What changed
OpenClaw's signed 2026.10.9 release patches runtime dependencies used in MCP, A2UI, Discord, mail and Microsoft authentication, applies workspace-only filesystem policy to Gateway-built tools, masks live credentials in MCP inspection and logs, and repairs Git, npm, database and full-disk recovery paths.
Why it matters
The release couples concrete security boundary fixes with data-preserving recovery. Operators can reduce credential and workspace exposure, but only if they upgrade the exact runtime, restart affected services and verify that rollback keeps both state and local edits intact.
What to do
Verify the signed tag and package, back up state, upgrade a disposable Gateway, then replay a Gateway-built tool outside the workspace, MCP inspection, a spoofed mail sender, a failed Git and npm rollback, a stale full-text index and a full-disk recovery. Inspect secrets, edits, database integrity and restart behavior before production rollout.
Caveat
This is a date-correct 29 October catch-up. Vendor release notes and signed artifacts establish the shipped changes, not whether an older deployment was exposed or is now clean; credentials, logs, local edits and recovered databases still require local inspection.