# Hermes Agent v0.15.1: dashboard reload-loop hotfix, Docker --insecure now explicit

> Same-day hotfix for v0.15.0. The headline fix stops the dashboard full-page reload loop that hit every loopback-mode install (Docker, hosted, fresh installs), where a by-design 401 from `/api/auth/me` was mistaken for a rotated session token. Docker users who relied on `--insecure` being inferred from a non-loopback bind host must now set `HERMES_DASHBOARD_INSECURE=1` explicitly — that is a required action, not a default carry-over.

| | |
|---|---|
| **Tool** | Hermes Agent |
| **Version** | v2026.5.29 |
| **Kind** | release |
| **Published** | 2026-05-29 |
| **Observed** | 2026-08-11 |
| **Significance** | 3/5 |
| **Breaking** | yes |
| **Categories** | fix, breaking, security |

## What changed


- Dashboard: `fetchJSON` gains an `allowUnauthorized` opt-out that skips the loopback stale-token reload; 401 still throws so `AuthWidget` swallows it and gated-mode `login_url` redirects are unaffected. Closes #34206, #34202 (#30698)
- Docker: `--insecure` is no longer inferred from a non-loopback bind host; disabling the dashboard's loopback auth requires `HERMES_DASHBOARD_INSECURE=1`. Existing setups that wanted insecure binding must set the env var (#34188, #34204)
- MCP: bare `npx`/`npm`/`node` commands resolve against `/usr/local/bin` so MCP servers launch inside the Docker image (#34186)
- Dashboard: skills page source pills and category sidebar restored (stale `useMemo` dependency) (#34194)
- Skills hub: catalog fetch walks the sitemap, surfacing all 19,932 skills.sh entries instead of the first 858 (#34025)
- Kanban: worker `SIGTERM` actually terminates the process (#34045); workers receive images referenced in task bodies for vision-capable models (#34210)
- Gateway: `.md` files deliver again — media-delivery validation is denylist-only instead of a narrow allowlist (#34022); no model stepdown on context overflow when the provider context limit is unknown (#33826)
- CLI: `/yolo` mid-session enables the per-session bypass instead of only toggling the already-snapshotted env var (#33931); `/model` and `hermes model` show the same list, with a disk cache for picker startup (#33867)
- Build: arm64 PR builds skip the GHA cache (#33704)
- Scope: 28 commits, 21 merged PRs, 9 contributors since v0.15.0


## Sources

- [github_release](https://github.com/NousResearch/hermes-agent/releases/tag/v2026.5.29) — retrieved 2026-08-11

## Community

_No curated reactions recorded. Facts and community takes are kept in separate layers
and never blended._

---
Canonical: https://changelogs.info/hermes-agent/v2026-5-29
Entity: https://changelogs.info/hermes-agent
Event ID: `evt_2026-05-29_hermes-agent_v2026-5-29`
Licence: event synthesis © changelogs.info, CC BY 4.0. Linked sources belong to their vendors.