OpenClaw 2026.6.35 was tagged 2026-09-10 06:43 UTC. The release notes open with "This is the final June 2026 Extended Stable (LTS) release." v2026.6.35 ships one headline change: bundled providers and channel adapters now bound untrusted response bodies, reject oversized inputs before expensive work, and preserve safe recovery when transports fail. The work landed primarily in PR #119942 with contributions from @RomneyDa, @vincentkoc, @Pick-cat, @RileyJJY, @ZengWen-DT, @Monkey-wusky, @chengzhichao-xydt (and others truncated in the fetch).
The 2026.9 line is current (story-2026-09-03-004 covered v2026.9.1; story-2026-09-06-001 covered v2026.9.2; story-2026-09-08-001 covered v2026.9.3). v2026.6.35 is the last patch release of the 2026.6.x extended-stable branch, intended for organizations that have not yet completed their migration to the 2026.9 line.
From the v2026.6.35 release notes (fetched 2026-09-10 14:08 UTC):
The headline change is boundary hardening for the bundled providers (model providers like Anthropic, OpenAI, Bedrock, Vertex) and channel adapters (Telegram, Discord, Slack, WhatsApp, etc.). Three distinct failure modes are addressed:
1. Bound untrusted response bodies: providers and channels receive response data from external services; if the response is malformed or hostile (e.g., extra-large JSON fields, unexpected types), the new bound prevents that data from propagating into the agent's prompt or tool results unchecked. 2. Reject oversized inputs before expensive work: inputs exceeding configured limits are rejected up front, before the agent commits to expensive token-billed reasoning on them. This is a denial-of-service guard at the provider/channel layer. 3. Preserve safe recovery when transports fail: when an upstream transport (HTTP request, webhook, polling loop) fails mid-call, the agent recovers to a safe state instead of leaking partial work.
These are bundled-provider and bundled-channel fixes — they do not require any change to user config, plugins, or skills. Organizations on the 2026.6.x line that have not customized their provider/channel boundaries will pick up the hardening automatically on upgrade.
Security posture: provider and channel adapters are the trust boundary between the agent runtime and the outside world. Hardening these adapters closes a class of input-handling vulnerabilities that would otherwise require per-provider/per-channel user audits. The headline change is the kind of passive security improvement that is best shipped automatically rather than as opt-in.
Operational reliability: rejecting oversized inputs before token-billed work prevents accidental cost spikes from misconfigured upstream responses. Safe transport-failure recovery prevents partial-work leaks that require manual cleanup.
End-of-life signal: the explicit "final June 2026 Extended Stable (LTS) release" wording is the editorial signal that the 2026.6.x branch will not receive further patches. Organizations still running 2026.6.x in production should plan their migration to the 2026.9 line. The 2026.6 line had roughly three months of active support (June 3 → September 10, 2026); the 2026.9 line has been current since August.
Migration cost: the 2026.9 line introduced Mermaid diagrams in chat, per-identity skill libraries, reliable auto-updates, GPT-6 Astra first-class support, Swarm default-on, and cross-agent session access default-on (story-2026-09-03-004 and story-2026-09-06-001). Some of these are default-on behavior changes that may require managed-settings review. Organizations should test on a staging environment before promoting 2026.6 → 2026.9.
All claims sourced verbatim from openclaw/openclaw/releases/tag/v2026.6.35 (fetched 2026-09-10 14:08 UTC). Cross-referenced against the GitHub atom feed (openclaw/openclaw/releases.atom, updated 2026-09-10T06:43:04Z) for release timestamp. PR #119942 is the primary-source reference for the headline change.
No firsthand test run was performed against the 2026.6.35 binary. Verification level: documentation comparison with primary-source verbatim quotes.
v2026.6.35 is a focused security release that closes the 2026.6 LTS branch. The headline provider/channel boundary hardening is the kind of passive security improvement that should be picked up automatically. The explicit "final" wording is the editorial signal that matters more than the headline change itself: organizations still on 2026.6.x should plan migration to 2026.9 now.
Originally published: 2026-09-10 14:08 UTC Last verified: 2026-09-10 14:08 UTC No corrections at this time. Correction (2026-09-10 22:13 UTC): EQR caught a primary-source URL 404. The originally cited URL …/tag/openclaw%202026.6.35 resolved to 404; the actual GitHub release tag is v2026.6.35 (verified 200). The Sources section above and primary_sources[] have been replaced with the corrected URL. Article body, verdict, and recommended action are unaffected by the URL rename; this is a citation correction, not a content correction.