The Hub for AI Coding Models, Tools & Workflows

LangChain.js shipped `@langchain/[email protected]` on 2026-09-27: ports explicit prompt-cache options across Chat Completions and Responses, preserves content-block breakpoints, and maps cache-write usage to `cache_creation`. A same-tag fix serializes `promptCacheRetention: "in-memory"` as API-legal `"in_memory"` and unifies precedence (per-call → modelKwargs → constructor); Chat Completions no longer drops modelKwargs.

ByteDance’s DeerFlow shipped v2.1.0 on 2026-09-24, closing the milestone with **772** merged PRs (~83k GitHub stars). Focus: trust and ops—verifiable subagent delegation, optional durable `batch_task`, pluggable memory (DeerMem / OpenViking / mem0 HTTP), plus E2B, BoxLite micro-VM, Tenki and OpenSandbox providers. Breakings: unconditional `X-Trace-Id`, reserved `/mnt/skills`, memory config under `memory.backend_config`, Docker bind defaults to `127.0.0.1`.

Pydantic shipped Monty v1.0.0 on 2026-09-25 (PyPI pydantic-monty, npm @pydantic/monty, crates.io monty), dropping the experimental label. OSS Monty is a from-scratch Rust Python bytecode VM (Ruff parser) with zero FS/network/env by default—host access only via explicit external functions. Official alternatives table: ~0.8ms warm checkout / ~5ms new pool vs ~195ms Docker exec, ~1500ms remote sandbox services, ~2700ms Pyodide. Built for agent-written code, not full VMs.

Confident AI’s deepeval 4.2.x (notes for 4.2.2/4.2.4; PyPI at 4.2.6) wires TypeSafe Jev into LLM-as-a-judge: evaluation LLMs still handle language tasks, while closed verdicts go to System One for typed decisions with calibrated probabilities. Claimed decision-stage pricing is about $0.042 per million input tokens with no output charge, ~100ms typical latency, and batched independent questions. Faithfulness, GEval, DAGMetric, and Classifiers are integrated; enable via `deepeval set-mode experimental` plus `typesafe-sdk`—missing keys fail loudly instead of silent fallback.

xAI shipped Python SDK v1.20.0 on 2026-09-24 (PyPI xai-sdk). For grok-imagine-video-1.5 it adds last_frame_url/last_frame_file_id to pin the exact closing frame (optionally interpolating from a pinned first frame) and a keyframes list to pin up to four in-clip reference images at second timestamps strictly inside the duration. Docs list video at about $0.08/sec with 480p/720p/1080p. Aimed at Imagine pipelines that need controllable start/end framing or storyboard alignment.

GPT Researcher shipped v3.7.0 on 2026-09-26 (PyPI gpt-researcher 0.16.x). The context filter now defaults to TypeSafe Jev, scoring passage usefulness for each sub-query instead of embedding similarity. On a 28-task replay with identical sources, kept-passage relevance is 73% for Jev vs 46% for embeddings (~59% relative lift). Without TYPESAFE_API_KEY it falls back to local BM25—no embedding provider required. Also requires Python 3.12+ and adds a retriever plugin entry point.

Spring shipped Spring AI 2.1.0-M1 on 2026-09-25. Headliners: OpenAI Responses API support (maps reasoning/function_call/image items to ReasoningPart/ToolCallPart/MediaPart while preserving item id/status for replay); ordered MessagePart lists on AbstractMessage so text, reasoning, tool calls, and media round-trip in model order; VectorStore.upsert for caller-supplied precomputed embeddings (wired for pgvector, Redis, Elasticsearch, Qdrant). Bumps Spring Boot to 4.2. First usable 2.1 milestone for teams adopting Responses and precomputed vector pipelines.

LangChain4j 1.20.1 landed 2026-09-25 atop the 1.20.0 line. AI Services now choose sync, TokenStream, CompletableFuture/CompletionStage, or Flow.Publisher by return type; non-blocking reaches tools, memory, guardrails, and the retrieval graph (@Experimental). Opt-in langchain4j-jackson3 routes JSON through Jackson 3 with typed JsonRead/WriteException. 1.20.1 lets @McpClientSupplier methods also take supplier parameters for per-request MCP clients. Aimed at Quarkus/Vert.x/WebFlux teams needing concurrent agents.

LangGraph.js shipped `@langchain/[email protected]` on 2026-09-25 (with `@langchain/[email protected]` and Vue/Svelte twins). `useStream`'s `"enqueue"` multitask strategy can set `queue: "server"` so queued runs hit backend Runs REST instead of an in-memory client queue—surviving reloads, visible across sessions, with server-side cancelQueued/clearQueue. Default remains `queue: "local"`; custom AgentServerAdapter transports are unsupported. For frontends that need durable, collaborative agent queues.

ByteDance launched DeerFlow 2.0.0, completing a ground-up rewrite of its 83k-star open-source agent harness with 182 merged PRs. Built around a SuperAgent architecture, DeerFlow 2.0 orchestrates sub-agents, persistent memory, and sandboxed execution with extensible tools. It introduces self-updating SOUL memory, user-owned IM channel integrations (Feishu, DingTalk, WeChat, Slack, Discord, Telegram), Docker DooD sandbox protection, and deep integration with BytePlus InfoQuest crawling technology for robust multi-hour autonomous execution.

Docker Engineering shipped docker-agent/cagent v1.144.0 on 2026-09-25. It widens ACP v1 compatibility: session delete + elicitation, model reasoning/safety options via session/set_config_option, shell via client terminal/create, client-supplied Streamable HTTP/SSE MCP on session new/resume/load, host credential auth/logout, audio prompts with bounded history replay. Sandbox gains --cloud and v3 kit so sandboxes run without a local Docker dependency. Plus TUI render wins and sandbox/filesystem confinement fixes. Aimed at teams embedding agents in IDEs/gateways over ACP.

Kilo-Org shipped open-source coding agent platform Kilo Code v7.8.1 (includes 7.8.0) on 2026-09-25. 7.8.0 brings a high-resolution streamed Agent Manager browser for public HTTPS pages and CDN assets in localhost previews, with install/retry/settings guidance, native cross-origin checks, ordered clipboard, and stalled-session cleanup; plus close-task commands and a stoppable session-cleanup pass. 7.8.1 publishes CycloneDX SBOMs for every CLI archive, npm package, container image, VS Code extension, and JetBrains plugin—SHA-256 bound and GitHub-attestation signed. Azure Entra ID accepts resource name or full endpoint URL.

Zed Industries shipped editor Zed v1.21.0 on 2026-09-23. AI: Agent Panel BYOK for Claude Opus 5.5 (Anthropic) and GPT-6 Astra/Sol/Luna (OpenAI); SuperGrok sign-in for Grok models; DeepSeek Flash 4.1; Z.ai GLM via Mistral provider; `agent.prevent_idle_sleep` on by default so long agent turns do not idle-sleep the machine. Also: language-server command picker, `showDocument` open file/URL, faster syntax/Markdown code-block rendering, ACP compatibility and async task wakeup improvements.

Indie developer wong2 released cf-mailroom, a fully self-hosted email system powered by Cloudflare (Workers, Email Routing, D1, R2, Web Push) designed for seamless human-agent collaboration. While humans interact through a responsive Gmail-like web UI, AI agents access mailboxes via the Model Context Protocol (MCP) with scoped OAuth permissions. The platform features automated natural-language email labeling, intelligent agent draft generation with custom playbooks, and one-click human approval workflows.

Unsloth AI released version v0.1.815-beta alongside official prebuilt Linux x86_64 CUDA 13 wheels for Flash-Attention 2.8.4, Causal-Conv1D 1.7.0, and Mamba-SSM 2.3.2.post1 targeting PyTorch 2.13/2.14 on Python 3.13. The release enables fast local deployment of Alibaba's Qwen-Image-2.1 across both consumer and datacenter GPUs using Fast FP8 and GGUF quantization (defaulting to Q4_K_M) for combined image generation and precise image editing. Crucially, the Unsloth workspace introduces custom Agent Skills compatible with Claude Code and .agents formats, featuring @skill tagging in chat and 2x faster reasoning blocks (boosting UI rendering from 30 FPS to 60 FPS).

unclecode shipped Crawl4AI v0.9.4 on 2026-09-23 (PyPI crawl4ai 0.9.4). It closes three coordinated advisories: blind SSRF via robots.txt (GHSA-f77g-77vp-r96v), SSRF with response disclosure via link_preview (GHSA-wh5w-hmj3-vgg7, high), and a dict-wrapper trust-boundary bypass that let non-admin clients read server env vars (GHSA-5w5p-vcv6-mm3f, high). A process-wide egress_policy wires the Docker PinningProxy into library HTTP clients. Default pruning switches to lxml-native PruningContentFilterLXML (~10×: 134→13 ms medium page; 2200→260 ms on a 6000-card page). Self-hosted Docker servers should upgrade.

Anthropic shipped the official Python SDK v1.8.0 on 2026-09-22 (PyPI anthropic 1.8.0). Versus 1.7.0 it adds `claude-opus-5-5`, inline tool definitions, and MCP tool-list pinning (beta) into client types/runners; fixes a shared `evaluated_permission` enum across Managed Agents events, a Python 3.13 crash when a stream is left open at exit, immediate `add_tools()` effect, and stripping reply-only params from the tool runner compaction request. For stacks already on Opus 5.5 and MCP-managed tools, this is the typed client surface that matches the server features.

The official MCP TypeScript SDK shipped `@modelcontextprotocol/[email protected]` on 2026-09-23 (npm). Headline: request-time `scopeChallenge` callbacks on tools, resources, resource templates, and prompts that return the exact scope set for an `insufficient_scope` challenge; `createMcpHandler` and Streamable HTTP answer HTTP 403 before handler/SSE setup. Patches add a default **4 MiB** request body limit and JSON-RPC batch cap of 100, treat request id `0` as a real id, stop sending `notifications/cancelled` for `initialize`, and enforce `Mcp-Name` on modern tasks routes. For Agent gateways wiring MCP to OAuth resource servers, this is a permissions + DoS hardening minor.

BerriAI shipped LiteLLM v1.102.1 on 2026-09-23 (PyPI litellm 1.102.1). Versus 1.102.0 it backports Anthropic/Bedrock/Vertex `safeguards`→`safeguard_results` passthrough so Claude Code Auto mode through a LiteLLM gateway can show Auto mode server: Enabled, and cherry-picks seven TypeSafe Jev changes (passthrough, complexity router, relevance compaction guardrail, auto-router classifier, OpenRouter jev-1.13 pricing, etc.) from the 1.103 RC onto `stable/1.102.x`. Docker images keep cosign verify instructions.

agno-agi shipped Agno v3.0.11 on 2026-09-23 (PyPI agno 3.0.11). `Knowledge.search()` now runs a knowledge-level retrieval pipeline that can widen candidates before reranking, with new `MMRReranker` (relevance vs diversity) and pgvector-focused `RecencyReranker` (score × exponential time decay); adds hostname migration for indexed page sources (dry-run by default), typed `PageCommandResult` with truncation/completeness metadata, and machine-readable `cancellation_stage` on Run/Team/Workflow outputs. Per-vector-db `reranker` is deprecated in favor of Knowledge-level rerankers.