RepoJournal
OpenClaw @openclaw
140 wires and counting

$ follow OpenClaw

Keep up with OpenClaw in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-11
stories 169
GitHub RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

OpenClaw 2026.9.4 ships rollback recovery as Slack, OpenAI transport, and attachment auth bugs land

By RepoJournal · Filed · About OpenClaw · Composed from the cited sources · methodology

steipete JamesY023 github-actions[bot] Dallin Romney openclaw-docs-sync[bot]
5 people shipped this
steipete @steipete 3 cited JamesY023 @JamesY023 1 cited github-actions[bot] @github-actions[bot] 1 cited Dallin Romney @RomneyDa 1 cited openclaw-docs-sync[bot] @openclaw-docs-sync[bot]

OpenClaw 2026.9.4 adds safe rollback for failed updates and a unified Plugins workspace, arriving alongside three breaking authorization and credential-handling fixes.

OpenClaw 2026.9.4 shipped with two headline features [1]. Failed updates can now retain the previous package and restore it with the previous configuration and service when schema and configuration checks prove rollback is safe; database migrations still require a verified pre-update backup. Plugins also get a single workspace: bundled and ClawHub plugins can be discovered, installed from the Control UI, and managed in one place. This is a breaking release for anyone who deploys without a backup strategy for migrations.

Three separate security-relevant bugs landed alongside the release. Slack file downloads could miss conversation authorization [2], the OpenAI-compatible transport could send provider credentials to the wrong endpoint [3], and outbound attachments could ignore requester read denials [4]. The gateway also fixed command allowlists so Control UI users whose verified profile was explicitly listed are no longer denied commands [5]. Per the change description, the profile established by verified login is matched while keeping command authority bound to the current connection, and shared owner attribution and synthetic callers do not gain that human authority.

Clawsweeper's GitHub ETag cache work stalled out in production. An earlier deployment caused exact reviews to begin failing at a growing rate, 0 to 11 to 25 failures per ten-minute window and 39 of 117 sweep runs failing in the last hour, with the control plane answering HTTP 503 on all four lease claim attempts [6]. That change was reverted, and the replacement work isolates the ETag cache from the exact-review queue by adding GithubEtagCache and the GITHUB_ETAG_CACHE binding [7]. Separately, the helper download now retries on TLS and connection errors [8] and tree metadata is projected at source [9].

Action items

References

  1. [1] openclaw 2026.9.4 ↗ openclaw/openclaw
  2. [2] Slack file downloads could miss conversation authorization openclaw/openclaw ↗
  3. [3] OpenAI-compatible transport could send provider credentials to the wrong endpoint openclaw/openclaw ↗
  4. [4] Outbound attachments could ignore requester read denials openclaw/openclaw ↗
  5. [5] fix(gateway): match verified users in command allowlists (#144601) ↗ openclaw/openclaw
  6. [6] revert: finalize oversized PRs with queue-owned activity evidence (#1525) ↗ openclaw/clawsweeper
  7. [7] fix: isolate GitHub etag cache from the exact-review queue ↗ openclaw/clawsweeper
  8. [8] fix(ci): retry the control-plane helper download on TLS and connection errors (#1528) ↗ openclaw/clawsweeper
  9. [9] fix(review): project bounded tree metadata at source (#1522) ↗ openclaw/clawsweeper

$ ls openclaw/reviews/ # the step-back reads

the week in review fs-safe 0.14.0 sets new guest listing rules the month in review 2026.8.1-beta.2 binds secrets to exact HTTPS hosts
Topics: AI Agents AI / ML Full archive → Weekly reviews →

Quick answers

What shipped in OpenClaw on September 11, 2026?
OpenClaw 2026.9.4 adds safe rollback for failed updates and a unified Plugins workspace, arriving alongside three breaking authorization and credential-handling fixes. In total, 104 commits, 54 pull requests, 1 releases, and 10 security advisories landed.
Who contributed to OpenClaw on September 11, 2026?
5 developers shipped this update, including JamesY023, github-actions[bot], steipete, Dallin Romney, and openclaw-docs-sync[bot].
What were the notable OpenClaw updates?
openclaw 2026.9.4, Slack file downloads could miss conversation authorization, and OpenAI-compatible transport could send provider credentials to the wrong endpoint.
♥

$ log @openclaw --recent

Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift 169 shipped Home-linked chat headers regain Pin session and Move to group 152 shipped fs-safe 0.14.0 ships safer guest listings, Code Mode stops dropping tool calls 120 shipped Matrix encryption recovery, faster session writes, stalled dashboard polls 114 shipped

$ log --all # elsewhere on the wire

Agentic Coding Cline desktop bundles shrink, goose unblocks its own clicks Local LLMs Metal MoE/SSM fusion lands, MiMo-V2.5 fp8 sharding fixed

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.