OpenClaw v2026.5.12: Slim Installs, Telegram Resilience & 89% Memory Win
OpenClaw v2026.5.12 is the most impactful maintenance release in months — 150+ targeted fixes, externalized channel dependencies that cut install weight, a transcript streaming memory reduction from 252 MB to 27 MB peak, and a broad security hardening pass covering the gateway, browser sandbox, Slack, and node-pairing paths. No breaking changes. No migration required.
One-line install or upgrade:
curl -fsSL https://raw.githubusercontent.com/iPythoning/b2b-sdr-agent-template/main/install.sh | bash
What Changed in v2026.5.12
Four headlines define this release: leaner installs via externalized channel deps, Telegram channel resilience through isolated polling and durable local spooling, transcript streaming memory cut 89%, and a security hardening pass across five subsystems.
Leaner Installations: Externalized Channel Dependencies
The single biggest architectural change in v2026.5.12 is dependency externalization. Previously, every OpenClaw core install pulled in the full dependency trees for WhatsApp (Baileys), Slack, Amazon Bedrock, and Anthropic Vertex — even if you never used those channels.
Starting with v2026.5.12:
- WhatsApp (Baileys), Slack, Amazon Bedrock, Anthropic Vertex, and related providers are loaded on-demand
- A fresh core install is significantly lighter — only your active channels bring in their dependencies
- pnpm upgraded to v11 with improved plugin install stability and better peer-dependency preservation during updates
For B2B SDR deployments on constrained VPS instances or Docker containers, this directly reduces cold-start time and disk usage. The pnpm 11 upgrade also fixes a class of intermittent plugin install failures that could leave channels in a half-initialized state.
Telegram: Isolated Polling + Durable Local Spooling
Telegram is the highest-traffic channel for most B2B SDR deployments in Asia and emerging markets. v2026.5.12 ships the most significant Telegram reliability work in months.
Isolated Polling with Durable Local Spooling
Telegram's getUpdates long-poll loop now runs in an isolated worker with its own retry envelope and a durable local message spool. Before this change, a network interruption during polling could silently drop inbound messages if the reconnect window was short. The local spool buffers inbound messages on disk during reconnect, draining them in order once the session recovers.
For SDR agents handling high-volume Telegram inbound — qualification pings, opt-in commands, callback requests — this means zero message loss during the network events that are common on cloud VPS instances.
Safer Group Media Handling
Group media events (photo, video, document sent to a group where your agent is a member) now validate message ownership and attachment type before dispatching to skills. This prevents a class of errors where unrecognized media types in a noisy group chat could cause skill dispatch failures that silently stopped the agent from processing subsequent messages.
HTML/Markdown Formatting Preserved in Streamed Replies
Streamed Telegram replies with mixed HTML and Markdown now preserve formatting throughout the stream, not just in the final chunk. For agents that stream qualification scripts, deal summaries, or product comparisons, this eliminates the garbled-formatting issue in mid-stream chunks.
Bot Token Rotation & Message Sequencing
Bot token rotation (used for multi-account SDR deployments) now reseeds the polling state correctly, and message sequencing during high-load bursts is fixed to prevent out-of-order delivery to skills.
Transcript Streaming: 89% Memory Reduction
The single most impactful performance fix in v2026.5.12 is transcript streaming optimization. Before: peak memory overhead for long sessions was +252 MB. After: +27 MB — an 89% reduction.
This matters for multi-agent deployments where dozens of SDR agents share a single OpenClaw runtime. At the old 252 MB baseline, a runtime with 20 concurrent long-session agents could consume 5+ GB of extra memory just from transcript overhead. At 27 MB, the same 20 agents add under 600 MB.
| Metric | Before v2026.5.12 | After v2026.5.12 | Change |
|---|---|---|---|
| Peak transcript stream memory | +252 MB | +27 MB | −89% |
| 20-agent runtime overhead | ~5.0 GB | ~540 MB | −4.5 GB |
Security Hardening Pass
v2026.5.12 includes a broad, coordinated security hardening pass across five subsystems.
Gateway & Browser Sandbox
The gateway sandbox path now validates command provenance before execution — commands arriving from untrusted sources that bypass the normal skill dispatch pipeline are rejected at the gateway boundary rather than passed through. Browser sandbox isolation is tightened.
Node Pairing & Device Approval
Device pairing requests now require explicit approval at the node level before the pairing can complete. Proxy-scoped access is validated against the trusted-proxy allowlist at binding time, not just at request time.
Slack & Environment Variable Handling
Provider credential environment variables (API keys, tokens, secrets) are now read and validated at channel boot time with stricter type checking. Slack's credential path no longer accepts partial or malformed env var values that previously resolved to empty-string credentials.
Codex/OpenAI: Auth-Profile-Backed Media Tools
Media tools (file analysis, image input, document processing) in the Codex/OpenAI integration now resolve credentials from the active auth profile rather than from a global credential store. This fixes silent failures when media tools were invoked under a non-default auth profile. Context-engine thread rotation and app-server/runtime fallback behavior are also improved, with better integration with MCP server projection for tool routing.
UI: Auto-Scroll Mode Selector
The Control UI and WebChat now include an auto-scroll mode selector — a toggle that controls whether the chat view auto-scrolls to the latest message during active streaming. This is a quality-of-life improvement for operators reviewing long agent sessions in the Control UI while new messages arrive. Session history sequence is also preserved correctly through live updates.
Windows & Docker Reliability
v2026.5.12 ships focused fixes for Windows credential handling (credential paths with spaces and non-ASCII characters now resolve correctly) and Docker environment isolation (env var leakage between containers in multi-agent Docker Compose setups is patched).
What's Not Changed
v2026.5.12 is a pure maintenance and hardening release. All existing configuration files, skill definitions, agent YAML, and channel credentials work without modification. Upgrade is safe for all production deployments.
Full Fixes at a Glance
| Subsystem | Fix |
|---|---|
| Deps/Install | WhatsApp, Slack, Bedrock, Vertex externalized; pnpm 11 |
| Telegram | Isolated polling + durable local spooling |
| Telegram | Safer group media handling |
| Telegram | HTML/Markdown format preserved in streamed replies |
| Telegram | Bot token rotation + message sequencing |
| Transcript | Peak memory +252 MB → +27 MB (−89%) |
| Security | Command provenance validation at gateway |
| Security | Node pairing explicit approval required |
| Security | Stricter env var validation for provider creds |
| Codex/OpenAI | Auth-profile-backed media tools |
| Codex/OpenAI | Context-engine thread rotation + MCP projection |
| UI | Auto-scroll mode selector (Control UI + WebChat) |
| UI | Session history sequence through live updates |
| Windows | Credential path handling (spaces, non-ASCII) |
| Docker | Env var isolation between containers |
| iMessage | Multiple reliability fixes |
FAQ
Is v2026.5.12 safe to upgrade to in production? Yes. No breaking changes, no config migration. Upgrade via the one-liner.
Do I need to reinstall my channels after the dependency externalization?
No. Existing channels continue to work. On the next openclaw update, the externalized deps are resolved automatically.
Will the transcript memory fix apply to existing long-running sessions? Yes. The fix is in the streaming layer and applies to all new transcript streams, including sessions already running before the upgrade.
What does "isolated polling" mean for Telegram uptime? Messages are now spooled locally during network interruptions and replayed in order on reconnect. For SDR agents, this means zero missed inbound messages during the network events common in cloud environments.
Does the security hardening change any user-facing behavior? Minimal. Device pairing now shows a confirmation step. Credential errors now fail loudly at boot instead of silently at first use.
Run Your B2B SDR Agent on PulseAgent
PulseAgent manages OpenClaw-powered SDR agents so you don't have to maintain servers, handle upgrades, or debug infrastructure. WhatsApp, Telegram, WeChat, LINE, email, and voice — all in one managed platform. Always on the latest stable OpenClaw release.
- Get started: pulseagent.io/app
- Pricing: pulseagent.io/pricing
- Self-host:
curl -fsSL https://raw.githubusercontent.com/iPythoning/b2b-sdr-agent-template/main/install.sh | bash
Explore use cases:
