Update openclaw to version v2026.4.14 (#5342)

Co-authored-by: nmfretz <nmfretz@gmail.com>

openclaw/docker-compose.yml

@@ -6,7 +6,7 @@ services:
       APP_PORT: 18789
 
   gateway:
-    image: ghcr.io/getumbrel/openclaw-umbrel:2026.4.12@sha256:acdd29f751e1ceac25a1983f1c7679aa18a6858fb46c50e91db52d7b6f38ba89
+    image: ghcr.io/getumbrel/openclaw-umbrel:2026.4.14@sha256:90be9c46cae1902c520196677f127c773305ad80de523b077e7f75ee0fdb48e5
     user: "1000:1000"
     init: true
     restart: on-failure
@@ -14,3 +14,5 @@ services:
     volumes:
       - ${APP_DATA_DIR}/data:/data
       - ${APP_DATA_DIR}/data/linuxbrew:/home/linuxbrew
+    environment:
+      APP_SEED: ${APP_SEED}

openclaw/umbrel-app.yml

@@ -3,7 +3,7 @@ id: openclaw
 name: OpenClaw
 tagline: The AI that actually does things
 category: ai
-version: "2026.4.12"
+version: "2026.4.14"
 port: 18789
 path: ""
 description: >-
@@ -39,33 +39,27 @@ gallery:
   - 2.jpg
   - 3.jpg
 releaseNotes: >-
-  ⚠️ Breaking change: Several legacy config aliases have been removed.
-
-
-  What's new in OpenClaw (v2026.4.2 → v2026.4.12):
-    - New Active Memory plugin gives OpenClaw a dedicated memory sub-agent before each reply, automatically surfacing relevant context without manual prompting
-    - New bundled LM Studio provider with onboarding, model discovery, and memory-search embeddings for local models
-    - New bundled Codex provider so `codex/gpt-*` models use Codex-managed auth and native threads
-    - New `openclaw exec-policy` command to manage exec approval settings from the CLI
-    - Video generation expanded with Seedance 2.0, xAI, Alibaba Wan, and Runway providers
-    - Music generation tool added with Google Lyria, MiniMax, and ComfyUI workflow support
-    - Memory Dreaming improvements including ChatGPT import, diary UI, grounded backfill, and more reliable promotion
-    - Memory Wiki restored with full CLI, sync, search, and contradiction-clustering tooling
-    - New bundled providers: Qwen, Fireworks AI, StepFun, Arcee AI, and Amazon Bedrock Mantle
-    - Control UI now available in 12 additional languages including Chinese, German, Spanish, and Japanese
-    - Matrix partial streaming now shows live typewriter animation via MSC4357 markers
-    - Feishu document comment sessions improved with richer context, reactions, and typing feedback
-    - Microsoft Teams gains reaction support, inline DM image downloads, and SSO sign-in callbacks
-    - Plugin loading narrowed to manifest-declared needs for faster startup and cleaner activation
-    - Gateway startup improved so channels resume first on Sandbox wake and WebSocket RPC stays available during sidecar startup
-    - Fixed gateway startup credential check — startup now fails if a placeholder example token is still configured
-    - Fixed WebSocket tick broadcasts being dropped, causing client disconnects during long-running work
-    - Fixed Telegram approval button callbacks deadlocking behind active agent turns
-    - Fixed audio transcription multipart requests failing with HTTP 400
-    - Fixed dreaming re-ingesting its own narrative transcripts and stalling below the durable-memory score threshold
-    - Fixed WhatsApp outbound media sends silently dropping attachments
-    - Fixed Matrix `requireMention` not working for non-OpenClaw clients
-    - Fixed exec environment variable overrides that could redirect trusted toolchains
+  What's new in OpenClaw (v2026.4.12 → v2026.4.14):
+    - Added forward-compatibility support for GPT-5.4-pro in the Codex provider
+    - Telegram forum topics now surface human-readable topic names in agent context
+    - Fixed Ollama runs timing out too early due to incorrect stream timeout settings
+    - Fixed Codex provider dropping all custom models from every provider in models.json
+    - Fixed image and PDF tools rejecting valid Ollama vision models
+    - Fixed Slack interactive triggers potentially bypassing configured allowlists
+    - Fixed local attachment path resolution failing open instead of closed on errors
+    - Blocked AI model from enabling dangerous security flags via config patch tool
+    - Fixed Google Gemini image requests returning 404 due to incorrect URL suffix handling
+    - Fixed Ollama streaming completions reporting bogus token counts causing premature compaction
+    - Fixed memory embedding providers with non-OpenAI prefixes failing with unknown provider error
+    - Fixed browser SSRF policy blocking normal hostname navigation and local CDP control
+    - Fixed Control UI freezing on maliciously crafted markdown via ReDoS vulnerability
+    - Fixed observer-mode setups where deny send policy was blocking inbound message processing
+    - Fixed WhatsApp encrypted media writes causing transient crashes on image sends
+    - Fixed heartbeat, cron, and exec turns overwriting shared session routing metadata
+    - Fixed Ollama memory embeddings adapter and added endpoint-aware cache keys
+    - Fixed voice-note replies silently dropping due to temp file handling issues
+    - Fixed AAC voice notes failing transcription due to incorrect MIME type mapping
+    - Fixed GPT-5.4 embedded runs failing request validation due to incorrect reasoning effort mapping
     - Multiple additional security hardening, stability, and compatibility fixes across channels, agents, and providers
     - And much more. Full details at https://github.com/openclaw/openclaw/releases
 submitter: Umbrel