$git log --oneline
2026.2.25PATCHβ BREAKINGπ‘ SECURITYReleased: 2026-02-25
π¨ URGENT: This release includes high-severity security patches. All users should upgrade immediately.
Critical Security Patch + Android Startup Improvements
/** High-severity security patch addressing multiple CVE-level vulnerabilities. Android gets major startup performance improvements. */
security_fixes.md
π Security Fixes (High Severity)
π‘Gateway WebSocket auth: enforced origin checks for browser WebSocket clients beyond Control UI/Webchat
π‘Gateway trusted proxy: required operator role for Control UI trusted-proxy pairing bypass
π‘macOS beta onboarding: removed Anthropic OAuth path that exposed PKCE verifier via OAuth state
π‘Microsoft Teams file consent: bound fileConsent/invoke upload acceptance to originating conversation
π‘Workspace FS: rejected hardlinked aliases in workspaceOnly and applyPatch boundary checks
π‘Node exec approvals: hardened system.run exec against symlink cwd paths and canonicalized path-like argv
π‘Signal: enforced DM/group authorization before reaction-only notification enqueue
π‘Discord reactions: enforced DM policy/allowlist authorization before reaction-event system enqueue
π‘Slack reactions + pins: gated reaction_* and pin_* system-event enqueue through shared sender authorization
breaking_changes.md
β Breaking Changes
β Heartbeat direct/DM delivery default is now 'allow' again. Set agents.defaults.heartbeat.directPolicy: 'block' to restore blocked behavior.
new_features.md
β¨ What's New
Android Streaming Improvements
Improved streaming delivery handling and markdown rendering quality in the native Android chat UI, including better GitHub-flavored markdown behavior.
Android Startup Performance
Deferred foreground-service startup, moved WebView debugging init out of critical startup path, added startup macrobenchmark and low-noise perf CLI scripts for deterministic cold-start tracking.
Mobile Compose Layout
Added mobile stacked layout for compose action buttons on small screens to improve send/session controls usability on phones.
upgrade.sh
π¦ Upgrade to 2026.2.25
$ npm install -g openclaw@2026.2.25