RepoJournal
OpenClaw @openclaw
77 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-07
stories 119
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Security fixes in gateway PATH and temp workspaces

By RepoJournal · Filed · About OpenClaw

vincentkoc omarshahine Santiago Qiong steipete jodok
6 people shipped this
vincentkoc @vincentkoc 4 cited omarshahine @omarshahine 4 cited Santiago @shbernal 2 cited Qiong @yangxiansheng 1 cited steipete @steipete 1 cited jodok @jodok 1 cited

OpenClaw shipped a security patch rejecting workspace package-manager PATH roots and routing temp workspaces through a private OpenClaw temp root.

OpenClaw's gateway PATH generation now includes pnpm 11's `PNPM_HOME/bin` layout while keeping pnpm 10-style paths compatible [1][2]. The same change rejects workspace package-manager PATH roots as a security measure, and preserves package paths from the root cwd. Gateway-side skill requirement checks previously missed pnpm 11 global shims, reporting missing `clawhub` even when installed [2].

A separate security fix [3] routes temp workspaces through a private OpenClaw temp root. The change also skips POSIX mode proof on Windows and aligns the release changelog.

Windows users running globally installed Gemini CLI or Claude Code backends could fail to start because Node does not execute npm `.cmd` launchers directly; the PR resolves standard Windows npm launchers through the existing generic spawn-program resolver, then executes their Node entrypoint or native executable [4]. The voice-call plugin now supports Twilio Calls in IE1 and AU1 via an optional config field `twilio.region` accepting `us1`, `ie1`, or `au1`; previously all requests went to US1 [5].

The docs site rebuilt its design system on the openclaw.ai / Foundation brand, replacing the old warm brown/orange palette with neutral ink, coral primary, and sea glass accents [6][7]. Follow-up fixes calm table-of-contents navigation by guarding the popstate handler against same-document hash changes, holding the scrollspy for 900ms, and cache-busting og urls [8][9]. imsg now makes native poll questions visible both directions: outbound polls send a caption after creation, and inbound title-less polls backfill from caption rows [10][11].

The imsg bridge helper now ships with an arm64e slice for macOS 26 Messages, with the CLI architecture set unchanged [12][13].

Action items

References

  1. [1] fix: include pnpm 11 bins in gateway PATH (#85238) ↗ openclaw/openclaw
  2. [2] fix: include pnpm 11 bins in gateway PATH ↗ openclaw/openclaw
  3. [3] fix(security): route temp workspaces through private OpenClaw temp root (#101224) (#101246) ↗ openclaw/openclaw
  4. [4] fix: Windows CLI backends fail through npm shims ↗ openclaw/openclaw
  5. [5] feat(voice-call): support Twilio calls in IE1 and AU1 ↗ openclaw/openclaw
  6. [6] feat(docs-site): rebuild design system on the openclaw.ai / Foundation brand ↗ openclaw/docs
  7. [7] feat(docs-site): rebuild design system on the openclaw.ai / Foundation brand (#89) ↗ openclaw/docs
  8. [8] fix(docs-site): toc scroll jumpiness, stale og caches, mobile language picker ↗ openclaw/docs
  9. [9] fix(docs-site): calm toc navigation, cache-busted og urls, native mobile language select (#91) ↗ openclaw/docs
  10. [10] fix(poll): make the poll question visible both directions (echo out, backfill in) ↗ openclaw/imsg
  11. [11] fix(poll): expose native poll questions (#155) ↗ openclaw/imsg
  12. [12] [codex] Include arm64e slice in imsg bridge helper ↗ openclaw/imsg
  13. [13] fix(release): ship arm64e bridge helper (#156) ↗ openclaw/imsg
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on July 7, 2026?
OpenClaw shipped a security patch rejecting workspace package-manager PATH roots and routing temp workspaces through a private OpenClaw temp root. In total, 89 commits and 30 pull requests landed.
Who contributed to OpenClaw on July 7, 2026?
6 developers shipped this update, including Santiago, Qiong, steipete, jodok, vincentkoc, and omarshahine.
What were the notable OpenClaw updates?
fix: include pnpm 11 bins in gateway PATH (#85238), fix: include pnpm 11 bins in gateway PATH, and fix(security): route temp workspaces through private OpenClaw temp root (#101224) (#101246).
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped Fixes for stale DashScope downloads and Telegram forward origins 117 shipped Plugin approvals now push to iOS devices; uploads and checks stop hanging 116 shipped Smarter CI reuse, tighter Copilot OAuth checks 210 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.