This release adds 4 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryAdd a default approval mode configuration and improve handling of MCP login token refreshes.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds default approval mode via `[startup].mode` setting. Adds default approval mode via `[startup].mode` setting. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Adds restart option after saving Tavily key via `/auth` endpoint. Adds restart option after saving Tavily key via `/auth` endpoint. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Adds environment reload from `/auth` modal using Ctrl+R shortcut. Adds environment reload from `/auth` modal using Ctrl+R shortcut. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Feature | Low |
Shows toast notification when `/auth` API key is saved. Shows toast notification when `/auth` API key is saved. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Restores interrupted prompt to input on ESC key press. Restores interrupted prompt to input on ESC key press. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Preserves transcript order during virtualization process. Preserves transcript order during virtualization process. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Runs stdio MCP server pre‑flight check off the event loop. Runs stdio MCP server pre‑flight check off the event loop. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Avoids duplicate "criteria ready" message on `/goal` revisions. Avoids duplicate "criteria ready" message on `/goal` revisions. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Restores welcome banner tips display. Restores welcome banner tips display. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Medium |
Clarifies managed `rg` install failure messages. Clarifies managed `rg` install failure messages. Source: llm_adapter@2026-07-16 Confidence: high |
— |
| Bugfix | Low |
Keeps notification center open for API‑key entry. Keeps notification center open for API‑key entry. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Queues `/mcp login` commands sent before server connection. Queues `/mcp login` commands sent before server connection. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
| Bugfix | Low |
Serializes MCP OAuth token refreshes to prevent reuse revocation. Serializes MCP OAuth token refreshes to prevent reuse revocation. Source: granite4.1:30b@2026-07-16-audit Confidence: low |
— |
Full changelog
Features
- Restore interrupted prompt to input on ESC (#4544) (fccf037)
- Add
[startup].modedefault approval mode (#4573) (7c5bf54) - Offer restart after saving Tavily key via
/auth(#4560) (12df81a) - Reload env from
/authmodal via Ctrl+R (#4566) (f07d638) - Toast on saved
/authAPI key (#4558) (ee3c264)
Bug Fixes
- Harden approval content rendering (#4581) (38446fd)
- Preserve transcript order during virtualization (#4549) (f6ee70c)
- Run stdio MCP server pre-flight check off the event loop (#4434) (c9636e2)
- Avoid duplicate "criteria ready" message on
/goalrevisions (#4559) (1110497) - Restore welcome banner tips (#4528) (3f1e55e)
- Clarify managed
rginstall failures (#4578) (434c84a) - Dedupe update/install log path output (#4553) (1398fee)
- Keep notification center open for API-key entry (#4568) (6e89417)
- Queue
/mcp loginsent before the server connects (#4533) (edac82c) - Serialize MCP OAuth token refreshes to prevent reuse revocation (#4565) (c37100d)
Thanks to our community contributors: @heyparth1
Internal maintainers: @johannes117, @mdrxy
Released by: @mdrxy
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About deepagents
Agent harness built with LangChain and LangGraph. Equipped with a planning tool, a filesystem backend, and the ability to spawn subagents - well-equipped to handle complex agentic tasks.
Related context
Related tools
Earlier breaking changes
- vlangchain-quickjs==0.2.0 Removes `skills_backend` capability.
- vdeepagents-cli==0.2.0 `deepagents deploy` now targets Managed Deep Agents API; removes `deepagents dev`, `deepagents.toml`, and `--config`/`--dry-run` flags.
Beta — feedback welcome: [email protected]