Security

Claude Code v2.1.85 introduces MCP server flexibility with environment variables for multi-server support, conditional hook execution to reduce overhead, and improved OAuth compliance with RFC 9728. The release includes significant bug fixes for context management, plugin handling, terminal compatibility, and streaming performance, plus enhancements to file autocomplete and scroll performance on large transcripts.

OpenClaw v2026.3.24-beta.2 addresses critical fixes for media access policies, Node.js version compatibility, and CLI update workflows. The release aligns outbound media handling with configured filesystem policies, lowers the Node 22 support floor to 22.14+, and adds preflight checks for Node version requirements during updates. Security audit tests are now isolated to prevent interference from local skill installations.

Claude Code v2.1.83 introduces significant improvements to policy management, environment reactivity, security, and user experience. Key additions include a drop-in directory for managed settings, new hook events for environment changes, transcript search functionality, and enhanced subprocess credential scrubbing. The release addresses numerous stability issues, performance regressions, and UI glitches while improving startup latency and memory usage across various platforms.

crewAI v1.11.1 introduces a flow_structure() serializer for Flow class introspection and addresses multiple security vulnerabilities by updating dependencies (pypdf, tinytag, langchain-core). Key fixes include preserving full LLM config during HITL resume for non-OpenAI providers, preventing path traversal in FileWriterTool, and resolving crashes in lock_store when redis is unavailable. The release also includes documentation improvements for custom tools and event listeners, plus refactoring to replace urllib with requests and improve type serialization.

OpenClaw v2026.3.22 is a major release with significant breaking changes focused on modernizing plugin architecture, standardizing tool paths, and improving security. Key updates include migrating from the legacy extension API to a new public plugin SDK, replacing the Chrome extension relay with native session management, standardizing image generation tools, and implementing stricter sandbox security controls. The release also introduces ClawHub integration for package management, new marketplace support, and enhanced plugin discovery mechanisms.

Claude Code v2.1.81 introduces the `--bare` flag for scripted calls, adds `--channels` permission relay for mobile approval forwarding, and fixes critical issues with OAuth re-authentication, voice mode reliability, and WebSocket connection handling. The release also improves MCP tool collapsing, plugin freshness tracking, and Remote Control session management while addressing numerous edge cases and race conditions across authentication, terminal UI, and bash command execution.

langchain-core version 1.2.20 release includes bug fixes, security hardening, and feature enhancements. Key improvements involve tracing invocation parameters in metadata, LangSmith integration metadata for agent creation, anti-SSRF hardening, and dependency updates. The release also includes documentation improvements and CI/CD optimizations.

Claude Code v2.1.78 introduces enhanced plugin state persistence, improved terminal notifications in tmux environments, and streaming response text. The release fixes critical issues including sandbox security vulnerabilities, API error handling loops, permission rule enforcement, and various UI/UX problems across VS Code, terminal modes, and voice functionality.

Claude Code v2.1.77 introduces significant improvements to token limits for Claude Opus and Sonnet models (up to 128k), enhances sandbox filesystem controls with `allowRead` settings, and fixes numerous critical bugs affecting bash commands, memory management, API tracking, and terminal UI interactions. The release also improves performance with faster startup times and session resumption, better plugin validation, and refined agent communication workflows.

OpenClaw v2026.3.8 introduces significant enhancements across CLI backup operations, macOS onboarding with remote gateway tokens, configurable Talk mode silence timeouts, TUI workspace inference, Brave web search LLM context mode, and ACP provenance tracking. The release includes numerous fixes for platform-specific issues including macOS launchd restart recovery, Android permission cleanup, Telegram/Matrix DM routing deduplication, browser CDP normalization, and model compatibility updates for GPT-5.4.

OpenClaw v2026.3.12 introduces major UI/dashboard improvements with modular views, fast-mode toggles for OpenAI and Anthropic models, provider-plugin architecture for Ollama/vLLM/SGLang, Kubernetes deployment support, and subagent session control. The release includes 30+ fixes addressing security vulnerabilities (device pairing, plugin auto-load, Unicode obfuscation), model compatibility issues (Kimi Coding, OpenRouter, Moonshot), chat deduplication across platforms (Slack, Telegram, iMessage, Mattermost), and infrastructure stability (session discovery, plugin caching, Windows updates).

This cookbook demonstrates building an autonomous SRE incident response agent using the Claude Agent SDK with read-write MCP tools for safe infrastructure access. The agent can investigate incidents by querying metrics and logs, diagnose root causes, apply remediations by editing configs and restarting services, and document post-mortems. The pattern uses a subprocess-based MCP server with scoped tool access, clear tool descriptions, and human-in-the-loop workflows to enable autonomous yet controlled incident response.

OpenClaw v2026.3.7 introduces major enhancements to context engine plugins, persistent channel bindings for Discord/Telegram, multi-language UI support (Spanish), improved web search capabilities, and Docker containerization optimizations. The release includes a breaking change requiring explicit gateway auth mode configuration. Key additions enable alternative context management strategies, durable ACP thread routing, per-topic agent overrides, and enhanced security with config validation.

Microsoft AutoGen releases python-v0.7.5 with 18 bug fixes and improvements including support for linear memory in RedisMemory, thinking mode support for Anthropic client, fixes for streaming response handling, GraphFlow cycle detection, and security enhancements with DockerCommandLineCodeExecutor. The release addresses issues with Bedrock streaming, JSON schema conversion, token counting, and MCP session management.

crewAI 1.9.0 introduces structured outputs and response_format support across providers, native multimodal file handling with OpenAI responses API, and Keycloak SSO provider support. The release includes improvements to tool calling, event ordering with parent-child hierarchy, a2a task execution utilities, and various bug fixes for file storage, API handling, and error management.

CrewAI 1.10.0 introduces enhanced MCP tool resolution, improved JSON argument parsing, user input handling in Flows, and migrates the CLI HTTP client from requests to httpx. The release includes 20+ bug fixes addressing tool validation, schema handling, callback execution, and race conditions, plus documentation updates for security guidance and 96 new integration actions.

crewAI 1.10.1 release includes upgraded Gemini GenAI support, multiple bug fixes addressing executor recursion, parallel function handling, MCP tool loading, and Jupyter compatibility. Security improvements include upgrading pypdf to 6.7.4 and resolving critical Dependabot alerts.

langchain-text-splitters version 1.1.1 was released with bug fixes including prevention of JSFrameworkTextSplitter mutating internal separators, resolution of a Server-Side Request Forgery vulnerability in HTMLHeaderTextSplitter, and fixes to HTMLSemanticPreservingSplitter. The release also includes dependency updates, code style improvements with ruff linting, and new features like model_kwargs support for SentenceTransformersTokenTextSplitter.

langchain-core version 1.2.14 was released with bug fixes for merge_lists with parallel tool calls, temperature parameter handling in LangSmith tracing, recursion errors in args_schema, and index/timestamp preservation during merging. The release also includes documentation updates for security best practices, removal of langserve from sys info utilities, and dependency bumps.

LangChain Classic version 1.0.2 was released with a critical security patch fixing a ReDoS vulnerability in MRKL and ReAct action regex (CVE-2024-58340). The release includes multiple dependency updates, bug fixes for ensemble retriever weights validation and configuration handling, documentation improvements, and various code quality enhancements including ruff upgrades and mypy fixes.