The approved-exec fix finally shipped, and the long-term line moved to a build without it
Merge ab5611f0 (binding exec approvals to the bytes that run), unreleased at the last two issues, is an ancestor of stable v2026.8.1 (2026-08-31) and of every later main-line tag; npm latest and beta are 2026.9.5. The npm extended-stable tag moved to 2026.7.35 on 2026-09-21, a July line that diverges from ab5611f0 and lacks the workspace-boundary and sandbox-stop fixes too. On 2026-09-11 the project published 75 advisories, 30 high, the exec-approval group patched in 2026.8.1.
What this changes for operators
- Run 2026.8.1 or later on the latest channel if you rely on the exec approval prompt. Do not read extended-stable as the safer choice; it is the unfixed one.
- Allow Always saved path-only grants before 2026.8.1 (GHSA-74gc); review persisted grants after upgrading.
- Evidence that would settle residual: an extended-stable build containing ab5611f0.
Primary sources
- github_release 2026-09-21-openclaw-the-approved-exec-fix-is-now-in-stable-but-not-on-extended-stable openclaw/openclaw / v2026.8.1
- commit 2026-09-21-openclaw-the-approved-exec-fix-is-now-in-stable-but-not-on-extended-stable github.com/openclaw/openclaw/commit/ab5611f0be610380fe48803fe4311896ca85806e
- tagged_commit_file 2026-09-21-openclaw-the-approved-exec-fix-is-now-in-stable-but-not-on-extended-stable openclaw/openclaw / src/infra/system-run-mutable-file-operand.ts
- github_release 2026-09-21-openclaw-extended-stable-moved-to-a-july-line-that-predates-every-fix-above openclaw/openclaw / v2026.7.35
- tagged_commit_file 2026-09-21-openclaw-extended-stable-moved-to-a-july-line-that-predates-every-fix-above openclaw/openclaw / docs/install/development-channels.md
- official_docs 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8 github.com/openclaw/openclaw/security/advisories/GHSA-74gc-hg2m-79p9
- official_docs 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8 github.com/openclaw/openclaw/security/advisories/GHSA-ghpx-6xwq-2w4w
- official_docs 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8 github.com/openclaw/openclaw/security/advisories/GHSA-3mq7-q27j-mq7q
- official_docs 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8 github.com/openclaw/openclaw/security/advisories/GHSA-wwcw-jfpp-gpxw
- official_docs 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8 github.com/openclaw/openclaw/security/advisories/GHSA-rrxp-5mx8-mvhh
Signal metadata
Source findings
- 2026-09-21-openclaw-the-approved-exec-fix-is-now-in-stable-but-not-on-extended-stable 2026-09-21-openclaw-the-approved-exec-fix-is-now-in-stable-but-not-on-extended-stable
- 2026-09-21-openclaw-extended-stable-moved-to-a-july-line-that-predates-every-fix-above 2026-09-21-openclaw-extended-stable-moved-to-a-july-line-that-predates-every-fix-above
- 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8 2026-09-21-openclaw-75-advisories-published-in-one-batch-the-exec-approval-family-is-patched-in-2026-8
Featured in
- Before the First Turn / 2026-09-21
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Schema: bitter.frontier_signals.v0 / ID: 2026-09-21-openclaw-exec-fix-shipped-extended-stable-did-not
Research evidence and publication history are open in the repository.