feat(container): update image docker.io/nousresearch/hermes-agent (v2026.7.30 ➔ v2026.8.3)

[drag0n141-bot]

This PR contains the following updates:

Package	Update	Change
docker.io/nousresearch/hermes-agent	minor	v2026.7.30 → v2026.8.3

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[drag0n141-bot]

--- kubernetes/apps/ai/hermes/app Kustomization: ai/hermes HelmRelease: ai/hermes

+++ kubernetes/apps/ai/hermes/app Kustomization: ai/hermes HelmRelease: ai/hermes

@@ -54,13 +54,13 @@

               WHATSAPP_MODE: bot
             envFrom:
             - secretRef:
                 name: hermes-secret
             image:
               repository: docker.io/nousresearch/hermes-agent
-              tag: v2026.7.30@sha256:b869e64d6496d4763d5e4fb675b5f504cb23b0e35ec9b790481a56118602b10f
+              tag: v2026.8.3@sha256:16788311e2fa3035456bdc1bafb8ec2b1777db64ebf020af9bb7eb73c3712c9e
             resources:
               limits:
                 memory: 4Gi
               requests:
                 cpu: 50m
                 memory: 512Mi
@@ -110,13 +110,13 @@

                 export HOMEBREW_PREFIX=/opt/data/.local/homebrew
                 mkdir -p $HOMEBREW_PREFIX
                 git clone --depth 1 https://github.com/Homebrew/brew $HOMEBREW_PREFIX
               fi
             image:
               repository: docker.io/nousresearch/hermes-agent
-              tag: v2026.7.30@sha256:b869e64d6496d4763d5e4fb675b5f504cb23b0e35ec9b790481a56118602b10f
+              tag: v2026.8.3@sha256:16788311e2fa3035456bdc1bafb8ec2b1777db64ebf020af9bb7eb73c3712c9e
         labels:
           nfsMount: 'true'
     defaultPodOptions:
       securityContext:
         fsGroup: 10000
         fsGroupChangePolicy: OnRootMismatch

[drag0n141-bot]

--- HelmRelease: ai/hermes Deployment: ai/hermes

+++ HelmRelease: ai/hermes Deployment: ai/hermes

@@ -88,13 +88,13 @@

 
           if [ ! -f /opt/data/.local/homebrew/bin/brew ]; then
             export HOMEBREW_PREFIX=/opt/data/.local/homebrew
             mkdir -p $HOMEBREW_PREFIX
             git clone --depth 1 https://github.com/Homebrew/brew $HOMEBREW_PREFIX
           fi
-        image: docker.io/nousresearch/hermes-agent:v2026.7.30@sha256:b869e64d6496d4763d5e4fb675b5f504cb23b0e35ec9b790481a56118602b10f
+        image: docker.io/nousresearch/hermes-agent:v2026.8.3@sha256:16788311e2fa3035456bdc1bafb8ec2b1777db64ebf020af9bb7eb73c3712c9e
         name: install-tools
         volumeMounts:
         - mountPath: /opt/data
           name: data
         - mountPath: /nfs-data
           name: nfs
@@ -138,13 +138,13 @@

           value: 'true'
         - name: WHATSAPP_MODE
           value: bot
         envFrom:
         - secretRef:
             name: hermes-secret
-        image: docker.io/nousresearch/hermes-agent:v2026.7.30@sha256:b869e64d6496d4763d5e4fb675b5f504cb23b0e35ec9b790481a56118602b10f
+        image: docker.io/nousresearch/hermes-agent:v2026.8.3@sha256:16788311e2fa3035456bdc1bafb8ec2b1777db64ebf020af9bb7eb73c3712c9e
         name: app
         resources:
           limits:
             memory: 4Gi
           requests:
             cpu: 50m

[claude]

nousresearch/hermes-agent: v2026.7.30 → v2026.8.3

Verdict: Safe to merge

This bumps the wrapper image tag from the v0.19.1 infra-patch tag to v0.20.0 ("The Herald Release"), Hermes Agent's own release — no separate inner component to trace since the Docker image is the application.

Research notes / things ruled out:

• The s6-overlay tini → entrypoint-dispatch.sh PID-1 migration (a real breaking change to container ENTRYPOINT behavior) landed in May 2026, well before v2026.7.30 — already in place, not introduced by this bump.
• API_SERVER_KEY being mandatory for non-loopback binds (this repo sets API_SERVER_HOST: 0.0.0.0) predates v2026.7.30 as well; not new here. The key is presumably supplied via the hermes-secret envFrom, which isn't visible to this read-only review.
• v0.20.0 adds an approval gate for docker/podman daemon-redirect commands run via the agent's shell tool. Not relevant here — the install-tools initContainer in kubernetes/apps/ai/hermes/app/helmrelease.yaml already explicitly deletes any bundled docker binary (rm -f /opt/data/.local/bin/hermes /opt/data/.local/bin/docker), so the agent has no docker in PATH to begin with.
• "Node 26 required, brew/pip channels retired" refers to how Hermes Agent itself is installed (shell installer / Docker / Nix remain supported) — irrelevant to a Docker-deployed instance, and unrelated to this repo's own install-tools container which git-clones Homebrew as an agent-accessible tool, independent of the app's internal runtime.
• No config version field or api_server YAML section is used in kubernetes/apps/ai/hermes/app/resources/config.yaml, so the new table-driven config-migration registry (auto-migration floor v12) and the YAML-level api_server bridging fix don't apply — this deployment configures everything via env vars.

New features worth adopting (optional, not required):

• Voice support added across every gateway platform including WhatsApp (transcription + platform-aware auto-TTS replies). This repo already runs WHATSAPP_ENABLED: true / WHATSAPP_MODE: bot, so voice notes would now be transcribed/answered automatically if an STT/TTS provider is configured — currently none is set in config.yaml, so this is inert until opted into.
• Cold start dropped ~14s → ~1.8s, which benefits pod restarts/rollouts given reloader.stakater.com/auto: "true" is set on this HelmRelease.
• tool_loop_guardrails.hard_stop_enabled (defaults false) is documented as recommended for unattended gateways to prevent stuck loops — this is pre-existing behavior, not new to this version, but worth a follow-up look given this is an unattended WhatsApp bot deployment.

Sources consulted:

• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.8.3
• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.30
• https://github.com/NousResearch/hermes-agent/releases
• https://hermes-agent.nousresearch.com/docs/user-guide/docker
• NousResearch/hermes-agent#31760 (s6-overlay migration, merged 2026-05-25)
• https://hermes-agent.nousresearch.com/docs/user-guide/features/api-server
• https://github.com/drag0n141/home-ops/blob/master/kubernetes/apps/ai/hermes/app/helmrelease.yaml
• https://github.com/drag0n141/home-ops/blob/master/kubernetes/apps/ai/hermes/app/resources/config.yaml