| 20790 |
fix: Math.max/min with spread operator can cause stack overflow on large
|
coygeek
|
Timeouts and Memory Ma...
|
2026-02-19 |
| 20770 |
fix: prevent stale session-entry overwrite during reset-model persistence
|
coygeek
|
Session Management Imp...
|
2026-02-19 |
| 19011 |
fix(discord): enforce owner checks for privileged message actions
|
coygeek
|
Signal and Discord Fixes
|
2026-02-17 |
| 18952 |
fix: sanitize schtasks env vars to prevent CRLF command injection
|
coygeek
|
Cross-Platform Fixes
|
2026-02-17 |
| 18852 |
fix: Voice-call state persistence is fire-and-forget, causing silent rec
|
coygeek
|
Voice Call Enhancement...
|
2026-02-17 |
| 18777 |
fix: LINE webhook acknowledges events before processing and drops failur
|
coygeek
|
Webhook Security Enhan...
|
2026-02-17 |
| 16877 |
fix: Authentication Rate Limiting is Opt-In Only - Disabled by Default
|
coygeek
|
Authentication and Rat...
|
2026-02-15 |
| 16060 |
fix(browser): require relay auth token for /extension WebSocket and /extensio...
|
coygeek
|
Chrome Extension Enhan...
|
2026-02-14 |
| 15985 |
fix(telegram): defer buffer deletion until processing succeeds
|
coygeek
|
Network Error Handling...
|
2026-02-14 |
| 15951 |
fix: Android production build permits cleartext traffic globally
|
coygeek
|
Android Ed25519 Enhanc...
|
2026-02-14 |
| 15907 |
fix(discovery): propagate TLS fingerprint through gateway discovery chain
|
coygeek
|
Gateway and TLS Enhanc...
|
2026-02-14 |
| 13090 |
fix: Device-pair extension leaks gateway credentials in chat messages
|
coygeek
|
Device Pairing and Gat...
|
2026-02-10 |
| 12174 |
fix(agents): add path containment check in apply_patch for non-sandboxed mode
|
coygeek
|
Sandbox Path Managemen...
|
2026-02-08 |
| 11812 |
fix: MSTeams attachment fetch follows redirects before allowlist checks
|
coygeek
|
MSTeams SSRF Protectio...
|
2026-02-08 |
| 11804 |
fix(webhook): return 503 from health endpoints when last processing failed
|
coygeek
|
Session Management and...
|
2026-02-08 |
| 11794 |
fix(gateway): validate session key ownership against authenticated identity
|
coygeek
|
OpenClaw Plugin Enhanc...
|
2026-02-08 |
| 11778 |
fix(plugins): enforce monotonic hook deny merges
|
coygeek
|
Plugin Hook Enhancements
|
2026-02-08 |
| 11765 |
fix(ci): restrict GITHUB_TOKEN permissions in workflows
|
coygeek
|
GitHub Actions CI Impr...
|
2026-02-08 |
| 11740 |
fix(gateway): remove IP-based canvas auth fallback
|
coygeek
|
Security Enhancements ...
|
2026-02-08 |
| 11439 |
fix(security): warn on relative OPENCLAW_CONFIG_PATH and disable config-origi...
|
coygeek
|
OpenClaw Plugin Enhanc...
|
2026-02-07 |
| 11435 |
fix(security): validate OPENCLAW_BROWSER_CONTROL_MODULE before dynamic import
|
coygeek
|
Security Enhancements ...
|
2026-02-07 |
| 11432 |
fix(security): add --ignore-scripts to npm install in hook and plugin installers
|
coygeek
|
Plugin Management Enha...
|
2026-02-07 |
| 11032 |
fix(security): block plugin install/load on critical source scan findings
|
coygeek
|
Security Enhancements ...
|
2026-02-07 |
| 11026 |
fix(auto-reply): remove ctx.To from elevated authorization token set
|
coygeek
|
WhatsApp Group Managem...
|
2026-02-07 |
| 10296 |
fix(ui): store Ed25519 private key as non-extractable CryptoKey in IndexedDB
|
coygeek
|
Android Ed25519 Enhanc...
|
2026-02-06 |
| 10231 |
fix(voice-call): escape locale/language params in TwiML to prevent XML injection
|
coygeek
|
TwiML Security and Fixes
|
2026-02-06 |
| 10174 |
fix(docker): exclude .env files from Docker build context
|
coygeek
|
Environment Variable S...
|
2026-02-06 |
| 9480 |
fix: Docker build runs unverified remote Bun installer
|
coygeek
|
Docker Enhancements an...
|
2026-02-05 |
| 9476 |
fix: GitHub tarball dependency lacks integrity verification in pnpm-lock
|
coygeek
|
OpenClaw Plugin Enhanc...
|
2026-02-05 |
| 9474 |
fix: GitHub Actions not pinned to SHA digests in CI/CD workflows
|
coygeek
|
GitHub Actions CI Impr...
|
2026-02-05 |