OpenClaw v2026.10.9 patches the libraries behind MCP, email and Teams

If your agents use MCP, check email or talk to Microsoft Teams, OpenClaw 2026.10.9 swaps vulnerable libraries for patched ones. Oversized Zod collections now get rejected early, in A2UI and in Discord's embedded app SDK.

Slide text

01 02 03 04 Security

openclaw/openclaw · CHANGELOG/2026.10.9.md

OpenClaw 2026.10.9 patches the libraries behind MCP, email and Teams

Oversized Zod collections are rejected early in A2UI and the Discord embedded app SDK.

IMAP sender parsing moves to nodemailer, so a spoofed sender can't pass the sender token gate. fast-uri rejects malformed URIs in MCP schemas, and Teams gets a patched MSAL Node.

The workspace only setting now applies to tools the Gateway builds too. Delegate changes still need your approval, and media tools can't reach files outside the workspace.

Inspecting an MCP server from the CLI no longer prints your real credentials. Google OAuth client secrets are masked in the logs as well.

Updates that fail safely.

If you run OpenClaw from a Git checkout and an update fails, the rollback used to reset the checkout. Now it keeps the edits you made.

npm rollbacks used to strand the package root. They now retry when Windows briefly denies access, and if that still fails, OpenClaw tells you the exact move that gets you a bootable install.

An update that finished publishing can now be repaired after its disk is remounted, and the repair keeps your original launcher and the sealed recovery helper.

When OpenClaw can't verify the service started, a stopped Gateway now recovers anyway. A passive stop on macOS no longer uninstalls a service that isn't there, and CLI Node runtimes recover when launched from the filesystem root, launchd jobs included.

Your data, kept.

When the SQLite tokenizer changes, OpenClaw now recovers intact agent databases and stale full-text search indexes, including the ones inside update snapshots.

Large transcript archives now migrate cleanly, without running into the string length limit in Node.js.

Fill the disk and your agents used to stay stuck until a restart. Now they pick back up on their own as soon as you free some space.

Sessions and commands.

New ACP sessions start in the working directory you asked for, not the default workspace. Local media in Codex steering messages comes from the session's own workspace, and overlapping model refreshes stop failing requests.

Gateway probe over SSH now honors an explicit port 22 instead of the alias's port. Video generation shows which options the provider ignored, and skills keep their icons and homepages when their metadata carries a trailing comment.

This release skips the Android app, which stays on its August build. Every other fix is in the release changelog. If your agents talk to MCP servers or an IMAP inbox, I'd update today, for the patched libraries alone.