cloud-1.39.0

## 1.39.0 (2026-06-24)

<!-- Release notes generated using configuration in .github/release.yml at main -->

## What's Changed
### Features
* feat: move existing users into the default org when first auto-added by @ak684 in https://github.com/OpenHands/OpenHands/pull/14740
* feat: route unclaimed automation events to the default org on single-org installs by @ak684 in https://github.com/OpenHands/OpenHands/pull/14745
* feat: add hide_personal_workspaces flag for org-only OHE installs by @ak684 in https://github.com/OpenHands/OpenHands/pull/14741
* feat: make the first signed-in user the default org owner, track the org by is_default flag by @ak684 in https://github.com/OpenHands/OpenHands/pull/14752
* feat(acp): add switch_acp_model proxy endpoint for cloud conversations by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14744
* feat(acp): add model dropdown and credential fields to agent settings page by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14733
* feat: add validation for secret names to ensure valid env var format by @jpshackelford in https://github.com/OpenHands/OpenHands/pull/12980
* feat: auto-accept invitation links instead of the confirm/cancel modal by @ak684 in https://github.com/OpenHands/OpenHands/pull/14786
* feat: expose copyable invite links so invitations work without email delivery by @ak684 in https://github.com/OpenHands/OpenHands/pull/14758
* feat: accept pending invitations by verified-email match at sign-in by @ak684 in https://github.com/OpenHands/OpenHands/pull/14759
* feat: explicit OH_DEPLOYMENT_MODE flag; gate cloud-account CTA to enterprise cloud by @ak684 in https://github.com/OpenHands/OpenHands/pull/14794
* feat: OHE multi-model LLM discovery + BYOK gating (proxy discovery, catalogue union, UX) by @ak684 in https://github.com/OpenHands/OpenHands/pull/14773
* feat(acp): allow MCP server config for ACP agents by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14613
* feat: enforce conversation limits by @HeyItsChloe in https://github.com/OpenHands/OpenHands/pull/14168
* feat(APP-2136): expose automations menu item for all users by @erisfully in https://github.com/OpenHands/OpenHands/pull/14688
* feat(jira-dc): persist and inject per-user OAuth tokens in resolver conversations by @ak684 in https://github.com/OpenHands/OpenHands/pull/14650
* feat(jira-dc): share linked OAuth token with eligible conversations by @ak684 in https://github.com/OpenHands/OpenHands/pull/14697
* feat: add DynamicRemoteSandboxSpecService backed by runtime-api warm configs by @tofarr in https://github.com/OpenHands/OpenHands/pull/14849
* feat: encode harness in chip icon, surface model in chip text by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14510
* feat: PLTF-2956 parallelize GitHub GraphQL queries in get_suggested_tasks by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14821
* feat: surface a clear error when a custom sandbox image's agent-server SDK mismatches by @ak684 in https://github.com/OpenHands/OpenHands/pull/14883
* feat: PLTF-2968 allow per-deployment resolver macro via OH_RESOLVER_LABEL by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14895
* feat: Support Slack attachments in agent context by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14934
* feat: add sub-agent task (TaskToolSet) visualizer to the chat UI by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14928
### Bug Fixes
* fix: bump agent-server to 1.27.1 for Gemini cache fix by @ak684 in https://github.com/OpenHands/OpenHands/pull/14751
* fix: bump agent-server to 1.28.0 by @ak684 in https://github.com/OpenHands/OpenHands/pull/14754
* fix(acp): sanitize agent-server error body in switch_acp_model proxy by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14760
* fix: Pin duplicate checker action to extensions release by @enyst in https://github.com/OpenHands/OpenHands/pull/14771
* fix(deps): bump postcss to 8.5.15 to fix XSS (GHSA-qx2v-qp2m-jg93) by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14770
* fix(frontend): start new LLM profiles on basic settings with blank fields by @ak684 in https://github.com/OpenHands/OpenHands/pull/14782
* fix: preserve LLM base URL on basic saves by @he-yufeng in https://github.com/OpenHands/OpenHands/pull/14776
* fix(enterprise): litellm_proxy/ → openhands/ on settings load by @smolpaws in https://github.com/OpenHands/OpenHands/pull/14766
* fix(frontend): treat managed openhands base URLs as provider defaults in view inference by @ak684 in https://github.com/OpenHands/OpenHands/pull/14783
* fix(frontend): only render the API key input once a provider is selected by @ak684 in https://github.com/OpenHands/OpenHands/pull/14787
* fix(frontend): hydrate the LLM profile edit form from the selected profile by @ak684 in https://github.com/OpenHands/OpenHands/pull/14789
* fix(frontend): accept typed emails without requiring Space in the invite input by @ak684 in https://github.com/OpenHands/OpenHands/pull/14790
* fix: redact credentials from PluginSpec.source during serialization by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14795
* fix: reconcile and label per-(user,org) LiteLLM managed keys by @ak684 in https://github.com/OpenHands/OpenHands/pull/14803
* fix: default enterprise injector kinds in the image, not just the chart by @ak684 in https://github.com/OpenHands/OpenHands/pull/14811
* fix(frontend): avoid dirty language filter input by @mturac in https://github.com/OpenHands/OpenHands/pull/14812
* fix(acp): surface acp_server on cloud conversations so the model picker renders by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14797
* fix: Add SaaS migration for sandbox pause state by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14829
* fix: Use final response endpoint for resolver callbacks by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14828
* fix: Ignore OpenHands bot GitHub resolver events by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14832
* fix: duplicate Slack no-repository selections by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14833
* fix: write trajectory exports as utf-8 by @wgu9 in https://github.com/OpenHands/OpenHands/pull/14810
* fix: use runtime /list API for sandbox concurrency count, not is_paused DB flag by @tofarr in https://github.com/OpenHands/OpenHands/pull/14834
* fix: renumber duplicate migration 122 → 123 (drop is_paused) by @tofarr in https://github.com/OpenHands/OpenHands/pull/14840
* fix: API key CORS header handling by @neubig in https://github.com/OpenHands/OpenHands/pull/14835
* fix: PLTF-2956 batch_get_sandboxes to gracefully handle runtime API failures by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14853
* fix: Fix CVE-2026-48526: Update pyjwt to 2.13.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14854
* fix: PLTF-2956 log level from warning to error for automation service forwarding failures by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14820
* fix: log error level for failed GitHub payload processing (#14814) by @GautamKumarOffical in https://github.com/OpenHands/OpenHands/pull/14863
* fix: Fix CVE-2026-49855: Update tornado to 6.5.7 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14856
* fix: decouple API-key (Bearer) auth from Keycloak offline sessions by @hieptl in https://github.com/OpenHands/OpenHands/pull/14867
* fix: Fix CVE-2026-54278: Update aiohttp to 3.14.1 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14871
* fix: PLTF-2956 Log 5xx responses at error level in AutomationEventService by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14819
* fix: revert conversation limit enforcement from #14168 by @malhotra5 in https://github.com/OpenHands/OpenHands/pull/14877
* fix: Fix CVE-2026-12143: Update form-data to 4.0.6 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14875
* fix: Fix CVE-2026-53539: Update python-multipart to >=0.0.30 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14876
* fix: post Bitbucket DC comments as the bot account and background webhook handling by @ak684 in https://github.com/OpenHands/OpenHands/pull/14881
* fix(frontend): send on Enter for touchscreen laptops by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14870
* fix: PLTF-2956 Tests for GitHub payload-processing failure log level by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14818
* fix: clean up LLM Profile auth fields (dedupe variant section + exclude inert auth_type) by @ak684 in https://github.com/OpenHands/OpenHands/pull/14893
* fix: prevent conversation export overload by @neubig in https://github.com/OpenHands/OpenHands/pull/14899
* fix: Forgejo/Gitea clone failure when hosted under a subpath by @VascoSch92 in https://github.com/OpenHands/OpenHands/pull/14930
* fix: self-heal stale LiteLLM user on re-onboarding by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14932
* fix: load global user & org skills without a selected repository by @hieptl in https://github.com/OpenHands/OpenHands/pull/14780
* fix: Fix GHSA-gj48-438w-jh9v: Update bleach to 6.4.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14945
* fix: Fix CVE-2026-45409: Update idna to 3.15 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14946
* fix: Fix GHSA-6v7p-g79w-8964: Update msgpack to 1.2.1 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14944
* fix: Fix CVE-2026-49458: Update dompurify to 3.4.6 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14872
* fix: Fix CVE-2026-44727: Update jupyter-server to 2.20.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14943
* fix: binaryornot Python 3 crash on binary reads by @enyst in https://github.com/OpenHands/OpenHands/pull/14518
* fix: Fix GHSA-jm82-fx9c-mx94: Update pypdf to >=6.13.3 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14959
* fix: Fix GHSA-cmwh-pvxp-8882: Update dompurify to 3.4.11 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14956
* fix: Fix CVE-2026-41691: Update i18next-http-backend to 3.0.5 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14955
* fix: Fix CVE-2026-54283: Update starlette to 1.3.1 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14874
* fix: Fix CVE-2026-8723: Update qs to 6.15.2 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14957
### Documentation
* docs: Bring README.md over from Agent Canvas by @rbren in https://github.com/OpenHands/OpenHands/pull/14844
* docs(skills): fix typo in OpenHands docs URL in add_agent.md by @sanjibani in https://github.com/OpenHands/OpenHands/pull/14865
* docs: revise source code links in README.md by @enyst in https://github.com/OpenHands/OpenHands/pull/14869
* docs: fix broken README urls by @lexcodes-dev in https://github.com/OpenHands/OpenHands/pull/14907
### Maintenance
* refactor(llm): clean up reverse-mapping OpenHands provider models by @enyst in https://github.com/OpenHands/OpenHands/pull/14725
* refactor(settings): delegate agent-settings merge to SDK apply_agent_settings_diff by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14677
* build(deps): bump SDK packages to v1.28.0 by @all-hands-bot in https://github.com/OpenHands/OpenHands/pull/14753
* chore(deps): bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in https://github.com/OpenHands/OpenHands/pull/14852
* chore: bump SDK and agent-server to 1.29.0 by @ak684 in https://github.com/OpenHands/OpenHands/pull/14889
* test: replace real sleeps in maintenance runner tests by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/13930
* refactor: extract billing test fixtures for PLTF-1269 by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/13998
* test: PLTF-1269 replace test_should_ naming with test_verb_noun_context convention by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14015
* chore: purge dead acp_env field footprint (removed in SDK 1.29.0) by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14921
### Other Changes
* PLTF-2899: keep resume flow responsive during rate limits by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14660
* fix: _configure_llm now preserves user LLM settings by @shanemort1982 in https://github.com/OpenHands/OpenHands/pull/14451
* Enable org LLM profiles in settings by @ak684 in https://github.com/OpenHands/OpenHands/pull/14715
* Revert ACP bootstrap-prompt resume + enable acp_isolate_data_dir on the cloud start path by @simonrosenberg in https://github.com/OpenHands/OpenHands/pull/14722
* PLTF-2899: Add async/await static analysis checks for enterprise code by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14664
* fix: remove org_id from ownership assertion in save_app_conversation_info by @tofarr in https://github.com/OpenHands/OpenHands/pull/14727
* Harden workflow GitHub context handling by @enyst in https://github.com/OpenHands/OpenHands/pull/14537
* ci: add label-triggered OpenHands QA workflow by @enyst in https://github.com/OpenHands/OpenHands/pull/14730
* Bump SDK packages to v1.27.0 by @all-hands-bot in https://github.com/OpenHands/OpenHands/pull/14726
* perf: skip runtime API call in webhook auth via SandboxRecord by @tofarr in https://github.com/OpenHands/OpenHands/pull/14732
* fix(bitbucket-dc): resolve user via whoami so avatars load with OAuth tokens by @ak684 in https://github.com/OpenHands/OpenHands/pull/14734
* Release 1.8.0 by @mamoodi in https://github.com/OpenHands/OpenHands/pull/14743
* PLTF-2895: add enterprise migration integrity check by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14689
* PLTF-2895: scope DB sessions tightly in poll_agent_servers to prevent idle-in-transaction by @aivong-openhands in https://github.com/OpenHands/OpenHands/pull/14637
* ci: adopt release-please for app and cloud releases by @jlav in https://github.com/OpenHands/OpenHands/pull/14718
* Fix OpenHands LLM key access for credited orgs by @enyst in https://github.com/OpenHands/OpenHands/pull/14724
* Use reusable issue duplicate checker action by @enyst in https://github.com/OpenHands/OpenHands/pull/14609
* fix: delete LiteLLM user on personal org reset by @fengjikui in https://github.com/OpenHands/OpenHands/pull/14700
* fix(frontend): skip Git-related API calls when no Git provider is configured by @saurya in https://github.com/OpenHands/OpenHands/pull/14338

## New Contributors
* @he-yufeng made their first contribution in https://github.com/OpenHands/OpenHands/pull/14776
* @fengjikui made their first contribution in https://github.com/OpenHands/OpenHands/pull/14700
* @mturac made their first contribution in https://github.com/OpenHands/OpenHands/pull/14812
* @wgu9 made their first contribution in https://github.com/OpenHands/OpenHands/pull/14810
* @sanjibani made their first contribution in https://github.com/OpenHands/OpenHands/pull/14865
* @GautamKumarOffical made their first contribution in https://github.com/OpenHands/OpenHands/pull/14863
* @lexcodes-dev made their first contribution in https://github.com/OpenHands/OpenHands/pull/14907

**Full Changelog**: https://github.com/OpenHands/OpenHands/compare/cloud-1.38.0...cloud-1.39.0

---
This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).