OpenClaw Replaces Its First 2026.10.10 Stable Candidate as the Branch Adds Bun 1.4.4 and a Brotli Fix for Claude Sessions

Follow-Up: 2026.10.10 Is Still Untagged, and Its First Frozen Candidate Was Replaced

Yesterday we reported that the Codex 0.164.0 upgrade was waiting for the 2026.10.10 stable candidate. As of 6:30 AM Pacific on Saturday, that release still has not shipped. The OpenClaw releases page on GitHub still lists 2026.10.10-beta.5 as the newest build, there is no v2026.10.10 tag, and npm still reads latest 2026.10.9, extended-stable 2026.9.36 and beta 2026.10.10-beta.5. The docs page for 2026.10.10 release notes also returns a 404.

The release branch shows what happened overnight. At 9:08 PM Pacific on Friday, Dallin Romney recorded a signed provenance commit on the frozen 2026.10.10 candidate. Two and a half hours later, at 11:34 PM, the project's RoboClaw release bot replaced that candidate with a new one. The commit message says the first candidate was replaced "after terminal candidate-owned failures," and that the replacement adds "the activated conditional dependency batch" plus focused fixes for locale drift, UI copy, Codex Stop fixtures, Bun Doctor path ordering and Gmail shutdown timers.

Qualification then kept finding problems. A 2:02 AM commit repairing qualification blockers backported a Codex conversation-binding fix from main and repaired Bun, QA, onboarding and Workboard test harnesses. Further repairs landed at 4:06 AM and 6:16 AM. Each round was followed by a new provenance verification. In total the branch is now 97 commits ahead of beta.5. The managed Codex pin on the branch is still 0.164.0, so the upgrade is ready to ship as soon as a candidate passes. We don't have a release date; it is TBD until a tag appears.

What the Candidate Now Carries Besides Codex: Bun 1.4.4 and a Brotli Fix

The replacement candidate picked up two runtime security changes that had been on main for about a week. Neither is in any OpenClaw release yet.

The first is pull request #184336, which requires stock Bun 1.4.4. It merged to main on October 26 and was cherry-picked onto the release branch late Friday. The PR says OpenClaw "still acquires and admits stock Bun 1.4.3, which predates upstream's compromised-key rejection for full TLS handshakes." After the change, stock Bun installs need 1.4.4, and older stock launchers get an upgrade message. The PR calls itself "partial remediation": in its testing, Bun 1.4.4 still authorized TLS 1.2 sessions saved by 1.4.3. Its advice is to "use a supported patched Node runtime where current compromised-key rejection is required." On the same branch, the pinned OpenClaw Bun fork manifest for 2026.10.10 now points to a build based on 1.4.4. The beta.5 and 2026.10.9 tags still point to builds based on 1.4.3.

The second is pull request #182664, which bumps the Claude ACP adapter to 0.95.0. Claude ACP sessions launched through the bundled acpx plugin run the Claude Code binary that ships inside Anthropic's agent SDK. According to the PR, adapter 0.93.0 pinned an SDK whose binary embeds Bun 1.4.3 with the brotli 1.2.0 decoder, and 0.95.0 pins SDK 0.3.309, whose binaries carry brotli 1.2.1. The underlying bug is described in Bun's GHSA-663w-cv8g-jj2p advisory for the brotli decoder, published October 23 and rated high. It's an out-of-bounds write in brotli's decoder that the brotli project says permits remote code execution. Bun's fetch asks for brotli responses by default, so the advisory notes that "a server that an application connects to can therefore send data to the decoder." Bun 1.4.4 is the fixed release.

For comparison, the released builds pin older adapters. We checked extensions/acpx/package.json at each tag: 2026.10.9 pins 0.85.1, 2026.9.36 pins 0.79.0 and beta.5 pins 0.86.0. On npm those pin SDK versions 0.3.286, 0.3.274 and 0.3.287. All are older than 0.3.309, the fixed pin named in the PR, but we have not independently confirmed which brotli version each older bundled binary contains. The candidate also backports undici 8.12.2 (up from 8.11.2) and body-parser 2.4.0. The commits don't name a specific advisory for either.

macOS Gateways That Vanish After an Update: Issue #188303 Stays Open

A Friday-morning report shows how the current recovery gap looks on a Mac. In issue #188303 on macOS Gateways disappearing from launchd, a user says that after the 2026.10.8 to 2026.10.9 auto-update, the managed Gateway's LaunchAgent vanished from the launchd domain entirely. Because the job was gone, KeepAlive couldn't restart it, and the Control UI stayed unreachable until a manual launchctl bootstrap. It happened twice in one day, once through the background reconcile path and once through the update path.

The project's RoboClaw bot replied that the update itself worked (state migrated, so rollback was correctly skipped), but the final recovery step refused to restart the Gateway after launchd had already booted the job out for maintenance. It pointed to two recovery fixes on main, #175890 and #172784, that are "not yet released" in 2026.10.8 or 2026.10.9. Until then, it suggests running launchctl bootstrap gui/$(id -u) ~/Library/LaunchAgents/ai.openclaw.gateway.plist, then openclaw doctor --fix and openclaw update status. The issue stays open for the reconcile-path case and for a reported buildup of helper processes. Separately, pull request #188226, which verifies launchd job identity during update handoff, merged to main Friday at 10:23 AM. It replaces flat pattern matching that could mistake a foreign job for the Gateway when deciding whether to recover. The release branch doesn't contain the original commits of #175890 or #172784, so whether 2026.10.10 includes equivalent backports is TBD.

Main Tightens Credential and Permission Boundaries

About 812 pull requests merged across all branches between 6 AM Friday and 6:30 AM Saturday Pacific, 771 of them to main. Four merged to main are worth knowing about for security, and none of them is in a release yet:

• Pull request #188674 on durable exec and secret-egress grants stops durable background commands from inheriting proxy-granted secrets. The reasoning: "A process intended to survive a Gateway restart must not depend on credentials whose grants end with that Gateway." Those commands now launch without the credentials, and the result says how many were left out.
• Pull request #189184 on plugin-owned credentials keeps credentials bound to a plugin instance out of the shared, transferable map used for model discovery. That also fixes a plugin provider that had been missing from the model list.
• Pull request #188833 on Claude CLI exec restrictions fixes a latent bug where a partial per-agent exec block could drop a global deny setting and request a permission bypass. The PR calls this "defense in depth" and says current launchers already strip the bypass.
• Pull request #189117 on mixed MCP definitions rejects new or edited MCP server entries that specify both a local command and a remote URL. It fixes the problem that "OpenClaw can silently run a local MCP command when the same server definition also specifies a remote URL." Existing entries keep working but now trigger a warning, and Doctor explains the two ways to fix them.

Also on Main: WhatsApp Catch-Up, Teams Files and Homebrew Node

• Pull request #188882 on WhatsApp messages missed during downtime fixes a bug where messages that arrived while the Gateway was down were marked read and never answered. Established linked accounts now answer recent offline messages, up to 20 minutes old, after startup or reconnect, with normal allowlist and mention rules still applied.
• Pull request #189339 on Microsoft Teams channel files sends files in standard channels to the team's own SharePoint site without a manually configured sharePointSiteId, using permissions the documented Teams manifest already grants. Group chats and private or shared channels still need an explicit site.
• Pull request #189061 on managed updates after Homebrew Node changes stops managed updates from refusing a compatible Gateway when Homebrew moves the Node path. The PR notes that a refusing 2026.10.7 updater needs a manual npm, pnpm or Bun hop to a release that has the fix.

Skill Card: mcporter Puts MCP Servers Behind One CLI