RepoJournal
Agentic Coding Agentic Coding
70 wires and counting

$ follow Agentic Coding

Keep up with Agentic Coding in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-07-31
stories 121
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

LANGCHAIN PATCHES CREDENTIAL LEAK IN MCP TOOLS; OPENHANDS SHIPS 1.8.0

By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology

github-actions[bot] ccurme langchain-oss-model-profiles[bot] jkennedyvz openhands-release-bot[bot] FraterCCCLXIII hieptl
13 people shipped this
github-actions[bot] @github-actions[bot] 1 cited ccurme @ccurme 1 cited langchain-oss-model-profiles[bot] @langchain-oss-model-profiles[bot] 1 cited jkennedyvz @jkennedyvz 1 cited openhands-release-bot[bot] @openhands-release-bot[bot] 1 cited FraterCCCLXIII @FraterCCCLXIII 1 cited hieptl @hieptl 1 cited neubig @neubig 1 cited saoudrizwan @saoudrizwan 1 cited minh2416294 @minh2416294 1 cited arafatkatze @arafatkatze 1 cited mdrxy @mdrxy abeatrix @abeatrix

LangChain's ChatOpenAI was leaving MCP tool credentials exposed in traces and callbacks, a regression now fixed before wider adoption.

The most urgent story: LangChain plugged a credential bleed in its OpenAI integration where MCP tool authorization fields were reaching LangSmith traces and configured callbacks [1]. The fix redacts both `headers` and `authorization` while preserving them in the actual OpenAI payload, with regression tests covering callback leakage. This matters because MCP tools are becoming standard infrastructure for agent work, and credential handling failures compound fast.

In parallel, LangChain shipped langchain-core 1.5.3 [2] with a fallback to `LANGSMITH_API_KEY` for gateway authentication, addressing a configuration gap. The team also added `user_profile_id` as a convenience attribute for Anthropic integrations [3], reducing boilerplate in agent chains. Model profile data refreshed automatically [4], with Poolside Laguna models removed from OpenRouter as deprecated.

OpenHands released v1.8.0 [5] with MCP server enable/disable controls and fixes for disabled skill context leakage. The team shipped domain-neutral extension-manifest hosting [7], PostHog telemetry identity alignment for Cloud users [8], and backend chooser UI compaction [6]. Cline landed multi-file diff rendering fixes [10], diff preview legacy parity [9], and reasoning-effort selectors for xAI, Z AI, and Moonshot [11].

Across all three desks: 61 commits, 52 PRs, and 8 releases in 24 hours. The credential fix in LangChain is the only breaking issue; everything else is additive or UX polish.

Action items

References

  1. [1] fix(openai): redact MCP `authorization` ↗ langchain-ai/langchain
  2. [2] langchain-core==1.5.3 ↗ langchain-ai/langchain
  3. [3] feat(anthropic): add `user_profile_id` convenience attribute ↗ langchain-ai/langchain
  4. [4] chore(model-profiles): refresh model profile data (#39141) ↗ langchain-ai/langchain
  5. [5] v1.8.0 ↗ OpenHands/OpenHands
  6. [6] feat(backends): compact Cloud vs Agent-server add-backend chooser ↗ OpenHands/OpenHands
  7. [7] feat: add a domain-neutral extension-manifest host ↗ OpenHands/OpenHands
  8. [8] fix: identify PostHog users with Cloud identity ↗ OpenHands/OpenHands
  9. [9] Show edited file after the diff preview closes (legacy parity) ↗ cline/cline
  10. [10] fix(vscode): show per-file diff for multi-file apply_patch ↗ cline/cline
  11. [11] fix(vscode): show catalog-driven reasoning effort selector for xAI, ZAI, and Moonshot ↗ cline/cline

$ ls ai-agents/reviews/ # the step-back reads

the week in review OpenCode remote-install hole, Claude Desktop file-open RCE the month in review OpenCode npm installs and Claude Desktop file bug
Topics: AI / ML AI Agents Full archive → Weekly reviews →

Quick answers

What shipped in Agentic Coding on July 31, 2026?
LangChain's ChatOpenAI was leaving MCP tool credentials exposed in traces and callbacks, a regression now fixed before wider adoption. In total, 61 commits, 52 pull requests, and 8 releases landed.
Who contributed to Agentic Coding on July 31, 2026?
13 developers shipped this update, including github-actions[bot], ccurme, langchain-oss-model-profiles[bot], jkennedyvz, mdrxy, openhands-release-bot[bot], FraterCCCLXIII, and hieptl, and 5 more.
What were the notable Agentic Coding updates?
fix(openai): redact MCP `authorization`, langchain-core==1.5.3, and feat(anthropic): add `user_profile_id` convenience attribute.
♥

$ log Agentic Coding --recent

Enterprise permission defaults get teeth as Codex, Gemini CLI and Goose ship fixes 218 shipped Claude Code ships Sonnet 5.5 as default, Goose patches a security advisory 207 shipped Bedrock profile auth survives migration; Cloudflare AI Gateway streams now time out 91 shipped Codex survives Windows launchers, keeps WebSocket turns alive 70 shipped

$ log --all # elsewhere on the wire

@openclaw openclaw 2026.9.7 hardens update rollback, and Peekaboo ships GPT-6.1 Sol Local LLMs Ollama gates System One on declared capabilities, llama.cpp fixes a stale-UI trap

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.