RepoJournal
Agentic Coding Agentic Coding
73 wires and counting

$ follow Agentic Coding

Keep up with Agentic Coding in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-01
stories 72
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

LANGCHAIN PATCHES CREDENTIAL LEAK IN STREAMING CALLBACKS

By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology

jkennedyvz nick-hollon-lc VascoSch92 Saoud Rizwan roian6 Cline Test hieptl
10 people shipped this
jkennedyvz @jkennedyvz 2 cited nick-hollon-lc @nick-hollon-lc 2 cited VascoSch92 @VascoSch92 2 cited Saoud Rizwan @saoudrizwan 2 cited roian6 @roian6 1 cited Cline Test @cline-test-bot 1 cited hieptl @hieptl neubig @neubig Sufiyan Khan @CoderSufiyan Tomás Barreiro @BarreiroT

LangChain patched a critical flaw that exposed remote MCP credentials to callback handlers and persisted traces, even when invocation params were redacted.

The vulnerability [1] lived in streaming callbacks that constructed options from original, unredacted kwargs instead of sanitized integration parameters. Remote credentials could leak to LangSmith traces and callback handlers downstream. The fix applies integration-sanitized parameters to streaming and v3 streaming-event callbacks while preserving original values for model invocation [3]. Across the stack, LangChain also fixed type annotations for text stream projections [2], updated Anthropic config tests [4], and OpenHands shipped live agent activity visualization in chat [5] while ironing out composer gating and run status rendering bugs [6] [7]. Cline closed out the sprint with fixes for Slack bot mention stripping [10], CLI dialog cleanup on exit [8], and browser opener failures on headless hosts [9].

Action items

References

  1. [1] fix(core): redact streaming callback options ↗ langchain-ai/langchain
  2. [2] fix(core): type text stream projections ↗ langchain-ai/langchain
  3. [3] fix(core): redact streaming callback options (#39179) ↗ langchain-ai/langchain
  4. [4] fix(langchain): update Anthropic config test (#39172) ↗ langchain-ai/langchain
  5. [5] feat: show live agent activity in chat ↗ OpenHands/OpenHands
  6. [6] fix(home): don't gate the composer on the seeded default profile's LLM ref ↗ OpenHands/OpenHands
  7. [7] fix(automations): render CANCELLED and SKIPPED run statuses ↗ OpenHands/OpenHands
  8. [8] fix(cli): silence dialog-container 'not a child of __root__' warning on exit (#12795) ↗ cline/cline
  9. [9] fix(cli): don't crash when no browser opener binary exists (#12782) ↗ cline/cline
  10. [10] fix(connectors): strip the Slack bot mention from incoming messages (#12780) ↗ cline/cline

$ ls ai-agents/reviews/ # the step-back reads

the week in review OpenCode remote-install hole, Claude Desktop file-open RCE the month in review OpenCode npm installs and Claude Desktop file bug
Topics: AI / ML AI Agents Full archive → Weekly reviews →

Quick answers

What shipped in Agentic Coding on August 1, 2026?
LangChain patched a critical flaw that exposed remote MCP credentials to callback handlers and persisted traces, even when invocation params were redacted. In total, 36 commits, 35 pull requests, and 1 releases landed.
Who contributed to Agentic Coding on August 1, 2026?
10 developers shipped this update, including jkennedyvz, nick-hollon-lc, hieptl, roian6, neubig, VascoSch92, Sufiyan Khan, and Saoud Rizwan, and 2 more.
What were the notable Agentic Coding updates?
fix(core): redact streaming callback options, fix(core): type text stream projections, and fix(core): redact streaming callback options (#39179).
♥

$ log Agentic Coding --recent

Codex drops the tool-namespace capability gate, Goose ships 1.53.0 142 shipped Goose exports sessions to HTML, Codex gets model-listing auth recovery 181 shipped Diff panes get one git process, Gemini CLI stops hanging, cline fixes custom providers 185 shipped Enterprise permission defaults get teeth as Codex, Gemini CLI and Goose ship fixes 218 shipped

$ log --all # elsewhere on the wire

@openclaw OpenClaw 2026.8.35 ships critical security fixes, Bun patches NODE_OPTIONS and worker ports Local LLMs llama.cpp spec sampling goes probabilistic, vLLM trims GLM-5.3 attention overhead

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.