NemoClaw v0.0.92 is out!

[cv]

NemoClaw v0.0.92 is a focused security and operational-confidence release. It updates OpenClaw sandboxes to OpenClaw 2026.7.1 and Node.js 22.23.1, applies reviewed and integrity-pinned dependency remediations, and preserves the device-scope and private-state protections expected during upgrades. Existing OpenClaw users should upgrade and rebuild their sandbox to pick up the new runtime.

This release also gives remote users one provider-neutral path for deploying NemoClaw to a headless Linux server. The guide now covers OpenClaw, Hermes, and Deep Agents Code together, including unattended installation, loopback-only access, readiness checks, policy configuration, updates, and reboot recovery.

Behind those user-facing changes, v0.0.92 makes live E2E progress easier to diagnose and strengthens installer, macOS, WSL, and Hermes image validation. These changes are deliberately narrow: they improve the confidence and visibility around releases without expanding NemoClaw's supported product surface.

OpenClaw and security

• #7280 updates OpenClaw to 2026.7.1 and the sandbox Node.js runtime to 22.23.1. The reviewed build remediates vulnerable Axios plugin copies and the affected OpenTelemetry Jaeger diagnostics graph, locks patched mcporter dependencies, preserves paired-device scope enforcement and private state, and validates an in-place upgrade from NemoClaw v0.0.89. This keeps the supported OpenClaw runtime current without weakening credential or upgrade boundaries.
• #7339 adds a real-artifact regression proving malformed Jaeger trace and baggage headers do not terminate the diagnostics process. This turns the Jaeger remediation into an executable release contract instead of relying only on dependency metadata.

Headless deployment

• #7346 consolidates remote deployment into one headless Linux server workflow for OpenClaw, Hermes, and Deep Agents Code. The guide covers unattended setup, loopback-only access, readiness checks, network policy, updates, and recovery after a host reboot, so operators have one maintained path instead of agent- or provider-specific deployment recipes.

E2E and platform confidence

• #7100 gives live E2E tests ordered semantic phases, outcomes, durations, resource-release timing, and secret-safe stall diagnostics. Each run now records where work stopped, while collection-time validation rejects invalid phase plans before live infrastructure is used.
• #7378 updates macOS validation to compare canonical watcher targets. This avoids false failures caused by equivalent path representations while retaining the underlying watcher contract.
• #7379 raises the full WSL suite limit from 60 to 90 minutes and capability-gates its Docker-only Hermes contract. This gives the complete platform suite enough time to finish while keeping the latest tag concurrency protection covered.
• #7380 provisions bounded swap before hosted Hermes image exports. This reduces export failures under memory pressure without changing the final image contents.
• #7381 gives Hermes guard checks a realistic child-process allowance and aligns WSL ownership fixtures with production. This removes timing and fixture noise while preserving the runtime guard behavior being tested.

Installer and release surface

• #7374 teaches installer integrity checks to accept the reviewed OpenShell Homebrew formula transition only when the template hash matches the exact release asset set. The installer remains fail-closed while supporting the current archive-only distribution contract.
• #7376 restores the previously missed v0.0.91 changelog entry and corrects its legacy inference-selector guidance to match the tagged code. This repairs release history without changing the immutable v0.0.91 tag.
• #7390 adds the canonical v0.0.92 changelog entry and records the release's user-visible behavior and validation scope.

Compare the complete release range: v0.0.91...v0.0.92.