7d:I[154500,[["$2",["$3","$4"],[14451,1389]],["$5",["$6","$7","$8","$9","$a","$b"],[40076,28925,10525,30632,7744,72054]]],"IconMark"] 78:T9c2,## Stack (DEP-91) Split from #1662 for reviewability, then **rescoped**: `main` has since landed #1681 (dependency/toolchain CVEs) and #1693 (`hoophq/hoopagent`), which superseded two PRs of the original stack. - ~~#1683 — Go dependency + toolchain CVE bumps~~ — closed, superseded by #1681 - ~~#1685 — opt-in `hoophq/hoopdev-minimal`~~ — closed, superseded by #1693 - #1684 — 1. agent-tools: drop kernel-header CVEs, modernize clean train **← you are here** - #1686 — 2. Vulnerability gates for hoopagent + govulncheck - #1687 — 3. SBOM + bundled-tool manifest on releases - #1688 — 4. Weekly base-OS rebuild of hoopagent - #1689 — 5. Image release integrity hardening Merge in order, bottom-up. Each PR targets the one below it. The remaining work is what `main` still lacks: the fat image's kernel-header CVEs, and any vulnerability gate, SBOM, or scheduled OS patching for `hoophq/hoopagent`. --- ## What Removes build-only packages from the `agent-tools` base image (the base of `hoophq/hoopdev`) and modernizes the clean train. - Drops `alien`, `elfutils`, `libelf-dev`, `python3-dev` — they pulled in `linux-libc-dev` (kernel headers, ~891 findings) and `libc6-dev` with no runtime use. - Installs `groff` and `python3-pip` with `--no-install-recommends`. - Declares `xz-utils` explicitly (previously transitive via the removed packages). - Uses runtime `unixodbc` instead of `-dev` headers. - Makes `KUBECTL`/`SQLCMD`/`MONGOSH`/`MONGODB_TOOLS` versions ARG-driven so the legacy and clean trains can diverge. ## Why Kernel headers were the single largest CVE contributor in the fat image and were never needed at runtime — every bundled CLI is prebuilt. `hoophq/hoopagent` (#1693) does not help here: `hoophq/hoopdev` is a separate image that many deployments still need for exec-based connections and RDP, and `main` still installs all four packages. ## Risk Legacy-train pins are unchanged, so `hoophq/hoopdev` keeps its current tool versions. The workflow asserts train contents (legacy keeps the legacy mongo shell; clean ships only `mongosh`). ## How to test ```bash docker build -f Dockerfile.tools -t agent-tools-test . docker run --rm agent-tools-test sh -c 'dpkg -l | grep -c linux-libc-dev || echo "0 (expected)"' docker run --rm agent-tools-test sh -c 'psql --version && mongosh --version && kubectl version --client && aws --version' ``` Expected: no `linux-libc-dev`; every bundled client still works. Part of DEP-91. Automated by MisterMal79:T1146,

PR Summary by Qodo

agent\-tools: remove kernel\-header deps and centralize clean\-train versions ✨ Enhancement ⚙️ Configuration changes 🕐 40\+ Minutes Grey Divider

AI Description

> • Remove build-only packages pulling kernel headers to cut CVE noise in agent-tools.
> • Make clean-train tool versions workflow-driven while keeping legacy pins unchanged.
> • Build both arches on PRs (no push) to catch arm64-only mismatches pre-merge.
>

Diagram

```mermaid graph TD WF["agent-tools-build.yml"] --> ARGS["Clean train args"] --> BLD["Buildx (amd64/arm64)"] --> IMG["agent-tools images"] --> GATE["License+provenance gates"] -->|"push (publish only)"| HUB{{"Docker Hub"}} DF["Dockerfile.tools"] --> BLD ```

High-Level Assessment

> The following are alternative approaches to this PR:

1. Move clean-train version pins to a repo file (e.g., versions.env)

- ➕ Single source of truth usable by CI and local builds without copying build\-args - ➕ Easier for Renovate/custom tooling to bump versions via file\-based updates - ➖ Adds another config artifact to keep in sync with Dockerfile ARG names - ➖ Requires small workflow refactor to read/parse the file reliably

2. Adopt docker-bake with named targets for legacy/clean

- ➕ More explicit train separation and reusable build definitions (local \+ CI) - ➕ Cleaner multi\-arch matrix handling and build\-arg reuse - ➖ Higher conceptual overhead for contributors unfamiliar with bake - ➖ May require broader changes across existing Docker build workflows

> **Recommendation:** The PR’s approach is solid for DEP\-91: it keeps legacy pins stable in the Dockerfile while letting clean\-train versions move quickly via workflow build\-args, and it removes kernel\-header sources at the root. If version bumps become frequent, consider extracting clean\-train pins into a dedicated versions file to reduce workflow churn and improve local reproducibility.

Files changed (2) +64 / -40

Other (2) +64 / -40

agent-tools-build.ymlCentralize clean-train build args and smoke-build arm64 on PRs +26/-12

> Centralize clean\-train build args and smoke\-build arm64 on PRs > >

> • Adds a workflow output containing all clean-train tool version build-args (and disables legacy mongo for clean). Removes per-job include_legacy_mongo plumbing and makes arm64 builds run on PRs as no-push smoke tests, gating login/push steps on publish runs.
>

> > .github/workflows/agent\-tools\-build.yml

Dockerfile.toolsDrop kernel-header-inducing packages and make key tool pins ARG-driven +38/-28

> Drop kernel\-header\-inducing packages and make key tool pins ARG\-driven > >

> • Removes build-only packages (python3-dev/alien/elfutils/libelf-dev) that pulled linux-libc-dev, and installs groff + python3-pip with --no-install-recommends while declaring xz-utils explicitly. Converts kubectl/sqlcmd/mongosh/mongodb-tools versions to ARGs and swaps unixodbc-dev for runtime unixodbc; also confines focal-security/libssl1.1 setup to the legacy-mongo guard.
>

> > Dockerfile.tools

7a:T1f87,

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🔗 Cross\-repo conflicts (0) 📜 Skill insights (0) Grey Divider

1. ~~Headers removed break derived builds~~ ✓ Resolved 🔗 Cross-repo conflict ☼ Reliability

Description

>
> >

> This PR drops build headers (python3-dev, unixodbc-dev) from hoophq/agent-tools, which is the base
> image for hoophq/hoopdev; hoophq/infra’s hoopdev-dck Dockerfile installs native Python deps (e.g.,
> pyodbc, pymssql) and may fail to build when infra upgrades its pinned hoopdev tag if any dependency
> falls back to an sdist build (especially on non-amd64). Coordinate with infra to add explicit build
> deps there or guarantee wheels-only installs.
>

> >

Code

>
> >

[Dockerfile.tools[R167\-169]](https://github.com/hoophq/hoop/pull/1684/files#diff-0c924a0b3b4fd4d6e06ef78f7129eb3d7bb38e2cf8b49c9d9c1411f75c4412c0R167-R169)

> > ```diff > + # DEP-91: runtime unixodbc (libodbc2 + isql), not the -dev headers which > + # pull linux-libc-dev. Same source version; ODBC runtime preserved. > + unixodbc=2.3.12-1ubuntu0.24.04.1 \ > ``` >

Relevance

>
> > `●● Moderate` > >

> Cross-repo downstream build-risk; plausible but outside this PR’s scope. Team may note/coordinate,
> not revert.
>

> > [PR\-\#1595](https://github.com/hoophq/hoop/pull/1595) > [PR\-\#1629](https://github.com/hoophq/hoop/pull/1629) > > ⓘ Recommendations generated based on similar findings in past PRs >

Evidence

>
> >

> PR repo shows hoopdev is built FROM agent-tools and that agent-tools no longer includes python3-dev
> and unixodbc-dev; infra repo shows a derived image that pip-installs native-extension packages which
> may require those headers if wheels aren’t available.
>

> >

[Dockerfile.dev[1\-7]](https://github.com/hoophq/hoop/blob/0473ea463cbc3d468157efdc0722975703e1b480/Dockerfile.dev/#L1-L7)

[Dockerfile.tools[26\-64]](https://github.com/hoophq/hoop/blob/0473ea463cbc3d468157efdc0722975703e1b480/Dockerfile.tools/#L26-L64)

[Dockerfile.tools[163\-176]](https://github.com/hoophq/hoop/blob/0473ea463cbc3d468157efdc0722975703e1b480/Dockerfile.tools/#L163-L176)

[External repo: hoophq/infra, dock/Dockerfile [1\-55]](https://github.com/hoophq/infra/blob/801e2c0ada76eb58e62b901f6c1b8266ba734435/dock/Dockerfile/#L1-L55)

Agent prompt

>
> > ``` > The issue below was found during a code review. Follow the provided context and guidance below and implement a solution > > ### Issue description > `hoophq/infra` builds `hoophq/hoopdev-dck` FROM `hoophq/hoopdev`, and `hoophq/hoopdev` is built FROM `hoophq/agent-tools`. This PR removes `python3-dev` and switches from `unixodbc-dev` to `unixodbc` in `agent-tools` (intentionally, to drop kernel headers CVEs). If infra’s `pip3.12 install ... pyodbc/pymssql/...` ever falls back to source builds (wheel gaps, platform differences), the build can fail due to missing Python/ODBC headers. > > ### Issue Context > - The infra Docker build currently pins `FROM hoophq/hoopdev:1.54.0`; it won’t break immediately, but it can break on the next bump to a hoopdev version built on the new `agent-tools` base. > - This is most likely to surface on architectures where wheels are missing or if dependency versions change. > > ### Fix Focus Areas > - Dockerfile.tools[26-64] > - Dockerfile.tools[163-176] > - Dockerfile.dev[1-7] > - /cross_repos/infra/dock/Dockerfile[1-55] > > ### Suggested remediation options > 1) In **hoophq/infra** `dock/Dockerfile`, add explicit build deps for the pip layer (only if needed): `python3-dev`, `build-essential`, and `unixodbc-dev` (or pin/ensure wheel-only installs). > 2) Alternatively, keep `agent-tools` slim but document this as a breaking contract for downstream images and add a CI build of infra’s Dockerfile against a hoopdev tag built from the new base (coordination/test gate). > ``` > ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools >

Context

✅ Tickets:

🎫 [Feature]: hoophq/hoopdev base image carries 1,000+ fixable CVEs; request slimmer agent image and dependency refresh

✅ Compliance rules (platform): 39 rules

✅ Cross-repo context

Explored: repo: hoophq/infra (sha: 801e2c0a)

Not relevant to this PR: hoophq/libhoop

Not relevant to this PR: hoophq/documentation

Not relevant to this PR: hoophq/changelog

Tip of the day

💡 Did you know, you can enable the Remediation agent and Qodo fixes findings in a dedicated fix PR

More tips ↗ \| Customize Qodo ↗ \| Qodo docs ↗

7b:T5ae, ## 📋 API Changelog # API Changelog unknown vs. unknown ## API Changes ### GET /access-requests/rules - :warning: added the new `jit_command` enum value to the `data/items/access_type` response property for the response status `200` - added the optional property `data/items/skip_review_groups` to the response with the `200` status ### POST /access-requests/rules - :warning: added the new `jit_command` enum value to the `access_type` response property for the response status `201` - added the new optional request property `skip_review_groups` - added the new `jit_command` enum value to the request property `access_type` - added the optional property `skip_review_groups` to the response with the `201` status ### GET /access-requests/rules/{name} - :warning: added the new `jit_command` enum value to the `access_type` response property for the response status `200` - added the optional property `skip_review_groups` to the response with the `200` status ### PUT /access-requests/rules/{name} - :warning: added the new `jit_command` enum value to the `access_type` response property for the response status `200` - added the new optional request property `skip_review_groups` - added the new `jit_command` enum value to the request property `access_type` - added the optional property `skip_review_groups` to the response with the `200` status ### GET /connection-credentials - endpoint added62:["$","$L75",null,{"entries":[{"key":["platform",{"userId":"anon"},"pulls","page",{"owner":"hoophq","repo":"hoop","pullNumber":1684}],"data":{"repositoryId":"4079","detail":{"author":{"avatarUrl":"https://cdn.trylle.com/media/images/33ea12519871e768926d5967b52b2a4a?key=AarGO97nEU22hrL28WYzC3YZ7Sutnv4nOzyP1Hs7043LEgaDRiCMob5DL%2FdswzqML5uI54vi1cOiTiDZWHwYYL%2Bb2DfE7PmIAZzrBABp4LTeU4B2ofeOFrQAWOe6dQUa7jTJgBekAZyQnshVHmT3VTzxsjDhRKGx4pEZvL0T4kj64mnFyYJ5ho0%3D","externalProvider":"github","login":"racerxdl","type":"User","url":"https://github.com/racerxdl"},"authorId":"578310","baseRefName":"main","closedAt":null,"comments":11,"createdAt":"2026-08-06T21:08:01Z","headRefName":"dep-91-tools","id":"4873909","isDraft":false,"labels":[{"color":"fbca04","description":"Bumps the patch version on release (bug fixes)","name":"patch"}],"number":1684,"repository":{"name":"hoop","owner":"hoophq","provider":"forgejo"},"state":"open","title":"DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train","updatedAt":"2026-08-12T18:21:44Z","url":"https://trylle.com/hoophq/hoop/pulls/1684","body":"$78","additions":161,"deletions":50,"changedFiles":3,"commits":2,"reviewComments":3,"headSha":"0473ea463cbc3d468157efdc0722975703e1b480","baseSha":"d5126d8ae3603bdbd31e56c4e9c085cc12d42be8","headRepoOwner":"hoophq","headRepoName":"hoop","isMerged":false,"mergeCommitSha":null,"mergedBy":null,"mergeable":false,"mergeableState":"dirty","conflictingFiles":[".github/workflows/agent-tools-build.yml"],"requestedTeams":[],"requestedReviewers":[],"graphqlId":"issue:1684"},"comments":[{"id":26265323,"graphqlId":"26265323","body":"$79","createdAt":"2026-08-06T21:19:54Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26265327,"graphqlId":"26265327","body":"$7a","createdAt":"2026-08-06T21:23:33Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"}},{"id":26265383,"graphqlId":"26265383","body":"\n## Migration Safety Analysis\n\nNo database migrations were changed in this PR. Safe to deploy to sandbox.","createdAt":"2026-08-10T14:17:42Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26265384,"graphqlId":"26265384","body":"\n## Migration Safety Analysis\n\n:warning: **Automated analysis unavailable** -- the LLM API call failed. Please review these migration files manually:\n\n```\ngateway/migrations/000107_access_request_rules_skip_review_groups.down.sql\ngateway/migrations/000107_access_request_rules_skip_review_groups.up.sql\n```\n\nCheck for:\n- Destructive operations (DROP TABLE, DROP COLUMN, TRUNCATE)\n- Missing or noop .down.sql files\n- Rollback safety for sandbox deployments\n---\n*Automated analysis by Migration Safety Check.*","createdAt":"2026-08-10T14:17:45Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26265386,"graphqlId":"26265386","body":"$7b","createdAt":"2026-08-10T14:19:01Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/618d0dadf2cc03e4da918f9fce155434?key=AZR2NWibZ4GI6G7n0snc5O%2FCy3ukthRybL%2FnPkuHfb%2BSDl5jyY%2BICnK7fBwKjvxrsVV6C0JPZxZTQgFdB8jeaILFLR9JfexsaUup8AkkgNnbAGbZgojNsOfLPmKPf7SYvH%2FYQb5ondr7R93kUYfqwz0RJC2nyFR5R%2Brm41rXkHLcotJyErDIvfgcMw%3D%3D","externalProvider":"github","login":"github-actions[bot]","type":"Bot","url":"https://github.com/apps/github-actions"}},{"id":26265393,"graphqlId":"26265393","body":"✅ Build Completed with Success, Version=1684.0.0-g48d32b1","createdAt":"2026-08-10T14:50:58Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/470961e494def4cd0709b7c42504cc37?key=AeihVuRUBQXr2SP8xQfP4NAuhIa8YVJqZHLiHn8Nfc9Yeq0RQL05J2GOEmvFOyDPKt4%2FP2zVT0RfAp2CLtRaQPGD8ntWMqnIDeNc3ZldOwQ%2BZOKRfk%2Fem0j1BHXuJvu%2B1nhG%2B8S5n5iqKaAv0QXZWT%2B%2FtcI1o%2FT0edI4%2FQIQaFbnUZo3RjL9OPU%3D","externalProvider":"github","login":"sandromello","type":"User","url":"https://github.com/sandromello"}},{"id":26265394,"graphqlId":"26265394","body":"✅ Build Completed with Success, Version=1684.0.0-g48d32b1","createdAt":"2026-08-10T14:52:16Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/470961e494def4cd0709b7c42504cc37?key=AeihVuRUBQXr2SP8xQfP4NAuhIa8YVJqZHLiHn8Nfc9Yeq0RQL05J2GOEmvFOyDPKt4%2FP2zVT0RfAp2CLtRaQPGD8ntWMqnIDeNc3ZldOwQ%2BZOKRfk%2Fem0j1BHXuJvu%2B1nhG%2B8S5n5iqKaAv0QXZWT%2B%2FtcI1o%2FT0edI4%2FQIQaFbnUZo3RjL9OPU%3D","externalProvider":"github","login":"sandromello","type":"User","url":"https://github.com/sandromello"}},{"id":26265586,"graphqlId":"26265586","body":"✅ Build Completed with Success, Version=1684.0.0-g0473ea4","createdAt":"2026-08-12T18:21:44Z","author":{"avatarUrl":"https://cdn.trylle.com/media/images/470961e494def4cd0709b7c42504cc37?key=AeihVuRUBQXr2SP8xQfP4NAuhIa8YVJqZHLiHn8Nfc9Yeq0RQL05J2GOEmvFOyDPKt4%2FP2zVT0RfAp2CLtRaQPGD8ntWMqnIDeNc3ZldOwQ%2BZOKRfk%2Fem0j1BHXuJvu%2B1nhG%2B8S5n5iqKaAv0QXZWT%2B%2FtcI1o%2FT0edI4%2FQIQaFbnUZo3RjL9OPU%3D","externalProvider":"github","login":"sandromello","type":"User","url":"https://github.com/sandromello"}}],"commits":[{"sha":"0473ea463cbc3d468157efdc0722975703e1b480","message":"agent-tools: keep build headers on the legacy train\n\nRemoving python3-dev, unixodbc-dev, alien, elfutils and libelf-dev cut\nthe kernel-header CVEs, but agent-tools is the base of hoophq/hoopdev,\nand published images built on it pip-install native extensions (pyodbc,\npymssql) that compile from source when no wheel matches. Dropping the\nheaders from the default train breaks those builds on their next base\nbump.\n\nGate them behind INCLUDE_BUILD_HEADERS instead: legacy keeps them, the\nopt-in clean train drops them. CI asserts both halves of the contract on\nboth architectures, and DEV.md documents what switching trains costs and\nwhat has to happen before the legacy default can change.\n\nVerified: legacy builds pyodbc from source, clean fails the same build.\n\n 🤖 Generated with Mister Maluco\n\nCo-Authored-By: MisterMal \n","createdAt":"2026-08-10T15:17:18-03:00","author":{"avatarUrl":"","login":"","name":"Lucas Teske","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}},{"sha":"1bfe898b80d8afdafaf8fc3bceb89da791ccbc76","message":"agent-tools: drop kernel-header CVEs and modernize clean train\n\nPart of DEP-91.\n- Remove python3-dev, libelf-dev, elfutils and alien; swap unixodbc-dev\n for the runtime unixodbc; move python3-pip to --no-install-recommends;\n add xz-utils explicitly. Eliminates the linux-libc-dev source (~891\n findings) on both trains with no tool loss.\n- Make tool versions ARG-driven: legacy keeps current pins for backward\n compatibility; the clean train builds the latest versions from a single\n source in the agent-tools workflow.\n\n 🤖 Generated with Mister Maluco\n\nCo-Authored-By: MisterMal \n","createdAt":"2026-07-31T02:39:41-03:00","author":{"avatarUrl":"","login":"","name":"Lucas Teske","type":"User","url":""},"verification":{"verified":false,"reason":"gpg.error.no_gpg_keys_found"}}],"events":[{"id":26258932,"event":"reviewed","createdAt":"2026-08-06T21:23:35Z","actor":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"reviewId":3430416,"reviewState":"COMMENT"}],"reviews":[{"id":3430417,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/470961e494def4cd0709b7c42504cc37?key=AeihVuRUBQXr2SP8xQfP4NAuhIa8YVJqZHLiHn8Nfc9Yeq0RQL05J2GOEmvFOyDPKt4%2FP2zVT0RfAp2CLtRaQPGD8ntWMqnIDeNc3ZldOwQ%2BZOKRfk%2Fem0j1BHXuJvu%2B1nhG%2B8S5n5iqKaAv0QXZWT%2B%2FtcI1o%2FT0edI4%2FQIQaFbnUZo3RjL9OPU%3D","externalProvider":"github","login":"sandromello","type":"User","url":"https://github.com/sandromello"},"submittedAt":"2026-08-06T21:08:01Z","official":false},{"id":3430418,"state":"REQUEST_REVIEW","author":{"avatarUrl":"https://cdn.trylle.com/media/images/13ea898d8b2efb86c3941cdd05695536?key=ActwzxnVsBTRj3O5ho87zdI%2F5S%2FDnGZ6mRiGxgqMT21l2tTmqPj3LD9%2B%2FMusw%2B51iihy1693dWvsoF3sVpGyjjKABlZMXU8FP3d%2B14gZy7rwObNz5gBt8WDb%2FVZG7u0DdGIUloKbwDFiK9e7EAinA241VwIbnrlp1MVLpMu8ZqfCSt2xcsCiF2k0","externalProvider":"github","login":"matheusfrancisco","type":"User","url":"https://github.com/matheusfrancisco"},"submittedAt":"2026-08-06T21:08:01Z","official":false},{"id":3430416,"state":"COMMENT","author":{"avatarUrl":"https://cdn.trylle.com/media/images/6e9366337c504d875f07d9396e8dad00?key=AbmsGsgJmFD1q6W9lI%2BWlurvwVh7T7MGrDc0ETLcwBdoqSo2kcmX7nhhJNnLgsxxdzofTpyOUif40XIBYZ95kmq5gfWwHWOY48VCwySHn4Mm2HYFJoiPLOZOi5ngyxXNJA6eJ6MLzY6hFqYe6Pe6ByR9Z%2BY%2FuN%2BGw1l%2BfZWheBgQMxiHG5oiqcDYo%2Bg%3D","externalProvider":"github","login":"qodo-code-review[bot]","type":"Bot","url":"https://github.com/apps/qodo-code-review"},"submittedAt":"2026-08-06T21:23:35Z","official":false}],"stackEvents":[],"commentPagination":{"totalCount":11,"perPage":30,"loadedPages":[1]},"eventPagination":{"loadedPages":[1],"hasMore":false},"headRefDeleted":false,"stack":{"source":"inferred","parent":null,"children":[{"number":1686,"title":"DEP-91 (2/5): gate hoopagent vulnerabilities and add govulncheck","state":"open","isDraft":false,"baseBranch":"dep-91-tools","headBranch":"dep-91-gates","url":"https://trylle.com/hoophq/hoop/pulls/1686"}],"siblings":[],"depth":0}},"fetchedAt":1793519073359}],"children":"$L7c"}] 64:null 6b:[["$","title","0",{"children":"Commits · DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train · hoophq/hoop | Trylle"}],["$","meta","1",{"name":"description","content":"Commits on DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train (#1684) in hoophq/hoop."}],["$","meta","2",{"name":"application-name","content":"Trylle"}],["$","link","3",{"rel":"manifest","href":"/manifest.json","crossOrigin":"$undefined"}],["$","meta","4",{"name":"keywords","content":"Commits · DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train · hoophq/hoop, hoophq/hoop, hoophq/hoop repository, hoop, Go repository, source code, trylle, agent-native git platform, git platform for agents and humans, git platform for ai agents, coding agent pull requests, ai code review, repository automation, stacked pull requests, two-way github sync, github-compatible actions, try cli"}],["$","meta","5",{"name":"robots","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","6",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","7",{"name":"googlebot","content":"index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1"}],["$","meta","8",{"name":"twitter:domain","content":"trylle.com"}],["$","meta","9",{"name":"twitter:url","content":"https://trylle.com/hoophq/hoop/pulls/1684/commits"}],["$","link","10",{"rel":"canonical","href":"https://trylle.com/hoophq/hoop/pulls/1684/commits"}],["$","meta","11",{"name":"format-detection","content":"telephone=no"}],["$","meta","12",{"name":"mobile-web-app-capable","content":"yes"}],["$","meta","13",{"name":"apple-mobile-web-app-title","content":"Trylle"}],["$","meta","14",{"name":"apple-mobile-web-app-status-bar-style","content":"black-translucent"}],["$","meta","15",{"property":"og:title","content":"Commits · DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train · hoophq/hoop | Trylle"}],["$","meta","16",{"property":"og:description","content":"Commits on DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train (#1684) in hoophq/hoop."}],["$","meta","17",{"property":"og:url","content":"https://trylle.com/hoophq/hoop/pulls/1684/commits"}],["$","meta","18",{"property":"og:site_name","content":"Trylle"}],["$","meta","19",{"property":"og:locale","content":"en_US"}],["$","meta","20",{"property":"og:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","21",{"property":"og:image:secure_url","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","22",{"property":"og:image:type","content":"image/png"}],["$","meta","23",{"property":"og:image:width","content":"1200"}],["$","meta","24",{"property":"og:image:height","content":"630"}],["$","meta","25",{"property":"og:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","meta","26",{"property":"og:type","content":"website"}],["$","meta","27",{"name":"twitter:card","content":"summary_large_image"}],["$","meta","28",{"name":"twitter:site","content":"@trylle"}],["$","meta","29",{"name":"twitter:title","content":"Commits · DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train · hoophq/hoop | Trylle"}],["$","meta","30",{"name":"twitter:description","content":"Commits on DEP-91 (1/5): agent-tools: drop kernel-header CVEs and modernize clean train (#1684) in hoophq/hoop."}],["$","meta","31",{"name":"twitter:image","content":"https://trylle.com/api/og.png?kind=repo&owner=hoophq&repo=hoop"}],["$","meta","32",{"name":"twitter:image:alt","content":"hoophq/hoop repository preview on Trylle"}],["$","link","33",{"rel":"icon","href":"/favicon.png","type":"image/png"}],["$","link","34",{"rel":"icon","href":"/favicon-white.png","type":"image/png","media":"(prefers-color-scheme: dark)"}],["$","link","35",{"rel":"apple-touch-icon","href":"/logo192.png"}],["$","$L7d","36",{}]]

Commits on Fri, Jul 31, 2026

Commits on Mon, Aug 10, 2026