Guide

OpenClaw v2026.4.5: ComfyUI, upgrade notes

April 6, 20264 min readUpdated September 11, 2026By OpenClawBlog Team

v2026.4.5 arrived on 2026-04-06 with a change that matters during maintenance: comfyui. The page is a researched reading note from the official release record, with a test path for a real Gateway.

The tag is stable, but the direct notes still define its migrations, corrections, and package-specific limits. Support still depends on the provider, channel, platform, and account behind the installation, so check those boundaries before extrapolating from the tag.

Channel
Stable

Primary signals
Agents/video generation; Agents/music generation; Providers/ComfyUI

Publication date
2026-04-06

Before the package changes

Agents/video generation

Evidence from the release. add the built-in video_generate tool so agents can create videos through configured providers and return the generated media directly in the reply.

Operator reading. Agents/video generation changes a capability choice, not automatically a billing or privacy agreement. Record provider, model id, context setting, and fallback behavior before changing a default.

Agents/music generation

Evidence from the release. ignore unsupported optional hints such as durationSeconds with a warning instead of hard-failing requests on providers like Google Lyria.

Operator reading. Check Agents/music generation with a known prompt and a disposable account. Save the selected route, reasoning setting, latency, and refusal or fallback result so another operator can reproduce it.

Providers/ComfyUI

Evidence from the release. add a bundled comfy workflow media plugin for local ComfyUI and Comfy Cloud workflows, including shared image_generate, video_generate, and workflow-backed music_generate support, with prompt injection, optional reference-image upload, live tests, and output download.

Operator reading. Providers/ComfyUI changes a capability choice, not automatically a billing or privacy agreement. Record provider, model id, context setting, and fallback behavior before changing a default.

Security

Evidence from the release. preserve restrictive plugin-only tool allowlists, require owner access for /allowlist add and /allowlist remove, fail closed when before_tool_call hooks crash, block browser SSRF redirect bypasses earlier, and keep non-interactive auth-choice inference scoped to bundled and already-trusted plugins.

Operator reading. Before widening access for Security, replay a narrow allow and deny case. A readable denial and a revoked test credential are part of the acceptance record.

Details behind the headline

Providers/OpenAI

make GPT-5 and Codex runs act sooner with lower-verbosity defaults, visible progress during tool work, and a one-shot retry when a turn only narrates the plan instead of taking action.

The safe reading of Providers/OpenAI is operational: prove the model can answer the intended task, then force a bounded failure and verify that no side effect is repeated.

Test this release without widening the boundary

Note the current version, host, provider, and workspace before exercising Agents/video generation.
Keep a tested backup beside the release record if the update can touch configuration, sessions, or a database.
Run a read-only prompt with a known answer and save provider, model, reasoning, and latency details.
Change only the candidate route, then confirm that a failed request returns a readable error and leaves the session intact.
Stop if the observed behavior falls outside the official note, and link the log or screenshot to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Record what the release actually changed

Keep the version, source URL, test identity, and rollback decision together. If this tag is pre-release, leave it isolated; if it is stable, record the migration and rollback result before reconnecting every channel.

Corrections worth replaying

Security. preserve restrictive plugin-only tool allowlists, require owner access for /allowlist add and /allowlist remove, fail closed when before_tool_call hooks crash, block browser SSRF redirect bypasses earlier, and keep non-interactive auth-choice inference scoped to bundled and already-trusted plugins. Keep the reproduction and the post-fix result together in the acceptance record.

Providers/OpenAI. make GPT-5 and Codex runs act sooner with lower-verbosity defaults, visible progress during tool work, and a one-shot retry when a turn only narrates the plan instead of taking action. Record the failure that this correction addresses before declaring the upgrade complete.

Use the complete OpenClaw v2026.4.5 release notes for the exact change list, then cross-check the official release index and the model provider reference before acting.