Skip to content

2.1.762

Choose a tag to compare

View all tags
@arthur-louisa arthur-louisa released this 31 Jul 05:32
· 307 commits to dev since this release
2.1.762
0048307
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

馃殌 Arthur Engine Release

July 31, 2026

This release brings expanded observability into the engine's AI processing, build-time supply-chain transparency for bundled models, important token-cost fixes, and a broad round of security hardening across container base libraries and Python dependencies.

Observability & Auditing

Audit Log

  • Added optional model-invocation tracking to the audit log via a new AUDIT_LOG_INCLUDE_AI_ACTIVITY environment variable (opt-in, default off), annotating authenticated entries with model name, provider, token counts, latency, and success/error status鈥攏ever prompt or response content (#1906)

Operators can now gain opt-in visibility into which AI models are invoked during each authenticated request, without exposing sensitive payload data.

Supply-Chain Transparency

AI Bill of Materials

  • Added build-time generation of a CycloneDX 1.6 AI-BOM that documents all bundled ML models鈥攊ncluding HuggingFace guardrail and embedding models with pinned commit SHAs, hashes, licenses, and tasks鈥攑ublished to S3, committed to the repo, and included in deployment model storage (#1909)
  • Fixed the committed AI-BOM so the engine version is no longer stamped into aibom.cdx.json, keeping the file a stable, diffable inventory while preserving version stamping in the S3 and Docker image copies (#2083)

These changes give users and operators a standardized, machine-readable inventory of all bundled models and their provenance for supply-chain visibility and compliance auditing.

Cost Accuracy

Token Cost Calculation

  • Fixed two token-cost bugs in trace and session calculations: cache-read tokens are now priced at the discounted cache-read rate, and unrecognized models are normalized and flagged as unknown rather than silently zeroed to $0 (#2050)

Users with cache-heavy workloads and unrecognized models will now see accurate token costs and clear visibility when a model cannot be priced.

Security & Hardening

Container Base Images

  • Patched distroless base /lib libraries (glibc, liblzma, libc6, and others) during image builds and synchronized dpkg metadata so external scanners correctly identify fixed vulnerabilities, resolving 19 previously reported OS-package CVEs (#2073)

Python Dependencies

  • Bumped aiohttp to 3.14.3 and python-dotenv to 1.2.2 across genai-engine, ml-engine, and arthur-observability-sdk to clear findings in customer Wiz security scans (#2074)

Deployed container images now ship with patched base libraries, accurate package metadata, and updated dependencies, allowing customer security gates to pass without false positives.

Reliability

Docker Build

  • Added retry logic and validation to the RDS certificate download in the genai-engine Docker build, using --retry-all-errors and -f plus a content guard to reject invalid certificates and fail loudly on bad downloads (#2080)

Docker image builds no longer fail on transient network issues, and corrupted certificate files are rejected instead of silently shipped.

Dependencies

Core AI Libraries

  • Updated langchain-openai to 1.4.1, langsmith to 0.10.10, and openai to 2.48.0, bringing the latest OpenAI API improvements and langchain enhancements (#2065)

Database Drivers

  • Updated snowflake-sqlalchemy to v1.11.0, adding stricter validation of sensitive connection parameters that must now be passed via connect_args= instead of URL query strings (#2046)
  • Updated psycopg to v3.3.4 with bug fixes and improved PostgreSQL compatibility (#2036)
  • Updated pyodbc to v5.3.0, adding Python 3.14 support and dropping EOL Python 3.8 (#2039)
  • Updated pgvector to v0.5.0, adding experimental type hints and removing the NumPy dependency (#2031)
  • Updated pymysql to v1.2.0, which introduces breaking changes: Connection.ping() no longer reconnects by default, Cursor error classes are removed, deprecated db/passwd arguments now warn, and TLS is enabled by default when supported (#2038)

Authentication

  • Updated python-keycloak to v5.12.0 for enhanced Keycloak authentication and integration capabilities (#2043)

Frontend & Build

  • Updated vite to v8.1.5 with improved minification for legacy builds and better build compatibility (#2061)
  • Updated typescript-eslint to v8.65.0, adding import defer parsing support and enhanced ESLint rules (#2059)
  • Updated tailwind-merge to v3.6.0, adding Tailwind CSS v4.3 support and the new postfixLookupClassGroups option (#2053)
  • Updated @rollup/rollup-linux-x64-gnu to v4.62.3 with build-input sanitization fixes (#2052)

Utilities & Type Stubs

  • Updated python-benedict to >=0.38,<0.39 with keylist, pattern-matching, and query-string parsing improvements (#2042)
  • Updated responses to v0.26.2 with more robust request mocking and HTTP/2 lowercase header handling (#2045)
  • Updated psutil to v7.2.2, bringing faster Process.wait() and new heap introspection functions (#2035)
  • Updated pytest to v9.1.1, fixing parametrized fixture overrides and conftest discovery (#2040)
  • Updated pre-commit to v4.6.1 across genai-engine and ml-engine (#2032)
  • Updated locust to v2.46.2 with response-time percentile fixes (#2028)
  • Updated types-requests to v2.33.0.20260712 (#2058)
  • Updated types-psutil to v7.2.2.20260518 (#2057)
  • Updated types-croniter to v6.2.4.20260711 (#2056)

This cycle refreshes core AI libraries, database drivers, and the frontend toolchain, along with routine type-stub and utility updates. Note the breaking changes in pymysql and the connection-parameter migration required for snowflake-sqlalchemy.

Developer Experience & CI/CD

Merge Queue & Throughput

  • Enabled GitHub merge queue support on the dev branch with a merge_group trigger that runs the full required CI suite as the final pre-merge gate, and reconciled Renovate to rebase only on conflicts (#2063)
  • Added per-ref concurrency groups to cancel superseded CI runs on new pushes while preserving main-branch runs for uninterrupted release deploys (#2049)
  • Exempted first-party Arthur packages (arthur-common, arthur-client) from Renovate's 3-day minimumReleaseAge soak to unblock dependency resolution and improve velocity (#2079)

Renovate Automation

  • Added a Claude auto-fix workflow that automatically repairs code-adaptation breakages in Renovate PRs鈥攖ype errors, eslint violations, and formatting鈥攚ith self-verification, required CI re-runs, and strict scope guards (#2076)
  • Fixed a bot-gating mismatch so Claude Code Review cleanly skips Renovate-triggered runs instead of erroring (#2051)

Pre-commit

  • Fixed pre-commit mypy hooks to explicitly install the linters dependency group and added --frozen to prevent lock file mutations, eliminating spurious errors from stale system mypy (#2075)

These improvements keep the merge queue flowing, cut wasted CI compute, and reduce manual intervention on dependency and lint breakages.

Internal

  • Production release increment consolidating dependency updates, security patches, CI/CD improvements, token-cost fixes, and AI-BOM generation (#2081)
  • Version increment PR triggering the production build and deployment pipeline (#2026)

These internal changes drive the release and deployment pipeline with no direct user impact.

Release notes generated by Louisa

Assets 2
Loading