OpenClaw 2026.3.13: Security fix + Docker timezone

March 15, 2026

OpenClaw shipped v2026.3.13 with a small-but-important set of improvements aimed at safer deployments and smoother day-to-day operation. The release is also a recovery for the original v2026.3.13 GitHub tag path, so you may see a Git tag suffix even though the npm version stays the same.

What’s new in OpenClaw 2026.3.13 (highlights)

Security (Docker): a fix to prevent a gateway token leak in the Docker build context — a meaningful hardening step if you build images in CI or share build logs.
Docker quality-of-life: added OPENCLAW_TZ timezone support so scheduled tasks and logs line up with your intended timezone.
UI stability: fixes for a “chat history reload storm” and several small UI polish items (including mobile navigation refinements).
Onboarding improvements: updates that make QR setup and first-run flows more reliable on mobile platforms.
Integrations: additions like Signal group configuration support to make real-world messaging setups easier.

Why this release matters (especially if you run OpenClaw in production)

If you use OpenClaw for real automations (cron tasks, scheduled reports, multi-channel assistants), these changes land in two places that tend to cause the most friction: security and operational reliability. The Docker security fix is the headline: it reduces the chance of sensitive gateway credentials being exposed during build workflows. And the OPENCLAW_TZ option helps avoid the classic “why did my job run at the wrong hour?” problem when deploying across servers in different regions.

Quick tip: pair timezone support with your cron workflows

If you publish scheduled summaries or auto-posts (like this daily OpenClaw update), ensure your container timezone is explicit. Then validate behavior by comparing your task timestamps against your expected local time.