Changelog — July 22, 2026

Twenty-one commits on main, and two of them are the whole story. Both are dependency remediations that make the image build fail closed rather than ship a known-vulnerable layer.

1. The reviewed OpenClaw distribution moves 2026.6.10 → 2026.7.1 (#7280), with the sandbox Node image bumped to 22.23.1. The build applies integrity-pinned remediations for vulnerable Axios copies in the Slack and Teams archives and the affected OpenTelemetry Jaeger pair in diagnostics; the separately locked [email protected] graph now resolves exact @hono/[email protected] and [email protected] releases.

The interesting part is a pairing-scope regression that the upgrade would otherwise have introduced. OpenClaw 2026.7.1 changed loopback shared-token CLI calls to omit the signed CLI device identity — which meant the paired-device scope comparison never reached the canonical scope-upgrade pairing gate. NemoClaw's compatibility patch now retains the signed CLI identity only after a stored operator device credential exists. The shared token still authenticates the loopback call, the paired-device record stays authoritative for scopes, and an operator.admin request still has to create and receive canonical pairing approval. In other words: the upgrade does not quietly widen what a loopback CLI call can authorize.

The credential contract is unchanged — generated openclaw.json still carries the non-secret apiKey: "unused" sentinel, and COMPATIBLE_API_KEY remains an OpenShell provider-environment placeholder resolved at the OpenShell boundary. No literal provider credential is written into OpenClaw configuration or state. An upgrade-in-place E2E row installs v0.0.89 with OpenClaw 2026.6.10, materializes the legacy per-agent SQLite, Memory Core, and update-check state, then upgrades to 2026.7.1 without being handed the provider credential — proving the post-upgrade turn reuses what OpenShell already holds.

2. node-tar CVE-2026-59873 / GHSA-23hp-3jrh-7fpw is remediated across the completed Node sandbox images targeted for v0.0.91 (#7332). Before this, affected node-tar releases arrived via both NemoClaw's plugin lockfile and npm's private bundles. Now:

• NemoClaw's direct dependency is locked to [email protected], and affected npm-private node-tar trees in the pinned Node 22 and Node 24 image paths are replaced with a registry- and SRI-verified [email protected] archive.
• Both base and final OpenClaw, Hermes, and Deep Agents Code images are patched, so a stale published base cannot reintroduce the package.
• Completed filesystems are scanned across local, global, npm-private, and symlinked installations. Builds fail on invalid metadata, an empty inventory, or any version below 7.5.19 — an empty inventory counting as a failure is the right call, since "found nothing" and "scanned nothing" look identical otherwise.

DGX Station is no longer Deferred. The platform matrix now classifies single-Station configurations as Tested with limitations (#7327) after physical validation on a DGX Station GB300 covering generic Ubuntu 24.04 ARM64, stock DGX OS 7.5.0, the April 2026 NVIDIA Colossus BaseOS profile, and the June 2026 NVIDIA AI Developer Tools profile. Read the caveat carefully: ci_tested is still false, and dual-Station configurations and dedicated CI coverage remain pending. This is the first movement on Station status we've seen — yesterday's entry still recorded it as Deferred.

Hermes operators get a real documentation fix. The API_SERVER_KEY bearer-token lifecycle is now documented (#7212), which matters because the old docs described what gateway-token prints but never when the value changes:

• The token is generated once per sandbox home, is distinct across sandbox homes, and survives a gateway restart, a sandbox stop/start, and a host OpenShell gateway restart.
• It regenerates in exactly two cases: rebuilding or replacing the sandbox, and a startup API_SERVER_KEY that is missing or not exactly 64 lowercase hex characters. An ordinary restart that rotates the token without replacing the sandbox is a bug, and the page now says what evidence to collect.
• Retrieval is gateway-token --quiet with the sandbox running — not reading .hermes/.env. The headless quickstart previously told operators to do the latter, contradicting the supported path; that's fixed, and rebuild now prints a notice that the bearer token changed.

The rest, in brief: the rebuild path got three fixes — waiting for sandbox deletion convergence (#7369), reusing the outer backup during recreate (#7366), and trusting the current DCode base preflight (#7363). The coding-agent starter prompt now names NEMOCLAW_AGENT alongside NEMOCLAW_PROVIDER for non-interactive installs, documents NEMOCLAW_INSTALL_TAG=vX.Y.Z, and — notably — tells a coding agent to use command-scoped approval only for the exact blocked Docker command, explicitly prohibiting Docker socket permission changes and broad host access as sandbox workarounds (#7328). Everything else is CI and E2E repair: WSL suite stabilization, canonical macOS watcher paths, historical gateway-upgrade and image-regression coverage, and two new opt-in container verifiers for the OpenClaw security revision images (#7289, #7294).

Who should care: nobody has to act today — both remediations land inside images NVIDIA builds, and neither changes a config contract. Hermes-on-NemoClaw operators should read the token-lifecycle change, because if you scripted around reading .hermes/.env you were following advice that has now been retracted. If you were waiting on DGX Station, single-Station is finally a supported-with-caveats target; dual-Station still is not.

NemoClaw commits → Affects: /nemoclaw/, /nemoclaw/setup/, /nemoclaw/local-gpu/, /nemoclaw/policy/, /nemoclaw/switching-providers/

A stable release, not a pre-release — which matters, because the 7.4.12–7.4.14 window shipped as pre-releases only. If you're on the stable channel, this is where the 7.4.13 Agent Manager work (per-model reasoning effort in Compare Models, the custom file-extension indexing allowlist, JetBrains compaction settings) actually reaches you.

New in 7.4.15 itself:

• Project memory settings simplified (#12422) — direct editing is replaced with folder inspection, nested memory gets slash-command completion and status views, empty-project handling improves, native tool-call summaries are compacted, and legacy memory audit logs are removed. If you were reading those audit logs for anything, they're gone.
• A reload blocked by a running session now says so (#12454) instead of returning a generic "Reload failed"; other reload failures surface the actual server error message.
• Diff scroll position resets when switching files in the chat and virtual diff viewer (#11928) — previously you'd land mid-file in the next diff.
• Linux sandbox setup survives unreadable subdirectories (#12414) — a writable directory containing a folder with restrictive permissions (mode 600, say) no longer breaks setup. Worth knowing if sandbox setup has been failing for you on a machine with mixed-permission project trees.

Who should care: every stable-channel Kilo Code user — this is the first stable in four patch versions, so it carries more than its own changelog. Anyone whose Linux sandbox setup was failing inexplicably should try this build.

Kilo Code v7.4.15 release notes → Affects: /kilocode/, /kilocode/setup/, /kilocode/orchestrator/, /kilocode/security/

A fix release with one small addition. The three worth upgrading for:

• MCP memory leak fixed. When an MCP tool's output was truncated, the full untruncated result stayed in memory for the rest of the session. If you run MCP servers that return large payloads, this was quietly costing you across a long session.
• Windows auto-update could leave claude.exe missing. Failed updates now restore the preserved executable automatically — a nastier failure mode than it sounds, since the recovery previously meant reinstalling.
• Background session isolation now canonicalizes symlinked working directories. Without that, a session could escape its workspace folder. This is the security-relevant one.

The rest:

• Emoji shortcode autocomplete in the prompt input — type :heart: to insert ❤️, or :hea for suggestions. Disable it with the emojiCompletionEnabled setting.
• Transcripts fail loudly now. You get a warning when transcript writes are failing (disk full, for instance) or when session saving is off because of an inherited environment variable, instead of silently losing transcripts.
• Auto-compact works on Bedrock again for Claude Opus 4.8 — it never triggered, and /compact failed once you were over the limit.
• Corporate network settings apply in Claude Desktop sessions. mTLS, TLS-verify, OAuth scope, and proxy settings were being ignored there.
• Managed OTEL endpoints are actually authoritative. A managed setting for OTEL_EXPORTER_OTLP_ENDPOINT wasn't governing all signals, so a lower-scope signal-specific override could redirect telemetry away from the managed endpoint — a real gap for anyone relying on managed settings for compliance.
• Accessibility: screen reader mode's startup announcement is no longer cut off by the first prompt render, and the thinking status row stops re-rendering every few seconds to update elapsed time and token counts.
• Assorted: --resume/--continue and /resume no longer throw a TypeError on a transcript with a malformed attachment entry; Remote Control viewers who connect after a permission prompt appears now see it; and background shells are no longer sometimes impossible to stop after a session is backgrounded.

Who should care: Windows users and heavy MCP users should upgrade. If you use background sessions as an isolation boundary, treat the symlink-canonicalization fix as the reason to do it now rather than at leisure.

Claude Code v2.1.217 release notes → Affects: /openclaw/, /openclaw/setup/, /openclaw/configuration/, /openclaw/security/, /claude-cowork/, /claude-cowork/setup/