Skip to content

Talon

v1.12.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

agentic-ai ai-agent anthropic autonomous-agents llm claude
+6 more
discord-bot mcp model-context-protocol self-hosted telegram-bot typescript

Affected surfaces

rce_ssrf breaking_upgrade

Summary

AI summary

Updates 1.12.0, Bug Fixes, and 2026-05-18 across a mixed release.

Full changelog

1.12.0 (2026-05-18)

Features

  • backend: add Codex as a fourth backend provider (#174) (7d476b9)
  • backend: add Kilo CLI as backend provider (#161) (9263611)
  • backend: add OpenAI Agents SDK as fifth backend (#199) (d9a6e90)
  • backend: Kilo 1:1 with Claude SDK + shared framework + backend registry (#169) (9ef3689)
  • claude-sdk: add Notification and StopFailure hooks for SDK telemetry (#128) (63c9cb8)
  • cli: setup wizard prompts for Discord bot token + applicationId (#185) (ed36c04)
  • cli: setup wizard supports backend selection + Discord frontend (#180) (8a9fb78)
  • codex: factory cleanup hook + expanded conformance + parity log line (#177) (077cf3b)
  • codex: friendly startup warning when no auth source available (#182) (5842517)
  • codex: runOneShotAgent + full model registry + 4-way registry parity tests (#175) (44ab734)
  • codex: set sensible ThreadOptions defaults — sandbox / approval / network (#183) (85e0d8c)
  • discord: show backend label in /status header (#191) (d10cbea)
  • frontend: add Discord frontend (discord.js v14) (#160) (625148c)
  • handlers: surface user-quoted portions from reply context (Bot API 7.0) (#157) (92210ec)
  • heartbeat: outbound telegram — explicit chat_id routing (#150) (77e7771)
  • picker: backend-agnostic model picker — provider groups, persisted free filter, decoupled /settings (#207) (91df6a9)
  • telegram: show backend label in /status header (#184) (9d18672)
  • tools: expose Talon MCP tools to the Discord frontend (#203) (a4a1ae3)
  • triggers: add persistent triggers that survive Talon restarts (#201) (40f4dd7)
  • triggers: self-authored watcher scripts that wake the bot (#96) (cafc8d4)

Bug Fixes

  • heartbeat: evict wedged SDK subprocesses, never deadlock the lock (#144) (d17a4eb)
  • heartbeat: frontend-agnostic outbound + comprehensive test coverage (#151) (85251d3)
  • kilo: make the chat flow actually work end-to-end (#170) (8286706)
  • openai-agents: isolate config from generic OPENAI_* env vars (#206) (fc16cb2)
  • six correctness and safety bugs (timer leak, HTML injection, log component, flush consistency, status regex) (#156) (7530244)
  • telegram: escape backend modelDetails so /model and /settings render (#164) (01f59ed)
  • tools: chat_id schema accepts negative IDs for groups/channels (#153) (9298246)
  • tools: mark react as a turn terminator (endsTurn: true) (#148) (afb03ef)
  • tools: preserve Discord snowflake IDs in tool input schemas (#204) (f46efce)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Talon

Get notified when new releases ship.

Sign up free

About Talon

All releases →

Related context

Earlier breaking changes

  • v3.0.0 Removes the talon:// address scheme; use real paths instead.
  • v2.0.0 Removes vfs_list, vfs_read, vfs_write tools and GET /vfs/* routes; eliminates talon ls/cat CLI commands.

Beta — feedback welcome: [email protected]