← back to report

OpenHands/OpenHands

// all events — 2026-06-27

Type AI Score Description Actor Reason Date
commit 1.00 fix: Fix CVE-2026-48779: Update ws to 8.21.0 (#15007) Contains 'Co-authored-by' with a bot, st 2026-06-26
commit 1.00 chore(security): add Python dependency freshness guardrails Commit message contains explicit AI assi 2026-06-26
commit 1.00 fix: self-heal stale LiteLLM user on re-onboarding (#14932) Commit message contains explicit AI assi 2026-06-22
commit 1.00 chore: purge dead acp_env field footprint (removed in SDK 1. Commit message contains explicit AI assi 2026-06-22
commit 1.00 test: PLTF-1269 replace test_should_ naming with test_verb_n Commit message contains explicit AI assi 2026-06-21
commit 1.00 refactor: extract billing test fixtures for PLTF-1269 (#1399 Commit message contains explicit AI assi 2026-06-21
commit 1.00 test: replace real sleeps in maintenance runner tests (#1393 Commit message contains explicit AI assi 2026-06-21
commit 1.00 fix: Fix CVE-2026-53539: Update python-multipart to >=0.0.30 Commit message co-authored by a bot, lik 2026-06-17
commit 1.00 fix: Fix CVE-2026-12143: Update form-data to 4.0.6 (#14875) Commit attributed to a bot, indicating A 2026-06-17
commit 1.00 docs: revise source code links in README.md Explicitly states an AI agent generated 2026-06-17
commit 1.00 feat: encode harness in chip icon, surface model in chip tex Commit message contains explicit AI assi 2026-06-17
commit 1.00 fix: Fix CVE-2026-54278: Update aiohttp to 3.14.1 (#14871) CVE bot as coauthor points to AI-generat 2026-06-17
commit 1.00 fix: Fix CVE-2026-49855: Update tornado to 6.5.7 (#14856) Commit coauthored by CVE Fix Bot; likely 2026-06-17
commit 1.00 build(deps): bump SDK packages to v1.28.0 (#14753) Commit message contains explicit AI assi 2026-06-15
commit 1.00 fix(acp): surface acp_server on cloud conversations so the m Commit message contains explicit AI assi 2026-06-15
commit 1.00 refactor(settings): delegate agent-settings merge to SDK app Commit message contains explicit AI assi 2026-06-15
commit 1.00 feat(acp): allow MCP server config for ACP agents (#14613) Commit message contains explicit AI assi 2026-06-15
commit 1.00 fix: redact credentials from PluginSpec.source during serial Commit message contains explicit AI assi 2026-06-13
pr 1.00 Add Russian (ru) language support to i18n PR body explicitly mentions AI collabora 2026-05-05
pr 1.00 ci: add release ready gate PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 fix: Fix CVE-2026-44681: Update authlib to >=1.6.12 PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 fix: Fix CVE-2026-53571: Update vite to ^7.3.5 PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 feat(org): Add organization conversation admin dashboard PR body explicitly mentions AI collabora 2026-06-16
pr 1.00 feat: Add full Git history user setting PR body explicitly mentions AI collabora 2026-06-23
pr 1.00 feat: Use interrupt endpoint for agent pause UI PR body explicitly mentions AI collabora 2026-06-24
pr 1.00 fix: Fix CVE-2026-54285: Update @opentelemetry/core to 2.8.0 PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 fix: Fix GHSA-4xgf-cpjx-pc3j: Update pydantic-settings to 2. PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 fix: Fix CVE-2026-48712: Update protobufjs to 7.6.4 PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 fix: handle None git_full_clone from DB in SaasSettingsStore PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 feat: add default_sandbox_spec_id to user settings PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 fix: Fix CVE-2026-48779: Update ws to 8.21.0 PR body explicitly mentions AI collabora 2026-06-26
pr 1.00 feat(enterprise/auth): super-admin management endpoint (gran PR body explicitly mentions AI collabora 2026-06-26
pr 1.00 feat(enterprise/auth): add super roles via user.role_id with PR body explicitly mentions AI collabora 2026-06-23
pr 1.00 chore(security): add dependency age guardrails PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 feat(app_server): inject self-hosted provider host (BITBUCKE PR body explicitly mentions AI collabora 2026-06-25
pr 1.00 feat: add sandbox_id placeholder to URL patterns for path-ba PR body explicitly mentions AI collabora 2026-05-03
pr 1.00 chore: add import-linter forbidden-import contracts for ente PR body explicitly mentions AI collabora 2026-05-15
pr 1.00 fix: prevent agent_context=null from corrupting org settings PR body explicitly mentions AI collabora 2026-06-07
pr 1.00 Update default agent server image to 1.23.1 PR body explicitly mentions AI collabora 2026-06-01
pr 1.00 Fix CVE-2026-41238: Update dompurify to 3.4.0 PR body explicitly mentions AI collabora 2026-06-01
pr 1.00 Avoid Keycloak full scan in Resend sync PR body explicitly mentions AI collabora 2026-05-26
pr 0.60 chore: remove cloud-line release-please bootstrap last-relea AGENT section used for free-text; formal 2026-06-24
pr 0.20 feat: add Astraflow provider support Generic provider summary but some human 2026-05-15
pr 0.20 fix: the github proxy endpoints lack rate limiting c... in.. Template plus terse issue-focused summar 2026-06-24
pr 0.15 fix: preserve user LLM settings (extra_headers, etc.) in _co More verbose, but technical and concrete 2026-05-16
pr 0.15 fix(backend): add WebSocket and HTTP proxy for K8s deploymen Slightly formal summary but technical, l 2026-01-24
pr 0.15 fix: return 404 for missing custom secrets Bullet format, precise; slightly formal 2026-05-15
commit 0.10 feat(jira-dc): email-mode auto-link, targeted repo lookup, a Domain-specific, concise, human-style te 2026-06-26
commit 0.10 feat(azure-devops): add resolver mentions + org-level one-cl Technical, detailed, direct language wit 2026-06-26
pr 0.10 fix: return actionable error when Jira DC token endpoint is Concise and domain-specific explanation, 2026-06-25
pr 0.10 feat: Add dynamic marketplace support for plugin registratio Clear technical explanation, matches hum 2026-06-18
pr 0.10 feat(app-server): paginate V1 branch search with non-empty q PR content is domain-specific, concise, 2026-04-19
pr 0.10 fix(secrets): return 404 when secret not found in update_cus Direct bug explanation with issue refere 2026-05-06
pr 0.10 Restore "Stay Logged In" feature (was wiped from #14367 by f Direct, domain-focused explanation; no A 2026-05-13
pr 0.10 Add Azure DevOps resolver mentions Technical bullet list; direct and specif 2026-05-27
pr 0.10 feat: add NVIDIA NIM support to OpenHands Free-text is concise, domain-specific, n 2026-06-23
pr 0.10 fix(app_server): serialize ProcessSandboxService port alloca Technical detail, in-line error descript 2026-04-28
pr 0.10 fix(resend-sync): switch to createdAfter delta fetch Detailed, domain-focused explanation, no 2026-05-04
pr 0.10 fix: paginate branch search results Changelog and testing notes, technical, 2026-05-15
pr 0.10 fix: allow attachment-only chat submit Concise, bullet style; uses domain terms 2026-05-15
pr 0.10 test(frontend): add V1 pending message queue coverage Concise, technical, contains domain-spec 2026-06-16
pr 0.10 fix: apply disabled_skills filter in conversation skills end Technical, uses specific endpoint names, 2026-06-24
pr 0.10 fix: align DELETE sandbox path param with handler arg name Describes technical mismatch with concis 2026-06-24
pr 0.10 feat: add multi-repo dependency support (closes #11938) Technical explanation, informal, clear h 2026-06-24
pr 0.10 fix(frontend): preserve returnTo through the onboarding inte Informal, concise, and specific technica 2026-05-09
pr 0.05 fix: preserve configured LLM settings Free-text is technical and terse, with c 2026-05-17
pr 0.05 feat: add dependency_repos field to clone additional reposit Concise technical summary, includes doma 2026-06-11
pr 0.05 fix(jira): make Jira Cloud and Jira DC HTTP timeouts configu Informal, domain-specific, and to-the-po 2026-06-26
pr 0.05 fix: honor sandbox runtime image override Short summary and technical; human abbre 2026-05-16
pr 0.05 fix: hide generated JSON action summaries Technical jargon and brief structure; hu 2026-05-16
pr 0.05 fix: infer docker sandbox host port from web url Terse, technical, uses common repo terms 2026-05-16
pr 0.05 fix: title API conversations from initial message Direct technical summary, clear domain c 2026-05-16
pr 0.05 feat: proxy runtime git/changes and git/diff via app-convers Very concise technical phrasing, typical 2026-06-01
commit 0.00 fix(jira): make Jira Cloud and Jira DC HTTP timeouts configu Terse, domain-specific commit message; n 2026-06-27
commit 0.00 chore(main): release cloud 1.40.0 (#14969) — 2026-06-26
commit 0.00 chore(deps-dev): bump jupyterlab from 4.5.7 to 4.5.9 (#15009 — 2026-06-26
commit 0.00 fix: remove duplicate Close button on the org invite links m Terse commit message, typical for humans 2026-06-26
commit 0.00 fix(llm): restore managed member-key fallback in effective L Commit uses terse technical language and 2026-06-25
commit 0.00 fix: return actionable error when Jira DC token endpoint is Direct, technical phrasing with actionab 2026-06-25
commit 0.00 feat: add default_sandbox_spec_id to user settings (#14985) Standard abbreviation and direct phrasin 2026-06-25
commit 0.00 fix(frontend): stop polling app-conversations with task IDs Technical bugfix note; abbreviations and 2026-06-25
commit 0.00 fix: handle None git_full_clone from DB in SaasSettingsStore Direct handling described, includes doma 2026-06-25
commit 0.00 fix: Fix CVE-2026-48712: Update protobufjs to 7.6.4 (#14981) Security fix message, co-author is a CVE 2026-06-25
commit 0.00 fix: Fix GHSA-4xgf-cpjx-pc3j: Update pydantic-settings to 2. CVE fix with explicit versioning; co-aut 2026-06-25
commit 0.00 fix: Fix CVE-2026-54285: Update @opentelemetry/core to 2.8.0 CVE update; no signs of AI text or phras 2026-06-25
commit 0.00 docs: fix dead link to self-hosting guide in README (#14975) Simple documentation fix, human co-autho 2026-06-25
commit 0.00 fix: avoid decrypting org_member.llm_api_key when not set (# Concise technical changelog, standard co 2026-06-24
commit 0.00 feat: Use interrupt endpoint for agent pause UI (#14972) Succinct PR title, human-like commit str 2026-06-24
commit 0.00 feat(enterprise): add admin user-provisioning endpoint (#148 Technical commit, brief and domain-speci 2026-06-24
commit 0.00 feat: Add full Git history user setting (#14950) Straightforward function addition, no AI 2026-06-24
commit 0.00 chore(main): release cloud 1.39.0 (#14748) — 2026-06-24
commit 0.00 fix: Fix CVE-2026-8723: Update qs to 6.15.2 (#14957) Short vulnerability fix message, standar 2026-06-24
commit 0.00 fix: Fix CVE-2026-54283: Update starlette to 1.3.1 (#14874) Security update commit, follows routine 2026-06-24
commit 0.00 fix: Fix CVE-2026-41691: Update i18next-http-backend to 3.0. Brief, factual security update with doma 2026-06-24
commit 0.00 fix: Fix GHSA-cmwh-pvxp-8882: Update dompurify to 3.4.11 (#1 Standard security changelog, no AI phras 2026-06-24
commit 0.00 fix: Fix GHSA-jm82-fx9c-mx94: Update pypdf to >=6.13.3 (#149 Direct CVE fix format, matches human eng 2026-06-24
commit 0.00 fix: binaryornot Python 3 crash on binary reads (#14518) Terse description of bug fix, typical hu 2026-06-24
commit 0.00 fix: Fix CVE-2026-44727: Update jupyter-server to 2.20.0 (#1 Git trailer shows automated bot, no AI s 2026-06-23
commit 0.00 fix: Fix CVE-2026-49458: Update dompurify to 3.4.6 (#14872) Git trailer shows automated bot, no AI s 2026-06-23
commit 0.00 fix: Fix GHSA-6v7p-g79w-8964: Update msgpack to 1.2.1 (#1494 Git trailer shows automated bot, no AI s 2026-06-23
commit 0.00 fix: Fix CVE-2026-45409: Update idna to 3.15 (#14946) Git trailer shows automated bot, no AI s 2026-06-23
commit 0.00 fix: Fix GHSA-gj48-438w-jh9v: Update bleach to 6.4.0 (#14945 Git trailer shows automated bot, no AI s 2026-06-23
commit 0.00 feat: add sub-agent task (TaskToolSet) visualizer to the cha Git trailer shows bot, no AI signals in 2026-06-23
commit 0.00 fix: load global user & org skills without a selected reposi Short message, informal, no AI signals. 2026-06-23
commit 0.00 feat: Support Slack attachments in agent context (#14934) Co-authored by bot; free text is concise 2026-06-23
commit 0.00 fix: Forgejo/Gitea clone failure when hosted under a subpath Terse, issue-referenced commit message; 2026-06-22
commit 0.00 docs: fix broken README urls (#14907) Very terse and domain-specific, clearly 2026-06-19
commit 0.00 fix: prevent conversation export overload (#14899) Commit message is terse and technical, t 2026-06-18
commit 0.00 feat: PLTF-2968 allow per-deployment resolver macro via OH_R Brief, domain-specific commit message wi 2026-06-18
commit 0.00 fix: clean up LLM Profile auth fields (dedupe variant sectio Contains abbreviations, casual style, an 2026-06-18
commit 0.00 fix: PLTF-2956 Tests for GitHub payload-processing failure l Human engineering tone, ticket reference 2026-06-18
commit 0.00 chore: bump SDK and agent-server to 1.29.0 (#14889) Standard technical changelog with ticket 2026-06-18
commit 0.00 fix(frontend): send on Enter for touchscreen laptops (#14870 Domain jargon, concise, informal, no AI 2026-06-18
commit 0.00 feat: surface a clear error when a custom sandbox image's ag Direct, technical commit message with do 2026-06-18
commit 0.00 fix: post Bitbucket DC comments as the bot account and backg Human-style description with abbreviatio 2026-06-18
commit 0.00 fix: revert conversation limit enforcement from #14168 (#148 Terse, domain-specific phrasing and no A 2026-06-17
commit 0.00 fix: PLTF-2956 Log 5xx responses at error level in Automatio Typical commit style; 'co-authored-by' u 2026-06-17
commit 0.00 fix(frontend): skip Git-related API calls when no Git provid Domain-specific, concise, and co-authore 2026-06-17
commit 0.00 feat: PLTF-2956 parallelize GitHub GraphQL queries in get_su Technical feature message, no AI or bot 2026-06-17
commit 0.00 fix: decouple API-key (Bearer) auth from Keycloak offline se Direct technical language; no indication 2026-06-17
commit 0.00 fix: log error level for failed GitHub payload processing (# Concise commit message with domain terms 2026-06-17
commit 0.00 docs(skills): fix typo in OpenHands docs URL in add_agent.md Terse, domain-specific typo fix typical 2026-06-17
commit 0.00 fix: PLTF-2956 log level from warning to error for automatio Standard terse commit message with domai 2026-06-16
commit 0.00 feat: add DynamicRemoteSandboxSpecService backed by runtime- Contains domain-specific jargon and conc 2026-06-16
commit 0.00 fix: Fix CVE-2026-48526: Update pyjwt to 2.13.0 (#14854) Follows standard CVE fix pattern; no AI 2026-06-16
commit 0.00 fix: PLTF-2956 batch_get_sandboxes to gracefully handle runt Brief, domain-targeted summary; no AI st 2026-06-16
commit 0.00 chore(deps): bump pyjwt from 2.12.1 to 2.13.0 (#14852) — 2026-06-16
commit 0.00 docs: Bring README.md over from Agent Canvas (#14844) Typical docs migration message, minimal 2026-06-16
commit 0.00 fix: API key CORS header handling (#14835) Terse, technical description, no AI sign 2026-06-16
commit 0.00 fix: renumber duplicate migration 122 → 123 (drop is_paused) Concise technical correction, uses domai 2026-06-16
commit 0.00 fix: use runtime /list API for sandbox concurrency count, no Direct, technical commit with abbreviati 2026-06-16
commit 0.00 fix: write trajectory exports as utf-8 (#14810) Short, actionable phrase; standard human 2026-06-16
commit 0.00 feat(jira-dc): share linked OAuth token with eligible conver Jargon-heavy summary, consistent with hu 2026-06-16
commit 0.00 feat(jira-dc): persist and inject per-user OAuth tokens in r Concise technical language and domain-sp 2026-06-16
commit 0.00 fix: duplicate Slack no-repository selections (#14833) Brief, domain-specific, informal commit 2026-06-15
commit 0.00 fix: Ignore OpenHands bot GitHub resolver events (#14832) Short, technical commit with clear domai 2026-06-15
commit 0.00 fix: Use final response endpoint for resolver callbacks (#14 Direct, domain-specific commit message, 2026-06-15
commit 0.00 fix: Add SaaS migration for sandbox pause state (#14829) Concise, technical message; lacks AI sty 2026-06-15
commit 0.00 feat(APP-2136): expose automations menu item for all users ( Technical description; APP-2136 is speci 2026-06-15
commit 0.00 feat: enforce conversation limits (#14168) Short, to the point, domain-relevant mes 2026-06-15
commit 0.00 fix(frontend): avoid dirty language filter input (#14812) Direct technical fix with jargon, no AI 2026-06-15
commit 0.00 fix: default enterprise injector kinds in the image, not jus Brief, technical, lacks AI phrasing or f 2026-06-15
commit 0.00 fix: reconcile and label per-(user,org) LiteLLM managed keys Short commit, terse technical phrasing, 2026-06-14
commit 0.00 feat: OHE multi-model LLM discovery + BYOK gating (proxy dis Concise, domain-specific, no AI hallmark 2026-06-14
commit 0.00 feat: explicit OH_DEPLOYMENT_MODE flag; gate cloud-account C Commit message uses domain abbreviations 2026-06-13
commit 0.00 feat: accept pending invitations by verified-email match at Brief, technical commit message with pro 2026-06-13
commit 0.00 feat: expose copyable invite links so invitations work witho Human-style, minimal commit with domain- 2026-06-13
commit 0.00 fix(frontend): accept typed emails without requiring Space i Commit is concise and refers to UI speci 2026-06-12
commit 0.00 fix(frontend): hydrate the LLM profile edit form from the se Uses terse, specific language typical of 2026-06-12
commit 0.00 fix(frontend): only render the API key input once a provider Commit message is concise and reflects h 2026-06-12
commit 0.00 fix(frontend): treat managed openhands base URLs as provider All items are terse, technical commit me 2026-06-12
commit 0.00 feat: auto-accept invitation links instead of the confirm/ca Terse, domain-specific language, no AI s 2026-06-12
commit 0.00 fix: delete LiteLLM user on personal org reset (#14700) Brief, technical fix description typical 2026-06-12
pr 0.00 fix(app-server): preserve selected repository across webhook Human troubleshooting description and ca 2026-06-27
pr 0.00 feat: implement semantic file chunking using tree-sitter AST Short, informal explanation common to hu 2026-06-07
pr 0.00 feat(app-server): archive workspace before delete, and captu Brief, local review note; human technica 2026-06-24
pr 0.00 feat(frontend): show "Delivering..." status for queued messa Structured, specific, and contains casua 2026-05-20
pr 0.00 fix: run .openhands setup.sh with POSIX source Has technical shorthand, minor sentence 2026-06-27
pr 0.00 fix: correctly raise 404 when updating or deleting a nonexis Contains typos/casual phrasing; clear hu 2026-05-01
pr 0.00 feat: Support Personal Skills/Agent Repo via Settings Contains domain-specific content and inf 2026-05-02
pr 0.00 Change port mapping from 3000 to 3202 Truncated, possibly human-incomplete; no 2026-05-06
pr 0.00 fix(git): support paginated branch search queries Contains error analysis and inline detai 2026-05-16
pr 0.00 chore(main): release 1.9.0 — 2026-06-10
pr 0.00 chore(main): release cloud 1.40.1 — 2026-06-27
pr 0.00 feat(enterprise): add admin user-provisioning endpoint Template content and minimal free-text, 2026-06-17
pr 0.00 fix: avoid decrypting org_member.llm_api_key when not set Casual, humorous phrasing clearly writte 2026-06-18
pr 0.00 docs: fix dead link to self-hosting guide in README Human-written correction, uses informal, 2026-06-25
pr 0.00 fix(frontend): stop polling app-conversations with task IDs Standard template, technical language, h 2026-06-25
pr 0.00 fix(llm): restore managed member-key fallback in effective L Template content; human free-text sectio 2026-06-25
pr 0.00 chore(security): add Python dependency freshness guardrails Technical context, correctly informal, n 2026-04-03
pr 0.00 fix: remove duplicate Close button on the org invite links m Direct, technical free text, and informa 2026-06-25
pr 0.00 chore(deps-dev): bump jupyterlab from 4.5.7 to 4.5.9 — 2026-06-26
pr 0.00 feat(azure-devops): add resolver mentions + org-level one-cl Concise, domain-specific PR content with 2026-06-25
pr 0.00 feat(jira-dc): email-mode auto-link, targeted repo lookup, a Uses technical detail and concise summar 2026-06-26
pr 0.00 chore(main): release cloud 1.40.0 — 2026-06-24
pr 0.00 fix: path param mismatch in delete_sandbox breaks DELETE /sa Human-written, short, concrete explanati 2026-06-20
pr 0.00 feat(azure-devops): post resolver replies as a service-accou Terse, domain-specific summary typical o 2026-06-26
pr 0.00 chore(deps): bump the security-all group across 1 directory — 2026-06-26
pr 0.00 chore(deps): bump the version-all group across 1 directory w — 2026-06-23
pr 0.00 chore(deps): bump ws from 8.19.0 to 8.21.0 in /frontend in t — 2026-06-25
pr 0.00 chore(deps): bump the version-all group in /enterprise with — 2026-06-26
pr 0.00 chore(deps): bump mcp from 1.27.1 to 1.28.0 in the mcp-packa — 2026-06-08
pr 0.00 chore(deps-dev): bump the eslint group across 1 directory wi — 2026-06-04
pr 0.00 fix(config): ignore malformed Ollama tags responses Human verification present, technical ca 2026-06-24
pr 0.00 feat: OpenHands Gateway and V1 routing for self-hosted deplo Human-verified, terse changelog, not AI- 2026-06-19
pr 0.00 fix(enterprise): log automation HTTP response failures as er Direct and concise; summary matches huma 2026-06-26
pr 0.00 test: ops box write-path self-test (ignore, closing) Informal language, self-test, and direct 2026-06-26
pr 0.00 fix(integrations): deduplicate merged repositories by full_n Human context, specific method names, ty 2026-04-19
pr 0.00 chore(deps): bump OpenHands/extensions from 0.4.1 to 0.5.0 — 2026-06-26
pr 0.00 chore(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 — 2026-06-26
pr 0.00 chore(deps): bump docker/metadata-action from 6.0.0 to 6.1.0 — 2026-06-26
pr 0.00 chore(deps): bump snok/install-poetry from 1.4.1 to 1.4.2 — 2026-06-26
pr 0.00 chore(deps): bump actions/checkout from 6 to 7 — 2026-06-26
pr 0.00 chore(deps): bump node from 25.9-trixie-slim to 26.4-trixie- — 2026-06-26
pr 0.00 chore(deps): bump actions/setup-python from 6 to 6.2.0 — 2026-06-26
pr 0.00 docs: document TrustedRouter LLM config Direct and concise, with domain context 2026-06-12
pr 0.00 - No free-text content; only a dash—certai 2026-05-04
pr 0.00 chore(deps): bump the security-all group across 1 directory — 2026-06-24
pr 0.00 fix: allow max_num_sandboxes=1 by accepting 0 in pause_old_s Informal and technical explanation typic 2026-06-25
pr 0.00 test: enforce GitHub Actions pinning policy No substantive free-text content in PR d 2026-06-21