From f6d98a908af82437e823c15cc20d4feafbd005da Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Mon, 2 Feb 2026 02:06:49 -0800 Subject: [PATCH] docs: add changelog entry for plugin install hardening --- CHANGELOG.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b9bbe74f1..cb77e3624 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,16 @@ Docs: https://docs.openclaw.ai +## 2026.2.2 + +### Fixes + +- Plugins: validate plugin/hook install paths and reject traversal-like names. +- Telegram: add download timeouts for file fetches. (#6914) Thanks @hclsys. +- Telegram: enforce thread specs for DM vs forum sends. (#6833) Thanks @obviyus. +- Streaming: avoid stuck typing indicator after streamed BlueBubbles replies. +- Streaming: dedupe fence-split handling and cover maxChars fallback for newline chunking. + ## 2026.2.1 ### Changes @@ -16,10 +26,6 @@ Docs: https://docs.openclaw.ai ### Fixes -- Telegram: add download timeouts for file fetches. (#6914) Thanks @hclsys. -- Telegram: enforce thread specs for DM vs forum sends. (#6833) Thanks @obviyus. -- Streaming: avoid stuck typing indicator after streamed BlueBubbles replies. -- Streaming: dedupe fence-split handling and cover maxChars fallback for newline chunking. - Auto-reply: avoid referencing workspace files in /new greeting prompt. (#5706) Thanks @bravostation. - Tools: treat `"*"` tool allowlist entries as valid to avoid spurious unknown-entry warnings. - Slack: harden media fetch limits and Slack file URL validation. (#6639) Thanks @davidiach.