Evidence record / openhands

A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.

Security: Fix CVE-2026-42305 via dulwich upgrade to 1.2.5

What Changed

Updated dulwich library to version 1.2.5 to address CVE-2026-42305 security vulnerability affecting git operations.

Operator Implication

Operators must deploy this security patch to mitigate CVE-2026-42305 exposure in git operations library. Git-based workflows may be affected if vulnerability is exploitable.

Receipt

Commit 3eb16a9 (2026-06-03T17:16:58Z): ‘Fix CVE-2026-42305: Update dulwich to 1.2.5 (#14626)’ - Git library vulnerability remediation in poetry.lock (enterprise

Finding metadata

Confidence: high
Actionability: test
Accessibility impact: none

Run: 2026-06-03-weekly-digest-2026-05-28_2026-06-03-frontier-v0

Finding ID: 2026-06-03-openhands-cve-2026-42305-dulwich

Accepted signals

Upgrade dulwich to 1.2.5 to close CVE-2026-42305 in git operations / 2026-06-03

Source links

Primary links, including exact changelog lines when available.

OpenHands
commitCommit 3eb16a9 (2026-06-03T17:16:58Z): 'Fix CVE-2026-42305: Update dulwich to 1.2.5 (#14626)' - Git library vulnerability remediation in poetry.lock (enterprise and root directories)github.com/OpenHands/OpenHands/commit/3eb16a9

Versioned source: run artifact