# Changelog ## 2026.10.9 ### Highlights - Patch vulnerable runtime dependencies: fast-uri 4.2.3 rejects malformed URI schemes and hosts in MCP schema validation, oversized Zod collections are rejected early in A2UI and the Discord embedded app SDK, IMAP sender parsing uses nodemailer 10.1.4 so spoofed senders cannot pass the sender token gate, and Microsoft Teams uses patched MSAL Node 7.1.1. (#187294) Thanks @RomneyDa. - Apply `tools.fs.workspaceOnly` to Gateway-built tools, so delegate changes still require approval and media tools stay inside the workspace. (#185094) Thanks @eleqtrizit, @RomneyDa, and @shakkernerd. - Keep live credentials out of MCP CLI inspection and mask Google OAuth client secrets in logs. (#180321, #180308, #183193) Thanks @brandon-julio-t, @wr-web, @LeizhenZhang, and @RomneyDa. - Make failed update rollbacks safe: Git-source rollbacks preserve operator edits instead of resetting the checkout, and npm rollbacks retry transient Windows denials and report the exact move that restores a bootable install instead of stranding the package root. (#185201, #184887, #185160, #184889) Thanks @wr-web, @syxscott, @LiuwqGit, @shakkernerd, and @RomneyDa. - Recover intact agent databases and stale full-text indexes after SQLite tokenizer changes, including update snapshots. (#176234, #176220, #176833, #181206) Thanks @ndakota79 and @RomneyDa. - Repair publication-complete updates after a remount while retaining the original launcher and sealed recovery helper. (#186557, #186527) Thanks @ericcaiwx-star, @sennyhoney, and @RomneyDa. - Migrate large transcript archives without exceeding Node.js string limits. (#170853, #170847) Thanks @iamonlv426 and @RomneyDa. - Allow agents to recover after a full disk once space becomes available, without requiring a restart. (#176902) Thanks @RomneyDa. ### Changes This maintenance release focuses on security dependency patches, recovery, data preservation, and reliability fixes. ### Fixes - Resolve local media in Codex steering messages from the session's own workspace instead of the agent's default workspace. (#181528) Thanks @RomneyDa. - Report uncertain process cleanup from buffered commands, such as local CLI speech providers, instead of presenting it as an ordinary command failure. (#184270, #184237) Thanks @shakkernerd and @RomneyDa. - Keep reapproved node connections alive by publishing the approval with its committed pairing facts before the request resumes. Thanks @RomneyDa. - Recover stopped Gateways when service activation cannot be verified; retain untouched-recovery behavior in Windows triage. (#172784, #181577, #181698) Thanks @SMF12138 and @RomneyDa. - Avoid uninstalling a Gateway service during a passive macOS stop when no service is installed. (#181257) Thanks @shakkernerd, @LiuwqGit, @eleqtrizit, @syxscott, and @RomneyDa. - Recover CLI Node runtimes when launched from the filesystem root, including launchd jobs. (#178112, #177739) Thanks @downingkeys and @RomneyDa. - Start new ACP sessions in the requested working directory instead of the default workspace. (#176852, #123557) Thanks @yinx65588-boop, @crappier, and @RomneyDa. - Prevent overlapping model refreshes from failing requests. (#179144) Thanks @RomneyDa. - Honor an explicit SSH port 22 in `openclaw gateway probe --ssh` instead of the alias's configured port. (#171092) Thanks @zhangguiping-xydt, @obviyus, and @RomneyDa. - Keep skill metadata such as icons and homepages when an inline YAML metadata value has a trailing comment. (#171224) Thanks @zhangguiping-xydt, @Takhoffman, and @RomneyDa. - Show provider-ignored options in `openclaw infer video generate` text and JSON output. (#171172) Thanks @ly85206559, @obviyus, and @RomneyDa. ### Complete contribution record This audited record covers the complete v2026.10.8..c213740c8338a05ac1a6db036e0d11060e70bf5d history: 48 in-range PRs + 0 retained seed-only PRs = 48 unique PRs. The generation manifest also supplies direct commits as editorial input; the grouped notes above prioritize user impact. Shipped baseline exclusions: v2026.10.8 (3 PRs: #180390, #180668, #181596). #### Pull requests - **PR #185538** Thanks @RomneyDa. - **PR #170853** Related #170847. Thanks @iamonlv426 and @RomneyDa. - **PR #185201** Related #184887. Thanks @wr-web and @RomneyDa and @syxscott. - **PR #176902** Thanks @RomneyDa. - **PR #176852** Related #123557. Thanks @yinx65588-boop and @RomneyDa and @crappier. - **PR #178112** Related #177739. Thanks @RomneyDa and @downingkeys. - **PR #179144** Thanks @RomneyDa. - **PR #180321** Related #180308. Thanks @brandon-julio-t and @wr-web and @RomneyDa. - **PR #183193** Thanks @LeizhenZhang and @RomneyDa. - **PR #176833** Related #176220. Thanks @RomneyDa and @ndakota79. - **PR #181698** Related #181577. Thanks @RomneyDa and @SMF12138. - **PR #172784** Related #181577. Thanks @RomneyDa and @SMF12138. - **PR #185541** Related #181577. Thanks @RomneyDa and @SMF12138. - **PR #176234** Related #176220. Thanks @RomneyDa and @ndakota79. - **PR #181206** Related #176220. Thanks @RomneyDa and @ndakota79. - **PR #186557** Related #186527. Thanks @ericcaiwx-star and @RomneyDa and @sennyhoney. - **PR #181257** Related #184889, #184237. Thanks @shakkernerd and @RomneyDa and @LiuwqGit and @eleqtrizit and @syxscott. - **PR #171224** Thanks @zhangguiping-xydt and @Takhoffman and @RomneyDa. - **PR #171172** Thanks @ly85206559 and @RomneyDa and @obviyus. - **PR #171092** Thanks @zhangguiping-xydt and @RomneyDa and @obviyus. - **PR #181528** Thanks @RomneyDa. - **PR #185692** Thanks @RomneyDa. - **PR #179085** Thanks @RomneyDa. - **PR #179097** Thanks @RomneyDa. - **PR #179104** Thanks @RomneyDa. - **PR #179125** Thanks @RomneyDa. - **PR #179077** Thanks @RomneyDa. - **PR #179112** Thanks @RomneyDa. - **PR #179109** Thanks @RomneyDa. - **PR #179083** Thanks @RomneyDa. - **PR #179093** Thanks @RomneyDa. - **PR #179079** Thanks @RomneyDa. - **PR #180250** Thanks @RomneyDa. - **PR #180238** Thanks @RomneyDa. - **PR #180257** Thanks @RomneyDa. - **PR #180245** Thanks @RomneyDa. - **PR #180249** Thanks @RomneyDa. - **PR #185160** Related #184889. Thanks @LiuwqGit and @RomneyDa and @shakkernerd and @syxscott. - **PR #187259** Thanks @RomneyDa and @shakkernerd. - **PR #182010** Thanks @RomneyDa and @shakkernerd. - **PR #184270** Related #184237. Thanks @shakkernerd and @RomneyDa. - **PR #185094** Thanks @eleqtrizit and @RomneyDa and @shakkernerd. - **PR #187412** Thanks @RomneyDa. - **PR #187430** Thanks @RomneyDa. - **PR #187459** Thanks @RomneyDa. - **PR #187487** Thanks @RomneyDa. - **PR #187294** Thanks @RomneyDa. - **PR #187496** Thanks @RomneyDa.