Overview

v0.21.6 — the first tag cut by the new stable release pipeline. Released October 8, 2026. Since v2026.9.24 (semantic version v0.21.5): 8,867 non-merge commits · 8,342 changed files (+772,490 / −225,600) · 2,106 merged PRs · 3,027 closed issues, measured at commit 818c13be1dc4fd28987e1e881a9408224afd4535.

What is different here is not the content but how the release is produced: this is the first version cut by the new stable release pipeline, and its shape is “one attempt ref, a tested Docker image, and a receipt tag at publish”. In plain terms: the release attempt itself carries the build and the tests, the image is published only once it passes, and the receipt for that publish is recorded on the tag — downstream consumers get an artifact that was tested, rather than a tag they build from afterwards.

Only three things ship with this release: the tag, this GitHub release and the Docker image. The desktop app, Termux packages and the Microsoft Store stay on their current build and move with the next bundled release.

The official body is explicit that the full curated notes ship with v0.22.0, which will document everything from v0.21.0 onward — highlights, feature areas and complete contributor credits — and that nothing in this window is skipped. Until then, this page records what the tag is, plus the changes already running on your machine.

---

Highlights

1. A stable release pipeline whose artifact was tested

This is the most easily missed change with the largest downstream effect. A tag used to be the starting gun: the image, hosted deployments and Nix packages each built themselves afterwards. The order is inverted now — a release attempt first, carrying the build and the tests, then the Docker image once it passes, then a receipt recorded on the tag. The practical benefit: nousresearch/hermes-agent:stable points at an image that was tested before publication. To confirm what you have, check the image digest, not the pull time you remember.

2. Three security fix groups (called out separately in this release)

• Dashboard authentication hardening (PRs #133367, #133369, #133370, plus session takeover #130685). Four issues reported together by Tenable Research (TRA-725 … TRA-728): a spoofed X-Forwarded-For could reset the password-login rate limit and get around the per-IP cap; unauthenticated login requests could write unbounded values to the audit log; the public /auth/ routes had no request-body size limit; native sign-in could send login codes to a non-loopback redirect, allowing session takeover.
• Repository git filter hardening (#130661). Automatic git calls (session workspace snapshots, subagent worktrees, kanban, worktree cleanup, hermes -w) could be hijacked by clean / smudge / process filter programs defined in an untrusted repository’s own config, before your first prompt.
• Email gateway sender hardening (#125212, #124322). A quoted display name in the From header could be crafted to look like an allowlisted sender, letting an attacker’s message pass the email allowlist.

3. Voice: spoken turns get their own model, and the Desktop gets a second mode

• A dedicated voice model: the new auxiliary.voice_chat slot (provider / model / reasoning_effort) replaces only the model answering the spoken turn; typing still uses the session model. It applies to CLI/TUI voice, the Desktop voice conversation and voice notes on messaging platforms, with usage booked under voice_chat. Configure it in Settings → Models → Auxiliary models on Desktop, or under hermes model → Auxiliary models.
• Voice turns default to reasoning off, including when the slot stays on auto and the session model answers; a model that cannot disable reasoning drops to its lowest accepted level, and a runtime refusal is remembered.
• Desktop full-duplex mode: voice.voice_chat_mode: gpt-live replaces the whole STT → turn → TTS chain with one full-duplex voice model that handles interruptions and background noise itself, has no tools, and delegates every real request to the session model. It needs a direct OpenAI key (voice.gpt_live.api_key / OPENAI_API_KEY / VOICE_TOOLS_OPENAI_KEY) and bills the voice layer at $0.05 per minute of session time (idle time counts). Desktop only; CLI/TUI /voice stays on the chained loop.

4. One gate for image routing: MCP images, computer_use captures, browser screenshots

• An MCP tool’s ImageContent used to come back only as MEDIA:/path, so even a vision-capable model received no pixels (a raw cua-driver server could not see the screen at all). When the active route accepts images inside tool results, the registry handler now returns a multimodal envelope: the image comes from this call’s own cache write, is re-encoded, sized to vision.embed_target_bytes (256 KiB by default, clamped 64 KiB–4 MiB) and a 1568 px ceiling, at most 4 per result, while the text half keeps its MEDIA: paths.
• tools.vision_tools._native_tool_result_images(provider, model, cfg) is now the single gate, shared by vision_analyze, browser screenshots, computer_use captures and MCP images. computer_use captures previously ignored agent.image_input_mode and went native even on text-only models.
• Two security behaviours come with it: invisible TAG characters (U+E0000–U+E007F) are stripped from MCP results (legitimate regional-flag emoji tag sequences are preserved), and vendor _meta is surfaced while keys under protocol-reserved prefixes (modelcontextprotocol, mcp) are dropped.

5. /yolo now travels with the session; a restart no longer drops it silently

/yolo used to flip only an in-memory set inside tools.approval, so any gateway restart quietly returned that chat to manual approvals while the user still believed it was bypassing them. The flag now lives on the chat’s routing entry (SessionEntry.yolo, persisted in gateway_routing), every turn re-arms the live flag from the resolved entry, and it is carried across compression and binding repoints. At the same time /new, /resume, /branch and auto-reset clear both the persisted and in-memory copies — a restart can never revive a bypass you dropped. The docs’ old claim that /yolo sets HERMES_YOLO_MODE was corrected: that environment variable is a separate activation path.

6. Also in the window (named by the official body, not yet covered here)

Live transcription while you speak on CLI, TUI and Desktop; favourite and pinned models at the top of the Desktop picker, a usage chip before a subscription hits its wall, and rate-limited providers that say why and until when; local models in hermes model plus llama.cpp CUDA on Linux x64 and arm64; pluggable layered language packs across core, Desktop and TUI; a summary-first hermes status; a review-pane diff scope selector (Uncommitted / Branch / Last turn); cron, doctor and home-channel warnings when the cron store goes unwritable; activate.fish; a unified Kanban workflow definition; and GPT-6.1 Sol plus Claude Sonnet 5.5 / Haiku 5.5 in the catalogs.

Improvements

• Plugin name resolution collapsed into a single resolver (_find_plugin_entry): canonical key or manifest name, then a unique bare leaf, then the catalog name resolved through the installer’s own record (.install-metadata.json) — and it fails on ambiguity rather than guessing. Entries whose catalog name differs from their manifest name (17 of 484, e.g. hermes-memory-wiki → memory-wiki, touchdesigner → td) now work with enable / disable / show / capabilities / update / remove. In the Desktop, turning a two-half package on went from three steps to one switch.
• Desktop plugin development: a symlinked checkout (ln -s ~/src/my-plugin ~/.hermes/plugins/my-plugin) is now recognised and drives its desktop half, the copy re-syncs on any byte difference and watches the source file for hot reload, and hermes plugins doctor <id> names a stale copy and how to refresh it.
• Both of those merged after this tag was cut, so they are main-only: git installs tracking main have them; installs on the tag (Docker images included) get them with the next tag.

Upgrade

# CLI (git installs)
hermes update

# Docker / Hermes Cloud
# nousresearch/hermes-agent:stable (or :latest)

# Desktop app and Termux
# unchanged in this release; they move with the next bundled release

After upgrading, spend a minute confirming what you actually got: hermes version (git installs also report distance from the tag and the short commit), and the image digest if you are on Docker.

← Hermes Agent Changelog