chore(main): release 1.49.0

[openhands-release-bot]

🤖 I have created a release beep boop

1.49.0 (2026-07-30)

What's Changed

Features

• feat: Allow disabling redis_rate_limiter via empty RATE_LIMIT_AUTH_WINDOWS by @tofarr in feat: Allow disabling redis_rate_limiter via empty RATE_LIMIT_AUTH_WINDOWS #97
• feat: Enforce CSP via middleware (OHE-2815) by @tofarr in feat: Enforce CSP via middleware (OHE-2815) #94

Bug Fixes

• fix: enforce cloud analytics consent from TOS by @malhotra5 in fix: enforce cloud analytics consent from TOS #79
• fix(ci): use private bot PAT for pr-artifacts cleanup job by @jlav in fix(ci): use private bot PAT for pr-artifacts cleanup job #88
• fix(enterprise): atomically migrate legacy empty tool settings by @simonrosenberg in fix(enterprise): atomically migrate legacy empty tool settings #12
• fix(settings): accept legacy detached MCP configs by @neubig in fix(settings): accept legacy detached MCP configs #93

Maintenance

• chore: bump SDK packages to v1.39.1 by @tofarr in chore: bump SDK packages to v1.39.1 #105

New Contributors

• @malhotra5 made their first contribution in fix: enforce cloud analytics consent from TOS #79
• @jlav made their first contribution in fix(ci): use private bot PAT for pr-artifacts cleanup job #88
• @simonrosenberg made their first contribution in fix(enterprise): atomically migrate legacy empty tool settings #12
• @neubig made their first contribution in fix(settings): accept legacy detached MCP configs #93
• @tofarr made their first contribution in feat: Allow disabling redis_rate_limiter via empty RATE_LIMIT_AUTH_WINDOWS #97

Full Changelog: 1.48.0...1.49.0

---

This PR was generated with Release Please. See documentation.

---

Enterprise server image for this PR:

ghcr.io/openhands/enterprise-server:sha-a18a510

[github-actions]

Coverage report

This PR does not seem to contain any modification to coverable code.

[tofarr]

🍰

[openhands-release-bot]

🤖 Created releases:

• 1.49.0

🌻