RepoJournal
Agentic Coding Agentic Coding
60 wires and counting

$ follow Agentic Coding

Keep up with Agentic Coding in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-09-13
stories 6
RSS Archive Reviews Topics

© 2026 RepoJournal Home Showcase Explore How it works Privacy

$ the-wire · showcase

OpenHands patches XSS in static server, adds Azure DevOps SSH remote support

By RepoJournal · Filed · About Agentic Coding · Composed from the cited sources · methodology

Mohd Quamar Tyagi Chocolatine75 neubig
3 people shipped this
Mohd Quamar Tyagi @Tyagiquamar 2 cited Chocolatine75 @Chocolatine75 2 cited neubig @neubig 1 cited

OpenHands shipped a fix that HTML-escapes injected runtime config and stops caching credential-bearing responses, closing an XSS path in its static server.

The static server injected runtime config values without HTML escaping, so config containing HTML characters could break out of the script tag. The fix routes values through `serializeForInlineScript` in `scripts/static-server.mjs` and sets `Cache-Control: no-store` on credential injection, which also prevents browsers from caching sensitive credentials like session API keys [1][2].

Azure DevOps SSH remotes now parse correctly. The control bar used to show the repo as `v3/myorg/myproject/myrepo` with no branch link; it now shows the correct name and exposes the Pull, Push, and Pull Request actions, according to the author's local test [3][5].

A new analytics call tracks authenticated Canvas arrivals and fires only after cookie authentication succeeds, isolated from startup [4].

$ ls ai-agents/reviews/ # the step-back reads

the week in review Cline desktop exits beta after backend and sign-out fixes the month in review LangChain tightens tool gatekeeping, Cline rewind matures, OpenHands surfaces agents
Topics: AI / ML AI Agents Full archive → Weekly reviews →

Quick answers

What shipped in Agentic Coding on September 13, 2026?
OpenHands shipped a fix that HTML-escapes injected runtime config and stops caching credential-bearing responses, closing an XSS path in its static server. In total, 3 commits and 3 pull requests landed.
Who contributed to Agentic Coding on September 13, 2026?
3 developers shipped this update, including Mohd Quamar Tyagi, Chocolatine75, and neubig.
What were the notable Agentic Coding updates?
fix(static-server): HTML-escape injected runtime config and set Cache-Control: no-store on credential injection (#17175), fix(static-server): HTML-escape injected runtime config and set Cache-Control: no-store on credential injection, and fix: recognize Azure DevOps SSH remotes.
♥

$ log Agentic Coding --recent

Cline desktop bundles shrink, goose unblocks its own clicks 92 shipped Claude Code reads AGENTS.md, Gemini CLI stops crashing on cancel 193 shipped OpenHands 1.20.0 ships agent profiles, Gemini CLI fixes OAuth token loss 150 shipped Compaction triggers on real token counts, LangChain 1.4.1 ships 96 shipped

$ log --all # elsewhere on the wire

@openclaw Cold-start Gateway diagnostics stop crying wolf, doctor repairs plugin drift Local LLMs Metal MoE/SSM fusion lands, MiMo-V2.5 fp8 sharding fixed

$ ls showcases/

Rails Django Laravel Node.js Go Vercel Vue.js Kubernetes HashiCorp Arch Linux Linux Anthropic

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.