Update docker.io/nousresearch/hermes-agent Docker tag to v2026.8.3

[renovate]

This PR contains the following updates:

Package	Update	Change	Pending
docker.io/nousresearch/hermes-agent	minor	v2026.6.19 → v2026.8.3	v2026.8.16 (+1)

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "after 12am and before 2am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

docker.io/nousresearch/hermes-agent (docker) v2026.6.19 -> v2026.8.3

Risk: 🔴 Risk

The Deep Dive

Update Scope

This PR replaces the actual digest-pinned Hermes Agent image from v2026.6.19 (Hermes 0.17.0) to v2026.8.3 (Hermes 0.20.0); the sole manifest change is the hermes container image, and there is no Kustomize image override, so Argo CD will deploy it with the existing gateway run arguments, PVC, Slack secrets, API server, dashboard/OIDC, webhook, and Camofox settings (PR diff, Felix deployment, v0.20.0 release). The Bun API and nginx sidecars, PostgreSQL cluster, RBAC, services, ingresses, and persistent-volume specification are unchanged (Felix kustomization).

Performance & Stability

• Substantial speed and durability work lands in this range. Upstream reports roughly 80% lower first-turn startup latency, live reasoning, durable final-answer redelivery after gateway restarts, and later prompt/config/tool hot-path improvements (v0.19.0 release, v0.20.0 release). These activate with the upgraded runtime where their code paths are used; Felix's gateway benefits from gateway startup and delivery work, while desktop-only performance improvements do not apply to this deployment. The proposed-version memory regression is analyzed once under Hazards & Risks.
• The container runtime changes materially. The target image moves to Node 26, adds fixed SQLite 3.53.4 for an upstream WAL-reset corruption defect, replaces tini with s6 supervision, and redirects optional lazy packages into persistent /opt/data/lazy-packages (target Dockerfile). The manifest's exact baked Hermes UID 10000 and fsGroup: 10000 avoid the image's explicit arbitrary-UID rejection, but Kubernetes forces a non-root start, bypassing the root-only ownership/remap path documented by upstream; existing PVC ownership makes compatibility plausible, not proven (stage-2 hook, Felix deployment).

Features & UX

• Scale-to-zero and coordinated drain make gateway lifecycle safer. The gateway can become dormant while idle and coordinate quiescence before restart, migration, or update so hosted/relay deployments reduce idle use without dropping active turns (v0.18.0 release). This capability is available after upgrade but requires lifecycle/relay configuration; recursive searches found no scale-to-zero, dormant, or drain keys in the reviewed Felix files, and CI cannot see configuration persisted on /opt/data. Felix uses a single replica with Recreate, so coordinated drain would be valuable if enabled but does not create rollout redundancy (deployment).
• Profile routing and durable delivery improve the active gateway. A single gateway can route channels or threads into isolated profiles with separate config, memory, skills, and secrets, while a durable delivery ledger automatically redelivers completed answers after a crash (v0.19.0 release). Delivery durability applies automatically; multiplexed profile routing requires mappings. Felix configures Slack credentials and one persistent home but no multiplex/profile-routing keys in reviewed files (ExternalSecret); live PVC profiles remain unknown.
• OTLP health export, signed outbound webhooks, and A2A add three different integration surfaces. OTLP can export gateway health/diagnostics to an observability backend; outbound webhooks push HMAC-signed session, turn, and tool lifecycle events to automation systems; the bundled A2A v1.0 plugin lets compatible external agents discover and invoke Hermes (v0.20.0 release). All are opt-in and need endpoints, credentials, or plugin setup. Recursive Felix searches found no OTLP/telemetry, outbound-webhook/HMAC, or A2A keys; the existing inbound Tailscale /webhooks route is not evidence of outbound lifecycle hooks (webhook ingress). Settings stored on the PVC or in external systems remain unobservable.
• Mixture-of-Agents and background delegation expand multi-model work. Named MoA ensembles appear as selectable virtual models, expose each reference model's reasoning, and stream the aggregator answer; background fan-out lets multiple delegated tasks run without blocking the main conversation and later consolidates their results (v0.18.0 release). Both require a user to select/configure models or delegate work, so they do not activate merely from the image change; neither the manifests nor repository-managed secrets establish MoA presets or provider credentials beyond API/Slack keys, while PVC profile state is unknown (ExternalSecret).
• Verification, learning, and cheaper self-review make autonomous work more inspectable. /goal completion contracts and a verification ledger let Hermes judge completion against recorded checks; /learn turns a described workflow, directory, or URL into a reusable skill; /journey exposes memories and skills for review/edit/delete; background review moves to a cheaper auxiliary model with digested context (v0.18.0 release). These are available through supported user surfaces and need commands, goal configuration, or an auxiliary model; verification-on-stop remains default-off after migration. Felix exposes the dashboard/gateway, but reviewed manifests do not establish goals, auxiliary routing, or live learned content.
• Voice becomes conversational across supported clients and messaging adapters. v0.20.0 streams TTS clause-by-clause, supports barge-in and wake words, transcribes voice notes on audio-capable platforms, and adds configurable STT/TTS providers (v0.20.0 release). Voice requires client/platform support plus speech-provider configuration; Felix declares Slack but no STT/TTS/voice keys in reviewed files, and Slack usage does not prove voice is enabled. The new default stt.language: en matters only if the unobserved live profile uses speech.
• Desktop artifacts/plugins/projects and CLI steering are available to remote-gateway users, not hosted by these manifests. Across the releases, desktop gains coding Projects, worktrees, live-preview artifacts, a plugin SDK, quick entry, and multiple windows; CLI/TUI gain /prompt, shell mode, /init, /diff, /context, /focus, prompt stash, and mid-turn redirects (v0.18.0 release, v0.20.0 release). These improve an installed desktop/CLI connected to Felix but require those external clients or explicit commands; this pod only declares gateway, webhook, and dashboard services, so actual client adoption is unknown (kustomization).
• Secrets, research, skills, models, and tools broaden. Bitwarden/1Password secret sources can inject scoped credentials; grounded research adds citations and fact checking; bundled office skills and lazy MCP startup reduce setup/startup cost; provider catalogs expand; terminal/file tools diagnose and recover from common failures; and the default tool iteration ceiling rises from 90 to 500 (v0.19.0 release, v0.20.0 release). Tool recovery and the iteration default activate automatically, whereas vaults, research skills, providers, and MCP require selection/configuration. Repository-managed Felix secrets expose API and Slack credentials only, but CI cannot inspect profile secrets on the PVC (ExternalSecret).

Security

• The proposed range includes security hardening rather than a confirmed newly introduced CVE. It adds DNS-pinned SSRF-safe fetches, stricter secret redaction, webhook body caps, credential-scope restrictions, and refreshed dependency floors (v0.18.0 release, v0.19.0 release, v0.20.0 release). This is relevant because Felix injects API and Slack credentials and exposes public gateway/dashboard ingresses plus a Tailscale webhook route (ExternalSecret, gateway ingress, webhook ingress).
• The target pins a non-affected cryptography version. v2026.8.3 pins cryptography 48.0.1, the first patched version for the high-severity, CVSS 7.5 denial-of-service advisory GHSA-537c-gmf6-5ccf, so the proposed target is outside the advisory's affected range. The old image's resolved transitive version was unavailable, so the deployment's before/after resolution status for this advisory is unknown and the PR cannot be characterized as fixing it.
• No repository-level advisory was published at evaluation time. The upstream public security-advisory API returned an empty list, while Dependabot alert access was denied; this supports no stronger claim than 'no public upstream GHSA found' (upstream security policy).

Key Fixes

• Gateway and state reliability improve across the range. The releases include response redelivery after restart, session integrity repairs, credential-pool locking fixes, OIDC/auth self-healing, webhook size limits, and dashboard/gateway stability work (v0.19.0 release, v0.20.0 release). These are relevant to Felix's long-running gateway, Slack socket-mode credentials, OIDC dashboard, webhook service, and persistent state, but they do not offset the proposed version's known memory regression.
• Tagged-image packaging is repaired in the included patch releases. v2026.7.7.2 replaces a git-pinned WhatsApp Baileys dependency with a published package so tagged Docker builds install reliably (v0.18.2 release); Felix does not declare WhatsApp, so this is build provenance rather than an active integration fix.

Newer Versions

• v2026.8.13 is the minimum meaningful safety floor. This 1,444-commit, roughly 656-PR stabilization rollup is the first release containing the fix for the blocking regression described under Hazards & Risks (v0.20.1 release, fix confirmation).
• v2026.8.16 and v2026.8.16.2 are also available. They add further gateway, cron, auth, installer, session-handoff, subprocess, and scheduler fixes (v0.20.2 release, v0.20.3 release). Because those tags include considerable additional churn, they need their own Renovate evaluation rather than being assumed safe.
• Another target-image issue remains open. A report against the v2026.8.3 Docker gateway shows terminal calls referencing scripts can fail before execution with ValueError: embedded null character in path (#80585); repository evidence cannot establish whether Felix's live users exercise that terminal pattern.

Hazards & Risks

• Known v2026.8.3 gateway OOM regression. The proposed gateway's per-session agent cache can retain complete transcripts and tool dumps without a byte budget; upstream reproduced 54–64 GB RSS and OOM and released memory-pressure LRU eviction in v2026.8.13 (#81625). Felix directly runs gateway run, persists /opt/data, and sets no container memory request or limit, so the affected path is active and an OOM could disrupt the sole replica and its state (deployment). This directly determines renovate:risk and is the reason not to deploy v2026.8.3.
• Changed defaults alter autonomous behavior. Smart approvals become the default, reasoning display defaults on, session auto-reset defaults off, in-place compaction defaults on, STT language defaults to English, and the tool-call iteration ceiling rises from 90 to 500 (v0.18.0 release, v0.19.0 release, v0.20.0 release). The higher iteration ceiling and smart approvals can increase runtime, spend, and command execution without repository changes; live profile overrides on the PVC are unknown.
• Compatibility inventory. The range removes the google-gemini-cli and google-antigravity OAuth providers, retires Kimi K2.x catalog entries and Brew/PyPI installation channels, deprecates max_async_children, requires Node 26 for supported runtime tooling, and introduces automatic config/state migrations including a newer compact FTS layout (v0.18.0 release, v0.19.0 release, v0.20.0 release). Docker remains a supported channel, but external clients and persistent live profiles are not visible in CI, so removed provider or deprecated-key use cannot be excluded.
• Non-root bootstrap is a targeted concern. The new image documents root startup for s6 setup and ownership repair, while Felix forces UID/GID 10000; that exact UID is accepted and the pod supplies matching fsGroup, so this is not a confirmed incompatibility, but the root-only remap/chown path will not run (target Dockerfile, stage-2 hook, deployment).

Further Follow-up

• Retarget rather than deploy this endpoint. Wait for Renovate to propose v2026.8.13 or newer—preferably the current v2026.8.16.2—and evaluate that exact image; if the candidate contains the memory-pressure eviction fix, the principal renovate:risk reason is removed, while a candidate without it remains risk (fix confirmation, latest release).
• Recovery prerequisite for persistent migrations. CI evidence found a 10 Gi felix-data PVC mounted at /opt/data but no Felix-specific backup/snapshot declaration (PVC, deployment). Before any 0.17→0.20 deployment, establish a recent recoverable snapshot and a tested restore path for that PVC: a verified restore keeps the successor evaluation focused on runtime compatibility, while no recoverable copy leaves rollback across automatic config/FTS/state migrations unsafe and retains renovate:risk.

Sources

• Hermes Agent v0.18.0 release
• Hermes Agent v0.19.0 release
• Hermes Agent v0.20.0 release
• Hermes Agent v0.20.1 release
• Gateway memory regression and fix
• Upstream version comparison
• Renovate PR diff

---

🔴 Verdict: Risk

Do not deploy v2026.8.3 because of the directly applicable blocking regression detailed under Hazards & Risks; v2026.8.13 is the first release with the confirmed fix (upstream confirmation). Retarget to a newer patch and evaluate that exact image, with a recoverable /opt/data snapshot before crossing the persistent-state migrations.