2026-07-01-openhands-new-untagged-cve-fix-on-main-after-cloud-1-40-0-cve-2026

New untagged CVE fix on main after cloud-1.40.0: CVE-2026-44681 authlib >=1.6.12 (commit e6fe505, PR #14983, 2026-06-29) (channel: main-unreleased, 2026-06-29). Operator consequence: A fresh dependency-CVE fix (authlib, an OAuth/auth library) is merged to main but reaches NO tag yet — cloud or OSS. Operators cannot get it via a release; watch for the next cloud tag (likely cloud-1.41.0) to pick it up. This is the new carry-forward item replacing last window's now-resolved batch. Full receipted detail lives in harvest/watchlist.md.

Receipt

https://github.com/OpenHands/OpenHands/commit/e6fe505

Finding metadata

Confidence: high

Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0

Finding ID: 2026-07-01-openhands-new-untagged-cve-fix-on-main-after-cloud-1-40-0-cve-2026

Accepted signals

OpenHands shipped its dependency-CVE fixes on the cloud channel; the OSS 1.8.0 line is frozen and a new CVE already sits untagged on main / 2026-07-01

Source links

Primary links, including exact changelog lines when available.

OpenHands
maintainer commit2026-07-01-openhands-new-untagged-cve-fix-on-main-after-cloud-1-40-0-cve-2026github.com/OpenHands/OpenHands/commit/e6fe505

Versioned source: run artifact