An entire OpenHands enterprise and security build-out, two windows unreleased (postcss CVE + git-token redaction)

What this changes for operators

• The only mainline release is still 1.8.0 (June 10). Two security fixes that matter to anyone on a build from main are in no tag: the moderate postcss XSS, CVE-2026-41305 (#14770), and a fix that stops a PluginSpec.source containing an embedded git token from being written to the database in plaintext (#14795). New writes are redacted.
• Operators on 1.8.0 have none of this and are not patched. Operators on a build from main should rotate any git token that was embedded in a repo source URL, because pre-fix writes were stored plaintext.