HolmesGPT 0.40.0 is almost entirely a security release for an SRE agent that shells out.

The CNCF Sandbox project shipped fixes on August 26 for command injection in the Kubernetes toolset plus slab, kubevela, inspektor_gadget and aks follow-ups, SSRF in fetch_webpage and connectivity_check, and hardening of kubectl-run to execute without a host shell (GitHub). The bash toolset now validates command arguments and redirections rather than just the prefix, and session-approval prefixes are cryptographically signed to prevent forgery. Prefix-only validation is the same class of mistake as Chainlit's executable-name allowlist, appearing in two unrelated projects on the same day.