Evidence record / openhands
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the signals and issues that cite it, below.
2026-07-01-openhands-new-untagged-cve-fix-on-main-after-cloud-1-40-0-cve-2026
New untagged CVE fix on main after cloud-1.40.0: CVE-2026-44681 authlib >=1.6.12 (commit e6fe505, PR #14983, 2026-06-29) (channel: main-unreleased, 2026-06-29). Operator consequence: A fresh dependency-CVE fix (authlib, an OAuth/auth library) is merged to main but reaches NO tag yet — cloud or OSS. Operators cannot get it via a release; watch for the next cloud tag (likely cloud-1.41.0) to pick it up. This is the new carry-forward item replacing last window’s now-resolved batch. Full receipted detail lives in harvest/watchlist.md.
Receipt
Finding metadata
Run: 2026-07-01-weekly-digest-2026-06-24_2026-07-01-frontier-v0
Finding ID: 2026-07-01-openhands-new-untagged-cve-fix-on-main-after-cloud-1-40-0-cve-2026
Source links
Primary links, including exact changelog lines when available.
Versioned source: run artifact