Skip to content

OpenHands

vcloud-1.41.0 scope: cloud Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent artificial-intelligence chatgpt claude-ai cli developer-tools
+2 more
llm openai

Affected surfaces

auth

Summary

AI summary

Features include semantic file chunking, org conversation dashboard, workspace state capture, device‑verify UI updates, enterprise super roles, API key windows, Laminar trace metadata, parallel tool calls, marketplace support, and auth cookie fallback; bug fixes address Jira timeout config, CVE-2026-44681, LLM profile handling, automation logging, alembic migration, repo resolution, dropdown rename, org‑gate fix, token streaming, PostHog email property, timezone storage, rate limiter tests, frontend delta rendering, sandbox runtime fallback; maintenance bumps SDK/agent-server and pins dependencies.

Full changelog

1.41.0 (2026-07-06)

What's Changed

Features

  • feat: implement semantic file chunking using tree-sitter AST parsing by @ysinghc in https://github.com/OpenHands/OpenHands/pull/14699
  • feat(org): Add organization conversation admin dashboard by @saurya in https://github.com/OpenHands/OpenHands/pull/14846
  • feat(app-server): capture production workspace state — initial snapshot at start + archive before delete (APP-2403) by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14953
  • feat(device-verify): align warning, button color, and add workspace dropdown by @tofarr in https://github.com/OpenHands/OpenHands/pull/15031
  • feat(enterprise/auth): add super roles via user.role_id with permission fallback by @chuckbutkus in https://github.com/OpenHands/OpenHands/pull/14937
  • feat(org): expose caller permissions on GET /organizations/{id}/me by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/15048
  • feat(api-keys): add optional active window (not_before & expires_at) by @tofarr in https://github.com/OpenHands/OpenHands/pull/15085
  • feat(app-server): add repo/branch to Laminar trace metadata by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/15059
  • feat: add parallel tool calls (tool_concurrency_limit) to agent settings by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14929
  • feat(api-keys): make 'unbound' org scope an explicit, first-class option by @tofarr in https://github.com/OpenHands/OpenHands/pull/15096
  • feat(jira-dc): fix the integration panel so members get guidance, not the admin setup form by @ak684 in https://github.com/OpenHands/OpenHands/pull/15040
  • feat: Add dynamic marketplace support for plugin registration by @HeyItsChloe in https://github.com/OpenHands/OpenHands/pull/14887
  • feat(saas-auth): accept api_key cookie as a fallback credential by @tofarr in https://github.com/OpenHands/OpenHands/pull/15101

Bug Fixes

  • fix(jira): make Jira Cloud and Jira DC HTTP timeouts configurable and consistent by @ak684 in https://github.com/OpenHands/OpenHands/pull/15012
  • fix: Fix CVE-2026-44681: Update authlib to >=1.6.12 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14983
  • fix: don't switch LLM profile before the conversation UUID exists (avoids 422) by @ak684 in https://github.com/OpenHands/OpenHands/pull/14900
  • fix(enterprise): log automation HTTP response failures as errors by @wgu9 in https://github.com/OpenHands/OpenHands/pull/15004
  • fix(enterprise): add alembic migration for execution_status column by @tofarr in https://github.com/OpenHands/OpenHands/pull/15030
  • fix(jira-dc): more forgiving repo + mention resolution for Data Center by @ak684 in https://github.com/OpenHands/OpenHands/pull/15034
  • fix(device-verify): rename 'Workspace' dropdown to 'Organization' by @tofarr in https://github.com/OpenHands/OpenHands/pull/15057
  • fix(jira-dc): don't org-gate a personal-workspace Jira DC integration by @ak684 in https://github.com/OpenHands/OpenHands/pull/15036
  • fix: stream LLM tokens for cloud conversations and profile switches by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/15021
  • fix: set email person property in PostHog during onboarding completion by @lilagrc in https://github.com/OpenHands/OpenHands/pull/15070
  • fix: Timezones stored in the db do not have a timezone by @tofarr in https://github.com/OpenHands/OpenHands/pull/15092
  • fix: add test for InMemoryRateLimiter.init to prevent duplicate assignment regression by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14729
  • fix(frontend): stop streamed deltas rendering twice and fragmenting in V1 chat by @shanemort1982 in https://github.com/OpenHands/OpenHands/pull/15108
  • fix: crash when request.client is None in InMemoryRateLimiter by @rakshith1928 in https://github.com/OpenHands/OpenHands/pull/15119
  • fix(sandbox-spec): fall back to defaults when runtime-api has no warm runtimes by @tofarr in https://github.com/OpenHands/OpenHands/pull/15141

Maintenance

  • chore: bump SDK and agent-server to 1.30.0 by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/15079
  • build: pin dependency versions exactly by @rbren in https://github.com/OpenHands/OpenHands/pull/14384
  • ci: add release ready gate by @enyst in https://github.com/OpenHands/OpenHands/pull/14987
  • chore: bump SDK packages to v1.31.1 by @all-hands-bot in https://github.com/OpenHands/OpenHands/pull/15127

New Contributors

  • @ysinghc made their first contribution in https://github.com/OpenHands/OpenHands/pull/14699
  • @rakshith1928 made their first contribution in https://github.com/OpenHands/OpenHands/pull/15119

Full Changelog: https://github.com/OpenHands/OpenHands/compare/cloud-1.40.0...cloud-1.41.0


This PR was generated with Release Please. See documentation.

Security Fixes

  • CVE-2026-44681 — Update authlib to >=1.6.12

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track OpenHands

Get notified when new releases ship.

Sign up free

About OpenHands

OpenHands: AI-Driven Development

All releases →

Related context

Earlier breaking changes

  • v1.8.0 Removes App tab from conversation UI.

Beta — feedback welcome: [email protected]