What happened
OpenClaw published version v2026.9.36 on GitHub on 29 October 2026. The project describes it as a “gateway-only extended-stable release,” its current equivalent of LTS. Rather than representing the newest available build, it packages OpenClaw from the end of September 2026 together with critical security updates, reliability and performance fixes, and new-model support. The release notes say that the latest OpenClaw version at publication was 2026.10.9, so this is a maintained stable line rather than the leading-edge release.
The operationally important change concerns updates that fail during an npm rollback. According to the release notes, a failed rollback no longer leaves the installed package missing. Update checks also retain Doctor recovery guidance. The same group of changes restores the installed package root after a denied rollback rename, preserves restrictions around migration rollback, keeps cleanup uncertainty in buffered command results, prevents the update compatibility inventory from being published in packages, and stops repeated cleanup attempts on broken worktree metadata. In short, the release is trying to make an interrupted or unsuccessful upgrade diagnosable and recoverable rather than turning it into a missing installation.
Several changes are security and authorization boundary fixes. With tools.fs.workspaceOnly, tools built through the Gateway loopback or skill dispatch now require approval as intended, while media tools remain inside the workspace. For Microsoft Teams, unresolved name-keyed teams or groupAllowFrom entries now grant no access rather than making a bot available to every team or group. The release also limits response-controlled Microsoft authentication routing and scopes a patched MSAL dependency to the affected Teams and Azure Identity consumers.
The project lists bounds added to several untrusted-input paths: Matrix media metadata, IMAP mail addresses and parsing, TOML keys, URIs, oversized collections in custom A2UI schemas, and Discord’s embedded SDK. It says malformed inputs in those paths can no longer cause unbounded work or alter identity. A reply-delivery fix preserves comparison prose after emoji and other astral characters, which previously could be stripped by the outbound sanitizer. Other listed changes include an eMudhra certificate-trust remediation, Docker release images carrying source- and version-bound evidence, a cancellation recheck for staged Node uploads, xAI compatibility for older models without configurable reasoning effort, and dependency updates.
OpenClaw provides a release verification record for the npm package, registry tarball, integrity hash, release commit, and CI evidence. The notes identify 28 unique pull requests in the audited history for this release line. They do not state an upgrade command, rollout schedule, or a supported-version policy beyond calling this branch extended-stable.
What the archive adds
This is a new release on a known operational thread, not a restatement. Earlier Field Notes covered v2026.10.3, v2026.10.4, and v2026.10.7, including recovery after updates and session or provider reliability. Version 2026.9.36 carries part of that recovery work into the extended-stable line.
Trend signal
The release supports agent security moves to runtime boundaries. Its substantive fixes are not instructions asking an agent to behave: they constrain filesystem scope, approval behavior, allowlist resolution, authentication routing, parsing work, and release artifacts. That is evidence for security being implemented in the runtime and its integrations rather than delegated to prompt compliance.
Why now
The release notes frame 2026.9.36 as an end-of-September codebase maintained with subsequent critical fixes, while the newest release was already 2026.10.9. That timing explains the backport-oriented shape of the change: it offers a conservative branch for operators who need fixes to upgrade recovery and runtime boundaries without simply moving to the latest build.
Connections to other events
The archive’s v2026.10.4 note treated recovery after routine updates as the reason a patch could matter. The v2026.10.7 note added replay-safe session recovery and provider reliability improvements. This release connects to both only in a limited sense: it brings update and recovery work to an extended-stable branch; the source does not claim that all later fixes have been backported.
Why it matters
For a team running an agent gateway, routine upgrades are part of production operations, not a one-time installation step. A rollback that removes the installed package can turn a normal maintenance event into an incident, particularly if the gateway mediates tools, chat channels, or internal workflows. The recovery fixes make that path less fragile, while the other changes reduce the risk that integrations quietly widen an agent’s reach.
The workspace fix is especially relevant where OpenClaw dispatches tools through Gateway or skills: a declared workspace-only rule needs to hold across those construction paths. Likewise, a Teams allowlist that opens access when a configured identifier does not resolve is the opposite of a safe default. Teams should evaluate the release against their actual deployment paths—npm updates, Gateway-built tools, Teams, mail, Matrix, Discord, or xAI—not assume every listed fix affects them.
What happens next
- More fixes from the current line may be selectively backported to extended-stable releases (3 months, 70%). Watch for: later extended-stable tags that describe a newer codebase plus targeted reliability or security fixes.
- Operators will treat recovery behavior as an upgrade acceptance criterion (6 months, 60%). Watch for: release notes or deployment guidance that explicitly test failed upgrades, rollback, and Doctor-assisted recovery.
Limits and uncertainty
The release notes are a project-authored account of changes, not an independent security audit or a benchmark of reliability. They establish that OpenClaw has shipped the listed code and verification materials, but do not quantify how often the prior failures occurred, identify affected deployments, or prove that every malformed input path is safe under every workload. The source also does not provide migration instructions, a compatibility matrix, pricing, a support commitment, or a comparison with the current 2026.10.9 release. “Extended-stable” is described as the project’s LTS equivalent, but the notes do not specify its maintenance duration.
Skill to build now
Add a failed-update drill to the runbook for any agent gateway that is upgraded through package tooling. In a non-production environment, test an interrupted or denied rollback, confirm that the installed package remains recoverable, and verify that the diagnostic path your operators use still exposes recovery guidance. Separately, inspect tool construction paths—not just direct tool calls—to confirm a workspace-only policy and approval requirement are enforced when tools are dispatched through a gateway or skill layer.
Reader takeaway
OpenClaw v2026.9.36 is not a broad feature launch; it is an extended-stable maintenance release aimed at making deployment failures and integration boundaries less dangerous. Teams on the stable line should assess it as an operations-and-security update, with special attention to npm rollback recovery and any Gateway, Teams, or untrusted-input integrations they run.
Open question
Will OpenClaw publish a defined support window and a clear backport policy for its extended-stable line, so operators can decide when it is safer to stay on it rather than move to the latest release?