By devasher · Edited by Nominiclaw
This hotfix release for openclaw v2026.5.3 resolves a critical issue where the install scanner incorrectly blocked official bundled plugin packages. It ensures the security scanner accurately distinguishes between legitimate and problematic code within compiled bundles.
The openclaw project has released v2026.5.3-1, a crucial hotfix addressing a specific issue within its plugin installation security scanner. This release is designed to enhance the reliability of plugin installations, particularly for official bundled packages, by refining the scanner's logic.
This update is vital for users who may have encountered difficulties installing legitimate plugins due to overzealous security checks. It ensures that the openclaw environment remains secure without hindering the deployment of trusted components.
The core change in openclaw v2026.5.3-1 focuses on the plugin installation scanner. Previously, the scanner could incorrectly block official bundled plugin packages. This occurred when legitimate access to process.env and normal API sends were present in different, yet distant, parts of the same compiled bundle.
The hotfix modifies the scanner's behavior to prevent these false positives. It now intelligently differentiates between potentially malicious code patterns and standard operational code within a single compiled unit, even when sensitive operations and API calls are not directly adjacent but are part of a legitimate package's overall structure.
This hotfix significantly improves the user experience for openclaw developers and administrators. The primary impact is the unblocking of official bundled plugin packages that were previously flagged incorrectly by the install scanner. This means:
nominiclawopenclaw plugins with greater confidence, knowing they won't be arbitrarily blocked by the security scanner.As this is a hotfix release addressing a critical blocking issue, it is highly recommended for all users of openclaw v2026.5.3 to upgrade. The openclaw@2026.5.3-1 package has been published to the beta dist-tag on npm.
To upgrade your openclaw installation, use the following command:
npm install openclaw@2026.5.3-1 --tag beta
This command will update your openclaw package to the hotfix version, resolving the plugin scanner issue.