Upgrade OpenClaw to 2026.3.23

[github-actions]

Automated Upgrade: 2026.3.11 → 2026.3.23

Test Results

Test	Result
Docker image builds	✅
Version matches Dockerfile	✅
Config valid JSON + correct defaults	✅
Config owned by openclaw user	✅
Gateway process running	✅
Gateway HTTP responds 200	✅
Tailscale binary present	✅
Channel plugins loaded	✅
Backup config valid	✅
openclaw doctor completes	✅
App Platform E2E	✅ Passed

⚠️ Known Upstream Regressions

• #53247: [Bug]: WhatsApp plugin crashes agent in v2026.3.23 with missing light-runtime-api
• #53785: [Bug]: Linux: @matrix-org/matrix-sdk-crypto-nodejs missing from npm package (only darwin-arm64 binary bundled)
• #53721: Telegram channel fails to initialize after gateway restart (regression in 2026.3.23-2)
• #53578: [Bug]: google-gemini-cli OAuth became consistently slow per turn after upgrading to OpenClaw 2026.3.23-2
• #53870: [Bug]: clawhub:@openclaw/matrix… This package release is pending a security scan by VirusTotal. Please try again in a few minutes.

Review these before merging.

Release Notes

2026.3.23

Breaking

Changes

• ModelStudio/Qwen: add standard (pay-as-you-go) DashScope endpoints for China and global Qwen API keys alongside the existing Coding Plan endpoints, and relabel the provider group to Qwen (Alibaba Cloud Model Studio). (#43878)
• UI/clarity: consolidate button primitives (btn--icon, btn--ghost, btn--xs), refine the Knot theme to a black-and-red palette with WCAG 2.1 AA contrast, add config icons for Diagnostics/CLI/Secrets/ACP/MCP sections, replace the roundness slider with discrete stops, and improve accessibility with aria-labels across usage filters. (#53272) Thanks @BunsDev.
• CSP/Control UI: compute SHA-256 hashes for inline <script> blocks in the served index.html and include them in the script-src CSP directive, keeping inline scripts blocked by default while allowing explicitly hashed bootstrap code. (#53307) Thanks @BunsDev.

Fixes

• Plugins/bundled runtimes: ship bundled plugin runtime sidecars like WhatsApp light-runtime-api.js, Matrix runtime-api.js, and other plugin runtime entry files in the npm package again, so global installs stop failing on missing bundled plugin runtime surfaces.
• CLI/channel auth: auto-select the single configured login-capable channel for channels login/logout, harden channel ids against prototype-chain and control-character abuse, and fall back cleanly to catalog-backed channel installs, so channel auth works again for single-channel setups and on-demand channel installs. (#53254) Thanks @BunsDev.
• Auth/OpenAI tokens: stop live gateway auth-profile writes from reverting freshly saved credentials back to stale in-memory values, and make models auth paste-token write to the resolved agent store, so Configure, Onboard, and token-paste flows stop snapping back to expired OpenAI tokens. Fixes #53207. Related to #45516.
• Control UI/auth: preserve operator scopes through the device-auth bypass path, ignore cached under-scoped operator tokens, and show a clear operator.read fallback message when a connection really lacks read scope, so operator sessions stop failing or blanking on read-backed pages. (#53110) Thanks @BunsDev.
• Plugins/ClawHub: resolve plugin API compatibility against the active runtime version at install time, and add regression coverage for current >=2026.3.22 ClawHub package checks so installs no longer fail behind the stale 1.2.0 constant. (#53157) Thanks @futhgar.
• Plugins/uninstall: accept installed clawhub: specs and versionless ClawHub package names as uninstall targets, so openclaw plugins uninstall clawhub:<package> works again even when the recorded install was pinned to a version.
• Browser/Chrome MCP: wait for existing-session browser tabs to become usable after attach instead of treating the initial Chrome MCP handshake as ready, which reduces user-profile timeouts and repeated consent churn on macOS Chrome attach flows. Fixes #52930. Thanks @vincentkoc.
• Browser/CDP: reuse an already-running loopback browser after a short initial reachability miss instead of immediately falling back to relaunch detection, which fixes second-run browser start/open regressions on slower headless Linux setups. Fixes #53004. Thanks @vincentkoc.
• Agents/web_search: use the active runtime web_search provider instead of stale/default selection, so agent turns keep hitting the provider you actually configured. Fixes #53020. Thanks @jzakirov.
• Mistral/models: lower bundled Mistral max-token defaults to safe output budgets and teach openclaw doctor --fix to repair old persisted Mistral provider configs that still carry context-sized output limits, avoiding deterministic Mistral 422 rejects on fresh and existing setups. Fixes #52599. Thanks @vincentkoc.
• ClawHub/macOS auth: honor macOS auth config and XDG auth paths for saved ClawHub credentials, so openclaw skills ... and gateway skill browsing keep using the signed-in auth state instead of silently falling back to unauthenticated mode. Fixes #53034.
• ClawHub/macOS: read the local ClawHub login from the macOS Application Support path and still honor XDG config on macOS, so skill browsing uses the logged-in token on both default and XDG-style setups. Fixes #52949. Thanks @scoootscooob.
• ClawHub/skills: resolve the local ClawHub auth token for gateway skill browsing and switch browse-all requests to search so ClawControl stops falling into unauthenticated 429s and empty authenticated skill lists. Fixes #52949. Thanks @vincentkoc.
• Config/warnings: suppress the confusing “newer OpenClaw” warning when a config written by a same-base correction release like 2026.3.23-2 is read by 2026.3.23, while still warning for truly newer or incompatible versions.
• CLI/cron: make openclaw cron add|edit --at ... --tz <iana> honor the requested local wall-clock time for offset-less one-shot datetimes, including DST boundaries, and keep --tz rejected for --every. (#53224) Thanks @RolfHegr.
• Commands/auth: stop slash-command authorization from crashing or dropping valid allowlists when channel allowFrom resolution hits unresolved SecretRef-backed accounts, and fail closed only for the affected provider inference path. (#52791) Thanks @Lukavyi.
• Agents/failover: classify generic api_error payloads as retryable only when they include transient failure signals, so MiniMax-style backend failures still trigger model fallback without misclassifying billing, auth, or format/context errors. (#49611) Thanks @ayushozha.
• LINE/runtime-api: pre-export overlapping runtime symbols before the line-runtime star export so jiti no longer throws TypeError: Cannot redefine property on startup. (#53221) Thanks @Drickon.
• Telegram/threading: populate currentThreadTs in the threading tool-context fallback for Telegram DM topics so thread-aware tools still receive the active topic context when the main thread metadata is missing. (#52217)
• Diagnostics/cache trace: strip credential fields from cache-trace JSONL output while preserving non-sensitive diagnostic fields and image redaction metadata.
• Docs/Feishu: replace botName with name in the channel config examples so the docs match the strict account schema for per-account display names. (#52753) Thanks @haroldfabla2-hue.
• Doctor/plugins: make openclaw doctor --fix remove stale plugins.allow and plugins.entries refs left behind after plugin removal. Thanks @sallyom
• Agents/replay: canonicalize malformed assistant transcript content before session-history sanitization so legacy or corrupted assistant turns stop crashing Pi replay and subagent recovery paths.
• ClawHub/skills: keep updating already-tracked legacy Unicode slugs after the ASCII-only slug hardening, so older installs do not get stuck behind Invalid skill slug errors during openclaw skills update. (#53206) Thanks @drobison00.
• Infra/exec trust: preserve shell-multiplexer wrapper binaries for policy checks without breaking approved-command reconstruction, so BusyBox/ToyBox allowlist and audit flows bind to the real wrapper while execution plans stay coherent. (#53134) Thanks @vincentkoc.
• Plugins/message tool: make Discord components and Slack blocks optional again, and route Feishu message(..., media=...) sends through the outbound media path, so pin/unpin/react flows stop failing schema validation and Feishu file/image attachments actually send. Fixes #52970 and #52962. Thanks @vincentkoc.
• Gateway/model pricing: stop openrouter/auto pricing refresh from recursing indefinitely during bootstrap, so OpenRouter auto routes can populate cached pricing and usage.cost again. Fixes #53035. Thanks @vincentkoc.
• Models/OpenAI Codex OAuth: bootstrap the env-configured HTTP/HTTPS proxy dispatcher on the stored-credential refresh path before token renewal runs, so expired Codex OAuth profiles can refresh successfully in proxy-required environments instead of locking users out after the first token expiry.
• Models/OpenAI Codex OAuth and Plugins/MiniMax OAuth: ensure env-configured HTTP/HTTPS proxy dispatchers are initialized before OAuth preflight and token exchange requests so proxy-required environments can complete MiniMax and OpenAI Codex sign-in flows again. (#52228; fixes #51619, #51569) Thanks @openperf.
• Plugins/memory-lancedb: bootstrap LanceDB into plugin runtime state on first use when the bundled npm install does not already have it, so plugins.slots.memory="memory-lancedb" works again after global npm installs without moving LanceDB into OpenClaw core dependencies. Fixes #26100.
• Config/plugins: treat stale unknown plugins.allow ids as warnings instead of fatal config errors, so recovery commands like plugins install, doctor --fix, and status still run when a plugin is missing locally. Fixes #52992. Thanks @vincentkoc.
• Doctor/WhatsApp: stop auto-enable from appending built-in channel ids like whatsapp to plugins.allow, so openclaw doctor --fix no longer writes schema-invalid plugin allowlist entries when repairing built-in channels. Fixes #52931. Thanks @vincentkoc.
• Telegram/auto-reply: preserve same-chat inbound debounce order without stranding stale busy-session followups, and keep same-key overflow turns ordered when tracked debounce keys are saturated. (#52998) Thanks @osolmaz.
• Telegram/message tool: add asDocument as a user-facing alias for forceDocument on image and GIF sends, while preserving explicit forceDocument precedence when both flags are present. (#52461) Thanks @bakhtiersizhaev.
• Discord/commands: return an explicit unauthorized reply for privileged native slash commands instead of falling through to Discord's misleading generic completion when auth gates reject the sender. Fixes #53041. Thanks @scoootscooob.
• Channels/catalog: let external channel catalogs override shipped fallback metadata and honor overridden npm specs during channel setup, so custom channel catalogs no longer fall back to bundled packages when a channel id matches. (#52988)
• Voice-call/Plivo: stabilize Plivo v2 replay keys so webhook retries and replay protection stop colliding on valid follow-up deliveries.
• Agents/skills: prefer the active resolved runtime snapshot for embedded skill config and env injection, so skills.entries.<skill>.apiKey SecretRefs resolve correctly during embedded startup instead of failing on raw source config. Fixes #53098. Thanks @vincentkoc.
• Agents/subagents: recheck timed-out worker waits against the latest runtime snapshot before sending completion events, so fast-finishing workers stop being reported as timed out when they actually succeeded. Fixes #53106. Thanks @vincentkoc.
• Agents/Anthropic: preserve latest assistant thinking and redacted-thinking block ordering during transcript image sanitization so follow-up turns do not trip Anthropic's unmodified-thinking validation. (#52961) Thanks @vincentkoc.
• Plugins/DeepSeek: refactor the bundled DeepSeek provider onto the shared single-provider plugin entry, move its coverage into the extension test lane, and keep bundled auth env-var metadata on the generated manifest path. (#48762) Thanks @07akioni.
• Plugins/Matrix: avoid duplicate resolveMatrixAccountStringValues runtime-api exports under Jiti so bundled Matrix installs no longer crash at startup with Cannot redefine property: resolveMatrixAccountStringValues. Fixes #52909 and #52891. Thanks @vincentkoc.
• Security/exec approvals: keep shell-wrapper positional-argv allowlist matching on real direct carriers only by rejecting single-quoted $0/$n tokens, disallowing newline-separated exec, and still accepting exec -- carrier forms. Thanks @vincentkoc.
• Gateway/probe: stop successful gateway handshakes from timing out as unreachable while post-connect detail RPCs are still loading, so slow devices report a reachable RPC failure instead of a false negative dead gateway. Fixes #52927. Thanks @vincentkoc.
• Gateway/supervision: stop lock conflicts from crash-looping under launchd and systemd by keeping the duplicate process in a retry wait instead of exiting as a failure while another healthy gateway still owns the lock. Fixes #52922. Thanks @vincentkoc.
• Gateway/auth: require auth for canvas routes and admin scope for agent session reset, so anonymous canvas access and non-admin reset requests fail closed.
• Release/install: keep previously released bundled plugins and Control UI assets in published openclaw npm installs, and fail release checks when those shipped artifacts are missing. Thanks @vincentkoc.

openclaw 2026.3.22

2026.3.22

Breaking

• Plugins/install: bare openclaw plugins install <package> now prefers ClawHub before npm for npm-safe names, and only falls back to npm when ClawHub does not have that package or version. Docs: https://docs.openclaw.ai/tools/clawhub
• Browser/Chrome MCP: remove the legacy Chrome extension relay path, bundled extension assets, driver: "extension", and browser.relayBindHost. Run openclaw doctor --fix to migrate host-local browser config to existing-session / user; Docker, headless, sandbox, and remote browser flows still use raw CDP. Docs: https://docs.openclaw.ai/gateway/doctor and https://docs.openclaw.ai/tools/browser (#47893) Thanks @vincentkoc.
• Tools/image generation: standardize the stock image create/edit path on the core image_generate tool. The old nano-banana-pro docs/examples are gone; if you previously copied that sample-skill config, switch to agents.defaults.imageGenerationModel for built-in image generation or install a separate third-party skill explicitly.
• Skills/image generation: remove the bundled nano-banana-pro skill wrapper. Use agents.defaults.imageGenerationModel.primary: "google/gemini-3-pro-image-preview" for the native Nano Banana-style path instead.
• Plugins/SDK: the new public plugin SDK surface is openclaw/plugin-sdk/*; openclaw/extension-api is removed with no compatibility shim. Bundled plugins must use injected runtime for host-side operations (for example api.runtime.agent.runEmbeddedPiAgent) and any remaining direct imports must come from narrow openclaw/plugin-sdk/* subpaths instead of the monolithic SDK root. Docs: https://docs.openclaw.ai/plugins/sdk-migration and https://docs.openclaw.ai/plugins/sdk-overview
• Plugins/message discovery: require ChannelMessageActionAdapter.describeMessageTool(...) for shared message tool discovery. The legacy listActions, getCapabilities, and getToolSchema adapter methods are removed. Plugin authors should migrate message discovery to describeMessageTool(...) and keep channel-specific action runtime code inside the owning plugin package. Thanks @gumadeiras.
• Plugins/Matrix: add a new Matrix plugin backed by the official matrix-js-sdk. If you are upgrading from the previous public Matrix plugin, follow the migration guide: https://docs.openclaw.ai/install/migrating-matrix Thanks @gumadeiras.
• Config/env: remove legacy CLAWDBOT_* and MOLTBOT_* compatibility env names across runtime, installers, and test tooling. Use the matching OPENCLAW_* env names instead.
• Config/state: remove legacy .moltbot state-dir and moltbot.json auto-detection/migration fallback. If you still keep state under ~/.moltbot, move it to ~/.openclaw or set OPENCLAW_STATE_DIR / OPENCLAW_CONFIG_PATH explicitly. Docs: https://docs.openclaw.ai/install/migrating and https://docs.openclaw.ai/start/getting-started
• Exec/env sandbox: block build-tool JVM injection (MAVEN_OPTS, SBT_OPTS, GRADLE_OPTS, ANT_OPTS), glibc tunable exploitation (GLIBC_TUNABLES), and .NET dependency resolution hijack (DOTNET_ADDITIONAL_DEPS) from the host exec environment, and restrict Gradle init script redirect (GRADLE_USER_HOME) as an override-only block so user-configured Gradle homes still propagate. (#49702)
• Discord/commands: switch native command deployment to Carbon reconcile by default so Discord restarts stop churning slash commands through OpenClaw’s local deploy path. (#46597) Thanks @huntharo and @thewilloftheshadow.
• Security/exec approvals: treat time as a transparent dispatch wrapper during allowlist evaluation and allow-always persistence so approved time ... commands bind the inner executable instead of the wrapper path. Thanks @YLChen-007 for reporting.
• Voice-call/webhooks: reject missing provider signature headers before body reads, drop the pre-auth body budget to 64 KB / 5s, and cap concurrent pre-auth requests per source IP so unauthenticated callers cannot force the old 1 MB / 30s buffering path. Thanks @SEORY0 for reporting.
• Plugins/Matrix: stop mention-gated or otherwise dropped room chatter from refreshing focused thread bindings before the message is actually routed, so idle ACP and session bindings can still expire normally in mention-required rooms. Thanks @vincentkoc, @dinakars777 and @mvanhorn.
• Plugins/Matrix: durably dedupe inbound room events across gateway restarts so previously handled Matrix messages are not replayed as new, while preserving clean-restart backlog delivery for unseen events. (#50922) thanks @gumadeiras
• Agents/media replies: migrate the remaining browser, canvas, and nodes snapshot outputs onto details.media so generated media keeps attaching to assistant replies after the collect-then-attach refactor. (#51731) Thanks @christianklotz.
• Android/contacts search: escape literal % and _ in contact-name queries so searches like 100% or _id no longer match unrelated contacts through SQL LIKE wildcards. (#41891) Thanks @Kaneki-x.
• Gateway/usage: include reset and deleted archived session transcripts in usage totals, session discovery, and archived-only session detail fallback so the Usage view no longer undercounts rotated sessions. (#43215) Thanks @rcrick.

Changes

• ClawHub/install: add native openclaw skills search|install|update flows plus openclaw plugins install clawhub:<package> with tracked update metadata, gateway skill-install/update support for ClawHub-backed requests, and regression coverage/docs for the new source path.
• Plugins/marketplaces: add Claude marketplace registry resolution, plugin@marketplace installs, marketplace listing, and update support, plus Docker E2E coverage for local and official marketplace flows. (#48058) Thanks @vincentkoc.
• Commands/plugins: add owner-gated /plugins and /plugin chat commands for plugin list/show and enable/disable flows, alongside explicit commands.plugins config gating. Thanks @vincentkoc.
• Install/update: allow package-manager installs from GitHub main via openclaw update --tag main, installer --version main, or direct npm/pnpm git specs. (#47630) Thanks @vincentkoc.
• Plugins/bundles: add compatible Codex, Claude, and Cursor bundle discovery/install support, map bundle skills into OpenClaw skills, and apply Claude bundle settings.json defaults to embedded Pi with shell overrides sanitized.
• CLI/hooks: route hook-pack install and update through openclaw plugins, keep openclaw hooks focused on hook visibility and per-hook controls, and show plugin-managed hook details in CLI output.
• Models/OpenAI: switch the default OpenAI setup model to openai/gpt-5.4, keep Codex on openai-codex/gpt-5.4, and centralize OpenAI chat, image, TTS, transcription, and embedding defaults in one shared module so future default-model updates stay low-churn. Thanks @vincentkoc.
• Agents: add per-agent thinking/reasoning/fast defaults and auto-revert disallowed model overrides to the agent's default selection. Thanks @xuanmingguo and @vincentkoc.
• Commands/btw: add /btw side questions for quick tool-less answers about the current session without changing future session context, with dismissible in-session TUI answers and explicit BTW replies on external channels. (#45444) Thanks @ngutman.
• Sandbox/runtime: add pluggable sandbox backends, ship an OpenShell backend with mirror and remote workspace modes, and make sandbox list/recreate/prune backend-aware instead of Docker-only.
• Sandbox/SSH: add a core SSH sandbox backend with secret-backed key, certificate, and known_hosts inputs, move shared remote exec/filesystem tooling into core, and keep OpenShell focused on sandbox lifecycle plus optional mirror mode.
• Browser/existing-session: support browser.profiles.<name>.userDataDir so Chrome DevTools MCP can attach to Brave, Edge, and other Chromium-based browsers through their own user data directories. (#48170) Thanks @velvet-shark.
• Plugins/bundles: make enabled bundle MCP servers expose runnable tools in embedded Pi, and default relative bundle MCP launches to the bundle root so marketplace bundles like Context7 work through Pi instead of stopping at config import.
• Plugins/providers: move OpenRouter, GitHub Copilot, and OpenAI Codex provider/runtime logic into bundled plugins, including dynamic model fallback, runtime auth exchange, stream wrappers, capability hints, and cache-TTL policy.
• Models/Anthropic Vertex: add core anthropic-vertex provider support for Claude via Google Vertex AI, including GCP auth/discovery and main run-path routing. (#43356) Thanks @sallyom and @yossiovadia.
• Plugins/Chutes: add a bundled Chutes provider with plugin-owned OAuth/API-key auth, dynamic model discovery, and default-on extension wiring. (#41416) Thanks @Veightor.
• Web tools/Exa: add Exa as a bundled web-search plugin with Exa-native date filters, search-mode selection, and optional content extraction under plugins.entries.exa.config.webSearch.*. Thanks @V-Gutierrez and @vincentkoc.
• Web tools/Tavily: add Tavily as a bundled web-search provider with dedicated tavily_search and tavily_extract tools, using canonical plugin-owned config under plugins.entries.tavily.config.webSearch.*. (#49200) thanks @lakshyaag-tavily.
• Web tools/Firecrawl: add Firecrawl as an onboard/configure search provider via a bundled plugin, expose explicit firecrawl_search and firecrawl_scrape tools, and align core web_fetch fallback behavior with Firecrawl base-URL/env fallback plus guarded endpoint fetches.
• Models/OpenAI: add native forward-compat support for gpt-5.4-mini and gpt-5.4-nano in the OpenAI provider catalog, runtime resolution, and reasoning capability gates. Thanks @vincentkoc.
• Control UI/chat: add an expand-to-canvas button on assistant chat bubbles and in-app session navigation from Sessions and Cron views. Thanks @BunsDev.
• Control UI/appearance: unify theme border radii across Claw, Knot, and Dash, and add a Roundness slider to the Appearance settings so users can adjust corner radius from sharp to fully rounded. Thanks @BunsDev.
• Control UI/usage: improve usage overview styling, localization, and responsive chat/context-notice presentation, including safer theme color handling and unclipped usage-header menus. (#51951) Thanks @BunsDev.
• Control UI/usage: drop the empty session-detail placeholder card so the usage view stays single-column until a real session detail panel is selected. (#52013) Thanks @BunsDev.
• Android/mobile: add a system-aware dark theme across onboarding and post-onboarding screens so the app follows the device theme through setup, chat, and voice flows. (#46249) Thanks @sibbl.
• Android/Talk: move Talk speech synthesis behind gateway talk.speak, keep Talk secrets on the gateway, and switch Android playback to final-response audio instead of device-local ElevenLabs streaming. (#50849)
• Android/nodes: add callLog.search plus shared Call Log permission wiring so Android nodes can search recent call history through the gateway. (#44073) Thanks @lixuankai.
• Android/nodes: add sms.search plus shared SMS permission wiring so Android nodes can search device text messages through the gateway. (#48299) Thanks @lixuankai.
• Telegram/apiRoot: add per-account custom Bot API endpoint support across send, probe, setup, doctor repair, and inbound media download paths so proxied or self-hosted Telegram deployments work end to end. (#48842) Thanks @Cypherm.
• Telegram/topics: auto-rename DM forum topics on first message with LLM-generated labels, with per-account and per-DM autoTopicLabel overrides. (#51502) Thanks @Lukavyi.
• Telegram/actions: add topic-edit for forum-topic renames and icon updates while sharing the same Telegram topic-edit transport used by the plugin runtime. (#47798) Thanks @obviyus.
• Telegram/error replies: add a default-off channels.telegram.silentErrorReplies setting so bot error replies can be delivered silently across regular replies, native commands, and fallback sends. (#19776) Thanks @ImLukeF.
• Feishu/cards: add structured interactive approval and quick-action launcher cards, preserve callback user and conversation context through routing, and keep legacy card-action fallback behavior so common actions can run without typing raw commands. (#47873) Thanks @Takhoffman.
• Feishu/ACP: add current-conversation ACP and subagent session binding for supported DMs and topic conversations, including completion delivery back to the originating Feishu conversation. (#46819) Thanks @Takhoffman.
• Feishu/streaming: add onReasoningStream and onReasoningEnd support to streaming cards, so /reasoning stream renders thinking tokens as markdown blockquotes in the same card — matching the Telegram channel's reasoning lane behavior. (#46029) Thanks @day253.
• Feishu/cards: add identity-aware structured card headers and note footers for Feishu replies and direct sends, while keeping that presentation wired through the shared outbound identity path. (#29938) Thanks @nszhsl.
• Plugins/Matrix: add allowBots room policy so configured Matrix bot accounts can talk to each other, with optional mention-only gating. Thanks @gumadeiras.
• Plugins/Matrix: add per-account allowPrivateNetwork opt-in for private/internal homeservers, while keeping public cleartext homeservers blocked. Thanks @gumadeiras.
• Plugins/MiniMax: add MiniMax-M2.7 and MiniMax-M2.7-highspeed models and update the default model from M2.5 to M2.7. (#49691) Thanks @liyuan97.
• MiniMax/fast mode: map shared /fast and params.fastMode to MiniMax -highspeed models for M2.1, M2.5, and M2.7 API-key and OAuth runs. Thanks @vincentkoc.
• Models/MiniMax defaults: raise bundled MiniMax M2.5/M2.7 context-window, max-token, and pricing metadata to the higher defaults shipped by the current upstream Pi SDK. Thanks @vincentkoc.
• Models/MiniMax: add bundled MiniMax-M2, MiniMax-M2.1, and MiniMax-M2.1-highspeed catalog entries so OpenClaw's provider metadata and OAuth aliases stay aligned with the current upstream Pi SDK. Thanks @vincentkoc.
• Plugins/MiniMax: merge the bundled MiniMax API and MiniMax OAuth plugin surfaces into a single default-on minimax plugin, while keeping legacy minimax-portal-auth config ids aliased for compatibility.
• Agents/Pi compatibility: align OpenClaw's bundled MiniMax runtime behavior with the current upstream Pi 0.61.1 release so embedded runs stay in sync with the latest published Pi SDK semantics. Thanks @vincentkoc.
• Models/GitHub Copilot: allow forward-compat dynamic model ids without code updates, while preserving configured provider and per-model overrides for those synthetic models. (#51325) Thanks @fuller-stack-dev.
• xAI/models: sync the bundled Grok catalog to current Pi-backed IDs, limits, and pricing metadata, while keeping older Grok fast and 4.20 aliases resolving cleanly at runtime. Thanks @vincentkoc.
• xAI/fast mode: map shared /fast and params.fastMode to the current xAI Grok fast model family so direct Grok runs can opt into the faster Pi-backed variants. Thanks @vincentkoc.
• CLI/config: expand config set with SecretRef and provider builder modes, JSON/batch assignment support, and --dry-run validation with structured JSON output. (#49296) Thanks @joshavant.
• Z.AI/models: sync the bundled GLM catalog to current Pi metadata, including newer 4.5/4.6 model families, updated multimodal entries, and current pricing and token limits. Thanks @vincentkoc.
• Mistral/models: sync the bundled default Mistral metadata to current Pi pricing so the built-in default no longer advertises zero-cost usage. Thanks @vincentkoc.
• Plugins/Xiaomi: switch the bundled Xiaomi provider to the /v1 OpenAI-compatible endpoint and add MiMo V2 Pro plus MiMo V2 Omni to the built-in catalog. (#49214) thanks @DJjjjhao.
• Agents/compaction: notify users when followup auto-compaction starts and finishes, keeping those notices out of TTS and preserving reply threading for the real assistant reply. (#38805) Thanks @zidongdesign.
• Memory/plugins: let the active memory plugin register its own system-prompt section while preserving cache-clear and snapshot-load prompt isolation. (#40126) Thanks @jarimustonen.
• Gateway/health monitor: add configurable stale-event thresholds and restart limits, plus per-channel and per-account healthMonitor.enabled overrides, while keeping the existing global disable path on gateway.channelHealthCheckMinutes=0. (#42107) Thanks @rstar327.
• Plugins/agent integrations: broaden the plugin surface for app-server integrations with channel-aware commands, interactive callbacks, inbound claims, and Discord/Telegram conversation binding support. (#45318) Thanks @huntharo and @vincentkoc.
• Plugins/binding: add onConversationBindingResolved(...) so plugins can react immediately after bind approvals or denies without blocking channel interaction acknowledgements. (#48678) Thanks @huntharo.
• Plugins/context engines: expose delegateCompactionToRuntime(...) on the public plugin SDK, refactor the legacy engine to use the shared helper, and clarify ownsCompaction delegation semantics for non-owning engines. (#49061) Thanks @jalehman.
• Plugins/context engines: pass the embedded runner modelId into context-engine assemble() so plugins can adapt context formatting per model. (#47437) thanks @jscianna.
• Plugins/context engines: add transcript maintenance rewrites for context engines, preserve active-branch transcript metadata during rewrites, and harden overflow-recovery truncation to rewrite sessions under the normal session write lock. (#51191) Thanks @jalehman.
• Skills/prompt budget: preserve all registered skills via a compact catalog fallback before dropping entries when the full prompt format exceeds maxSkillsPromptChars. (#47553) Thanks @snese.
• Hooks/workspace: keep repo-local <workspace>/hooks disabled until explicitly enabled, block workspace hook name collisions from shadowing bundled/managed/plugin hooks, and treat hooks.internal.load.extraDirs as trusted managed hook sources.
• Security/plugins: reject remote marketplace manifest entries that expand installation outside the cloned marketplace repo, including external git/GitHub sources, HTTP archives, and absolute paths.
• Gateway/docs: clarify that empty URL input allowlists are treated as unset, document allowUrl: false as the deny-all switch, and add regression coverage for the normalization path.
• secrets: harden read-only SecretRef command paths and diagnostics. (#47794) Thanks @joshavant.
• Scope message SecretRef resolution and harden doctor/status paths. (#48728) Thanks @joshavant.
• Build/memory tools: emit dist/cli/memory-cli.js as a stable core entry so runtime memory_search loading no longer depends on hashed memory-cli-* bundle names. (#51759) Thanks @oliviareid-svg.
• Plugins/testing: add a public openclaw/plugin-sdk/testing surface for plugin-author test helpers, and move bundled-extension-only test bridges out of extensions/ into private repo test helpers.
• Agents/steering docs: update embedded Pi steering docs and runner comments for the current upstream behavior, where queued steering is injected after the active assistant turn finishes its tool calls instead of skipping the remaining tools mid-turn. Thanks @vincentkoc.
• Doctor/refactor: start splitting doctor provider checks into src/commands/doctor/providers/* by extracting Telegram first-run and group allowlist warnings into a provider-specific module, keeping the current setup guidance and warning behavior intact. Thanks @vincentkoc.
• Refactor/channels: remove the legacy channel shim directories and point channel-specific imports directly at the extension-owned implementations. (#45967) Thanks @scoootscooob.
• Docs/Zalo: clarify the Marketplace-bot support matrix and config guidance so the Zalo channel docs match current Bot Creator behavior more closely. (#47552) Thanks @No898.
• Docs/plugins: add the community DingTalk plugin listing to the docs catalog. (#29913) Thanks @sliverp.
• Docs/plugins: add the community QQbot plugin listing to the docs catalog. (#29898) Thanks @sliverp.
• Docs/plugins: add the community wecom plugin listing to the docs catalog. (#29905) Thanks @sliverp.

Fixes

• Web tools/search provider lists: keep onboarding, configure, and docs provider lists alphabetical while preserving the separate runtime auto-detect precedence used for credential-based provider selection.
• Media/Windows security: block remote-host file:// media URLs and UNC/network paths before local filesystem resolution in core media loading and adjacent prompt/sandbox attachment seams, so the next release no longer allows structured local-media inputs to trigger outbound SMB credential handshakes on Windows. Thanks @RacerZ-fighting for reporting.
• Gateway/discovery: fail closed on unresolved Bonjour and DNS-SD service endpoints in CLI discovery, onboarding, and gateway status so TXT-only hints can no longer steer routing or SSH auto-target selection. Thanks @nexrin for reporting.
• Security/pairing: bind iOS setup codes to the intended node profile and reject first-use bootstrap redemption that asks for broader roles or scopes. Thanks @tdjackey.
• Memory/core tools: register memory_search and memory_get independently so one unavailable memory tool no longer suppresses the other in new sessions. (#50198) Thanks @artwalker.
• Web tools/Exa: align the bundled Exa plugin with the current Exa API by supporting newer search types and richer contents options, while fixing the result-count cap to honor Exa's higher limit. Thanks @vincentkoc.
• Plugins/Matrix: move bundled plugin KeyedAsyncQueue imports onto the stable plugin-sdk/core surface so Matrix Docker/runtime builds do not depend on the brittle keyed-async-queue subpath. Thanks @ecohash-co and @vincentkoc.
• Nostr/security: enforce inbound DM policy before decrypt, route Nostr DMs through the standard reply pipeline, and add pre-crypto rate and size guards so unknown senders cannot bypass pairing or force unbounded crypto work. Thanks @kuranikaran.
• Synology Chat/security: keep reply delivery bound to stable numeric user_id by default, and gate mutable username/nickname recipient lookup behind dangerouslyAllowNameMatching with new regression coverage. Thanks @nexrin.
• Agents/default timeout: raise the shared default agent timeout from 600s to 48h so long-running ACP and agent sessions do not fail unless you configure a shorter limit.
• Gateway/startup: load bundled channel plugins from compiled dist/extensions entries in built installs, so gateway boot no longer recompiles bundled extension TypeScript on every startup and WhatsApp-class cold starts drop back to seconds instead of tens of seconds or worse. (#47560) Thanks @ngutman.
• Gateway/startup: prewarm the configured primary model before channel startup and retry one transient provider-runtime miss so the first Telegram or Discord message after boot no longer fails with Unknown model: openai-codex/gpt-5.4. Thanks @vincentkoc.
• CLI/startup: lazy-load channel add and root help startup paths to trim avoidable RSS and help latency on constrained hosts. (#46784) Thanks @vincentkoc.
• Configure/startup: move outbound send-deps resolution into a lightweight helper so openclaw configure no longer stalls after the banner while eagerly loading channel plugins. (#46301) Thanks @scoootscooob.
• CLI/auth choice: lazy-load plugin/provider fallback resolution so mapped auth choices stay on the static path and only unknown choices pay the heavy provider load. (#47495) Thanks @vincentkoc.
• Gateway/Discord startup: load only configured channel plugins during gateway boot, and lazy-load Discord provider/session runtime setup so startup stops importing unrelated providers and trims cold-start delay. Thanks @vincentkoc.
• Agents/inbound: lazy-load media and link understanding for plain-text turns and cache synced auth stores by auth-file state so ordinary inbound replies avoid unnecessary startup churn. Thanks @vincentkoc.
• Agents/openai-compatible tool calls: deduplicate repeated tool call ids across live assistant messages and replayed history so OpenAI-compatible backends no longer reject duplicate tool_call_id values with HTTP 400. (#40996) Thanks @xaeon2026.
• Agents/openai-responses: strip prompt_cache_key and prompt_cache_retention for non-OpenAI-compatible Responses endpoints while keeping them on direct OpenAI and Azure OpenAI paths, so third-party OpenAI-compatible providers no longer reject those requests with HTTP 400. (#49877) Thanks @ShaunTsai.
• Models/openai-completions: default non-native OpenAI-compatible providers to omit tool-definition strict fields unless users explicitly opt back in, so tool calling keeps working on providers that reject that option. (#45497) Thanks @sahancava.
• Models/OpenRouter runtime capabilities: fetch uncatalogued OpenRouter model metadata on first use so newly added vision models keep image input instead of silently degrading to text-only, with top-level capability field fallbacks for /api/v1/models. (#45824) Thanks @DJjjjhao.
• Control UI/session routing: preserve established external delivery routes when webchat views or sends in externally originated sessions, so subagent completions still return to the original channel instead of the dashboard. (#47797) Thanks @brokemac79.
• Telegram/replies: set allow_sending_without_reply on reply-targeted sends and media-error notices so deleted parent messages no longer drop otherwise valid replies. (#52524) Thanks @moltbot886.
• Telegram/polling: hard-timeout stuck getUpdates requests so wedged network paths fail over sooner instead of waiting for the polling stall watchdog. Thanks @vincentkoc.
• Android/location: make current-location requests drop late callbacks after timeout instead of crashing with Already resumed. (#52318) Thanks @Kaneki-x.
• Android/pairing: resolve portless secure setup URLs to 443 while preserving direct cleartext gateway defaults and explicit :80 manual endpoints in onboarding. (#43540) Thanks @fmercurio.
• Android/canvas: ignore bridge messages from pages outside the bundled scaffold and trusted A2UI surfaces. Thanks @vincentkoc.
• CLI/status: keep status --json stdout clean by skipping plugin compatibility scans that were not rendered in the JSON payload. (#52449) Thanks @cgdusek.
• WhatsApp/reconnect: restore the append recency filter in the extension inbox monitor and handle protobuf Long timestamps correctly, so fresh post-reconnect append messages are processed while stale history sync stays suppressed. (#42588) Thanks @MonkeyLeeT.
• WhatsApp/login: wait for pending creds writes before reopening after Baileys 515 pairing restarts in both QR login and channels login flows, and keep the restart coverage pinned to the real wrapped error shape plus per-account creds queues. (#27910) Thanks @asyncjason.
• Android/canvas: serialize A2UI action-status event strings before evaluating WebView JS, so action ids and multiline errors do not break the callback dispatch. (#43784) Thanks @Kaneki-x.
• Android/camera: recycle intermediate and final snap bitmaps in camera.snap so repeated captures do not leak native image memory. (#41902) Thanks @Kaneki-x.
• Control UI/logging: make browser-safe logger imports avoid eager temp-dir resolution so the bundled Control UI no longer crashes to a blank screen when logging reaches tmp-openclaw-dir. (#48469) Fixes #48062. Thanks @7inspire.
• Control UI/chat sessions: show human-readable labels in the grouped session dropdown again, keep unique scoped fallbacks when metadata is missing, and disambiguate duplicate labels only when needed. (#45130) Thanks @luzhidong.
• Telegram/replies: ignore malformed non-string reply text and caption fields when describing reply context, so unexpected Telegram reply payloads no longer break inbound context assembly. (#50500) Thanks @p3nchan.
• Control UI/dashboard: preserve structured gateway shutdown reasons across restart disconnects so config-triggered restarts no longer fall back to disconnected (1006): no reason. (#46580) Fixes #46532. Thanks @vincentkoc.
• Android/chat: theme the thinking dropdown and TLS trust dialogs explicitly so popup surfaces match the active app theme instead of falling back to mismatched Material defaults.

---

This is an automated version bump. Only the Dockerfile was changed.
If release notes mention config/schema changes, manual review is required.
Do not merge if there are known regressions above.

Docker test output

=== OpenClaw Upgrade Verification ===

Waiting for container openclaw-upgrade-test to be ready...
✓ Container is responsive (waiting for init to complete...)
✓ s6 init complete (crond up)
✓ Version: 2026.3.23
✓ Config is valid JSON
✓ tools.profile: coding
✓ Config owned by openclaw
✓ Auth mode: token
✓ Gateway process running
✓ Tailscale binary present
Waiting for gateway HTTP...
✓ Gateway HTTP: 200
✓ Config writable by openclaw user
✓ Channel plugins loaded: discord,signal,telegram,whatsapp
✓ Backup config (backup.yaml) is valid
✓ pnpm store excluded from backups
SKIP: Telegram channel probe (TELEGRAM_BOT_TOKEN not set)
✓ openclaw doctor completes

=== Upgrade Verification Results ===
  Passed:   13
  Failed:   0
  Warnings: 0

=== All upgrade verification tests passed ✅ ===