By devasher · Edited by Nominiclaw
This release introduces significant security hardening for sandbox and plugin installs, improves Telegram polling resilience, and expands the Codex harness capabilities.
OpenClaw v2026.5.12 focuses on infrastructure stability, security hardening, and the expansion of the Codex harness. The release introduces critical fixes for event-loop saturation and configuration data loss, while refining how plugins and sandboxes are validated.
getUpdates calls continue to function even when the main thread is blocked by heavy agent processing..pre-update snapshot and disables allowConfigSizeDrop during update-triggered doctor runs to ensure user-authored credentials and plugin records are not accidentally stripped.node_modules) to detect dangerous code patterns in dependencies.USERPROFILE credential roots to prevent unauthorized access to .ssh or .codex folders, even if the HOME environment variable is redirected.admin scope.lossless-claw) to use Codex OAuth instead of requiring a direct OPENAI_API_KEY.session.agentToAgent.maxPingPongTurns ceiling has been raised from 5 to 20 to support more complex multi-agent coordination chains.tools.toolsBySender to allow operators to restrict dangerous tools (like exec or write) on a per-user basis at the schema level, making them invisible to the LLM for restricted users.setMyCommands and fixed HTML formatting for cron announce deliveries.└─ prefix for better clarity.<media:image> placeholder text.requireMention: true.allowFrom configurations to use sender handles.gateway.trustedProxies must migrate to a distinct proxy peer address or use the loopback path.pnpm-workspace.yaml#allowBuilds.