Skip to content

v0.38.7

Choose a tag to compare

View all tags
@github-actions github-actions released this 08 Nov 23:15
v0.38.7
c99537c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Security updates in the agent harnesses' own dependencies. The first start after upgrading reinstalls 7 harnesses once.

Upgrading

  • Hermes, Qwen Code, Aider, Agent Zero, Mistral Vibe, System One and Pi are reinstalled once, at the first start after the upgrade, from their updated locks. That took under 5 minutes on the amd64 host we measured. Later starts install nothing.

What changed

Of the package versions in the harness locks that carry a published advisory, these are the ones a harness actually reaches: it decodes the image, opens the repository, or connects to the remote server. Each moves to its first fixed release (#656):

Harness Moved Why it matters here
Hermes Pillow 12.2.0 → 13.0.0, certifi → 2026.10.19 its vision tool decodes workspace images
Qwen Code sharp 0.35.4 → 0.35.5 (libvips with it) its image view reads an image's metadata before checking its type, so an SVG reached librsvg
Aider GitPython 3.1.46 → 3.2.1, certifi, anyio 4.12.1 → 4.14.2 it opens the session's repository with GitPython
Agent Zero mcp 1.27.0 → 1.30.0, certifi it connects to remote MCP servers
Mistral Vibe mcp 1.28.1 → 1.30.0, certifi it connects to remote MCP servers
System One mcp 2.1.1 → 2.2.0, anyio → 4.14.2 it connects to remote MCP servers
Pi (MCP adapter) @modelcontextprotocol/client and core 2.0.0 → 2.3.1 it connects to remote MCP servers with custom headers
  • certifi: releases before 2026.10.18 trust a certificate authority whose intermediate keys leaked. The image's own Python, the system certificate store and Node's built-in roots don't include it.
  • The MCP clients: a cross-origin redirect could carry a server's headers to another host.
  • How: each harness's own pins are unchanged. The new versions come in as overrides beside its lock, re-locked at the same cutoff, so nothing else moved. Every hash still matches the file PyPI or npm published.
  • Not in this release: nanobot's PDF reader. Its advisories are denial of service on files the session itself supplies, and the fix needs nanobot 0.4.

Checked

On 0.38.7-rc.1, on an existing volume upgraded from 0.38.6:

  • Reinstall: the 7 harnesses reinstalled from their locks with no warning.
  • Real tasks: a first turn, a follow-up, a model switch and back, a file the task must produce, and a sandbox recycle passed on Hermes, Pi, Qwen Code, Agent Zero, Mistral Vibe and Aider. System One completed its built-in order desk.
  • The updated decoders on real images: Hermes's vision tool read a PNG under Pillow 13, and Qwen Code's image view read one under sharp 0.35.5.
  • MCP: a plugin's MCP tool was called over stdio, SSE and streamable HTTP on every updated harness.
  • Fresh volume: the release gate installed all 30 harnesses on amd64 and arm64, and the second start installed nothing.
  • The release's tree is identical to the candidate's.

Full Changelog: v0.38.6...v0.38.7

Assets 2
Loading