Skip to main content

Return to Changelog

v1.7.6

· 2 min read

This patch release moves h2oGPTe to Python 3.12, requires regex inline flags at the start of a pattern, and fixes security vulnerabilities, document ingestion, and Claude chat sessions.

Breaking changes​

  • Regex inline flags must come first: h2oGPTe now runs on Python 3.12, which requires a global inline flag such as (?i) to appear at the start of a pattern. Requests that use a pattern like ^(?i)name$ fail with a REGEX_LEGACY_FLAGS error that names the setting. This affects Disallowed Regex Patterns in guardrail settings and column redaction patterns for CSV and Excel ingestion. h2oGPTe doesn't rewrite patterns automatically: before you upgrade, move the flag to the start of each affected pattern, for example change ^(?i)name$ to (?i)^name$.

Python client​

  • Fixed the job timeout error showing the internal enum name, such as JobKind.IngestUploadsJob, instead of the job kind, IngestUploadsJob.

Bug fixes​

  • Fixed HTML and Markdown documents failing to ingest when a remote resource, such as an image, never finished loading. These documents now ingest with the content that did load.
  • Fixed the built-in Playwright browser tool failing on its first call with a Browser "chrome-for-testing" is not installed error, including in air-gapped deployments.
  • Fixed Claude chat sessions failing on every question after Claude replied with its reasoning but no answer.
  • Fixed requests through the OpenAI-compatible API failing for some Amazon Bedrock models, such as gpt-5.6 models.

Security​

  • eMudhra root certificate no longer trusted: Because attackers compromised several eMudhra intermediate certificates, h2oGPTe no longer trusts the emSign ECC Root CA - G3 root certificate. Connections to sites and services that use certificates from this root now fail.
  • Usernames and emails kept out of logs: When an administrator turns off logging of sensitive information, h2oGPTe no longer writes usernames or email addresses to its logs, including emails followed by an underscore.
  • Access checks tightened: Fixed several gaps that let a signed-in user read data or use credentials they didn't have access to.
  • Unsafe archive uploads skipped: h2oGPTe now skips an uploaded tar archive that tries to write files outside its own folder.
  • Security vulnerabilities: Fixed CVE-2026-85734, CVE-2026-85740, CVE-2026-59991, CVE-2026-78669, CVE-2026-111497, CVE-2026-111943, CVE-2026-118306, and CVE-2026-118331.
Feedback