RepoJournal
AI Agents AI Agents
49 wires and counting

$ follow AI Agents

Keep up with AI Agents in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-09
stories 74
RSS Archive Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

Cline collapses lingering undici 5.x to fix CVE-2026-1525

By RepoJournal · Filed · About AI Agents

TheRealSpencer github-actions[bot] ccurme smolpaws all-hands-bot DevinVinson saoudrizwan
14 people shipped this
TheRealSpencer @TheRealSpencer 2 cited github-actions[bot] @github-actions[bot] 1 cited ccurme @ccurme 1 cited smolpaws @smolpaws 1 cited all-hands-bot @all-hands-bot 1 cited DevinVinson @DevinVinson 1 cited saoudrizwan @saoudrizwan 1 cited abeatrix @abeatrix 1 cited mkondratek @mkondratek 1 cited Jean-Rémi Larcelet-Prost @jrlprost 1 cited github-actions @github-actions langchain-oss-model-profiles[bot] @langchain-oss-model-profiles[bot] langchain-oss-model-profiles @langchain-oss-model-profiles hieptl @hieptl

Cline closed the last CVE-2026-1525 exposure by pinning all undici copies to 7.x, while LangChain's OpenAI integration added async tool support.

Cline resolved the final nested undici@5.29.0 dependency (under dify-ai-provider → @ai-sdk/provider-utils@3.0.33) by adding a root override `"undici": ">=7.29.0 <8"` and regenerating bun.lock. This collapses that copy onto the undici@7.29.0 already shipped; no new package version enters the lockfile, and @fastify/busboy, pulled in only by undici 5, leaves it. This completes the residual half of #13223, with the other items deferred [1][2]. This is a security fix for CVE-2026-1525; upgrade your Cline installation to include this override before your next sync.

Action items

References

  1. [1] security: collapse nested undici@5.29.0 onto 7.x (CVE-2026-1525) — residual of #13223 (#13809) ↗ cline/cline
  2. [2] security: collapse nested undici@5.29.0 onto 7.x (CVE-2026-1525) — residual of #13223 ↗ cline/cline
  3. [3] fix(desktop): gate the observer stream on ClineCore's subscription, not a timer ↗ cline/cline
  4. [4] feat(desktop): attribute lifecycle telemetry across the shared Hub ↗ cline/cline
  5. [5] langchain-openai==1.6.1 ↗ langchain-ai/langchain
  6. [6] fix(openai): bump `max_completion_tokens` in cache breakpoint integration test (#40284) ↗ langchain-ai/langchain
  7. [7] ci: run e2e suites after merge to main ↗ OpenHands/OpenHands
  8. [8] refactor: infer issue readiness type from body instead of label ↗ OpenHands/OpenHands
  9. [9] refactor: rename Canvas Extensions to Apps ↗ OpenHands/OpenHands
  10. [10] fix(webview): flag attached images the selected model can't use and offer a model switch ↗ cline/cline
  11. [11] docs: remove dead Phorm Ask AI badge from README (#23005) ↗ run-llama/llama_index

$ ls ai-agents/reviews/ # the step-back reads

the week in review LangChain 1.4.0 alphas add MCP adapter the month in review LangChain tightens tool gatekeeping, Cline rewind matures, OpenHands surfaces agents
Topics: AI Agents AI / ML Full archive →

Quick answers

What shipped in AI Agents on September 9, 2026?
Cline closed the last CVE-2026-1525 exposure by pinning all undici copies to 7.x, while LangChain's OpenAI integration added async tool support. In total, 36 commits, 37 pull requests, and 1 releases landed.
Who contributed to AI Agents on September 9, 2026?
14 developers shipped this update, including github-actions[bot], github-actions, langchain-oss-model-profiles[bot], langchain-oss-model-profiles, ccurme, smolpaws, all-hands-bot, and DevinVinson, and 6 more.
What were the notable AI Agents updates?
security: collapse nested undici@5.29.0 onto 7.x (CVE-2026-1525) — residual of #13223 (#13809), security: collapse nested undici@5.29.0 onto 7.x (CVE-2026-1525) — residual of #13223, and fix(desktop): gate the observer stream on ClineCore's subscription, not a timer.
♥

$ log AI Agents --recent

Cline desktop commands unblocked from slow backend startup 6 shipped DeepSeek strict mode routed to beta endpoint 12 shipped LangChain Azure AD auth rides OpenAI 3.8.0 8 shipped LangChain adds async OpenAI tools; OpenHands fixes flaky CI 23 shipped

$ log --all # elsewhere on the wire

@openclaw openclaw 2026.9.3 rehearses updates; discrawl guards publication compatibility Local LLMs Ollama retries compaction after context overflow, llama.cpp fuses Vulkan kernels

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.