RepoJournal
OpenClaw @openclaw
65 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-06-30
stories 63
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

OpenClaw ships seven security fixes across HTTP, Browser, and Exec surfaces

By RepoJournal · Filed · About OpenClaw

Vincent Koc
1 person shipped this
Vincent Koc @vincentkoc 2 cited

Seven fixes over two repos harden core surfaces: browser URL checks, glob allowlists, admin scope, and slow-read DoS, with two maintenance commits in the clownfish repo.

OpenClaw patched several HTTP-surface vulnerabilities. Identity-bearing HTTP callers could reach admin-scoped tools [1], and remote media URLs could slow-read exhaust tool workers [2]. Both widen the attack surface available to unauthenticated or low-privilege callers; the fixes tighten scope checks and bound media reads.

The browser act route could miss current-tab URL checks [3], and browser snapshot routes could miss SSRF checks after navigation [4]. These gaps let a browser session act on tabs without validating the URL as expected, or reach internal targets post-redirect. Also fixed: exec allowlist glob matching could allow traversal bypasses [5], which weakens command allowlisting. Hardening these three surfaces closes classes of URL-validation and path-traversal bugs.

In @openclaw/clownfish, the last two commits staged the next round of OpenClaw PRs [6] and their remediation [7], part of routine preparation cadence.

Action items

References

  1. [1] Identity-bearing HTTP callers could reach admin-scoped tools openclaw/openclaw ↗
  2. [2] Remote media URLs could slow-read exhaust tool workers openclaw/openclaw ↗
  3. [3] Browser act route could miss current-tab URL checks openclaw/openclaw ↗
  4. [4] Browser snapshot routes could miss post-navigation SSRF checks openclaw/openclaw ↗
  5. [5] Exec allowlist glob matching could allow traversal bypasses openclaw/openclaw ↗
  6. [6] chore: add next OpenClaw ready PR drip ↗ openclaw/clownfish
  7. [7] chore: add next OpenClaw PR remediation drip ↗ openclaw/clownfish
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on June 30, 2026?
Seven fixes over two repos harden core surfaces: browser URL checks, glob allowlists, admin scope, and slow-read DoS, with two maintenance commits in the clownfish repo. In total, 28 commits, 25 pull requests, and 10 security advisories landed.
Who contributed to OpenClaw on June 30, 2026?
1 developer shipped this update, including Vincent Koc.
What were the notable OpenClaw updates?
Identity-bearing HTTP callers could reach admin-scoped tools, Remote media URLs could slow-read exhaust tool workers, and Browser act route could miss current-tab URL checks.
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped OpenClaw extracts reusable @openclaw/ai runtime package 52 shipped Fix config-health migration warning, session drift hard invalidations, MCP stderr crash 21 shipped Ambient transcript watermark now scoped per session, DeepSeek V4 reasoning fixed on OpenRouter 25 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.