OpenHands

1.39.0 (2026-06-24)

What's Changed

Features

• feat: move existing users into the default org when first auto-added by @ak684 in https://github.com/OpenHands/OpenHands/pull/14740
• feat: route unclaimed automation events to the default org on single-org installs by @ak684 in https://github.com/OpenHands/OpenHands/pull/14745
• feat: add hide_personal_workspaces flag for org-only OHE installs by @ak684 in https://github.com/OpenHands/OpenHands/pull/14741
• feat: make the first signed-in user the default org owner, track the org by is_default flag by @ak684 in https://github.com/OpenHands/OpenHands/pull/14752
• feat(acp): add switch_acp_model proxy endpoint for cloud conversations by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14744
• feat(acp): add model dropdown and credential fields to agent settings page by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14733
• feat: add validation for secret names to ensure valid env var format by @jpshackelford in https://github.com/OpenHands/OpenHands/pull/12980
• feat: auto-accept invitation links instead of the confirm/cancel modal by @ak684 in https://github.com/OpenHands/OpenHands/pull/14786
• feat: expose copyable invite links so invitations work without email delivery by @ak684 in https://github.com/OpenHands/OpenHands/pull/14758
• feat: accept pending invitations by verified-email match at sign-in by @ak684 in https://github.com/OpenHands/OpenHands/pull/14759
• feat: explicit OH_DEPLOYMENT_MODE flag; gate cloud-account CTA to enterprise cloud by @ak684 in https://github.com/OpenHands/OpenHands/pull/14794
• feat: OHE multi-model LLM discovery + BYOK gating (proxy discovery, catalogue union, UX) by @ak684 in https://github.com/OpenHands/OpenHands/pull/14773
• feat(acp): allow MCP server config for ACP agents by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14613
• feat: enforce conversation limits by @HeyItsChloe in https://github.com/OpenHands/OpenHands/pull/14168
• feat(APP-2136): expose automations menu item for all users by @erisfully in https://github.com/OpenHands/OpenHands/pull/14688
• feat(jira-dc): persist and inject per-user OAuth tokens in resolver conversations by @ak684 in https://github.com/OpenHands/OpenHands/pull/14650
• feat(jira-dc): share linked OAuth token with eligible conversations by @ak684 in https://github.com/OpenHands/OpenHands/pull/14697
• feat: add DynamicRemoteSandboxSpecService backed by runtime-api warm configs by @tofarr in https://github.com/OpenHands/OpenHands/pull/14849
• feat: encode harness in chip icon, surface model in chip text by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14510
• feat: PLTF-2956 parallelize GitHub GraphQL queries in get_suggested_tasks by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14821
• feat: surface a clear error when a custom sandbox image's agent-server SDK mismatches by @ak684 in https://github.com/OpenHands/OpenHands/pull/14883
• feat: PLTF-2968 allow per-deployment resolver macro via OH_RESOLVER_LABEL by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14895
• feat: Support Slack attachments in agent context by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14934
• feat: add sub-agent task (TaskToolSet) visualizer to the chat UI by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14928

Bug Fixes

• fix: bump agent-server to 1.27.1 for Gemini cache fix by @ak684 in https://github.com/OpenHands/OpenHands/pull/14751
• fix: bump agent-server to 1.28.0 by @ak684 in https://github.com/OpenHands/OpenHands/pull/14754
• fix(acp): sanitize agent-server error body in switch_acp_model proxy by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14760
• fix: Pin duplicate checker action to extensions release by @enyst in https://github.com/OpenHands/OpenHands/pull/14771
• fix(deps): bump postcss to 8.5.15 to fix XSS (GHSA-qx2v-qp2m-jg93) by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14770
• fix(frontend): start new LLM profiles on basic settings with blank fields by @ak684 in https://github.com/OpenHands/OpenHands/pull/14782
• fix: preserve LLM base URL on basic saves by @he-yufeng in https://github.com/OpenHands/OpenHands/pull/14776
• fix(enterprise): litellm_proxy/ → openhands/ on settings load by @smolpaws in https://github.com/OpenHands/OpenHands/pull/14766
• fix(frontend): treat managed openhands base URLs as provider defaults in view inference by @ak684 in https://github.com/OpenHands/OpenHands/pull/14783
• fix(frontend): only render the API key input once a provider is selected by @ak684 in https://github.com/OpenHands/OpenHands/pull/14787
• fix(frontend): hydrate the LLM profile edit form from the selected profile by @ak684 in https://github.com/OpenHands/OpenHands/pull/14789
• fix(frontend): accept typed emails without requiring Space in the invite input by @ak684 in https://github.com/OpenHands/OpenHands/pull/14790
• fix: redact credentials from PluginSpec.source during serialization by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14795
• fix: reconcile and label per-(user,org) LiteLLM managed keys by @ak684 in https://github.com/OpenHands/OpenHands/pull/14803
• fix: default enterprise injector kinds in the image, not just the chart by @ak684 in https://github.com/OpenHands/OpenHands/pull/14811
• fix(frontend): avoid dirty language filter input by @mturac in https://github.com/OpenHands/OpenHands/pull/14812
• fix(acp): surface acp_server on cloud conversations so the model picker renders by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14797
• fix: Add SaaS migration for sandbox pause state by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14829
• fix: Use final response endpoint for resolver callbacks by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14828
• fix: Ignore OpenHands bot GitHub resolver events by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14832
• fix: duplicate Slack no-repository selections by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14833
• fix: write trajectory exports as utf-8 by @wgu9 in https://github.com/OpenHands/OpenHands/pull/14810
• fix: use runtime /list API for sandbox concurrency count, not is_paused DB flag by @tofarr in https://github.com/OpenHands/OpenHands/pull/14834
• fix: renumber duplicate migration 122 → 123 (drop is_paused) by @tofarr in https://github.com/OpenHands/OpenHands/pull/14840
• fix: API key CORS header handling by @neubig in https://github.com/OpenHands/OpenHands/pull/14835
• fix: PLTF-2956 batch_get_sandboxes to gracefully handle runtime API failures by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14853
• fix: Fix CVE-2026-48526: Update pyjwt to 2.13.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14854
• fix: PLTF-2956 log level from warning to error for automation service forwarding failures by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14820
• fix: log error level for failed GitHub payload processing (#14814) by @GautamKumarOffical in https://github.com/OpenHands/OpenHands/pull/14863
• fix: Fix CVE-2026-49855: Update tornado to 6.5.7 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14856
• fix: decouple API-key (Bearer) auth from Keycloak offline sessions by @hieptl in https://github.com/OpenHands/OpenHands/pull/14867
• fix: Fix CVE-2026-54278: Update aiohttp to 3.14.1 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14871
• fix: PLTF-2956 Log 5xx responses at error level in AutomationEventService by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14819
• fix: revert conversation limit enforcement from #14168 by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14877
• fix: Fix CVE-2026-12143: Update form-data to 4.0.6 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14875
• fix: Fix CVE-2026-53539: Update python-multipart to >=0.0.30 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14876
• fix: post Bitbucket DC comments as the bot account and background webhook handling by @ak684 in https://github.com/OpenHands/OpenHands/pull/14881
• fix(frontend): send on Enter for touchscreen laptops by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14870
• fix: PLTF-2956 Tests for GitHub payload-processing failure log level by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14818
• fix: clean up LLM Profile auth fields (dedupe variant section + exclude inert auth_type) by @ak684 in https://github.com/OpenHands/OpenHands/pull/14893
• fix: prevent conversation export overload by @neubig in https://github.com/OpenHands/OpenHands/pull/14899
• fix: Forgejo/Gitea clone failure when hosted under a subpath by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14930
• fix: self-heal stale LiteLLM user on re-onboarding by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14932
• fix: load global user & org skills without a selected repository by @hieptl in https://github.com/OpenHands/OpenHands/pull/14780
• fix: Fix GHSA-gj48-438w-jh9v: Update bleach to 6.4.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14945
• fix: Fix CVE-2026-45409: Update idna to 3.15 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14946
• fix: Fix GHSA-6v7p-g79w-8964: Update msgpack to 1.2.1 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14944
• fix: Fix CVE-2026-49458: Update dompurify to 3.4.6 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14872
• fix: Fix CVE-2026-44727: Update jupyter-server to 2.20.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14943
• fix: binaryornot Python 3 crash on binary reads by @enyst in https://github.com/OpenHands/OpenHands/pull/14518
• fix: Fix GHSA-jm82-fx9c-mx94: Update pypdf to >=6.13.3 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14959
• fix: Fix GHSA-cmwh-pvxp-8882: Update dompurify to 3.4.11 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14956
• fix: Fix CVE-2026-41691: Update i18next-http-backend to 3.0.5 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14955
• fix: Fix CVE-2026-54283: Update starlette to 1.3.1 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14874
• fix: Fix CVE-2026-8723: Update qs to 6.15.2 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14957

Documentation

• docs: Bring README.md over from Agent Canvas by @rbren in https://github.com/OpenHands/OpenHands/pull/14844
• docs(skills): fix typo in OpenHands docs URL in add_agent.md by @sanjibani in https://github.com/OpenHands/OpenHands/pull/14865
• docs: revise source code links in README.md by @enyst in https://github.com/OpenHands/OpenHands/pull/14869
• docs: fix broken README urls by @lexcodes-dev in https://github.com/OpenHands/OpenHands/pull/14907

Maintenance

• refactor(llm): clean up reverse-mapping OpenHands provider models by @enyst in https://github.com/OpenHands/OpenHands/pull/14725
• refactor(settings): delegate agent-settings merge to SDK apply_agent_settings_diff by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14677
• build(deps): bump SDK packages to v1.28.0 by @all-hands-bot in https://github.com/OpenHands/OpenHands/pull/14753
• chore(deps): bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in https://github.com/OpenHands/OpenHands/pull/14852
• chore: bump SDK and agent-server to 1.29.0 by @ak684 in https://github.com/OpenHands/OpenHands/pull/14889
• test: replace real sleeps in maintenance runner tests by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/13930
• refactor: extract billing test fixtures for PLTF-1269 by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/13998
• test: PLTF-1269 replace test_should_ naming with test_verb_noun_context convention by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14015
• chore: purge dead acp_env field footprint (removed in SDK 1.29.0) by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14921

Other Changes

• PLTF-2899: keep resume flow responsive during rate limits by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14660
• fix: _configure_llm now preserves user LLM settings by @shanemort1982 in https://github.com/OpenHands/OpenHands/pull/14451
• Enable org LLM profiles in settings by @ak684 in https://github.com/OpenHands/OpenHands/pull/14715
• Revert ACP bootstrap-prompt resume + enable acp_isolate_data_dir on the cloud start path by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14722
• PLTF-2899: Add async/await static analysis checks for enterprise code by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14664
• fix: remove org_id from ownership assertion in save_app_conversation_info by @tofarr in https://github.com/OpenHands/OpenHands/pull/14727
• Harden workflow GitHub context handling by @enyst in https://github.com/OpenHands/OpenHands/pull/14537
• ci: add label-triggered OpenHands QA workflow by @enyst in https://github.com/OpenHands/OpenHands/pull/14730
• Bump SDK packages to v1.27.0 by @all-hands-bot in https://github.com/OpenHands/OpenHands/pull/14726
• perf: skip runtime API call in webhook auth via SandboxRecord by @tofarr in https://github.com/OpenHands/OpenHands/pull/14732
• fix(bitbucket-dc): resolve user via whoami so avatars load with OAuth tokens by @ak684 in https://github.com/OpenHands/OpenHands/pull/14734
• Release 1.8.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14743
• PLTF-2895: add enterprise migration integrity check by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14689
• PLTF-2895: scope DB sessions tightly in poll_agent_servers to prevent idle-in-transaction by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14637
• ci: adopt release-please for app and cloud releases by @jlav in https://github.com/OpenHands/OpenHands/pull/14718
• Fix OpenHands LLM key access for credited orgs by @enyst in https://github.com/OpenHands/OpenHands/pull/14724
• Use reusable issue duplicate checker action by @enyst in https://github.com/OpenHands/OpenHands/pull/14609
• fix: delete LiteLLM user on personal org reset by @fengjikui in https://github.com/OpenHands/OpenHands/pull/14700
• fix(frontend): skip Git-related API calls when no Git provider is configured by @saurya in https://github.com/OpenHands/OpenHands/pull/14338

New Contributors

• @he-yufeng made their first contribution in https://github.com/OpenHands/OpenHands/pull/14776
• @fengjikui made their first contribution in https://github.com/OpenHands/OpenHands/pull/14700
• @mturac made their first contribution in https://github.com/OpenHands/OpenHands/pull/14812
• @wgu9 made their first contribution in https://github.com/OpenHands/OpenHands/pull/14810
• @sanjibani made their first contribution in https://github.com/OpenHands/OpenHands/pull/14865
• @GautamKumarOffical made their first contribution in https://github.com/OpenHands/OpenHands/pull/14863
• @lexcodes-dev made their first contribution in https://github.com/OpenHands/OpenHands/pull/14907

Full Changelog: https://github.com/OpenHands/OpenHands/compare/cloud-1.38.0...cloud-1.39.0

This PR was generated with Release Please. See documentation.