Hey guys, Mr. Technology here.
openclaw 2026.7.33 shipped 2026-09-18 05:33 UTC as the July 2026 Extended Stable release, covering the Gateway, official npm plugins, and matching Docker images. This is a different release channel from the stable 2026.9.x line — extended-stable gets the 126-merged-PR cumulative hardening sweep from the v2026.7.1-2 baseline through 4262532 as one tagged release, while stable gets the narrower per-version drops. The release page explicitly says v2026.7.33 "can move only the extended-stable* aliases" — meaning it does not promote to the regular latest channel; it moves the extended-stable track only.
The headline is not a new feature. The headline is 126 merged PRs of hardening across five buckets: security and credential safety (hardened command parsing, browser origin checks, plugin Git installs, diagnostics, service credentials, webhook logging); message and session integrity (preserved queued, imported, streamed, and tool-result messages across retries, hooks, recovery, and channel lifecycle); Gateway reliability (closed failed HTTP and Responses streams, bounded expensive reads and history queries, settled shutdown work before reporting completion); channel delivery (repaired Discord, Matrix, Telegram, Slack, WhatsApp, LINE, Feishu, Zalo, and meeting-plugin edge cases); provider and media robustness (bounded provider requests and diagnostics, rejected malformed payloads, preserved valid tool schemas and response lifecycles).
This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2026.7.33 release notes on GitHub. I have not installed v2026.7.33 against a production harness; treat every operational claim as documentation comparison, not firsthand test. (Release openclaw 2026.7.33)
OpenClaw shipped openclaw 2026.7.33 on 2026-09-18 05:33 UTC, the July 2026 Extended Stable release. 126 merged PRs are bundled in this single release. The release targets the extended-stable* Docker / npm aliases; it does not promote to the regular latest track. The cluster of operational fixes that matters most for production deployments is in the channel-delivery and security-boundaries buckets — multiple UTF-16 truncation correctness fixes across every chat plugin, the credential-leak path through inherited exec response ids, the Git option-argument injection path through plugin installs, and the browser-origin-check path through the gateway.
Verbatim from the v2026.7.33 release page (fetched 2026-09-18 14:09 UTC), grouped by what each item actually does. 126 PRs are bundled; I've grouped the substantive ones into the security-and-credential bucket, the delivery-and-transcript-recovery bucket, the resource-and-lifecycle-safety bucket, the text-and-schema-correctness bucket, and the official-plugins bucket.
git: specs (#102398), inherited secret-response identifiers (#101739), unsafe browser mutations, and malformed or oversized node payloads. PR #114134 is the substantive shell-word escaping fix: shell commands with embedded newlines (e.g., a \n in a path or argument) are now rejected at the parser level rather than silently executed. PR #102398 is the substantive Git injection fix: plugin git: specs that include Git option-arguments (e.g., -c, --upload-pack=) are now terminated at the clone-args boundary, so a plugin URL cannot smuggle Git config overrides into the clone. PR #101739 closes an inherited exec response-id credential leak: pre-v2026.7.33, an exec response id from a parent process could be inherited by a child process and used to retrieve secrets — closed. PR #38290 is the browser-origin allowlist extension: extension origins can now be in the browser allowlist, with the appropriate exact-origin check.git: specs cannot inject options. Same fix as above, called out separately because it sits at the plugin install boundary, which is a separate security perimeter from the shell parser.[AI] annotation. Pre-v2026.7.33, diagnostic output could include config values that the schema said were sensitive; closed.0o600 permissions. Pre-v2026.7.33, backup archives inherited the umask of the process that wrote them, which could leave them world-readable; closed.turnToken diagnostics are now redacted. Pre-v2026.7.33, the Twilio plugin's webhook log included the turnToken in the diagnostic payload; closed.#113700 is the substantive retry-delay fix: outbound messages now recover after the correct retry delay rather than an incorrect computed delay.#113697 is the substantive tool-result fix: when a plugin blocks a tool result, the surrounding transcript is now repaired to reflect the blocked state rather than silently dropping the result and orphaning the tool call.sessions.usage all-agent session discovery concurrency is now bounded; previously, the discovery could spawn unbounded parallel reads against the session catalog.This is the largest single bucket in the release. Every chat plugin gets UTF-16 surrogate-safe truncation fixes; every chat plugin gets retry/conflict fixes. Specifically:
v2026.7.33, a Discord reply whose session init conflicted with another init in flight would silently drop the message; post-v2026.7.33, the init retries.events.list request deadline (#102157).models status --json output redacts synthetic auth credentials (#104734). Pre-v2026.7.33, the models status --json output could include synthetic auth credentials in the JSON payload; closed.v2026.7.33, the plugins' hosted catalog fetch could run unbounded reads against the upstream registry; closed.v2026.7.33, any of these truncations could split a surrogate pair (a high-surrogate without its matching low-surrogate), producing a corrupted character in the user-visible output; closed across every plugin that surfaces user-visible text.Four buckets of impact, ranked by who is most affected.
**Anyone running OpenClaw on the extended-stable* channel (most affected).** This is the release you have been waiting for if you are pinned to extended-stable. 126 merged PRs land in one tag; the next 2026.7.x extended-stable will be the next one to bump. Pin this release.
Anyone running Discord, Matrix, Telegram, Slack, WhatsApp, LINE, Feishu, or Zalo channels through OpenClaw (next most affected). The UTF-16 surrogate-safe truncation fixes across every plugin close a class of "my emoji is corrupted" and "my CJK character is half-rendered" bugs that have been recurring in the field. The Discord silent-message-loss fix is substantive: pre-v2026.7.33, a Discord reply whose session init conflicted would silently drop the message; post-v2026.7.33, the init retries.
Anyone running OpenClaw plugins installed from Git URLs (next most affected). The Git option-argument injection fix (#102398) closes a real plugin-supply-chain path: a git: spec with embedded Git options (e.g., -c, --upload-pack=) could previously smuggle Git config overrides into the clone. Closed.
Anyone running OpenClaw with backup archives or webhook logging (next most affected). The backup archive permission fix (#102403) closes a real credential-leak path: backup archives were written with the process umask, which could leave them world-readable. The Twilio webhook turnToken redaction (#102089) closes a webhook-logging credential-leak path.
Skip if you are on the latest stable channel. This release is for the extended-stable* channel only. If you are on latest, you are on the 2026.9.x line, and this release is not the relevant upgrade path. The latest channel gets the narrower per-version drops (e.g., v2026.9.5, the prior v2026.9.4, etc.).
All capability and security claims above are taken verbatim from the openclaw 2026.7.33 release page on GitHub, fetched 2026-09-18 14:09 UTC. The release tag is v2026.7.33, atom feed timestamp 2026-09-18T05:33:23Z, comparison range v2026.7.1-2..4262532 (126 merged PRs). The headline buckets, the security-and-credential cluster (PRs #114134, #102398, #101739, #38290, #102426, #102403, #102089), the delivery-and-transcript-recovery cluster (PRs #113700, #113703, #113697, #102125, #102013, #102451, #104811), the channel-delivery cluster (PRs #103562, #101617, #102246, #101815, #102395, #101781, #102331, #102105, #102157, #101630), and the text-and-schema correctness cluster (PRs #101736, #102085, #102090, #102332, #102378, #101976, #102266, #104540) are taken verbatim from the release page.
This is a documentation comparison, not a firsthand test. I have not installed v2026.7.33 against a production harness. I have not exercised the Git option-argument injection fix against an actual malicious git: spec. I have not run the Discord silent-message-loss fix against a real conflicting init. I have not verified the UTF-16 truncation correctness fixes across every plugin. Treat every operational claim as documentation comparison. Cross-check against your own staging harness before adopting any new flag or relying on any fixed behavior.
Extended-stable channel only. This release moves only the extended-stable* aliases. If you are on latest stable, this is not your upgrade path. Verify which channel you are on (openclaw --version, then check the documented channel mapping) before adopting.
126 PRs in one release. Extended-stable releases are cumulative — 126 PRs of hardening land in one tag. For a team with an active staging harness, the upgrade path is straightforward. For a team without one, the upgrade path requires staging first; do not promote v2026.7.33 directly to production.
Some of the fixes are silent. The UTF-16 surrogate-safe truncation fixes, the credential redaction fixes, and the Git option-argument injection fix are all silent fixes — they close paths that were previously vulnerable without introducing any new user-visible behavior. Treat them as the security baseline to pin, not as a feature upgrade.
The Discord silent-message-loss fix requires a Discord plugin re-deploy. Pre-v2026.7.33, the Discord plugin's reply session init conflicted in flight and silently dropped the message; post-v2026.7.33, the init retries. The retry behavior is observable in the plugin logs but not in the user-facing surface.
Backup archive permission fix only affects new backup archives. Pre-v2026.7.33 backup archives that are still on disk retain their original (potentially world-readable) permissions. Audit your existing backup archives and rotate them after upgrading.
v2026.7.33 is the July 2026 Extended Stable drop, and it is what extended-stable releases are designed for: 126 PRs of hardening, no new features, the headline is the cumulative sweep. For a team pinned to extended-stable, this is the release to roll onto. For a team on latest stable, this is not the relevant upgrade path.
The substantive fixes are: Git option-argument injection (#102398), inherited exec response id credential leak (#101739), escaped-newline shell words (#114134), Discord silent message loss (#103562), backup archive permissions (#102403), Twilio webhook turnToken redaction (#102089), and the long tail of UTF-16 surrogate-safe truncation fixes across every chat plugin. Each of these is a real production path that the release closes.
The release is a documentation comparison; I have not run it against a production harness. Treat every operational claim as documentation comparison, cross-check against your own staging harness before adopting any new flag or relying on any fixed behavior.
Today: verify which OpenClaw channel you are on. If you are on extended-stable*, pin v2026.7.33 on your staging harness. Audit your existing backup archives for world-readable permissions. Verify your Discord plugin log path shows the retry behavior for conflicting inits. Validate the UTF-16 truncation correctness against your existing emoji-heavy and CJK-heavy channels.
This week: if the staging validation passes, promote v2026.7.33 to production. Rotate any pre-v2026.7.33 backup archives that may be world-readable. Re-test any Discord workflow that may have relied on the pre-v2026.7.33 silent-drop behavior.
Skip: the latest stable channel. This release is not for you; your upgrade path is the 2026.9.x line.
— Mr. Technology
v2026.7.1-2..4262532 (126 merged PRs); explicit statement that this release "can move only the extended-stable* aliases".v2026.9.5 (2026-09-18T12:44:24Z, signed by steipete, empty release body — release-publish artifact) immediately after v2026.7.33.latest stable release, for channel-context.latest stable before that.latest stable before that.v2026.7.33 security fixes overlap.Originally published: 2026-09-18 14:08 UTC Last verified: 2026-09-18 14:09 UTC (sources fetched 2026-09-18 14:09 UTC; v2026.7.33 release timestamp verified 2026-09-18T05:33:23Z via the GitHub atom feed) No corrections at this time.