v1.48.0

What's Changed

• fix(ci): open PR for merged artifact cleanup by @enyst in #4933
• fix(tools): add logging filter to redact secrets from libtmux log output by @all-hands-bot in #4871
• fix(sdk): add sk-oh-* OpenHands API key pattern to redact_api_key_literals by @all-hands-bot in #4947
• Fail over to fallback LLM immediately on hard quota exhaustion by @all-hands-bot in #4917
• fix(llm): remove LLM.modify_params past its v1.47.0 removal deadline by @enyst in #4954
• fix(acp): materialise only the running provider's file secrets by @simonrosenberg in #4927
• chore(deps): bump cryptography from 48.0.1 to 50.0.0 by @dependabot[bot] in #4948
• chore: forbid getattr and setattr in SDK by @neubig in #4906
• ci: check Python API breakage on release PRs by @neubig in #4971
• fix(sdk): generate titles with Responses and subscription streaming by @neubig in #4968
• fix(ts-client): reject browser-only downloads early in Node.js by @BORAN002 in #4982
• chore: remove merged PR artifacts by @all-hands-bot in #5020
• feat(profiles): scope which secrets an agent profile receives by @simonrosenberg in #4931
• feat(agent-server): conversation-scoped runtime APIs and clients by @neubig in #4966
• chore(ts-client): bump pinned agent-server image to 1.47.0 and regen types by @juanmichelini in #4970
• feat(sdk): extend existing conversation and workspace APIs for automation by @neubig in #5010
• chore(deps): bump pip from 26.1 to 26.2 by @dependabot[bot] in #4949
• chore: enable Dependabot uv ecosystem by @neubig in #5050
• chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #4047
• chore(deps): bump slackapi/slack-github-action from 3.0.3 to 4.0.0 by @dependabot[bot] in #4128
• chore(deps): bump ws from 8.21.2 to 8.21.3 in /clients/typescript by @dependabot[bot] in #4719
• chore(deps): bump @babel/preset-env from 7.29.5 to 8.0.2 in /clients/typescript by @dependabot[bot] in #4722
• chore(deps-dev): bump setuptools from 80.9.0 to 83.0.0 by @dependabot[bot] in #5045
• chore(deps): bump docker/login-action from 4.4.0 to 4.6.0 by @dependabot[bot] in #4724
• chore(deps): bump typescript-eslint from 8.67.0 to 8.70.0 in /clients/typescript by @dependabot[bot] in #5052
• chore(deps): bump @typescript-eslint/parser from 8.67.0 to 8.70.0 in /clients/typescript by @dependabot[bot] in #5053
• chore: isolate Dependabot uv updates by @neubig in #5060
• fix(agent-server): delegate MCP OAuth callback to FastMCP instead of forking it by @VascoSch92 in #4821
• feat(workspace): add AgentSandboxWorkspace (Kubernetes, kubernetes-sigs/agent-sandbox) by @aleks-stefanovic in #4516
• chore(deps): bump cachetools from 5.5.2 to 7.1.8 by @dependabot[bot] in #5059
• chore(deps): bump actions/checkout from 4 to 7 by @dependabot[bot] in #5065
• chore(deps): bump MishaKav/pytest-coverage-comment from 1.10.0 to 1.12.2 by @dependabot[bot] in #5064
• ci: accept the existing search limit schema repair by @enyst in #5032
• chore(deps): update griffe[pypi] requirement from >=2.0.0 to >=2.3.0 by @dependabot[bot] in #5057
• chore(deps): bump packaging from 25.0 to 26.3 by @dependabot[bot] in #5056
• chore(deps): bump nefrob/pr-description from 1.2.0 to 1.3.0 by @dependabot[bot] in #4129
• chore(deps): bump lewagon/wait-on-check-action from 1.7.0 to 1.9.1 by @dependabot[bot] in #4044
• chore(deps): bump docker/build-push-action from 7.1.0 to 7.3.0 by @dependabot[bot] in #3958
• chore(deps): bump @babel/core from 8.0.1 to 8.0.5 in /clients/typescript by @dependabot[bot] in #5062
• chore(deps): bump @babel/preset-env from 8.0.2 to 8.0.5 in /clients/typescript by @dependabot[bot] in #5061
• chore(deps): bump eslint from 10.8.1 to 10.10.0 in /clients/typescript by @dependabot[bot] in #5051
• chore(deps): bump uvicorn from 0.37.0 to 0.52.4 by @dependabot[bot] in #5066
• chore(deps): bump @types/node from 26.2.0 to 26.5.1 in /clients/typescript by @dependabot[bot] in #5063
• test(ts-client): migrate from Jest to Vitest by @neubig in #5075
• fix(sdk): strip inline reasoning from LLM-generated titles by @aniketwaghh in #4703
• fix(agent-server): enforce the paginated search limit by @mkuri in #4991
• fix(agent-server): use a minimal Debian Python/Node runtime by @neubig in #5077
• test(examples): exclude agent-sandbox example from example tests by @VascoSch92 in #5083
• fix(sdk): don't deep-copy the agent LLM in ask_agent by @VascoSch92 in #5085
• Release v1.48.0 by @all-hands-bot in #5079

New Contributors

• @BORAN002 made their first contribution in #4982
• @aleks-stefanovic made their first contribution in #4516
• @aniketwaghh made their first contribution in #4703
• @mkuri made their first contribution in #4991

Full Changelog: v1.47.0...v1.48.0