Skip to content

2.1.748

Choose a tag to compare

View all tags
@arthur-louisa arthur-louisa released this 29 Jul 08:34
· 366 commits to dev since this release
2.1.748
9437cc1
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

馃殌 Arthur Engine Release

July 29, 2026

This release deepens dataset traceability and version management, refines the task list experience, and delivers a broad wave of security remediations across container images and dependencies.

Datasets & Traceability

Dataset Records & Versions

  • Added the ability to link dataset records back to their originating traces, with a new SourceTraceLink component and navigation directly from the dataset UI (#1978)
  • Introduced dataset version reinstatement, letting users restore a prior version as a new latest version鈥攕imilar to a git revert鈥攚ithout overwriting history (#1962)

Add-to-Dataset Flow

  • Fixed transform auto-matching and auto-filling so transforms are recognized after columns are first added, removing the need for the "Fill from Object" workaround (#1961)
  • Fixed the unsaved changes confirmation to guard all exit paths鈥攕idebar navigation, in-page Back button, and version switching鈥攙ia a unified NavigationGuardContext (#1990)

Dataset workflows are now more transparent and forgiving, giving users clearer lineage back to source traces, safer version recovery, and consistent protection against accidental data loss.

Task List & Filtering

  • Moved sorting and activity filtering server-side and based the "Active in last N days" filter on real trace activity, so task lists remain accurate and complete regardless of size (#1975)
  • Removed the sort dropdown from the task list and standardized ordering to newest-first by creation date (#2027)

Task list behavior is now reliable at scale, with accurate "Last active" labels and a simplified, consistent ordering model.

Formatting & UI Consistency

  • Migrated to shared DurationCell and formatter components from the unify-shared library, ensuring latency and duration values render with consistent decimal precision (#1976)

Latency and duration values now display cleanly across all panels, free from trailing floating-point artifacts.

Deployment & Infrastructure

Helm Charts

  • Exposed the ml-engine HorizontalPodAutoscaler in the umbrella chart values, letting operators enable and configure ML engine auto-scaling with sensible defaults (#1984)
  • Fixed genaiEngineInternalHost Helm configuration to include the required http:// scheme, resolving ML Engine startup failures (#1942)

CI & Release Tooling

  • Updated CI to rebuild model-upload images when their Dockerfile, dependencies, or entrypoint scripts change, ensuring security and dependency updates reliably reach production (#2019)
  • Added a scheduled stale PR cleanup workflow that labels and eventually closes inactive pull requests while preserving active and kept-open ones (#1991)
  • Improved Renovate configuration to automatically flow transitive and uv updates and to group langchain and openai package updates into coordinated PRs (#2012, #2015)
  • Added sourcemap upload configuration for meticulous test coverage analysis, scoped to testing builds only (#2009)

These changes give operators more control over ML engine scaling while strengthening the reliability of the build and release pipeline.

Security & Vulnerability Remediation

Container Image CVEs

  • Bumped torch to 2.13.0 and uv to 0.12.0 to clear HIGH-severity RCE, deserialization, and Rust crate CVEs across genai-engine and ml-engine images (#2034)
  • Bumped hf-xet to 1.5.2 to patch a vendored quinn-proto vulnerability, eliminating a remote memory exhaustion risk (#2041)
  • Triaged and resolved the full Trivy HIGH backlog, remediating findings via uv upgrades and formally justifying the remainder with OpenVEX statements (#2018)
  • Added OpenVEX justifications for perl-base CVEs in the models-gcs image where the vulnerable code paths are unreachable (#2002)
  • Dropped the remediated nltk CVE-2026-54293 VEX exception now that the fixed version is pinned (#2016)

Dependency Security Patches

  • Updated pypdf to v6.14.2 to address two critical CVEs causing infinite loops when parsing malformed PDF inline images (#1985)
  • Bumped vulnerable transitive Python dependencies (pyasn1, Pillow, mcp, joserfc), resolving 30 of 31 open Dependabot alerts (#2014)
  • Updated frontend dependencies including tar, React Router, and shared-components to patch known CVEs in the frontend security scan (#2013, #2017)

Container images now pass HIGH-severity security scanning with all findings either remediated or documented, and users are protected against critical PDF-parsing and transitive dependency vulnerabilities.

Dependency Updates

ML & Data Libraries

  • Updated sentence-transformers to v5.6.1, fixing silently degraded embeddings for RoBERTa-family models under flash attention (#2008)
  • Updated GLiNER to v0.2.28 with improved inference reliability and Transformers v5 compatibility (#2004)
  • Updated presidio-analyzer and presidio-anonymizer to v2.2.364, improving UK NINO and Indian vehicle registration detection and adding a CLI threshold override (#2006, #2007)
  • Updated duckdb to v1.5.5 for numpy compatibility and a DuckDBPyRelation.query alias fix (#2003)
  • Updated croniter to v6.2.4 with corrected cron range calculations and faster evaluation of comma-separated ranges (#2021)
  • Updated pandas to v3.0.5 and google-cloud-bigquery to v3.42.2 for stability and upstream fixes (#2005, #2024)
  • Updated boto3 across several patch releases to capture upstream AWS SDK improvements (#1989, #1996, #2001)

Frontend & UI Libraries

  • Updated the React monorepo to v19.2.8 for improved stability (#2020)
  • Updated monaco-editor to v0.56.0, adding new editor APIs, configuration options, and improved Markdown security handling (#2029)
  • Updated framer-motion to v12.42.2, graduating animateView with selector support and improved view-transition animations (#2023)
  • Updated nuqs to v2.9.2 with improved query-string state recovery and Next.js security patches (#2030)
  • Fixed a @vitejs/plugin-react regression by updating to v6.0.4, resolving a $RefreshSig$ is not defined error under NODE_ENV=production (#1994)
  • Updated Amplitude analytics and session replay browser SDKs to their latest patch versions (#1986, #1987, #1993)

Arthur Client

  • Updated the arthur-client dependency across genai-engine and ml-engine through successive patch releases (#1988, #1995, #2000)

These updates keep the Arthur Engine's ML, data, and frontend stacks current, delivering improved accuracy, stability, and compatibility across the platform.

Release notes generated by Louisa

Assets 2
Loading