npm openclaw 2026.10.3
openclaw 2026.10.3
on Node.js NPM

3 hours ago

2026.10.3

Highlights

Changes

Fixes

  • Doctor: keep canonical OAuth profiles when the legacy auth store is unreadable or malformed instead of deleting them. (#170256) Thanks @Yolo521-bot.
  • Doctor: never rewrite root memory files with replacement characters, and reject malformed UTF-8 before path set writes an edited file. (#169029, #168491) Thanks @wangmiao0668000666 and @Takhoffman.
  • Doctor: preserve installed plugins when path-safety checks block them instead of stripping their enabled flag when run as root. (#168111) Thanks @obviyus.
  • Doctor: include Canvas and Memory Core files in recovery copies, keep captures stable while workers stay open, honor Windows permissions for SQLite recovery snapshots, and stop spurious backups for unchanged one-shot cron jobs. (#169436, #169516, #170022, #169397, #168938) Thanks @RomneyDa, @harshitgupta31415, and @WG-Mojo.
  • Updates: recover blocked updates after receipt identity drift, lost handoff leases, legacy package metadata drift, and FreeBSD package recovery refusals. (#168388, #169038, #169027, #168775) Thanks @k94118, @mkdelta221, @waynegault, and @chedong.
  • Updates: older updaters no longer refuse candidates over bookkeeping-only config changes, and npm recovery reclaims retained runtimes that blocked it. (#170195, #170170) Thanks @Warhangel.
  • Updates: keep the real failure when git-update cleanup reporting is unavailable, route migrated-no-rollback failures to openclaw update repair, and stop reporting successful handoffs as failures. (#169454, #168993) Thanks @sayitfast and @RomneyDa.
  • Updates: clear repaired migration warnings, tolerate clock jumps during verification, and name the database and reason in capture and config-read warnings. (#169004, #169282, #169284) Thanks @WG-Mojo and @DonnieFi.
  • Updates: preserve the service heap limit in update processes, stop copying unrelated parent dependencies, and keep npm-global updates from retaining unrelated global packages. (#168889, #168927, #169551) Thanks @bluet, @RomneyDa, and @holgergruenhagen.
  • Updates: ride out briefly locked state databases, keep update-history writes from stalling Gateway cron and cleanup, and prevent false ownership loss during upgrades. (#168210, #169283, #169915) Thanks @DonnieFi and @vincentkoc.
  • Updates: Doctor handles unreadable supervisors and child binding errors, clean service-install refusals stay out of native-authority recovery, and openclaw update repair no longer reports success when Doctor maintenance was skipped. (#169665, #169658, #167714)
  • Windows: recognize machine-qualified Scheduled Task accounts, keep updater workers on short-name or miscased install paths, and stop rollbacks from Doctor ancestry re-checks. (#169481, #169292, #169563) Thanks @RomneyDa.
  • macOS: unblock updates with protected Bun service commands, authenticate the app-hosted first run, and renew learned TLS pins on automatic reconnects. (#170006, #169403, #168151) Thanks @jokerman1302-eng.
  • pnpm: keep Gateway service commands on the durable install link and keep pnpm 12 launchers working after native updates. (#170003, #170131) Thanks @xilopaint and @k-sekula.
  • Plugins: preserve webhook listeners during deferred plugin upgrades, unblock repairs while data migrations are pending, and stop stale Codex runtimes breaking turns after updates. (#169035, #170339, #170306) Thanks @sirius1024 and @RomneyDa.
  • Plugins: catalog refreshes no longer retain duplicate native plugin graphs and recover their config after a failed native ESM refresh. (#169272, #169321) Thanks @obviyus and @RomneyDa.
  • Gateway: Claude CLI session tools keep working after the turn that started the MCP loopback ends, and channel tools no longer fail with stale caller authority after a config write restarts the account. (#165432, #159396) Thanks @Oldrich333, @Leit-motif, @ceckert, and @RomneyDa.
  • Gateway: node requests and events no longer fail with "pairing changed" after unrelated pairing activity or while another device's pairing is written. (#169486, #169575)
  • Gateway: restart cleanly when a stored cloud worker's machine is gone, preserve live sends during outbound queue recovery, and resume steered sessions after restart. (#168907, #169010, #170252) Thanks @RomneyDa.
  • Agents: prevent next-turn failures after native compaction without loading entire large transcripts. (#169583, #108851) Thanks @obviyus.
  • Models: switching back to an OpenAI model works when the Codex plugin is disabled, and model selections without an activatable harness are rejected. (#169412, #134837) Thanks @obviyus and @goslingmanagment.
  • OpenAI: turns no longer fail when the ChatGPT WebSocket closes with code 1000 mid-stream. (#167512) Thanks @ericcurtin, @obviyus, and @mightyx.
  • Codex: recover follow-up requests after failed thread preparation. (#169431) Thanks @jjjhenriksen and @RomneyDa.
  • Networking: guarded model requests fall back to IPv6 when IPv4 is unreachable, keeping SSRF validation. (#168973) Thanks @an2in and @georgenaz.
  • Copilot: honor reported context capacity when native limits are missing. (#156636) Thanks @saju01 and @RomneyDa.
  • Anthropic: guide Claude CLI to the registered OpenClaw tools. (#153032) Thanks @kiranvk-2011.
  • DeepSeek: recover calls markup instead of leaking tool payloads into replies. (#169728) Thanks @TOMUIV.
  • Release: first-hop update coverage admits sources by schema version, failed receipts recover without rerunning workloads, and upgrade diagnostics keep failing steps. (#169012, #168266, #165267, #169567, #169084, #168191, #165968, #164789, #168097) Thanks @RomneyDa and @shakkernerd.

Complete contribution record

This audited record covers the complete v2026.10.2..8dd1ada history: 79 in-range PRs + 0 retained seed-only PRs = 79 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact.

Pull requests

Release verification

Check out latest releases or
releases around openclaw 2026.10.3

Don't miss a new openclaw release

NewReleases is sending notifications on new releases.

Get notifications