HolmesGPT skills refresh live, no redeploy needed

HolmesGPT's 0.41.0-alpha release, posted September 6, turns git-synced skills into a first-class skill_repos concept that refreshes live. Push a runbook skill to the repo and every running Holmes instance picks it up immediately.

For on-call teams, that cuts out a build-and-deploy cycle. Updating an SRE agent's diagnostic steps used to mean building and shipping a new image.

The same release clears a security backlog inside the image. Every High-severity CVE gets patched, and so do Mediums that had sat unpatched for more than 60 days. A separate fix rotates the realtime JWT before it expires, replacing a design where the token only refreshed after a request already failed with an auth error.

The release notes don't say how skill_repos decides when to refresh, or whether a bad skill push can be rolled back as fast as it went out. For a team pointing Holmes at a repo full of untested runbooks, that's the open question: live sync cuts deploy friction, but it also means a bad push reaches production alerts with nothing in between.