Updated Node.js to 24.22.2, OpenCode to 1.19.5, Claude Code to 2.1.318 and GitHub CLI to 2.103.3.
Updated npm to 12.2.2, pnpm to 12.16.1, Wrangler to 4.157.0 and Lighthouse to 13.6.0.
Updated Python Playwright to 1.64.1, Certifi to 2026.10.23 and pip to 26.3.
Followed Paperclip's official Cursor SDK 1.3.1 resolution. Paperclip stays at 2026.831.1 with jsdom 30.1.3 and Undici 8.12.3.
Raised the official Debian Chromium, common and sandbox floor to 156.0.8078.79-1~deb13u1 on AMD64 and ARM64.
Updated Docker Scout to 1.29.0. Full scanner reports and accepted upstream findings remain attached to the release.
Fixed
Removed the old npm node-gyp/Undici replacements. npm 12.2.2 supplies its own official bundle.
Removed PM2's js-yaml and get-uri/basic-ftp replacements. PM2 7.1.2 supplies js-yaml 4.3.2 and no longer includes the old FTP subtree.
Removed pip vendor repairs. The runtime and offline seed use the unmodified official pip 26.3 wheel.
Followed Lighthouse's current trace-engine graph without the removed legacy-javascript dependency.
Security
Known upstream vulnerabilities remain in bundled third-party software. Accepting them doesn't fix them or prove they're safe. See the attached reports for affected packages and versions.
Avoid untrusted browser content and automation while known findings remain. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port.
Paperclip stays at 2026.831.1 and Claude Auth stays at 2.2.1. This release doesn't verify a Claude Auth token-refresh fix. Existing compatibility holds and persistent data paths remain unchanged.
Updated Node.js LTS to 24.22.1. Builds now require official Debian Chromium, common and sandbox packages 155.0.8059.79-1~deb13u1 or newer on AMD64 and ARM64.
Updated OpenCode to 1.19.3 and Claude Code to 2.1.307. OpenSpec is now 1.14.3. GitHub CLI is 2.103.0 and lazygit is 0.66.2.
Updated npm to 12.2.1, pnpm to 12.15.0, Vite to 8.3.5 and ESLint to 10.13.0.
Updated Wrangler to 4.151.3 with its published Miniflare 5.20261019.1-beta and workerd 1.20261019.1 graph. Updated Prisma to 7.10.1.
Refreshed the Python 3.13 hash locks with FastAPI 0.143.5, Markdown 3.11.2, setuptools 84.2.1, Pillow 13.0.0 and certifi 2026.10.19.
Kept Paperclip 2026.831.1 while following its normal Cursor SDK 1.0.40 and jsdom 30.1.3 resolution. jsdom now supplies Undici 8.12.3 without a HolyCode replacement.
Updated release scanning to Trivy 0.76.1 and Docker Scout 1.27.0. Upgrade and untouched-volume rollback checks now use the pinned v1.2.7 image.
Fixed
Removed the npm brace-expansion, tar and ip-address replacements. npm 12.2.1 supplies those dependencies through its published graph.
Removed Prisma's deepmerge-ts and mysql2 replacements and the added type peers. Prisma 7.10.1 supplies deepmerge-ts 8.0.2 and mysql2 3.24.4 through its published graph.
Updated npm's existing node-gyp Undici replacement to 8.12.3. pnpm 12.15.0 supplies fixed Undici 6.29.1 in its official bundle.
Updated pip to 26.2.2 for its fixed Certifi bundle. The existing msgpack 1.2.2, pkg_resources 78.1.1 and urllib3 2.8.0 repairs remain in the runtime and offline seed.
Followed Lighthouse 13.5.0's normal trace-engine resolution to legacy-javascript 0.0.4. third-party-web remains 0.30.0.
Corrected Scout result-to-package matching so a shared vulnerability rule no longer multiplies accepted finding counts. Actual repeated observations remain visible.
Security
Known upstream vulnerabilities remain in bundled third-party software. Accepting them doesn't fix them or prove they're safe.
Avoid untrusted browser content and automation while known findings remain. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port; those controls don't prove a finding is unreachable.
Chromium issue #14 requires fresh browser checks of both released native AMD64 and ARM64 images before closure. It also requires package inventories, full Scout and Trivy reports, verified registry digests and updated public warnings.
The compatibility holds remain, including Paperclip 2026.831.1 and Claude Auth 2.2.1. This release does not verify a fix for Claude Auth token refresh. See the dependency audit for the remaining holds and security policy.
Update Node to 24.22.0, OpenCode to 1.19.0, Claude Code to 2.1.300 and OpenSpec to 1.14.2.
Update fzf, lazygit, pnpm, Prettier, Wrangler and the Python toolchain dependencies. Keep Wrangler with its official Miniflare/workerd graph.
Follow Paperclip's normal jsdom resolution to official Undici 8.12.1, with clearer dependency version errors.
Update pinned build actions and Trivy to 0.76.0. Keep full scanner reports and accepted upstream vulnerability records.
Use v1.2.6 for upgrade and rollback checks. Preserve Paperclip 2026.831.1, user data, providers and plugin settings.
Fixed
Raise the Chromium, Chromium Common and Chromium Sandbox floor to Debian 155.0.8059.39-1~deb13u1 on AMD64 and ARM64. Fresh scans no longer report the five CVEs reported in #13 plus CVE-2026-106195 and CVE-2026-106237.
Cover hidden-iframe visibility in the Playwright 1.64.0 browser check.
Correct the runtime table to npm 12.2.0.
Security
Fresh scans still report 37 other Chromium CVEs, CVE-2026-110136 through CVE-2026-110172. These are accepted upstream findings, including seven rated CRITICAL by Scout. Neither scanner lists a fixed version. Track the remaining findings in #14.
Avoid untrusted browser content and automation. Keep the non-root user, Chromium sandbox, supplied seccomp profile and closed browser port. These controls do not prove the vulnerabilities are unreachable.
Full per-architecture scanner reports, package inventories, software bills of materials and accepted-finding records are attached to this release.
Compatibility
Claude Auth 2.2.1 does not establish a fix for the idle credential-refresh failure in #11. That issue remains open.
Keep the documented Paperclip, TypeScript, Prisma, Apprise and json-server compatibility holds. Managed oh-my-openagent and Hermes remain suspended.
Accepted upstream vulnerabilities are not fixed vulnerabilities. Secrets, HolyCode-owned findings, unknown provenance, malformed reports and scanner failures still block delivery.
Update OpenCode to 1.18.35, Claude Code to 2.1.296, pnpm to 12.10.1 and Vite to 8.3.4.
Update Wrangler to 4.149.0 with Miniflare 5.20261006.1-alpha, workerd 1.20261006.1 and its official Sharp 0.35.5/libvips 1.3.4 graph.
Follow Paperclip's normal Cursor SDK 1.0.37 resolution without changing Paperclip, jsdom or Undici.
Follow Lighthouse's normal legacy-javascript 0.0.3 resolution and report expected/actual graph mismatches.
Update python-dotenv to 1.2.4, Markdown to 3.11, FastAPI to 0.143.0 and Uvicorn to 0.54.0. Refresh the Drizzle ORM fixture to 0.45.4.
Pin the remaining Ubuntu workflow jobs to 24.04. Use v1.2.5 for upgrade and untouched-volume rollback checks.
Security
Keep full Trivy and Docker Scout reports in the release assets. Third-party findings remain accepted upstream vulnerabilities, not fixes.
Chromium issue #13 remains open. Its five CVEs are not a complete current advisory inventory; later findings may also apply. Avoid untrusted browser content and automation while those findings remain, and keep the sandbox, seccomp profile, unprivileged user and closed browser port.
Claude Auth issue #11 remains open; this release does not establish a credential-refresh fix.
Documentation
npm is 12.2.0, verified by the Dockerfile and image metadata. The tagged README Runtime table still says 12.0.2; that row is stale. The component table and current site use 12.2.0.
Compatibility
Keep Paperclip 2026.831.1, TypeScript 6.0.3, Prisma 7.10.0, Apprise 1.13.1 and existing user data. Deferred major upgrades need separate compatibility checks.
Preserve user-managed plugins and external CLIProxyAPI endpoints. Hermes and HolyCode-managed oh-my-openagent remain suspended.
Updated Claude Code to 2.1.290, OpenSpec to 1.14.1, pnpm to 12.9.1, ESLint to 10.12.0, and Wrangler to 4.147.0 with its matching Miniflare and workerd packages.
Switched GitHub CLI, fzf, and lazygit to official checksum-verified release archives. Updated lazygit to 0.66.0 and delta to 0.20.1.
Kept the full Trivy and Docker Scout reports and added accepted upstream vulnerability records. Third-party findings remain visible; secrets, HolyCode-owned findings, invalid reports, unknown package provenance, and scanner failures still block delivery.
Kept Paperclip at 2026.831.1 and Claude Auth at 2.2.1. The credential-refresh report in issue #11 remains open.
Fixed
Updated all three Debian Chromium packages to .92 on AMD64 and ARM64, fixing the earlier v1.2.4 .57 advisory set and removing its package exception. Newer CVEs remain listed below. Pull coderluii/holycode:1.2.5 and restart your container to apply the update.
Corrected the security-policy audit link, the contribution guide for disabled Discussions, and the missing v1.2.4 changelog entries.
Known issues
Debian Chromium is 154.0.8037.92-1~deb13u1 on AMD64 and ARM64. It fixes the older .57 advisory set, but five newer CVEs remain accepted upstream vulnerabilities: CVE-2026-103622, CVE-2026-103624, CVE-2026-103625, CVE-2026-103626, and CVE-2026-103628. Two are Critical. Google ships the upstream fix in .97; Debian has not published that package yet. Avoid untrusted browser content and automation until the corrected Debian packages ship. See the dependency audit.
Other accepted upstream findings remain listed by dependency, installed version, and CVE in the scanner assets attached to this release. Acceptance permits delivery; it does not mean those findings are fixed.
Updated bundled OpenCode to 1.18.34, Claude Code to 2.1.286, OpenSpec to 1.14.0, npm to 12.2.0, pnpm to 12.8.1, Vite to 8.3.2, and GitHub CLI to 2.102.0.
Updated Wrangler to 4.145.0 with its matching Miniflare and workerd packages, refreshed the Go builder image, and updated the release scanners and Renovate validator. The dependency audit lists the selected updates and compatibility holds.
Kept Claude Auth at 2.2.1. This release does not fix the credential-refresh report in issue #11, which remains open.
Known issues
The ARM64 image includes Chromium 154.0.8037.57-1~deb13u1. The 11 known CVEs include code-execution and sandbox-escape risks. The 33 exact package/CVE/version exceptions expire October 8, 2026. Avoid untrusted browser content and automation on ARM64. Existing sandbox and container controls do not make this safe. A follow-up release must replace the affected packages and remove the exceptions. Pull the corrected image and restart the container to apply it.
Fixed
Removed Paperclip's obsolete Undici override after its dependency graph changed. The image now checks the current package owners and exercises jsdom's fetch path without adding an unused dependency.
Updated npm's node-gyp and Undici packages, PM2's FTP dependency, and pip's vendored urllib3 to address the security findings in those bundled copies.
Repaired the offline pip seed as well, so a new Python environment gets the same fixes. Source records, licenses, and the patched package metadata stay in sync.
Updated bundled OpenCode to 1.18.32, Claude Code to 2.1.281, OpenSpec to 1.13.2, npm to 12.1.0, and the selected development and inspection tools. The dependency audit lists every updated pin and compatibility hold.
Updated the bundled Claude Auth plugin to 2.2.1. This release does not claim to resolve the credential-refresh report in issue #11, which remains open.
Fixed
When CLIProxyAPI is enabled and no model list is set, HolyCode discovers the models offered by its /models endpoint for OpenCode. An explicit CLIPROXYAPI_MODELS list still takes precedence; a temporary discovery failure leaves user-owned provider settings untouched.
Update GitHub CLI to 2.101.0, OpenCode to 1.18.31, Claude Code to 2.1.276, OpenSpec to 1.13.1, pnpm to 12.4.2, Prettier to 3.9.8, and Wrangler to 4.134.0 with Miniflare 5.20260917.0-alpha and workerd 1.20260917.1.
Update Playwright to 1.63.0 and pandas to 3.0.6 with their compatible Python lock refresh.
Update npm-owned brace-expansion to 5.0.12, ip-address to 10.7.2, and the protected Renovate validator to 44.97.6.
Keep Paperclip at 2026.831.1 so fresh self-hosted instances do not silently enable the native runner. This release adds no Paperclip migration or default override.
Keep opencode-claude-auth at 2.2.0. The idle-session credential refresh reported in issue #11 remains open and is not fixed by the Claude Code update.
Fixed
Reject malformed or cross-scanner Trivy and Docker Scout reports instead of treating them as empty findings.
Refresh Claude Code to 2.1.270, pnpm to 12.4.1, Wrangler to 4.131.2 with its owned Miniflare/workerd pair, fzf to 0.74.4, and lazygit to 0.65.1.
Refresh Matplotlib to 3.11.2, tqdm to 4.70.1, and Uvicorn to 0.53.0 while keeping Node.js 24.21.0 LTS, Go 1.27.1, and the documented compatibility holds.
Fixed
Keep non-root OpenSpec project initialization portable through Git Bash bind mounts and stop stubborn Uvicorn smoke processes cleanly.
Update Node.js LTS to 24.21.0, OpenCode to 1.18.30, Claude Code to 2.1.268, OpenSpec to 1.13.0, Vite to 8.3.0, and Wrangler to 4.131.0.
Keep the bundled Claude Auth plugin and existing service defaults. Initialize OpenSpec explicitly with openspec init --tools opencode; startup leaves your projects alone.
Fixed
Update pip's bundled msgpack to 1.2.2 and use Wrangler's upstream Sharp dependency instead of the older custom replacement.
Upgrade
Stop the container and back up your home, local-cache, and workspace volumes before updating. Paperclip stays on 2026.831.1. To return to image 1.1.9, restore your untouched pre-upgrade backup.
Install THIRD-PARTY-NOTICES at /usr/local/share/holycode/THIRD-PARTY-NOTICES.
Changed
Refresh OpenCode, Claude Code, Paperclip, OpenSpec, Claude Auth, pnpm 12.4.0, Wrangler, ESLint, GitHub CLI, lazygit, and compatible Python packages.
Keep TypeScript 6.0.3, Prisma 7.10.0, json-server 0.17.4, and Paperclip's Undici 6.28.1 replacement on their compatible stable lines.
Fixed
Replace PM2's nested js-yaml and Miniflare's nested Sharp/libvips packages with owner-guarded fixed releases.
Make suspended Hermes and HolyCode-managed oh-my-openagent startup errors version-neutral.
Paperclip 2026.831.1 applies migrations 0223 through 0230. Stop the container and back up your home/workspace volumes before upgrading. The retired brandColor and attachmentMaxBytes fields are removed, and in-progress login sessions reset, so restart login afterward. To roll back, restore the untouched backup with image 1.1.8; never run 1.1.8 against a database already migrated by 1.1.9.
Docker tag 1.1.6 was not published because the security gate stopped promotion.
Docker tag latest now points to 1.1.7.
Changed
Refresh Node.js to 24.19.0, GitHub CLI to 2.97.0, fzf to 0.74.2, lazygit to 0.64.0, OpenCode to 1.18.16, Claude Code to 2.1.228, and Claude Auth to 2.1.6.
Refresh pnpm to 11.21.0, tsx to 4.23.12, Vite to 8.2.1, Wrangler to 4.121.0, ESLint to 10.8.1, and Renovate to 44.24.2.
Refresh the hash-locked Python set with Playwright 1.62.0, NumPy 2.5.2, Packaging 26.3, setuptools 84.0.0, Markdown 3.10.3, Uvicorn 0.52.1, and pip 26.2.1.
Security
Validate image builds and smoke tests on native AMD64 and ARM64 runners.
Refresh Docker Scout to 1.24.0 and Trivy to 0.73.0 while keeping fixable critical and high findings fail-closed.
Corrected the HolyCode Cloud copy in the README, moved the live hosted link beneath the product headline, and removed maintenance-only release text from public documentation.
Rebuilt the image with current Debian Trixie security packages.
Security
Updated Chromium to Debian Trixie's 151.0.7922.71 security package and retired the four Chromium exceptions used by v1.1.4.
Update OpenCode to 1.18.9, Claude Code to 2.1.220, Paperclip to 2026.722.0, npm to 12.0.2, pnpm to 11.18.0, ESLint to 10.8.0, Wrangler to 4.115.0, and Prisma to 7.9.1.
Refresh the Python 3.13 package set, including pip 26.2, pandas 3.0.5, tqdm 4.70.0, FastAPI 0.141.1, and Uvicorn 0.52.0.
Bundle opencode-claude-auth 2.1.5 as an integrity-checked offline package so container startup no longer downloads it from npm.
Upgrade Paperclip's database through migration 0183. Back up your volumes before updating, and restore untouched pre-upgrade volumes if you roll back to 1.1.3.
Suspend HolyCode-managed oh-my-openagent installation. Once you remove the legacy enable flag, the first v1.1.4 start disables its old active entry while preserving settings, skills, and cached package data.
Security
Rebuild GitHub CLI, fzf, and lazygit from their exact release sources with reviewed dependency updates.
Replace pip's vulnerable internal msgpack and pkg_resources copies with hash-verified fixed sources.
Remove the root npm lifecycle cache from the final image after the reviewed package scripts finish.
Remove Netlify CLI and serve. Hermes stays unbundled, CLIProxyAPI stays external-only, and HolyCode-managed oh-my-openagent installation remains suspended while their accessible dependency trees retain unresolved findings.
Run Chromium as the unprivileged opencode user with Debian's setuid sandbox and the constrained HolyCode seccomp profile.
Record the four Chromium fixes that Debian Trixie has not published yet as narrow exceptions expiring on August 28, 2026. The release audit lists the affected CVEs, controls, and removal trigger.
Fixed
Validate both hash-locked Python package sets, npm lifecycle scripts, release metadata, exact scanner exceptions, plugin modes, and Renovate extraction in protected release checks.
Promote the exact multi-architecture image that passed protected validation instead of rebuilding after validation.
Refresh OpenCode to 1.18.4, Claude Code to 2.1.216, s6-overlay to 3.2.3.2, fzf to 0.74.1, pnpm to 11.15.1, Vite to 8.1.5, Prettier to 3.9.6, Wrangler to 4.112.0, Prisma to 7.9.0, Lighthouse to 13.4.1, and oh-my-openagent to 4.19.0.
Refresh the supported Python packages, including Requests 2.34.2 and Pillow 12.3.0.
Keep Paperclip at 2026.707.0 while its newer destructive migration chain receives separate persistence testing.
Run Chromium as opencode with its sandbox enabled through the shipped config/chromium-seccomp.json profile.
Removed
Temporarily remove bundled Hermes while its current release line requires vulnerable dependencies. Existing /home/opencode/.hermes data is left untouched.
Remove Vercel CLI, sharp-cli, concurrently, and LHCI because their current dependency trees contain fixable critical or high findings.
Fixed
Rebuild GitHub CLI 2.96.0 from its exact upstream tag with Go 1.26.5 to remove CVE-2026-39822 from the bundled binary.
Replace Paperclip's vulnerable nested Undici 5.29.0 with Undici 6.27.0 and validate the Cursor adapter contract.
Install the PostgreSQL 17 client directly instead of its empty compatibility metapackage.
Validate npm lifecycle scripts by exact version, integrity, architecture, and script body before approved scripts run.
Promote the exact multi-architecture image built and scanned by protected validation instead of rebuilding during publication.
Before upgrading from a release earlier than v1.1.3, add the Chromium seccomp profile described in the README. Then update with:
docker compose pull
docker compose up -d
Rollback requires untouched pre-upgrade volume snapshots with image 1.1.2; in-place database downgrades are not supported.
Updated OpenCode to 1.18.1, Claude Code to 2.1.210, s6-overlay to 3.2.3.1, pnpm to 11.13.0, tsx to 4.23.1, and the default oh-my-openagent pin to 4.18.1.
Rebuilt on the current Node 24.18.0 Bookworm digest and current Bookworm security packages.
Kept Netlify CLI 26.2.0 for remote build and deploy commands while removing its local functions binary.
Registered OpenCode, Xvfb, Paperclip, and Hermes through the service bundle path required by s6-overlay 3.2.3.1.
Aligned the shared Python environment with Hermes's exact Requests, Pillow, and Rich versions.
Made release validation compare the actual current and rollback images instead of hard-coded runtime versions.
Removed
Removed the bundled CLIProxyAPI sidecar while its published image contains fixable high-severity dependencies. External CLIProxyAPI endpoints remain supported.
Removed Netlify local functions support until upstream publishes rebuilt platform binaries.
Removed obsolete Trivy exceptions because the affected Netlify binaries are no longer shipped.
Added native AMD64 and ARM64 release checks for upgrades, rollback, CLIProxyAPI authentication, Docker Scout, and Trivy.
Published SPDX SBOM and SLSA provenance attestations with Docker image tags latest and 1.1.0.
Added Renovate coverage and one-digit release version validation.
Changed
Updated the base to Node.js 24.18.0 LTS with npm 11.16.0, OpenCode 1.17.18, Claude Code 2.1.207, Paperclip 2026.707.0, Hermes v2026.7.7.2, and CLIProxyAPI v7.2.71.
Pinned container bases, release downloads, GitHub Actions, Docker Scout, Claude Code, and automatic OpenCode plugin updates to reviewed versions, digests, checksums, or commit SHAs.
Corrected the release sequence at v1.1.0 while preserving v1.0.10 through v1.0.13 as published history.
Fixed
Run Hermes with /home/opencode and matching XDG paths.
Keep OpenCode plugin behavior deterministic in manual, automatic, disabled, and legacy unversioned configurations.
Removed Drizzle Kit's unused legacy loader and old nested esbuild binaries.
Removed root npm download caches from the image layers, reducing build residue and eliminating placeholder-token secret findings.
Refresh the Docker runtime to Node.js 22.23.1 LTS while keeping npm 10.9.8.
Refresh the pinned OpenCode, Paperclip, npm CLI, PyPI utility, GitHub-release, git-tag, and GitHub Actions versions used by the Docker image and workflows.
Move Paperclip to its published Skills catalog package path and remove HolyCode's temporary catalog compatibility shim.
Update the README, Docker Hub description, Podman guide, translations, and third-party notice text for the current Paperclip catalog packaging.
Fixed
Keep pull-request validation pointed at Paperclip's current Skills catalog manifest path.
Document Paperclip's OpenCode home/config paths and the supported Docker update path across the README, Docker Hub description, Podman guide, examples, security notes, and translations.
Fixed
Start Paperclip with the same /home/opencode HOME and XDG paths used by OpenCode so the OpenCode adapter no longer falls back to /root/.config/opencode.
Add pull-request validation that starts Paperclip and checks its runtime HOME/XDG environment.
Add Hermes Agent as an optional bundled service with ENABLE_HERMES, persistent ~/.hermes state, and an API surface on port 8642
Add Paperclip as an optional bundled service with ENABLE_PAPERCLIP, persistent ~/.paperclip state, and a local dashboard on port 3100
Install Claude Code CLI in the image so the Claude Auth flow has the binary it expects
Expand the shipped toolset with TypeScript, pnpm, Prisma, Lighthouse, database CLIs, media tools, and Python utility packages
Add a pull-request validation workflow that builds the image and smoke-checks the OpenCode binary
Changed
Refresh the docs, translations, Docker Hub description, and landing page to reflect the new bundled services and the larger 50+ toolset
Extend the default compose and env examples with Hermes and Paperclip toggles
Fixed
Resolve the python-dotenv and dotenv-cli binary collision so the image builds cleanly
Switch Hermes to its foreground gateway runner and bootstrap Paperclip in a Docker-safe authenticated mode so both bundled services start correctly under s6-overlay
Remove shell-expanded Python config edits from entrypoint.sh by passing data into Python safely
Repair broken asset and LICENSE paths in the affected translated READMEs
Remove stale Slim-variant references from the package request issue template