v0.6.0

openclaw/wacliv0.6.0Apr 14, 2026by dinakars777

AI Summary

Major security-focused release addressing multiple vulnerabilities in SQLite store and path sanitization, plus fixing critical sync/reconnect deadlocks. Includes contributions from multiple new community members.

Key Highlights

Security patches for SQLite URI path injection against '?' and '#' characters
Security patches for table name validation (guard tableHasColumn against empty table name)
Security patches for path sanitization stripping null bytes and control characters
Bug fixes for LIKE wildcard and FTS5 query syntax injection in search
Added panic recovery to event handler and media workers
Fixed reconnect duration bounds to prevent indefinite lock holding

New Features

WACLI_STORE_DIR environment variable to configure store directory
Panic recovery for event handler and media workers

Full Release Notes

This release contains a massive security sweep resolving multiple underlying vulnerabilities in the SQLite store and path sanitization constraints, as well as fixing the critical sync/reconnect deadlocks. 

Huge thanks to @draix for the security patches, and tying off the backlog sweep for @steipete!

## What's Changed
* chore(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/steipete/wacli/pull/69
* security: validate SQLite URI path against '?' and '#' injection (#59) by @draix in https://github.com/steipete/wacli/pull/141
* security: guard tableHasColumn against empty table name (#58) by @draix in https://github.com/steipete/wacli/pull/142
* security: strip null bytes and control chars in path sanitization (#60) by @draix in https://github.com/steipete/wacli/pull/140
* bug: escape LIKE wildcard chars in search queries (#56) by @draix in https://github.com/steipete/wacli/pull/145
* bug: sanitize FTS5 user queries to prevent query-syntax injection (#57) by @draix in https://github.com/steipete/wacli/pull/146
* security: add panic recovery to event handler and media workers (#52) by @draix in https://github.com/steipete/wacli/pull/143
* feat: add WACLI_STORE_DIR env variable to configure store directory (#36) by @draix in https://github.com/steipete/wacli/pull/150
* fix: force exit on second SIGINT during long-running commands by @dinakars777 in https://github.com/steipete/wacli/pull/112
* fix: bound reconnect duration to prevent indefinite lock holding by @dinakars777 in https://github.com/steipete/wacli/pull/113

## New Contributors
* @dependabot[bot] made their first contribution in https://github.com/steipete/wacli/pull/69
* @draix made their first contribution in https://github.com/steipete/wacli/pull/141
* @dinakars777 made their first contribution in https://github.com/steipete/wacli/pull/112

**Full Changelog**: https://github.com/steipete/wacli/compare/v0.5.0...v0.6.0