OpenClaw updates?
fix(provider-transport-fetch): bound SSE buffer to prevent OOM (#96989), fix(googlechat): replace unbounded response.json() with readProviderJsonResponse (#96772), and fix(googlechat): replace unbounded response.json() with readProviderJsonResponse.