11/06/2026

Changed

• Run release qualification on maintainer-controlled native AMD64 and ARM64 hosts and report the actual results through local commit statuses
• Keep hosted build and validation workflows manual-only, with explicit authorization and existing-release guards
• Build explicitly requested hosted releases on parallel native AMD64 and ARM64 runners instead of emulating ARM64
• Retain the v1.2.9 top-level tool versions, persistent data paths and compatibility holds

Fixed

• Prevent normal releases from starting a duplicate hosted publisher that later needs cancellation
• Bind local status results to exact source, command receipts and artifacts; reject stale or incomplete evidence
• Refuse published-version overwrites and remove release-asset clobbering from the manual fallback
• Follow Paperclip's supported Undici 8.12.4 patch resolution with exact version and integrity checks, without a dependency replacement

11/04/2026

Changed

• Updated Node.js to 24.22.2, OpenCode to 1.19.5, Claude Code to 2.1.318 and GitHub CLI to 2.103.3.
• Updated npm to 12.2.2, pnpm to 12.16.1, Wrangler to 4.157.0 and Lighthouse to 13.6.0.
• Updated Python Playwright to 1.64.1, Certifi to 2026.10.23 and pip to 26.3.
• Followed Paperclip's official Cursor SDK 1.3.1 resolution. Paperclip stays at 2026.831.1 with jsdom 30.1.3 and Undici 8.12.3.
• Raised the official Debian Chromium, common and sandbox floor to 156.0.8078.79-1~deb13u1 on AMD64 and ARM64.
• Updated Docker Scout to 1.29.0. Full scanner reports and accepted upstream findings remain attached to the release.

Fixed

• Removed the old npm node-gyp/Undici replacements. npm 12.2.2 supplies its own official bundle.
• Removed PM2's js-yaml and get-uri/basic-ftp replacements. PM2 7.1.2 supplies js-yaml 4.3.2 and no longer includes the old FTP subtree.
• Removed pip vendor repairs. The runtime and offline seed use the unmodified official pip 26.3 wheel.
• Followed Lighthouse's current trace-engine graph without the removed legacy-javascript dependency.

Security

Known upstream vulnerabilities remain in bundled third-party software. Accepting them doesn't fix them or prove they're safe. See the attached reports for affected packages and versions.

Avoid untrusted browser content and automation while known findings remain. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port.

Paperclip stays at 2026.831.1 and Claude Auth stays at 2.2.1. This release doesn't verify a Claude Auth token-refresh fix. Existing compatibility holds and persistent data paths remain unchanged.

10/26/2026

Changed

• Updated Node.js LTS to 24.22.1. Builds now require official Debian Chromium, common and sandbox packages 155.0.8059.79-1~deb13u1 or newer on AMD64 and ARM64.
• Updated OpenCode to 1.19.3 and Claude Code to 2.1.307. OpenSpec is now 1.14.3. GitHub CLI is 2.103.0 and lazygit is 0.66.2.
• Updated npm to 12.2.1, pnpm to 12.15.0, Vite to 8.3.5 and ESLint to 10.13.0.
• Updated Wrangler to 4.151.3 with its published Miniflare 5.20261019.1-beta and workerd 1.20261019.1 graph. Updated Prisma to 7.10.1.
• Refreshed the Python 3.13 hash locks with FastAPI 0.143.5, Markdown 3.11.2, setuptools 84.2.1, Pillow 13.0.0 and certifi 2026.10.19.
• Kept Paperclip 2026.831.1 while following its normal Cursor SDK 1.0.40 and jsdom 30.1.3 resolution. jsdom now supplies Undici 8.12.3 without a HolyCode replacement.
• Updated release scanning to Trivy 0.76.1 and Docker Scout 1.27.0. Upgrade and untouched-volume rollback checks now use the pinned v1.2.7 image.

Fixed

• Removed the npm brace-expansion, tar and ip-address replacements. npm 12.2.1 supplies those dependencies through its published graph.
• Removed Prisma's deepmerge-ts and mysql2 replacements and the added type peers. Prisma 7.10.1 supplies deepmerge-ts 8.0.2 and mysql2 3.24.4 through its published graph.
• Updated npm's existing node-gyp Undici replacement to 8.12.3. pnpm 12.15.0 supplies fixed Undici 6.29.1 in its official bundle.
• Updated pip to 26.2.2 for its fixed Certifi bundle. The existing msgpack 1.2.2, pkg_resources 78.1.1 and urllib3 2.8.0 repairs remain in the runtime and offline seed.
• Followed Lighthouse 13.5.0's normal trace-engine resolution to legacy-javascript 0.0.4. third-party-web remains 0.30.0.
• Corrected Scout result-to-package matching so a shared vulnerability rule no longer multiplies accepted finding counts. Actual repeated observations remain visible.

Security

Known upstream vulnerabilities remain in bundled third-party software. Accepting them doesn't fix them or prove they're safe.

Avoid untrusted browser content and automation while known findings remain. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port; those controls don't prove a finding is unreachable.

Chromium issue #14 requires fresh browser checks of both released native AMD64 and ARM64 images before closure. It also requires package inventories, full Scout and Trivy reports, verified registry digests and updated public warnings.

The compatibility holds remain, including Paperclip 2026.831.1 and Claude Auth 2.2.1. This release does not verify a fix for Claude Auth token refresh. See the dependency audit for the remaining holds and security policy.

10/15/2026

Changed

• Update Node to 24.22.0, OpenCode to 1.19.0, Claude Code to 2.1.300 and OpenSpec to 1.14.2.
• Update fzf, lazygit, pnpm, Prettier, Wrangler and the Python toolchain dependencies. Keep Wrangler with its official Miniflare/workerd graph.
• Follow Paperclip's normal jsdom resolution to official Undici 8.12.1, with clearer dependency version errors.
• Update pinned build actions and Trivy to 0.76.0. Keep full scanner reports and accepted upstream vulnerability records.
• Use v1.2.6 for upgrade and rollback checks. Preserve Paperclip 2026.831.1, user data, providers and plugin settings.

Fixed

• Raise the Chromium, Chromium Common and Chromium Sandbox floor to Debian 155.0.8059.39-1~deb13u1 on AMD64 and ARM64. Fresh scans no longer report the five CVEs reported in #13 plus CVE-2026-106195 and CVE-2026-106237.
• Cover hidden-iframe visibility in the Playwright 1.64.0 browser check.
• Correct the runtime table to npm 12.2.0.

Security

• Fresh scans still report 37 other Chromium CVEs, CVE-2026-110136 through CVE-2026-110172. These are accepted upstream findings, including seven rated CRITICAL by Scout. Neither scanner lists a fixed version. Track the remaining findings in #14.
• Avoid untrusted browser content and automation. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port. These controls do not prove the vulnerabilities are unreachable.
• Full per-architecture scanner reports, package inventories, software bills of materials and accepted-finding records are attached to this release.

Compatibility

• Claude Auth 2.2.1 does not establish a fix for the idle credential-refresh failure in #11. That issue remains open.
• Keep the documented Paperclip, TypeScript, Prisma, Apprise and json-server compatibility holds. Managed oh-my-openagent and Hermes remain suspended.
• Accepted upstream vulnerabilities are not fixed vulnerabilities. Secrets, HolyCode-owned findings, unknown provenance, malformed reports and scanner failures still block delivery.

10/10/2026

Changed

• Update OpenCode to 1.18.35, Claude Code to 2.1.296, pnpm to 12.10.1 and Vite to 8.3.4.
• Update Wrangler to 4.149.0 with Miniflare 5.20261006.1-alpha, workerd 1.20261006.1 and its official Sharp 0.35.5/libvips 1.3.4 graph.
• Follow Paperclip's normal Cursor SDK 1.0.37 resolution without changing Paperclip, jsdom or Undici.
• Follow Lighthouse's normal legacy-javascript 0.0.3 resolution and report expected/actual graph mismatches.
• Update python-dotenv to 1.2.4, Markdown to 3.11, FastAPI to 0.143.0 and Uvicorn to 0.54.0. Refresh the Drizzle ORM fixture to 0.45.4.
• Pin the remaining Ubuntu workflow jobs to 24.04. Use v1.2.5 for upgrade and untouched-volume rollback checks.

Security

• Keep full Trivy and Docker Scout reports in the release assets. Third-party findings remain accepted upstream vulnerabilities, not fixes.
• Chromium issue #13 remains open. Its five CVEs are not a complete current advisory inventory; later findings may also apply. Avoid untrusted browser content and automation while those findings remain, and keep the sandbox, seccomp profile, unprivileged user and closed browser port.
• Claude Auth issue #11 remains open; this release does not establish a credential-refresh fix.

Documentation

• npm is 12.2.0, verified by the Dockerfile and image metadata. The tagged README Runtime table still says 12.0.2; that row is stale. The component table and current site use 12.2.0.

Compatibility

• Keep Paperclip 2026.831.1, TypeScript 6.0.3, Prisma 7.10.0, Apprise 1.13.1 and existing user data. Deferred major upgrades need separate compatibility checks.
• Preserve user-managed plugins and external CLIProxyAPI endpoints. Hermes and HolyCode-managed oh-my-openagent remain suspended.

10/05/2026

Changed

• Updated Claude Code to 2.1.290, OpenSpec to 1.14.1, pnpm to 12.9.1, ESLint to 10.12.0, and Wrangler to 4.147.0 with its matching Miniflare and workerd packages.
• Switched GitHub CLI, fzf, and lazygit to official checksum-verified release archives. Updated lazygit to 0.66.0 and delta to 0.20.1.
• Kept the full Trivy and Docker Scout reports and added accepted upstream vulnerability records. Third-party findings remain visible; secrets, HolyCode-owned findings, invalid reports, unknown package provenance, and scanner failures still block delivery.
• Kept Paperclip at 2026.831.1 and Claude Auth at 2.2.1. The credential-refresh report in issue #11 remains open.

Fixed

• Updated all three Debian Chromium packages to .92 on AMD64 and ARM64, fixing the earlier v1.2.4 .57 advisory set and removing its package exception. Newer CVEs remain listed below. Pull coderluii/holycode:1.2.5 and restart your container to apply the update.
• Corrected the security-policy audit link, the contribution guide for disabled Discussions, and the missing v1.2.4 changelog entries.

Known issues

• Debian Chromium is 154.0.8037.92-1~deb13u1 on AMD64 and ARM64. It fixes the older .57 advisory set, but five newer CVEs remain accepted upstream vulnerabilities: CVE-2026-103622, CVE-2026-103624, CVE-2026-103625, CVE-2026-103626, and CVE-2026-103628. Two are Critical. Google ships the upstream fix in .97; Debian has not published that package yet. Avoid untrusted browser content and automation until the corrected Debian packages ship. See the dependency audit.
• Other accepted upstream findings remain listed by dependency, installed version, and CVE in the scanner assets attached to this release. Acceptance permits delivery; it does not mean those findings are fixed.

10/01/2026

Changed

• Updated bundled OpenCode to 1.18.34, Claude Code to 2.1.286, OpenSpec to 1.14.0, npm to 12.2.0, pnpm to 12.8.1, Vite to 8.3.2, and GitHub CLI to 2.102.0.
• Updated Wrangler to 4.145.0 with its matching Miniflare and workerd packages, refreshed the Go builder image, and updated the release scanners and Renovate validator. The dependency audit lists the selected updates and compatibility holds.
• Kept Claude Auth at 2.2.1. This release does not fix the credential-refresh report in issue #11, which remains open.

Known issues

• The ARM64 image includes Chromium 154.0.8037.57-1~deb13u1. The 11 known CVEs include code-execution and sandbox-escape risks. The 33 exact package/CVE/version exceptions expire October 8, 2026. Avoid untrusted browser content and automation on ARM64. Existing sandbox and container controls do not make this safe. A follow-up release must replace the affected packages and remove the exceptions. Pull the corrected image and restart the container to apply it.

Fixed

• Removed Paperclip's obsolete Undici override after its dependency graph changed. The image now checks the current package owners and exercises jsdom's fetch path without adding an unused dependency.
• Updated npm's node-gyp and Undici packages, PM2's FTP dependency, and pip's vendored urllib3 to address the security findings in those bundled copies.
• Repaired the offline pip seed as well, so a new Python environment gets the same fixes. Source records, licenses, and the patched package metadata stay in sync.

09/24/2026

Changed

• Updated bundled OpenCode to 1.18.32, Claude Code to 2.1.281, OpenSpec to 1.13.2, npm to 12.1.0, and the selected development and inspection tools. The dependency audit lists every updated pin and compatibility hold.
• Updated the bundled Claude Auth plugin to 2.2.1. This release does not claim to resolve the credential-refresh report in issue #11, which remains open.

Fixed

• When CLIProxyAPI is enabled and no model list is set, HolyCode discovers the models offered by its /models endpoint for OpenCode. An explicit CLIPROXYAPI_MODELS list still takes precedence; a temporary discovery failure leaves user-owned provider settings untouched.

09/18/2026

Changed

• Update GitHub CLI to 2.101.0, OpenCode to 1.18.31, Claude Code to 2.1.276, OpenSpec to 1.13.1, pnpm to 12.4.2, Prettier to 3.9.8, and Wrangler to 4.134.0 with Miniflare 5.20260917.0-alpha and workerd 1.20260917.1.
• Update Playwright to 1.63.0 and pandas to 3.0.6 with their compatible Python lock refresh.
• Update npm-owned brace-expansion to 5.0.12, ip-address to 10.7.2, and the protected Renovate validator to 44.97.6.
• Keep Paperclip at 2026.831.1 so fresh self-hosted instances do not silently enable the native runner. This release adds no Paperclip migration or default override.
• Keep opencode-claude-auth at 2.2.0. The idle-session credential refresh reported in issue #11 remains open and is not fixed by the Claude Code update.

Fixed

• Reject malformed or cross-scanner Trivy and Docker Scout reports instead of treating them as empty findings.

09/14/2026

Changed

• Refresh Claude Code to 2.1.270, pnpm to 12.4.1, Wrangler to 4.131.2 with its owned Miniflare/workerd pair, fzf to 0.74.4, and lazygit to 0.65.1.
• Refresh Matplotlib to 3.11.2, tqdm to 4.70.1, and Uvicorn to 0.53.0 while keeping Node.js 24.21.0 LTS, Go 1.27.1, and the documented compatibility holds.

Fixed

• Keep non-root OpenSpec project initialization portable through Git Bash bind mounts and stop stubborn Uvicorn smoke processes cleanly.