OpenClaw v2026.6.34 Extends Stable Channel with Security and Reliability Hardening

OpenClaw v2026.6.34 has been released on the extended-stable channel, marking a focused maintenance release that prioritizes security hardening and reliability improvements rather than new features.

Key Highlights

Safer Browser and Network Boundaries — Sandboxed browser routes, trusted DNS targets, custom browser origins, and loopback provider endpoints now reject unsafe access paths, closing a meaningful attack surface.

More Resilient Agent and Provider Runs — Retained session writes, provider fallbacks, stream progress handling, and stdio failures now recover cleanly instead of silently ending active work.

Stronger Channel Recovery — Pending channel work resumes after recovery, acknowledgements are idempotent, and sustained Discord gateway bursts stay bounded.

Safer Operator Diagnostics — Command and status surfaces keep owner-only actions protected and prevent credentials from appearing in account URLs or summaries.

Robust Local Runtime State — SQLite checkpoints, workspace reads, gateway process signalling, plugin HTTP responses, and dependency handling all tolerate transient host conditions without turning them into failed runs.

Security Fixes

This release patches production dependency vulnerabilities in brace-expansion, PostCSS, fast-uri, ip-address, and Undici. It also fixes OpenCode Go’s use of the correct hy3 model identifier instead of the deprecated hy3-preview alias.

Deprecation Notice

Plugin SDK migration is underway. before_agent_start, root openclaw/plugin-sdk imports, providerAuthEnvVars, and channelEnvVars are scheduled for removal. See the Plugin SDK migration guide to update before the cutoff.

Install via npm install [email protected] or pull the container tags 2026.6.34, 2026.6.34-slim, and 2026.6.34-browser for amd64 and arm64.