Engel Nyst and openhands
d04c1bb31c
Automate good first issue labeling in issue triage ( #14498 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-22 17:54:32 +02:00
Juan Michelini and openhands
3515cb0858
Use user email as Laminar trace user_id when available ( #14504 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-21 18:44:54 -03:00
HeyItsChloe and openhands
b572505519
fix: MCP settings wont update ( #14492 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-21 11:46:30 -07:00
Alona
0df162887f
BBDC: optionally post comments/reactions as a bot service account ( #14517 )
2026-05-21 13:34:03 -05:00
Alona
f4c76596fc
BBDC: prompt unenrolled @-mentioners to sign up instead of falling back to the installer ( #14509 )
2026-05-21 11:00:23 -05:00
aivong-openhands and OpenHands CVE Fix Bot
1fb2144e49
Fix CVE-2026-41140: Update poetry to 2.3.4 ( #14361 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-21 10:26:46 -04:00
aivong-openhands and OpenHands CVE Fix Bot
5ec986ba97
Fix CVE-2026-39373: Update jwcrypto to 1.5.7 ( #14503 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-21 10:25:49 -04:00
aivong-openhands and OpenHands CVE Fix Bot
a256611dfb
Fix CVE-2026-39377: Update nbconvert to 7.17.1 ( #14362 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-21 10:25:27 -04:00
Vasco Schiavo and openhands
9b0cb9e061
chore: change default model to MiniMax-M2.7 ( #14508 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-21 12:46:17 +00:00
a58498cc12
chore(lint): pyproject.toml as single source of truth for ruff ( #14507 )
...
Co-authored-by: Simon Rosenberg <simon@openhands.dev >
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-21 14:34:17 +02:00
f81494be8c
fix: show raw llm_model on OpenHands conversation chip ( #14505 )
...
Co-authored-by: Simon Rosenberg <simon@openhands.dev >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
2026-05-21 14:04:21 +02:00
Hiep Le
8350c498aa
feat: permissive CORS for API-key requests ( #14473 )
2026-05-21 13:44:11 +07:00
Juan Michelini and openhands
9a7e3edd67
Pass user_id to StartConversationRequest for Laminar tracing ( #14412 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-21 03:36:40 +00:00
faada52596
PLTF-2686: Add sdk to mypy checking in the enterprise folder and fix the resulting errors ( #14463 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
Co-authored-by: aivong-openhands <ai.vong@openhands.dev >
2026-05-20 21:21:52 -05:00
Alona
6e1e3d03d3
Fix BBDC mentioner resolution to use numeric id, and add 👀 eye reaction ( #14497 )
...
Resolve the BBDC @-mentioning user by their numeric id (matches the OIDC sub stored in Keycloak's bitbucket_data_center_id), instead of the slug which never matched and fell back to the installer. Add a best-effort 👀 reaction on the triggering comment via the comment-likes plugin, posted as the invoking user. Realigns BBDC with GitHub/GitLab (numeric-id keyed). Companion chart change: OpenHands-Cloud #647 .
2026-05-20 18:59:54 -04:00
aivong-openhands and OpenHands CVE Fix Bot
e069646a9a
Fix CVE-2026-44289: Pin protobufjs to 7.5.6 ( #14484 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-20 17:29:46 -04:00
af3c8b0df9
chore(deps): bump the version-all group across 1 directory with 14 updates ( #12806 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: aivong-openhands <ai.vong@openhands.dev >
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-20 23:29:25 +02:00
cf3fbdbc3f
chore(deps-dev): bump the eslint group across 1 directory with 3 updates ( #13938 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: enyst <engel.nyst@gmail.com >
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-20 23:29:19 +02:00
dependabot[bot]
3eedc82079
chore(deps): bump actions/setup-node from 4 to 6 ( #14090 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:52 +02:00
dependabot[bot]
774fd6bec8
chore(deps): bump docker/setup-buildx-action from 3 to 4 ( #14091 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:46 +02:00
dependabot[bot]
b81c80a9d5
chore(deps): bump actions/setup-python from 5 to 6 ( #14093 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:39 +02:00
dependabot[bot]
ebf9e20f76
chore(deps): bump dawidd6/action-download-artifact from 15 to 21 ( #14236 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:31 +02:00
dependabot[bot]
ea91f7c5a9
chore(deps): bump ubuntu from 22.04 to 26.04 in /containers/dev ( #14332 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:23 +02:00
dependabot[bot]
84fcbedea9
chore(deps): bump actions/github-script from 7 to 9 ( #14466 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:17 +02:00
dependabot[bot]
985194f1e9
chore(deps): bump the security-all group across 1 directory with 3 updates ( #14490 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:28:10 +02:00
dependabot[bot]
0206a974fa
chore(deps): bump mcp from 1.27.0 to 1.27.1 in the mcp-packages group ( #14382 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-20 23:27:22 +02:00
e8e1eebd22
Fix CVE-2026-44431: Update urllib3 to 2.7.0 ( #14481 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
Co-authored-by: ak684 <alona@all-hands.dev >
2026-05-20 15:28:41 -05:00
aivong-openhands and openhands
ac596597ec
fix: replace jwcrypto with joserfc to address CVE-2024-28102 ( #14479 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-20 14:09:25 -05:00
Alona
86a73afc25
Chunk the keycloak_auth cookie to survive the 4096-byte browser cap ( #14482 )
2026-05-20 13:57:49 -05:00
Alona
332b6d14e6
Add automated Bitbucket Data Center webhook lifecycle (Part 4) ( #14461 )
2026-05-20 12:03:41 -05:00
aivong-openhands and openhands
7944f704fe
Fix CVE-2026-42561: Update python-multipart to 0.0.28 ( #14357 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-20 12:00:39 -05:00
Graham Neubig and openhands
0916b25251
Update workflow shell context handling ( #14478 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-20 16:22:06 +00:00
aivong-openhands and OpenHands CVE Fix Bot
50d4ec2b0c
Fix CVE-2026-35397: Update jupyter-server to 2.18.2 ( #14435 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-20 11:07:18 -04:00
Kushal
15716df79f
fix: avoid rewriting provider credit errors ( #14437 )
2026-05-19 14:55:33 -04:00
Juan Michelini and openhands
a88f5038c3
Break verified_models → app_server.config import cycle ( #14436 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-19 14:06:08 -03:00
Engel Nyst and OpenHands
adb2699780
ci: add 7-day Dependabot cooldown ( #14465 )
...
Co-authored-by: OpenHands <openhands@all-hands.dev >
2026-05-19 10:08:58 +02:00
aivong-openhands and OpenHands CVE Fix Bot
e5047a82db
Fix CVE-2026-41312: Update pypdf to 6.10.2 ( #14355 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-18 18:25:28 -05:00
Alona
699924d3b1
[PLTF-2500] Add Bitbucket DC webhook enrollment UI for manual enrollment ( #14407 )
2026-05-18 12:20:39 -05:00
Juan Michelini and openhands
ba6b072d70
fix(config-api): show 'openhands' provider first in providers list ( #14297 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-18 11:34:45 -03:00
e3d9abfd01
Add issue duplicate automation workflow ( #14444 )
...
Co-authored-by: Engel Nyst <engel.nyst@gmail.com >
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-16 17:34:23 +02:00
aivong-openhands and OpenHands CVE Fix Bot
68083f275b
Fix CVE-2026-44897: Update mistune to 3.2.1 ( #14360 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-16 10:02:04 -05:00
aivong-openhands and OpenHands CVE Fix Bot
ceb870e811
Fix CVE-2026-44307: Update mako to 1.3.12 ( #14356 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-16 10:01:18 -05:00
dependabot[bot]
9b1418cb36
chore(deps): bump pypdf from 6.9.2 to 6.10.2 in /enterprise ( #14130 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-15 22:53:55 -04:00
9aa772b97c
feat(acp): minimal generic ACP agent UI ( #14401 )
...
Co-authored-by: Debug Agent <debug@example.com >
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com >
Co-authored-by: Simon Rosenberg <simon@openhands.dev >
2026-05-15 16:02:43 -04:00
aivong-openhands and OpenHands CVE Fix Bot
4804682920
Fix CVE-2026-42264: Update axios to 1.15.2 ( #14428 )
...
Co-authored-by: OpenHands CVE Fix Bot <openhands@all-hands.dev >
2026-05-15 16:00:42 -04:00
03ccd71fc0
Add PR review bot triage guidelines ( #14410 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
Co-authored-by: OpenHands Bot <contact@all-hands.dev >
2026-05-15 14:53:49 -04:00
Xingyao Wang and openhands
0ee42b7ac3
Add PR readiness confirmation CI workflow ( #14429 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-15 14:24:35 -04:00
623cf6868d
chore(deps-dev): bump notebook from 7.5.5 to 7.5.6 ( #14358 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: openhands <openhands@all-hands.dev >
Co-authored-by: aivong-openhands <ai.vong@openhands.dev >
2026-05-15 13:30:40 -04:00
6b6810ce16
chore: bump openhands SDK to v1.22.1 ( #14424 )
...
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Co-authored-by: openhands <openhands@all-hands.dev >
Co-authored-by: Simon Rosenberg <simon@openhands.dev >
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-05-15 13:20:10 +00:00
John-Mason P. Shackelford and openhands
3e61c63c7c
fix(api): add title field to AppConversationUpdateRequest ( #14420 )
...
Co-authored-by: openhands <openhands@all-hands.dev >
2026-05-15 08:19:27 -04:00
