What HolmesGPT/holmesgpt shipped
Written by FoxPlug from public releases; not affiliated with Holmesgpt. An automatic summary of the public release, pull request and commit data of github.com/HolmesGPT/holmesgpt. Holmesgpt did not write it and does not use or endorse FoxPlug. Every line links to the public change it describes.
Get a weekly update like this for your product, free
Week of September 21, 2026
What shipped
- Bash parsing now requires approval for complex syntax including loops, conditionals, and case statements, with dangerous arguments and write redirects checked regardless of parseability. Pull request #2500
- Six Critical/High CVEs in grpc, x/crypto, and Helm dependencies were patched in the Holmes image. Pull request #2494
- The agent now respects account-level opt-out settings that prevent data from reaching hosted models. Pull request #2486
- kubernetes-remediation MCP image was upgraded from 1.3.0 to 1.4.0. Pull request #2481
- Bash toolset documentation now shows actual allow-list prefix examples and explains scoping options. Pull request #2495
Why it matters
This week brings security hardening for bash command execution, vulnerability patches in core dependencies, and better alignment between the agent and platform settings. Documentation improvements make bash configuration clearer for users.
Changelog entry
- Bash commands with loops, conditionals, and case statements now require approval; dangerous arguments and write redirects are checked even when parsing fails Pull request #2500
- Patched six Critical/High CVEs in grpc, x/crypto, and Helm dependencies Pull request #2494
- Agent now reads and enforces account-level opt-out settings for hosted models Pull request #2486
- Bumped kubernetes-remediation MCP image to 1.4.0 Pull request #2481
- Bash toolset documentation now shows real allow-list prefix examples and scoping options Pull request #2495
[0] Bash approval rules tightened for complex syntax. [4] Six CVEs patched. [1] Account opt-out settings now honored. [3] kubernetes-remediation MCP 1.4.0. [2] Bash docs clarified.
This week's HolmesGPT updates focus on security and reliability. [0] Bash command execution now requires approval for complex syntax patterns. [4] Six Critical/High CVEs in dependencies were resolved. [1] The agent respects account-level opt-out settings for hosted models. [3] kubernetes-remediation MCP upgraded to 1.4.0. [2] Bash toolset documentation improved with real prefix examples.
Week of September 14, 2026
What shipped
- Fixed command injection vulnerability where propagated HTTP headers bypassed parameter sanitization in the YAML tool shell. Pull request #2467
- Fixed privilege escalation where conversation worker identity was not bound to the Conversations row owner. Pull request #2480
- Constrained impact claims in narratives to observed evidence, removing invented consequences from failure analysis. Pull request #2449
- Removed kube-lineage entirely from the repository as part of dependency cleanup. Pull request #2464
- Hardened kubernetes-remediation file-read policy defaults in the Helm chart to restrict auto-approved container file reads. Pull request #2479
- Fixed Coralogix UI permalinks to use the correct team UI hostname for US2 and other regions. Pull request #2474
- Added GPU node diagnostics support to kubernetes-remediation MCP for debugging GPU nodes without GPU allocation. Pull request #2462
- Added namespaceScopedRBAC Helm value to support namespace-scoped Holmes installations. Pull request #2469
- Added configurable request timeout for New Relic toolset via
timeout_secondsparameter. Pull request #2457 - Stopped the LLM from claiming a rejected command is awaiting approval when approval flow is unavailable. Pull request #2461
Why it matters
This week addresses multiple security issues including command injection and privilege escalation vulnerabilities. The fixes improve reliability of failure analysis by constraining claims to observed evidence, and expand capabilities with GPU diagnostics and regional support for observability platforms.
Changelog entry
- Security: Fixed command injection in propagated HTTP headers reaching YAML tool shell (CWE-78) Pull request #2467
- Security: Fixed privilege escalation where conversation worker identity was not bound to row owner (CWE-639/862/863) Pull request #2480
- Security: Hardened kubernetes-remediation file-read policy defaults in Helm chart (ROB-973) Pull request #2479
- Improved failure narratives to constrain impact claims to observed evidence only Pull request #2449
- Added GPU node diagnostics support to kubernetes-remediation MCP Pull request #2462
- Added namespaceScopedRBAC Helm value for namespace-scoped installations Pull request #2469
- Fixed Coralogix UI permalinks for US2 and other regions Pull request #2474
- Added configurable request timeout for New Relic toolset Pull request #2457
- Fixed LLM messaging when tool approval is not available Pull request #2461
- Removed kube-lineage dependency from repository Pull request #2464
- Documented Baseten Model APIs as a provider Pull request #2483
0.42.0 ships security fixes for command injection and privilege escalation, hardened file-read policies, GPU diagnostics, and corrected failure analysis to constrain claims to evidence.
0.42.0 is out. This release hardens security with fixes for command injection and privilege escalation vulnerabilities, tightens file-read policy defaults, adds GPU node diagnostics, supports namespace-scoped deployments, and improves failure narratives by constraining claims to observed evidence only.