v0.2.26 v1.16.22

Name: ladybird
Author: LadybirdBrowser

high risk

LadybirdBrowser/ladybirdSep 25, 2026 → Sep 28, 20263 days between releases

What's New

Hardens web security with host validation and mandatory hook approvals

Breaking Changes

Web server now restricts responses to specific host names; add names to [web] allowed_hosts to avoid 421 errors.
Hooks approved in v1.16.21 and earlier are re-asked for approval as they lacked interpreter or resolved path data.

New Features

New CLI command 'trust-hooks' for managing hook approvals.
Per-server idle timeout configuration.
Input edge hardening for CLI, tmux, and OpenClaw.

Improvements

Web server now restricts responses to specific host names.
Mandatory approval workflow for repository worktree hooks based on SHA256.
Secure cookie handling using HttpOnly and SameSite=Strict.

Upgrade Notes

If using a reverse proxy or Tailscale, add the host name to [web] allowed_hosts before upgrading. Approvals recorded in v1.16.21 will be re-validated on the next run.

The Two Releases

v0.2.26

Sep 25, 2026· 27 days ago

Introduces a comprehensive 'Exploit Chain' system including a schema, loader, compiler, CLI, and an embedded library of 13 CVE-based chains with an on-demand registry.

Full release notes

v1.16.22

Sep 28, 2026· 24 days ago

Hardens web security with strict host validation and HttpOnly cookies, and introduces a mandatory approval workflow for repository worktree hooks based on SHA256.

Full release notes