Skip to main content

​
OpenHands Enterprise 0.90.1

Released October 23, 2026.

​
Highlights

  • Identity providers managed from the Super Admin dashboard — Auth providers get their own edit page with a preset picker, branding, a self-registration control, an enabled toggle, help text, and matching of existing users by email. SAML now supports SP-initiated login with SP metadata, GitHub, GitLab, and Bitbucket login providers are seeded through Keycloak, and OAuth V2 login can be turned on from the Admin Console.
  • Azure DevOps — Repositories are listed and searched across every organization, pull request and work item events reach automations, Service Hook errors are shown instead of hidden, Microsoft Entra sign-in gets git parity, and sandboxes can clone Azure DevOps repositories.
  • Keycloak 26.8 and security updates — The bundled Keycloak moves from 26.3 to 26.8 to clear known vulnerabilities. The upgrade migrates the Keycloak database one way and the chart backs it up first; see the Upgrade Notes. The Enterprise Server, Agent Server, and Automation images also distrust the compromised eMudhra/emSign certificate authorities.
  • Automation improvements — Automations can carry descriptions, Azure DevOps is a built-in event source, runs are skipped when the daily sandbox limit is reached, sandboxes that fail to provision are retried and cleaned up, and organization members can save drafts and delete their own uploads.
  • Budget and LLM fixes — Your Budget shows the effective remaining budget, Slack alert settings persist, the bundled LiteLLM proxy no longer retries rate limits and handles zero-cost models correctly, and Azure AI Foundry can be configured with unsupported-parameter dropping.

​
Upgrade Notes

  • Keycloak 26.3 to 26.8 is a one-way database migration — On its first start, Keycloak 26.8 migrates its database to the 26.8 schema, and Keycloak 26.3 cannot run against it afterwards. Before the upgrade, a pre-upgrade Job copies the Keycloak database to bitnami_keycloak_backup_26_3_0 on the same PostgreSQL server while Keycloak 26.3 is still running. The copy needs PostgreSQL 17 or older, a database user that can CREATE DATABASE (the bundled postgres user can), and must finish within 240 seconds by default (keycloak.preUpgradeBackup.activeDeadlineSeconds; raise it for a large database). If the copy fails, the upgrade stops before anything changes, and the reason is in the log of the <release>-keycloak-backup Job. If your installation cannot meet these requirements, back the database up yourself and turn off Back Up Keycloak Database Before Upgrade under Upgrade Checks in the Admin Console (keycloak.preUpgradeBackup.enabled=false for Helm). Installs rendered with helm template, such as ArgoCD, never run the Job and must back up by hand. The rollback steps are in the chart README. The Job never drops a backup, and every later Keycloak version change adds another full copy, so drop old bitnami_keycloak_backup_* databases once you will not roll back.
  • Email verification is no longer enforced by default — Users whose identity provider does not assert a verified email address can now sign in. Set REQUIRE_VERIFIED_EMAILS=true on the Enterprise Server (the chart’s env map) to keep blocking them until they verify.

​
Features

​
Enterprise Server

​
Software Agent SDK

​
Automation

​
OpenHands Cloud (Helm Chart)

​
Bug Fixes

​
Enterprise Server

​
Software Agent SDK

​
Automation

​
OpenHands Cloud (Helm Chart)

​
Component Versions

​
Full Changelog