How to Update OpenClaw Without Breaking It (and Why to Get Past 2026.8.1)

Published 2026-10-19 · Updated 2026-10-18 · By The Is My Agent Safe team

Which version am I on?

Run this on the machine where your Gateway runs:

openclaw --version

OpenClaw versions are dates, such as 2026.10.4. Two things trip people up:

• A number like 2026.8.11 belongs to the OpenClaw iOS app. It isn't a Gateway or CLI release.
• Channel plugins (the @openclaw/* packages) have their own versions. openclaw --version doesn't show them.

Also check how you installed OpenClaw. A global npm, pnpm or bun install updates with openclaw update. A Docker install doesn't (see below).

Why is 2026.8.1 the version to get past?

OpenClaw 2026.8.1 came out on August 31, 2026. Per OpenClaw's security advisories, it fixed 17 issues rated high. If you're on anything older, you're missing all of them.

One of them is CVE-2026-100552 (rated high), fixed in 2026.8.1. In plain English: if you send some chats to the Codex runtime and limit their tools with a per-chat allowlist (tools.allow), that limit didn't apply to Codex's own shell, process, file and patch tools. So a chat you'd restricted could still run commands.

"Rated high" is the advisory's own severity. We don't quote a numeric score for it. If you don't route chats to a Codex runtime, this particular CVE doesn't affect you, but the other fixes in that release still might.

If you can't update yet, the advisory's interim advice is to route restricted chats to a runtime without native host tools, or disable those tools at the agent boundary. Then update.

2026.8.1 isn't the end of the line. Later releases fixed more advisories, so aim for the current release, not just 2026.8.1.

How do I update without breaking things?

1. Read the release notes between your version and the target. Look for lines marked breaking.
2. Make a backup with openclaw backup create.
3. Preview the update with openclaw update --dry-run. It shows the target without changing anything.
4. Run openclaw update. It stages the new version, runs OpenClaw's own checks and restarts the Gateway.
5. Check the result with openclaw update status and openclaw gateway status --deep.
6. Re-run openclaw security audit --deep to see whether any findings changed.

The commands, in order:

openclaw backup create
openclaw update --dry-run
openclaw update
openclaw update status
openclaw gateway status --deep
openclaw security audit --deep

Prefer slower, longer-supported releases? OpenClaw has an extended-stable channel: openclaw update --channel extended-stable. The beta and dev channels are for testing, not for an agent you rely on.

What breaks when I go to 2026.8.1?

The 2026.8.1 release notes list two breaking changes:

• OpenProse removed. The bundled OpenProse plugin and the /prose command are gone. Your .prose files stay.
• OpenAI route migration. Model refs and routes named codex/* or openai-codex/* move to openai/*.

For both, the release notes say to run:

openclaw doctor --fix

Doctor flags anything it can't migrate for you to fix by hand. Then restart the Gateway with openclaw gateway restart.

If you're jumping several releases at once, check each release's breaking changes, not only the last one. We can list breaking changes from release notes, but we can't tell what will break in your particular setup.

What if I run OpenClaw in Docker?

openclaw update doesn't replace a container image. OpenClaw's docs say to pull or build the new image and recreate the container with the same state and config mounts. Back up first, and keep the old image tag until the new one is working.

What if the update fails?

The updater prints the outcome and the path to a local report, even when it fails. If the new version fails its checks, it can roll back to the previous one and keep the report.

• Run openclaw update status to see what happened.
• Run openclaw gateway status --deep to see whether the Gateway is serving.
• Follow the recovery steps the updater prints. Don't keep restarting a Gateway the report says is still starting.

For a global npm install, OpenClaw's docs give a manual path: install the target version, then repair and restart.

npm i -g openclaw@<target> --allow-scripts=openclaw
openclaw doctor --fix
openclaw gateway restart

Replace <target> with the release you want, such as 2026.10.4.

Where next?

• The OpenClaw security checklist: updating is item one, and there are more.
• What every audit finding means: read the audit you just re-ran.
• Is this audit finding real?: if a warning looks wrong after the update.

Frequently asked questions

Sources

1. OpenClaw docs: openclaw update (CLI)
2. OpenClaw docs: updating
3. OpenClaw docs: openclaw backup (CLI)
4. OpenClaw docs: openclaw doctor (CLI)
5. OpenClaw docs: openclaw security (CLI)
6. OpenClaw release v2026.8.1 (Aug 31, 2026)
7. GitHub advisory GHSA-wwcw-jfpp-gpxw (CVE-2026-100552)
8. OpenClaw GitHub security advisories