OpenClaw v2026.5.19: Dependencies, upgrade notes

v2026.5.19 arrived on 2026-05-20 with a change that matters during maintenance: dependencies. The page is a researched reading note from the official release record, with a test path for a real Gateway.

This is a stable release line; read the exact record for migrations and fixes before applying it to a live Gateway. The release body cannot certify every local combination of provider, channel, platform, and account; use the bounded test below for the path you actually run.

Before the package changes

Agents

What changed. clarify that fixes should default to clean bounded refactors, lean internals, and explicit plugin SDK/API deprecation paths.

Check it with. A visible plugin card is not approval for Agents. Inspect the source and run one allowed and one refused operation before changing a shared Gateway.

Dependencies

What changed. update @openclaw/proxyline to 0.3.3.

Check it with. The promise in Dependencies is only useful if the old state returns. Take a verified backup, interrupt a candidate update, and inspect both the retained package and the service.

Dependencies

What changed. update Pi packages to 0.75.1 and raise the minimum supported Node.js 22 line to 22.19.

Check it with. Before relying on Dependencies, rehearse it on a disposable install. Record the schema, configuration, service owner, and exact point at which rollback is allowed or refused.

CLI

What changed. reject explicit port numbers above 65535 before they reach Gateway or Node bind paths. Fixes #83900.

Check it with. Measure CLI before and after the update with synthetic data, and explain every accepted finding in the release record.

Details behind the headline

Codex app-server

preserve plugin tool auth profiles when Codex owns model transport so OpenClaw dynamic tools can resolve their provider credentials.

Treat Codex app-server as a boundary change. Exercise one permitted request and one refused request with a test identity, then keep both decisions in the log.

A bounded check for this version

1. Start with a disposable checkpoint: record the version, host, provider, and workspace tied to Agents.
2. Check the release's migration notes and make a restorable backup before changing persistent state.
3. Ask the same small question through the affected route and record the account, model id, context, and response time.
4. Compare the answer, tool permissions, and fallback behavior with the baseline before changing a default.
5. If the result differs from the release body, stop the rollout and attach the log, screenshot, or transcript to the version record.

openclaw --version
openclaw gateway status
openclaw security audit

Close the loop with evidence

A useful maintenance record names the changed behavior, the behavior that stayed stable, the identity that approved the test, and the step that would undo it. Preserve that record beside the release tag.

Edge cases in this tag

CLI. reject explicit port numbers above 65535 before they reach Gateway or Node bind paths. Fixes #83900. Record the failure that this correction addresses before declaring the upgrade complete.

Codex app-server. preserve plugin tool auth profiles when Codex owns model transport so OpenClaw dynamic tools can resolve their provider credentials. This is the edge case to include in a regression check, especially when the release is pre-release.

The authoritative record is the v2026.5.19 GitHub release. The release index gives the surrounding sequence, while the Gateway security guide supplies the operational background.