[Release] openclaw/openclaw v2026.6.34: openclaw 2026.6.34

OpenClaw v2026.6.34 is an extended-stable maintenance release focused on security hardening and reliability improvements without new features. Key enhancements include safer browser and network boundaries with sandboxed routes, more resilient agent and provider runs with improved session handling, stronger channel recovery mechanisms, safer operator diagnostics with credential protection, and more robust local runtime state management. The release includes 25 merged PRs addressing execution safety, delivery stability, and gateway reliability, with upcoming deprecations for Plugin SDK migration scheduled after July 24.

Key Points

• •Implement sandboxed browser routes and trusted DNS targets to reject unsafe access paths and improve network boundary security
• •Enable retained session writes and provider fallbacks to recover from stream progress handling and stdio failures without silently ending active work
• •Resume pending channel work after recovery with idempotent acknowledgements and bounded Discord gateway burst handling
• •Protect owner-only operator actions and prevent credentials from appearing in account URLs or diagnostic summaries
• •Harden SQLite checkpoints, workspace reads, gateway process signalling, and plugin HTTP responses to tolerate transient host conditions
• •Update production dependencies including brace-expansion, PostCSS, fast-uri, ip-address, and Undici for security patches
• •Migrate Plugin SDK usage from deprecated hooks (before_agent_start) and root imports to modern hook stages and focused SDK subpath imports before July 24
• •Use documented 'hy3' model identifier instead of failing 'hy3-preview' alias for OpenCode Go
• •Retain parent app-server subscription in Codex native subagents and recognize multi-agent V2 child activity until completion
• •Verify release integrity using npm signatures, SLSA provenance attestation, and container manifest digests across amd64 and arm64 platforms

Workflow Diagram

Concepts

Artifacts (3)

Package: openclaw@2026.6.34
Registry: https://www.npmjs.com/package/openclaw/v/2026.6.34
Tarball: openclaw-2026.6.34.tgz
SHA512: sha512-Rm4khBrWn9HYqE99NBryCFgjwlsIuwBqK5jIANn2773CGXJ1JIZkDn5twEHB+8SVFdh0FPNPHRVgZepzNJDfHg==
Signatures: Published with SLSA provenance attestation
Registry URL: https://registry.npmjs.org/-/npm/v1/attestations/openclaw@2026.6.34

Container Images: GHCR and Docker Hub
Tags: 2026.6.34, 2026.6.34-slim, 2026.6.34-browser
Architectures: amd64, arm64
Default/Slim Digest: sha256:47d342bafe83bd3b2dca6f1d8d8b608ba7b542a1952564960648943346206759
Browser Digest: sha256:55203a7abced818c0378aac0a128a2fceee5448c08f36be7e0058762a3b3ff41
Aliases: extended-stable, extended-stable-slim, extended-stable-browser
GHCR: https://github.com/openclaw/openclaw/pkgs/container/openclaw
Docker Hub: https://hub.docker.com/r/openclaw/openclaw/tags?name=2026.6.34

DEPRECATION SCHEDULE: After July 24, 2026

DEPRECATED:
- before_agent_start hook
- Root openclaw/plugin-sdk imports
- providerAuthEnvVars
- channelEnvVars

MIGRATE TO:
- Modern hook stages
- Focused SDK subpath imports
- Manifest setup descriptors

REFERENCES:
- Plugin SDK migration: /plugins/sdk-migration
- Plugin manifests: /plugins/manifest