Skip to content

2.1.699

Choose a tag to compare

View all tags
@arthur-louisa arthur-louisa released this 14 Jul 04:07
2.1.699
c213601
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🚀 Arthur Engine Release

July 14, 2026

This release strengthens supply chain transparency with registry-embedded SBOMs, expands GenAI Engine deployment flexibility on EKS Auto Mode, and delivers several important security patches and stability fixes.

GenAI Engine & Deployment

Model Loading & PVC Support

  • Refactored model PVC support into a clean online/offline toggle via modelPVC.enabled, resolving read-only mount issues and letting users switch between online model loading from Hugging Face and offline loading from a pre-populated PVC (#1893)
  • Added unit tests for offline model loading alongside comprehensive documentation for GPU deployment topologies (#1893)

EKS Auto Mode & GPU

  • Documented GPU configuration for EKS Auto Mode with Karpenter, including ready-to-apply NodePool manifests and exact Helm values settings (#1893)
  • Corrected the GPU NodePool configuration example in the EKS Auto Mode Helm guide, updating the limits syntax to the v1 API and narrowing instance requirements to the tested g4dn family to eliminate strict decoding errors (#1918)

Database Compatibility

  • Reverted PostgreSQL from version 18 back to version 16 to fix broken data volume mounts in previously running engines, and pinned Postgres to version 16 to prevent future breaking upgrades (#1890)

This release makes GenAI Engine significantly easier to deploy across diverse environments, giving users reliable model loading options and validated GPU autoscaling on EKS Auto Mode.

Supply Chain & Security

CycloneDX SBOM Attestations

  • Attached CycloneDX SBOM attestations to genai-engine and ml-engine images, allowing security teams to inspect bills-of-materials directly from the registry without relying on expiring workflow artifacts (#1897)
  • Extended SBOM attestation support to model-upload images (genai-engine-models-s3, genai-engine-models-fs, and genai-engine-models-gcs), with a switch to docker buildx imagetools create to preserve attestations during registry-to-registry operations (#1898)
  • Published per-release CycloneDX SBOMs to a stable, public S3 location (s3://arthur-cft/arthur-engine/sbom/<VERSION>/) for all six images, replacing ephemeral GitHub Actions artifacts with predictable, linkable URLs (#1903)

Security Patches

  • Updated transformers to v5.5.0 to address CVE-2026-5241, a critical arbitrary code execution vulnerability in the LightGlue model loading path (#1917)
  • Updated NLTK to v3.10.0 to fix CVE-2026-54293, a critical arbitrary file read vulnerability caused by a decode-after-check flaw in nltk.data.load() (#1891)
  • Updated swagger-typescript-api to v13.12.4, including a fix for a potential SSRF vulnerability in Request.download() (#1892)

Users gain both stronger supply chain visibility through stable, registry-embedded SBOMs and protection against multiple critical security vulnerabilities.

User Interface

Tracing & Observability

  • Updated @arizeai/openinference-semantic-conventions to v2.5.0, bringing the latest OpenInference tracing and monitoring conventions (#1875)
  • Fixed a version skew by pinning all copies of the OpenInference semantic conventions to 2.5.0 and adding proper handling of the new PROMPT span kind with appropriate color and icon mappings (#1916)

Component Libraries

  • Updated @base-ui/react to v1.6.0 with bug fixes and accessibility improvements across Accordion, Alert Dialog, Autocomplete, Avatar, and Checkbox components (#1895)
  • Updated @tanstack/react-pacer to v0.22.1, improving tree-shaking support and standalone devtools panel rendering (#1896)
  • Updated @mui/x-charts to v8.29.2 with upstream DataGrid rendering and scrolling fixes (#1888)

UI improvements deliver better observability with support for the new PROMPT span kind, alongside accessibility and performance enhancements across core component libraries.

Reliability & Release Engineering

  • Fixed race conditions in the model-upload manifest commit step across the ECS, FS, and GCP workflows by staging and committing before pulling, then retrying the pull-and-push sequence up to five times (#1899)
  • Added a GitHub workflow to enforce the release process, ensuring consistent release procedures and reducing manual errors (#1705)

These changes improve the reliability of model uploads under concurrent builds and bring greater consistency to the release pipeline.

Maintenance & Dependency Updates

  • Updated arthur-client across genai-engine and ml-engine to v1.4.2244 (#1889), v1.4.2248 (#1904), v1.4.2255 (#1908), and v1.4.2256 (#1910)
  • Updated langchain to v1.3.12 in the genai-engine module (#1911)
  • Updated vitest to v4.1.10 with test stability fixes for browser filesystem access and module resolution (#1905)
  • Updated @amplitude/analytics-browser to v2.44.5 (#1913) and @amplitude/experiment-js-client to v1.21.3 (#1907)

Routine dependency updates keep the Arthur Engine stack current, stable, and secure.

Release notes generated by Louisa

Assets 2
Loading