OpenClaw 2026.5.12 trims dependencies and hardens security

OpenClaw’s 2026.5.12 release makes a broad set of packaging, runtime, and security changes across the platform. The update reduces what core installs pull in, adds fallback behavior for some control-plane turns, and fixes a range of bugs in messaging, sessions, auth, and the web interface.

On the packaging side, OpenClaw said it externalized the Amazon Bedrock and Bedrock Mantle provider packages so core installs no longer bring in AWS SDK dependencies unless those providers are installed. It made a similar change for Slack, OpenShell sandbox, and Anthropic Vertex plugins, so their runtime dependency chains only install when those plugins are present.

The company also changed plugin and provider discovery behavior. According to the release notes, OpenClaw now discovers provider plugins from setup.providers[].envVars credentials during provider discovery, while keeping the older providerAuthEnvVars fallback. It also added support for preserving third-party peer dependencies in the managed npm root when later plugin installs or updates recalculate the shared dependency tree.

Several changes focus on ACP, or the Agent Control Plane, which is the layer that manages agent turns and runtime backends. OpenClaw added acp.fallbacks so ACP turns can try configured backup runtime backends when the primary backend is unavailable before any output is emitted.

The release also changes how sessions and message delivery work. OpenClaw said it now carries monotonic transcript message sequence data through live updates and refreshes SSE history when stale sequence input would otherwise append bad incremental state. It also classifies ACP spawn-child sessions as kind: "spawn-child" instead of "direct" in sessions and status output, and reports agentRuntime.id: "acpx" for ACP control-plane rows where appropriate.

Messaging fixes are a major part of the update. OpenClaw said it preserved source-reply delivery metadata when merging tool-returned media into final replies, which keeps message-tool-only replies deliverable and mirrored. It also changed WebChat and TUI routing so Codex tools.message source replies go to the active internal UI turn and session history instead of disappearing.

The Telegram channel got multiple fixes. OpenClaw said Bot API polling now stays alive during main event-loop stalls by moving ingress to an isolated worker with a durable local spool. It also preserves rendered HTML formatting through lazy cron announce delivery, skips unmentioned group media when requireMention is enabled, and deletes tool-progress-only draft bubbles before rotating to the final answer.

Security and auth received updates as well. OpenClaw added Windows USERPROFILE to sandbox blocked home roots so credential-bearing binds under the Windows user profile are denied even if HOME points somewhere else. It also stopped inferring provider env-var markers from broad uppercase strings and now resolves config-backed provider apiKey values only through structured env SecretRefs.

The release includes changes for the CLI, onboarding, update flow, and browser controls. OpenClaw now forwards provider-specific auth flags through the onboarding wizard, preserves bare plugin and parent-command help on the lightweight path, and requires explicit browser device pairing and Control UI pairing in several cases. It also fixed update behavior so snapshot config is preserved before repair and restart writes, and added support for honoring --no-git-update for existing git checkouts before resolving release refs.

Other fixes touch media handling, plugin install and uninstall behavior, Slack file redirects, Windows environment variables, macOS gateway trust, and Codex harness behavior. OpenClaw said the update also includes diagnostics changes, better error classification for auth refresh issues, and several package/version bumps across channels such as Weixin, WeCom, WhatsApp, and Telegram.