Skip to content

2.1.688

Choose a tag to compare

View all tags
@arthur-louisa arthur-louisa released this 06 Jul 17:38
2.1.688
5dd5caf
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🚀 Arthur Engine Release

July 6, 2026

This release prioritizes security with a critical remote code execution patch, alongside PII processing updates, front-end dependency improvements, and expanded model deployment documentation.

Security

  • Upgraded HuggingFace transformers to v5.3.0 to address CVE-2026-4372, a critical remote code execution vulnerability (CVSS 7.8) that allowed attackers to craft malicious config.json files to execute arbitrary code when loading models, bypassing the trust_remote_code mechanism (#1876)

This upgrade closes a critical RCE vector that exploited standard model-loading usage patterns. Note that this is a breaking change; operators should review their model-loading workflows before deploying.

PII Detection & Anonymization

  • Updated presidio-analyzer to v2.2.363, bringing repository rebranding to Data Privacy Stack, migrated documentation, and continued PII detection improvements (#1877)
  • Updated presidio-anonymizer to v2.2.363 with source distribution publishing, improved documentation, and container images now hosted on GitHub Container Registry under ghcr.io/data-privacy-stack (#1878)

These updates keep Arthur's PII processing capabilities current with the latest Presidio releases and modernized distribution channels.

Front-End & User Interface

Component Libraries

  • Updated Material-UI packages with bug fixes for autocomplete highlight sync and scroll preservation, popper rendering, button icon alignment, and improved checkbox accessibility (#1870)
  • Updated the React monorepo with bug fixes for Server Actions FormData handling and performance improvements in React Server Components (#1871)
  • Updated Tailwind CSS to v4.3.1, adding a --silent CLI option and improving container query support, drop-shadow utilities, and Node 26+ compatibility (#1872)
  • Updated Tailwind CSS to v4.3.2 with fixes for bare spacing values, watch mode rebuilds, custom variant handling, and expanded framework file scanning (#1882)

Analytics & Session Replay

  • Updated @amplitude/analytics-browser to v2.44.3 for improved analytics logging stability, offline-to-online transition handling, and video tracking error handling (#1873)
  • Updated @amplitude/analytics-browser to v2.44.4 as a routine patch bump (#1879)
  • Updated @amplitude/experiment-js-client to v1.21.2, fixing global scope handling and improving server-side rendering compatibility (#1880)
  • Updated @amplitude/plugin-session-replay-browser to v1.33.0, adding custom transport hooks for authenticated proxies in session replay (#1885)

These front-end updates deliver cleaner UI behavior, more reliable analytics, and more flexible session replay configuration.

Platform & Dependencies

  • Updated arthur-client to v1.4.2229 (#1874)
  • Updated arthur-client to v1.4.2235 across genai-engine and ml-engine (#1881)
  • Updated arthur-client to v1.4.2243 with the latest stability improvements and fixes (#1884)
  • Updated SQLAlchemy to v2.0.51 across genai-engine and ml-engine packages (#1864)
  • Updated swagger-typescript-api to v13.12.3 (#1869)

Ongoing dependency maintenance keeps the platform current and stable across the engine's core libraries.

Documentation

  • Added a comprehensive guide for deploying GenAI Engine guardrail models on standard Kubernetes block-storage PVCs (ReadWriteOnce) without a network file system, including ready-to-apply manifests, block-storage configuration specifics, single-replica constraints, and migration guidance toward EFS/RWX setups (#1883)

This new guide gives operators a simpler alternative to EFS/NFS for deploying guardrail models on standard Kubernetes infrastructure.

Release Management

  • Incremented the arthur-engine version to consolidate accumulated dependency updates and documentation improvements for the production build and deployment pipeline (#1886)
  • Incremented the arthur-engine version to trigger a prior production release consolidating dependency updates, security patches, and feature additions (#1867)

These internal release commits coordinate the production build and deployment pipeline and carry no direct user impact.

Release notes generated by Louisa

Assets 2
Loading