OpenClaw v2026.7.35 (Sep 21): First GitHub Release for the July Extended-Stable Line; Doctor Plugin Registry Fix Closes a Restart-Loop Where Default Bundled Plugins Disappeared

OpenClaw published v2026.7.35 on September 21, 2026 (atom feed entry timestamp 2026-09-21T13:14:04Z). It is the first GitHub Release for the July maintenance line — and the release page body is explicit about that: "OpenClaw 2026.7.33 and 2026.7.34 were unstable extended-stable builds and were intentionally not published as GitHub Releases. Because 2026.7.35 is the first GitHub Release for the July maintenance line, it includes their complete changelogs below." The release also backports a Doctor plugin registry defect fix from PR #136045 that the September 18 v2026.7.33 pillar did not cover.

This report is a documentation comparison: every claim is sourced verbatim from the GitHub release page body, the atom feed, the security advisories page, and the prior v2026.7.33 cross-reference. No firsthand production-harness run was executed.

What happened

v2026.7.35 was published on September 21, 2026 as a GitHub Release on the openclaw/openclaw repository (atom feed entry id tag:github.com,2008:Repository/1103012935/v2026.7.35, updated 2026-09-21T13:14:04Z).
The release page body states that v2026.7.33 and v2026.7.34 were unstable extended-stable builds that were intentionally not published as GitHub Releases. v2026.7.35 is therefore the first pinnable release on the July extended-stable channel, and its release notes retroactively publish the v2026.7.33 and v2026.7.34 changelogs in full.
The release introduces one new fix: a Doctor plugin registry backport from PR #136045 that preserves the complete bundled plugin inventory when Doctor creates or repairs registry state, so default Browser, Canvas, pairing, file-transfer, phone-control, Talk voice, and Bonjour plugins remain available after restart. State-migration discovery also recovers from the partial registry written by v2026.7.34 while retaining external plugin install records.
The release page's Complete contribution record note documents the selection methodology: "This extended-stable follow-up was selected from a complete 1,418-commit audit after the prior 2026.7.34 audit cursor. No other defect observed during clean install or the 2026.6.35 upgrade required a July-line backport."

What actually changed

The release has three distinct surfaces:

1. Channel publication. Operators on the July extended-stable channel can now pin a real GitHub Release tag (v2026.7.35) instead of tracking the previously-unpublished internal builds. The release page explicitly retroactively publishes the v2026.7.33 and v2026.7.34 changelogs because they were never published as GitHub Releases at the time.

2. Doctor plugin registry fix (new, backported from #136045). "Doctor plugin registry: preserve the complete bundled plugin inventory when Doctor creates or repairs registry state, so default Browser, Canvas, pairing, file-transfer, phone-control, Talk voice, and Bonjour plugins remain available after restart. State-migration discovery now also recovers from the partial registry written by 2026.7.34 while retaining external plugin install records." Thanks @wangmiao0668000666.

3. Cumulative July extended-stable notes (retroactive publication of v2026.7.33). The release page now publicly documents the v2026.7.33 fix clusters — security and credential safety, message and session integrity, Gateway reliability, channel delivery repair across Discord / Matrix / Telegram / Slack / WhatsApp / LINE / Feishu / Zalo / meeting-plugin, provider and media robustness, text and schema correctness (UTF-16 boundary preservation, root tool-schema properties, non-finite schema rejection, exact UTF-8 write sizes), official plugin repairs, and the 126-PR complete contribution record spanning v2026.7.1-2 through commit 4262532.

Why developers and founders should care

If you pin to the July extended-stable channel for production Gateways, v2026.7.35 is the first tag you can actually pin to. Before this release, the July channel only had internal release-tooling commits (v2026.7.34's test(release): use entitled Gemini live model + fix(release): repair 7.34 validation gates) and the unstable v2026.7.33 internal build. That is a real operational change for teams that depend on GitHub-tagged releases for supply-chain integrity, SBOM generation, or deployment automation.
If you ran Doctor on the July channel after v2026.7.34, your bundled plugins may have been dropped from the registry state. The v2026.7.35 backport specifically handles "the partial registry written by 2026.7.34" — confirming that v2026.7.34's validation-gate repair had a side effect on the registry. State-migration discovery in v2026.7.35 recovers from that partial state without losing external plugin install records.
If you ran v2026.7.33's prior security and credential fixes (covered in the September 18 pillar at openclaw-v2026-7-33-extended-stable-channel-security-credential-utf-16-sep-2026), v2026.7.35 now gives those fixes an officially pinnable GitHub Release with a complete contribution record (126 merged PRs).
If you audit OpenClaw for security boundaries, the v2026.7.35-published v2026.7.33 fix cluster is worth re-reading: escaped-newline command words, exact-origin mismatches, injected Git option arguments, inherited secret-response identifiers, unsafe browser mutations, malformed or oversized node payloads. The September 18 pillar summarized these; the v2026.7.35 release page lists them verbatim with PR numbers.

Evidence and test results

v2026.7.35 atom feed entry: tag:github.com,2008:Repository/1103012935/v2026.7.35, updated 2026-09-21T13:14:04Z, verified at fetch time 2026-09-21T20:08 UTC.
GitHub release page body for v2026.7.35 (verified verbatim at fetch 2026-09-21T20:09 UTC).
The Doctor plugin registry fix is backported from PR #136045 by @wangmiao0668000666.
v2026.7.33 contribution record: 126 merged PRs spanning v2026.7.1-2 through commit 4262532 (release page PR list captured verbatim; sample: PR #102438 "fix: auth bookkeeping no longer reverts rotated OpenAI OAuth credentials" by @obviyus; PR #102403 "fix(backup): write backup archive with owner-only 0o600 permissions" by @yetval; PR #102398 "fix(plugins): terminate git clone args so git: specs cannot inject options" by @yetval; PR #38290 "Gateway: allow extension origins in browser allowlist" by @brunowowk + @mosidevv; PR #104540 "fix(sessions): prevent corrupted Unicode in persisted tool details" by @zhangguiping-xydt).
OpenClaw security advisories page (verified 2026-09-21T20:08 UTC): 10-advisory set unchanged from September 11, 2026. Severity breakdown: 8 Moderate + 2 High. The two High advisories are GHSA-3mq7-q27j-mq7q "Exec approvals could outlive their reviewed working directory" and GHSA-9m4p-cqp4-jppq "WhatsApp login tool could reach non-owner turns". No new advisories published since the September 11 batch.

Cost, risk, and limitations

No firsthand production-harness run was executed against v2026.7.35. Verification level: documentation comparison. The Doctor plugin registry fix, the registry state recovery behavior, and the v2026.7.35 alias promotion are sourced verbatim from the release page; no live Gateway was installed, restarted, or inspected for this report.
The release notes do not state whether v2026.7.35 supersedes v2026.7.33 in the Docker extended-stable alias promotion. The v2026.7.33 release tooling was specified to "carry the current Docker channel classifier, promoter, verification policy, and tests so v2026.7.33 can move only the extended-stable aliases"*, but the v2026.7.35 release page does not explicitly say whether the alias mapping changed. Operators who pinned Docker tags should verify alias behavior after upgrade.
The bundled plugin inventory list may not be exhaustive. The Doctor fix lists "Browser, Canvas, pairing, file-transfer, phone-control, Talk voice, and Bonjour" — but the prior coverage audit for v2026.7.33 (Sep 18) referenced "the npm-published plugin inventory" without enumerating it. Operators should not assume those seven plugins are the complete bundled set.
OpenClaw security advisories remain at the September 11 batch. v2026.7.35 does not introduce or remediate any advisory. The two High-severity items (GHSA-3mq7-q27j-mq7q exec-approval working-directory lifecycle, GHSA-9m4p-cqp4-jppq WhatsApp login tool non-owner-turn reach) remain unpatched in this release.
FreeBSD ARM64 update handoff remains flagged as "unverified" in the v2026.9.x release notes (per the September 19 v2026.9.5 article). v2026.7.35 does not mention FreeBSD ARM64 status; the July-line backport was selected from a 1,418-commit audit but the release page does not enumerate platform-specific update handoff behavior.

Mr. Technology verdict

v2026.7.35 is a small but operationally meaningful release for the July extended-stable channel. The new code change is one PR's worth of work (Doctor plugin registry fix backport); the larger significance is that this is the first GitHub Release on the July channel, which makes the v2026.7.33 security and credential fixes — and the previously-unpublished v2026.7.34 — pinnable, auditable, and discoverable. Teams that have been holding back from the July channel because they require GitHub-tagged releases for supply-chain integrity should re-evaluate pinning now. Teams that already ran v2026.7.33 should upgrade specifically for the Doctor plugin registry backport and the state-migration recovery from v2026.7.34's partial registry.

Recommended action

Today: If you run OpenClaw on the July extended-stable channel, upgrade to v2026.7.35. If you ran Doctor after v2026.7.34, run Doctor again after upgrade so the state-migration discovery recovers the bundled plugin inventory.
This week: Audit your dependency pinning. If you were avoiding the July channel because v2026.7.33 and v2026.7.34 had no GitHub Releases, that objection is now resolved. Update CI and SBOM pipelines to recognize the v2026.7.35 tag.
Next week: Re-check the Docker extended-stable alias mapping. The v2026.7.35 release page does not state whether the alias moved to v2026.7.35 or remained on v2026.7.33; verify with your container workflow before relying on :extended-stable tag pulls.
Skip if not in scope: If you are on the v2026.9.x stable channel or the v2026.6.35 final LTS line, v2026.7.35 is not your upgrade target. The September 19 v2026.9.5 pillar and the September 10 v2026.6.35 final LTS article remain the canonical references for those lines.

Sources

OpenClaw v2026.7.35 release page — verified 2026-09-21T20:09 UTC.
OpenClaw releases atom feed — verified 2026-09-21T20:08 UTC (entry id tag:github.com,2008:Repository/1103012935/v2026.7.35).
OpenClaw security advisories page — verified 2026-09-21T20:08 UTC (10-advisory set, 8 Moderate + 2 High, all dated September 11, 2026).
PR #136045 — Doctor plugin registry fix backport.
Prior coverage: openclaw-v2026-7-33-extended-stable-channel-security-credential-utf-16-sep-2026 (September 18, 2026 pillar — v2026.7.33 security/credential/UTF-16 fixes and 126-PR contribution record).

Article history

Originally published: 2026-09-21 20:09 UTC
Last verified: 2026-09-21 20:09 UTC
No corrections at this time.