Config files OpenCode has changed
Config you own — hooks, permission rules, MCP servers, settings — that releases below state a change to. Counted from the release notes we track, newest change first. How a harness is layered.
Security advisories
2 published for OpenCode, from the GitHub Advisory Database.
- CriticalMalicious website can execute commands on the local system through XSS in the OpenCode web UI
Fixed in 1.1.10 · CVE-2026-22813 · Jan 13, 2026
Fixed in 1.0.216 · CVE-2026-22812 · Jan 13, 2026
Release signals
Added external browser OAuth for the Snowflake Cortex provider (@santigc6)
- Improved project copy management and move-session flows in v2
- Recovered expired MCP sessions instead of leaving MCP tools disconnected
- Cleared closed MCP clients so stale MCP connections do not linger
- Returned structured MCP tool output in a readable form
- Fixed duplicate renderable IDs that could break TUI rendering
- Fixed commands using `$ARGUMENTS` so file contents are not injected twice (@verdverm)
- Added auth headers to `RunCommand` fetch requests (@OpeOginni)
- +15 more changes
Read the full release noteHide the full release note
Core
Improvements
- Added external browser OAuth for the Snowflake Cortex provider (@santigc6)
- Improved project copy management and move-session flows in v2
Bugfixes
- Recovered expired MCP sessions instead of leaving MCP tools disconnected
- Cleared closed MCP clients so stale MCP connections do not linger
- Returned structured MCP tool output in a readable form
- Fixed duplicate renderable IDs that could break TUI rendering
- Fixed commands using
$ARGUMENTSso file contents are not injected twice (@verdverm)
TUI
Bugfixes
- Added auth headers to
RunCommandfetch requests (@OpeOginni)
Desktop
Improvements
- Brought v2 visibility settings to the web app
- Refreshed the oc-2 color theme (@arvsrn)
Bugfixes
- Made the terminal resize gutter easier to grab
- Faded overflowing titlebar tabs instead of clipping them abruptly
Thank you to 5 community contributors:
-
@verdverm:
- fix(tui): double file content injection in commands using $ARGUMENTS (#31245)
-
@arvsrn:
- feat(app): update oc-2 colors (#31071)
-
@Slickstef11:
- docs: update North Mini Code privacy terms (#32096)
-
@santigc6:
Excerpt ends here — this release continues at the source ↗.
Added `cwd` support for local MCP servers so they can start from a workspace-relative directory. (@Grantmartin2002)
- Added connector-based authentication flows and support for stored provider credentials.
- Added v2 API endpoints to create and fetch sessions, list session questions, and resolve the active location.
- File reads now return raw content with the correct content type for API and SDK clients.
- MCP server log notifications are now surfaced in opencode logs.
- Fixed Gemini tool schemas that used multi-type fields so compatible tools keep working. (@Killusions)
- +15 more changes
Read the full release noteHide the full release note
Core
Improvements
- Added
cwdsupport for local MCP servers so they can start from a workspace-relative directory. (@Grantmartin2002) - Added connector-based authentication flows and support for stored provider credentials.
- Added v2 API endpoints to create and fetch sessions, list session questions, and resolve the active location.
- File reads now return raw content with the correct content type for API and SDK clients.
- MCP server log notifications are now surfaced in opencode logs.
Bugfixes
- Fixed Gemini tool schemas that used multi-type fields so compatible tools keep working. (@Killusions)
- Content-filtered model responses now surface as visible errors instead of failing silently. (@kkdawkins)
- Fixed MCP auth and debug requests dropping configured headers.
- Snapshot creation now reuses source Git objects to avoid long re-hashing delays on huge repos. (@dmtrKovalenko)
- Fixed MCP catalog request timeouts not applying when listing prompts, resources, or tools.
Thank you to 5 community contributors:
-
@dmtrKovalenko:
- fix(snapshot): reuse source git objects to avoid re-hashing huge repos (#31798)
-
@tobwen:
Excerpt ends here — this release continues at the source ↗.
Fixed issue with 1.17.2 desktop crashing
Primary source ↗Recover from expired remote config auth by prompting you to log in again instead of failing to load config (@Ayushlm10)
- Let subagents use their own configured permissions again
- Restore Linux launcher and icon identity so pinned apps keep opening correctly (@neriousy)
- Restore the device attachment picker (@rexdotsh)
- **Thank you to 3 community contributors:**
- @Ayushlm10:
- fix: recover from expired enterprise auth on remote config load (#31661)
- @rexdotsh:
- fix(app): restore device attachment picker (#31707)
- @neriousy:
- fix(desktop): restore linux launcher identity (#31709)
References can include usage descriptions for agents, show up in the new docs, and be hidden from `@` autocomplete when needed.
- Deprecated `reference` config entries continue to load under the newer `references` config key.
- MCP prompt and resource requests now respect configured server timeouts.
- Anthropic fallback responses are handled correctly again.
- MCP servers that fail during client setup now fail cleanly instead of leaving a broken connection behind.
- +2 more changes
Read the full release noteHide the full release note
Core
Improvements
- References can include usage descriptions for agents, show up in the new docs, and be hidden from
@autocomplete when needed.
Bugfixes
- Deprecated
referenceconfig entries continue to load under the newerreferencesconfig key. - MCP prompt and resource requests now respect configured server timeouts.
- Anthropic fallback responses are handled correctly again.
- MCP servers that fail during client setup now fail cleanly instead of leaving a broken connection behind.
Desktop
Improvements
- The new desktop session flow now has a dedicated
/new-sessionroute with draft tabs that keep your prompt and project selection together until you start the session.
Bugfixes
- Restored macOS auto-updates.
Polled sources
[github-releases] GitHub Releases
GitHub Releases · last read Oct 24, 2026
https://github.com/anomalyco/opencode/releases