RepoJournal
OpenClaw @openclaw
113 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-17
stories 135
GitHub RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Plugin JSON body reading converges on one bounded reader

By RepoJournal · Filed · About OpenClaw

Peter Steinberger openclaw-docs-sync[bot]
2 people shipped this
Peter Steinberger @steipete 9 cited openclaw-docs-sync[bot] @openclaw-docs-sync[bot] 1 cited

OpenClaw consolidated plugin JSON body parsing onto a single canonical bounded reader with strict size, timeout, and cleanup semantics, closing an indefinite-hold vulnerability in unauthenticated Telegram Mini App requests.

OpenClaw refactored plugin HTTP endpoints to use one canonical bounded JSON body reader, eliminating drifting size, timeout, stream-error, and cleanup behavior across admin and Telegram routes [1]. The consolidation closes a vulnerability where an unauthenticated Telegram Mini App auth request could hold the request body open indefinitely because its local reader had no timeout [2]. The work includes a security test suite covering the migration [1].

Onboarding in display-less WSL environments now opens the browser via canonical browser-open support, with WSL detection caching preserved and stale browser processes cleaned up [3]. The Workboard plugin now syncs lifecycle states even when the dashboard is closed, using `agent_end` and `subagent_ended` hooks plus a 60-second `sessions.list` sweep, replacing the UI-only lifecycle write path [4]. Plugin metadata tests now reset the full lifecycle between tests, addressing a gap where memoized registries could leak stale state [5].

The Crabbox CLI gains `heartbeat`, which sends an owner-scoped heartbeat through the coordinator and prints the committed lease state, falling back to provider `Touch` only after local-claim and terminal-state checks [6]. Local-container provisioning now bypasses reusable-workspace ownership only for guaranteed-cleanup fresh runs, preserving ownership for retention policies [7], and honors native architecture assertions with no emulation fallback [8]. Jujutsu sync validates local sources before any provisioning, closing a remaining paid-resource side effect [9]. Five automated doc sync mirrors updated openclaw/docs [10].

Action items

References

  1. [1] refactor(security): consolidate plugin JSON body reading onto canonical bounded reader (#124944) ↗ openclaw/openclaw
  2. [2] refactor(security): consolidate plugin JSON body reading onto canonical bounded reader ↗ openclaw/openclaw
  3. [3] fix(onboard): open browser handoff in display-less WSL (#124704) ↗ openclaw/openclaw
  4. [4] fix(workboard): keep cards synced when dashboard is closed ↗ openclaw/openclaw
  5. [5] test(plugins): reset the whole plugin metadata lifecycle between tests (#125037) ↗ openclaw/openclaw
  6. [6] feat: add lease heartbeat command ↗ openclaw/crabbox
  7. [7] fix(local-container): bypass fresh one-shot ownership ↗ openclaw/crabbox
  8. [8] fix(local-container): honor native architecture assertions ↗ openclaw/crabbox
  9. [9] fix(sync): validate Jujutsu before delegated provisioning ↗ openclaw/crabbox
  10. [10] chore(sync): mirror docs from openclaw/openclaw@0c4e2f6681d1bbc4cd5c8c6d7cb147e7509a8937 ↗ openclaw/docs

$ ls openclaw/reviews/ # the step-back reads

the month in review 2026.8.1-beta.2 binds secrets to exact HTTPS hosts
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in OpenClaw on August 17, 2026?
OpenClaw consolidated plugin JSON body parsing onto a single canonical bounded reader with strict size, timeout, and cleanup semantics, closing an indefinite-hold vulnerability in unauthenticated Telegram Mini App requests. In total, 96 commits and 39 pull requests landed.
Who contributed to OpenClaw on August 17, 2026?
2 developers shipped this update, including Peter Steinberger and openclaw-docs-sync[bot].
What were the notable OpenClaw updates?
refactor(security): consolidate plugin JSON body reading onto canonical bounded reader (#124944), refactor(security): consolidate plugin JSON body reading onto canonical bounded reader, and fix(onboard): open browser handoff in display-less WSL (#124704).
♥

$ log @openclaw --recent

Gesture update rollback guard fixed; Slack slackens redundant work 150 shipped CLI runner preserves partial Claude output on aborted turns 61 shipped Mantis proof agent gains programmable trust boundaries 83 shipped Session overwrites fenced, provider cleanup hardened, main unblocked 117 shipped

$ log --all # elsewhere on the wire

Meta React Native adds Stable API guards to renderer attributed string FastAPI & Pydantic Pydantic fixes Mypy plugin crash, tightens datetime constraints

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.