Shipped · Observability

What HolmesGPT/holmesgpt shipped

The public repository of Holmesgpt · github.com/HolmesGPT/holmesgpt

Written by FoxPlug from the repository's own releases; not affiliated with Holmesgpt. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/HolmesGPT/holmesgpt; Holmesgpt did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

Follow holmesgpt's weekly shipped digest

Week of October 5, 2026

What shipped

Why it matters

This week brought release 0.43.0 along with changes that affect how conversations run day to day: fast mode is now the default, the auto executor runs one conversation at a time, and conversations run on named executors that separate user chats from alert triage. The Kubernetes MCP addon gained per-user Dex auth with private CA support, and several fixes make usage pricing and tool calls more reliable.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Holmes 0.43.0 is out. Fast mode is now the default, the auto executor runs one conversation at a time, and conversations run on named executors for manual chats and auto triage. Per-user Dex auth for the Kubernetes MCP addon is documented. Details in the repo.

Post for LinkedIn

Holmes 0.43.0 is out this week. Fast mode is now the default and TodoWrite planning is opt-in. The auto executor defaults to one conversation at a time, so background triage, bulk investigations and triggered workflows no longer run concurrently, and conversations now run on named executors that separate live user chats from alert-triage work. The Kubernetes MCP addon gained per-user Dex auth with private CA support, with setup documented on the MCP page. On the reliability side, the model cost map refreshes on a lookup miss so recently released models are priced while Holmes is running, Robusta models whose upstream name is not provider/id are now priced, and free-form object parameters are kept out of strict tool calls.

Week of September 28, 2026

What shipped

Why it matters

This week focused on fixing security issues and improving documentation consistency. The security fix for /eval endpoints prevents unauthorized code execution from pull request comments, while the widespread documentation standardization ensures readers follow the same reliable steps regardless of which integration they're setting up.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: fixed a security issue in /eval and /list endpoints, removed the broken kubectl-run toolset, fixed SQL Server TLS validation, and standardized deployment documentation across 40+ integration pages.

Post for LinkedIn

This week's updates to HolmesGPT focused on security and documentation reliability. We fixed a critical issue where /eval and /list endpoints weren't properly gated on repository permissions, removed the kubectl-run toolset after consistent failures, resolved TLS certificate validation problems with pyOpenSSL 26.2, and standardized deployment instructions across 40+ integration pages to ensure readers get consistent, working steps every time.

Week of September 21, 2026

What shipped

Why it matters

This week brings security hardening for bash command execution, vulnerability patches in core dependencies, and better alignment between the agent and platform settings. Documentation improvements make bash configuration clearer for users.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Bash approval rules tightened for complex syntax. Six CVEs patched. Account opt-out settings now honored. kubernetes-remediation MCP 1.4.0. Bash docs clarified.

Post for LinkedIn

This week's HolmesGPT updates focus on security and reliability. Bash command execution now requires approval for complex syntax patterns. Six Critical/High CVEs in dependencies were resolved. The agent respects account-level opt-out settings for hosted models. kubernetes-remediation MCP upgraded to 1.4.0. Bash toolset documentation improved with real prefix examples.

Week of September 14, 2026

What shipped

Why it matters

This week addresses multiple security issues including command injection and privilege escalation vulnerabilities. The fixes improve reliability of failure analysis by constraining claims to observed evidence, and expand capabilities with GPU diagnostics and regional support for observability platforms.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

0.42.0 ships security fixes for command injection and privilege escalation, hardened file-read policies, GPU diagnostics, and corrected failure analysis to constrain claims to evidence.

Post for LinkedIn

0.42.0 is out. This release hardens security with fixes for command injection and privilege escalation vulnerabilities, tightens file-read policy defaults, adds GPU node diagnostics, supports namespace-scoped deployments, and improves failure narratives by constraining claims to observed evidence only.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-13.

Is this your repo? Ask us to remove this page.