Release Notes

0.2.48 (2026-09-11)

Everything merged since 0.2.47. This is the first tag to use the v prefix (v0.2.48), which the release pipeline requires.

packaging: a source build made outside a git checkout shipped 3 of 169 modules with no error and no warning. [tool.setuptools.packages.find].include was a bare "aixplain", which fnmatches the full dotted package name and so discarded all 26 subpackages; the missing setuptools-scm file-finder had been masking it. Now "aixplain*", with a CI check that installs the built wheel into a clean venv and imports it (ENG-3543, #1047).

v2-run: poll URLs returned by the backend are now host-validated, and x-api-key is dropped on a cross-host redirect, so a redirect can no longer walk the API key off-origin (BUG-937, SEV1, #1040)
v2-rlm: TEAM_API_KEY is no longer baked into generated RLM sandbox source (BUG-936, #1042)
v2-http: every client request carries a default timeout (#1014), and the remaining unbounded calls on the upload/file path are bounded (#1041)
SEV2 hardening across HTTP, load and control-effectiveness paths (BUG-942, BUG-1097, BUG-941, BUG-939, BUG-946, #1076), plus functional-test safety and run-metadata disclosure (BUG-947, BUG-1096, BUG-945, #1078)

v1 now emits an import-time deprecation notice and ships MIGRATION.md. v1 is removed on 2027-02-01; migrate to from aixplain import Aixplain. Silence the notice with AIXPLAIN_SUPPRESS_V1_DEPRECATION=1 (#1044)

v2-file: unified File assets and persistent agent files — attach files to an agent once and have them persist across runs (#1055)
v2-skill: update skill file content in place via Skill.update() / file listing (#1075)
v2-agent: run artifacts surfaced on the agent response (#1036)
v2-run: the calling agent propagates as an x-agent header (ENG-3488, #1023) and the run session as x-session-id (ENG-3473, #1013)
v2: media-generation members on the Function enum (#1033)
plugins: aiXplain Marketplace and Agent Builder plugins (#1058)

v2-run: no more duplicate run submissions — POST retry, poll retry and failed-run classification all fixed (BUG-1090, #1045)
v2: search filters, result shapes, save() and run kwargs corrected (BUG-1092, BUG-1094, BUG-1093, BUG-1091, #1074)
v2-agent: updated skills now persist on save() (#1065); the duplicated agent-files init block introduced by a merge is gone (#1072)
v2: the progress display thread no longer leaks on failed or concurrent runs (BUG-943, #1088)
v2-trigger: flat schedule attributes (timezone, time, run_at, days, schedule_type) hydrate instead of reading null (#1066)
v2-utility: Utility.run is an instance method again, so super().run() binds self (#1034)
tool: DEFAULT_INTEGRATION_ID points at Python Sandbox rather than Slack (#1025); script tools send the required function_name when connecting (#1030)
model: session_id restored in _SDK_ONLY_PARAMS after a merge dropped it (#1020); OpenRouter reasoning fields normalize into reasoning_content (#1012)
v2-rlm: max_iterations default restored to 10 (#1050)
client: supplierError detail surfaced in APIError messages (#1032)
run: caller identifier propagates as x-user-id without leaking into model/tool payloads (#1006)
generator: writes to aixplain/v1 paths and escapes backend values (ENG-3435, #1090)

release pipeline: tag-push publishing to PyPI with least-privilege workflow permissions and Trusted Publishing; required CI contexts on main documented in docs/ci/required-checks.md (ENG-3428, #1048)
test integrity: coverage gate, credential-free collection, and v2 effect assertions (#1043); conditional agent/team_agent functional skips with orphaned CI legs re-attached (ENG-3544, #1046)
docs: README drops SDK v1 mentions and points at app.aixplain.com (#1060)