Skip to content

2.1.683

Choose a tag to compare

View all tags
@arthur-louisa arthur-louisa released this 28 Jun 04:08
2.1.683
277bd98
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🚀 Arthur Engine Release

June 28, 2026

This release strengthens session observability with new filtering capabilities while delivering a comprehensive security hardening effort across container images, dependencies, and CI vulnerability scanning.

Sessions & Observability

Session Filtering

  • Added Trace ID and Session ID filtering to the Sessions table, bringing it to feature parity with the traces tables; backend now supports optional trace_ids and session_ids query parameters on GET /api/v1/traces/sessions, with chip-based filter inputs in the sessions filter modal that combine via AND logic (#1825)

Session State Management

  • Demo user session state is now automatically cleared on logout, preventing lingering state from persisting across logout events (#1767)

These changes give users more precise control when investigating sessions and ensure demo environments stay clean between logins.

User Interface

Onboarding & Shared Components

  • Moved onboarding tour components and utilities into the Arthur shared components library, reducing duplication and improving reusability across projects (#1848)

UI Dependency Updates

  • Updated zustand to v5.0.14, improving devtools type inference and Firefox/Safari debugging compatibility (#1812)
  • Updated @vitejs/plugin-react to v6.0.3 with upstream bug fixes and improvements (#1860)
  • Updated react-error-boundary to v6.1.2 (#1810)
  • Updated uuid to v14.0.1, fixing type checking for projects using bundler module resolution (#1865)
  • Updated papaparse to v5.5.4, @amplitude/plugin-session-replay-browser to v1.32.2, and vitest to v4.1.9 for improved test runner stability (#1861, #1840, #1866)

UI improvements in this release focus on shared component consolidation and routine dependency maintenance to keep the frontend stable and current.

Security

Dependency Vulnerability Fixes

  • Updated transformers to v5.0.0 to address critical code-execution vulnerabilities CVE-2025-14926 and CVE-2025-14927 in malicious model checkpoint conversion (#1831)
  • Updated authlib to v1.6.12 to fix a critical OAuth 2.0 open redirect vulnerability, CVE-2026-41479 (#1827)
  • Updated requests to v2.33.0 to address CVE-2026-25645 in extract_zipped_paths() (#1829)
  • Updated python-dotenv to v1.2.2 to fix CVE-2026-28684, preventing arbitrary file overwrites via symlink exploitation (#1828)
  • Updated pydantic-settings to v2.14.2 to close a local file read vulnerability in NestedSecretsSettingsSource (#1816)
  • Upgraded litellm to v1.89.3 to remediate CVE-2026-40217, a custom-code guardrail sandbox-escape RCE in the LiteLLM proxy (#1853)
  • Bumped hf-xet to v1.5.1 to patch a HIGH-severity DoS vulnerability (RUSTSEC-2026-0104) in the vendored rustls-webpki crate (#1839)
  • Bumped transitive cryptography dependency to v48.0.1 in GenAI Engine (#1838)

Container Image Hardening

  • Patched fixable HIGH/CRITICAL base-OS CVEs in libssl3, libc6, and libexpat1, and removed the unused Python 3.11 runtime that was repeatedly flagged in scans (#1851)
  • Patched base-OS CVEs in model-upload images and brought them to feature parity with the genai-engine and ml-engine images on Python 3.12 (#1856)

Vulnerability Scanning & VEX

  • Added advisory container vulnerability scanning across customer-facing Docker images using Docker Scout and Trivy, with automated VEX justification documentation, SARIF reports, and SBOMs on every build and daily schedule (#1826)
  • Added version-pinned production image scanning plus scheduled scans targeting the latest -dev image to catch vulnerabilities early (#1833)
  • Added VEX justifications for 12 known container image CVE findings, including machine-readable OpenVEX statements and human-readable rationale (#1852)
  • Repaired VEX matching that was silently failing to suppress CVEs, added 17 new justification statements for unfixed HIGH/CRITICAL CVEs, and remediated fixable findings by bumping uv to 0.11.25 (#1862)

This release represents a significant investment in security posture, eliminating known vulnerabilities across dependencies and container images while establishing transparent, documented vulnerability scanning in CI.

Data & Integrations

Database & Query Dependencies

  • Updated postgres Docker image to v18, bringing performance improvements, new features, and security patches to arthur-engine and genai-engine deployments (#1837)
  • Updated duckdb to v1.5.4, adding support for pathlib.Path, os.PathLike, bytes, and file-like objects with read_parquet/from_parquet, plus correct rel→query operations on read-only connections (#1841)
  • Updated snowflake-sqlalchemy to v1.10.2, fixing regexp_match/regexp_replace flag handling and identifier quoting consistency in table reflection (#1863)

LangChain & Client Libraries

  • Upgraded arthur-client to v1.4.2228 across genai-engine and ml-engine, migrating LLMEval references to Eval to align with the new API (#1850)
  • Upgraded arthur-common to v2.4.67, accepting a transitive pandas 2.3.3 → 3.0.3 bump (#1849)
  • Updated langchain to v1.3.11 and langchain-openai to v1.3.3 (#1846, #1847)
  • Updated fastapi-pagination to v0.15.15, restoring compatibility with FastAPI v0.137.0 (#1843)

These updates keep core data integrations current and ensure reliable SQL generation, query handling, and model evaluation across supported backends.

Engineering & CI

Build Reliability

  • Fixed intermittent Docker build failures (SIGILL/exit code 132) by building the UI stage on the native platform, avoiding QEMU emulation crashes during multi-platform CPU image builds (#1859)
  • Pinned Docker base images back to supported Python versions (3.12 for GenAI Engine, 3.13 for ML Engine) and added a Renovate guard to prevent incompatible auto-merged Python bumps (#1842)

CI Workflow Improvements

  • Replaced the manual Trivy install with the official aquasecurity/setup-trivy action pinned to latest, resolving 404 errors from removed release assets (#1854)
  • Fixed Docker Hub rate-limit errors by pulling scan images once with authenticated credentials across the 6-image matrix (#1855)
  • Corrected the scheduled vulnerability scan to target the latest version-pinned -dev image instead of a non-existent floating tag (#1832)
  • Added a Claude Code observability CI workflow to consistently test the observability tracer (#1707)
  • Updated DockerHub credentials across model-upload and scanning workflows, and removed the Scout scan to simplify the vulnerability reporting pipeline (#1857, #1858)
  • Enabled Renovate lockFileMaintenance to regenerate lock files weekly, automatically patching vulnerable transitive dependencies (#1845)

Release Management

  • Incremented the arthur-engine version, consolidating accumulated dependency, security, and feature changes into the production release pipeline (#1822, #1867)

This release delivers substantial improvements to build reliability and CI security tooling, ensuring consistent multi-platform builds and dependable vulnerability detection across the pipeline.

Release notes generated by Louisa

Assets 2
Loading