[openclaw] OpenClaw replaced a deprecated sandbox hash algorithm

**[openclaw] OpenClaw replaced a deprecated sandbox hash algorithm**

Affected Packages / Versions npm package: openclaw Affected versions: <= 2026.2.14 Fixed version (pre-set): 2026.2.15 Description The sandbox identifier cache key for Docker/browser sandbox configuration used SHA-1 to hash normalized configuration payloads. SHA-1 is deprecated for cryptographic use and has known collision weaknesses. In this code path, deterministic IDs are used to decide whether an existing sandbox container can be reused safely. A collision in this hash could let one configuration be interpreted as another under the same sandbox cache identity, increasing the risk of cache poisoning and unsafe sandbox state reuse. The implementation now uses SHA-256 for these deterministic hashes to restore collision resistance for this security-relevant identifier path...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.