Skip to content

Flag 2026.10.10 changes and add missing advisories and ClawHub policy (Oct 2026 research) - #150

Merged
melvincarvalho merged 8 commits into
gh-pagesfrom
upd/latest-release
Oct 18, 2026
Merged

melvincarvalho merged 8 commits into
gh-pagesfrom
upd/latest-release

Conversation

@melvincarvalho

Copy link
Copy Markdown
Contributor

From the research report "OpenClaw latest October 2026" (rows 1–9). The site stays pinned to 2026.10.4, which is still npm latest. Changes in the next release get a short Changing in 2026.10.10 (beta) callout. Each one was checked against the v2026.10.10-beta.1 tag and the 2026.10.4 shipped docs.

# Pages Change
1 skill-workshop, skill-development, configuration, cli propose is still documented for 10.4. Every mention now warns that 10.10 retires proposals and that doctor --fix rewrites propose to off, silently turning learning off.
2 hardening, overview, privacy-compliance 10.4 masks secrets in tool payloads before they reach the model. 10.10 drops that masking in the model context, transcripts and UI (logs and exports stay masked). Protect transcripts accordingly.
3 known-vulnerabilities New "Other OpenClaw components" section: 8 Windows Node advisories (2026-09-03), 5 ClawHub advisories (2026-09-11), ClawScan before 0.1.7, pinclaw, two VulnCheck CVEs with no GHSA (fixed in 2026.9.4/9.5), and CVE-2026-94094 labelled unconfirmed. All 13 GHSAs and 10 CVEs resolve.
4 skill-verification, clawhub Since 2026-10-13 every ClawHub release is pending until its TruffleHog and ClawScan checks pass (clawhub #3947). Also fixed: a stale "reports auto-hide a skill after three" in clawhub.md; reports never auto-hide.
5 installation, deployment-options Pre-announces the macOS/iOS/Safari 26.2 minimum (10.4 needs macOS 15.0+)
6 channels X channel note (in 10.10-beta.1, not in 10.4)
7 plugin-system, channels, cli, upgrading-to-2 Keeps the explicit clawhub:/npm: prefix advice. The ClawHub-default change (#173669) is on main only.
8 faq, upgrading-to-2, plugin-system Beta channel at 2026.10.10-beta.1, extended-stable at 2026.9.33, version numbers not in date order; the plugin SDK's sync-SQLite compatibility ends 2026-12-31
9 faq Donor list cites both the README and openclaw.org/donors

Also: cli.md notes that fleet is removed in 10.10 (confirmed against the beta.1 command index).

The snippet gates report 0 failures. The build passes.

@melvincarvalho
melvincarvalho merged commit 396de96 into gh-pages Oct 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant