Skip to content

2.1.801

Choose a tag to compare

View all tags
@arthur-louisa arthur-louisa released this 19 Aug 04:58
· 205 commits to dev since this release
2.1.801
0080e17
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

🚀 Arthur Engine Release

August 19, 2026

This release sharpens the traces filtering experience, adds new deep-linking and model-curation capabilities, and delivers a broad wave of security hardening and supply-chain safeguards across the platform.

Traces & Observability

Filtering

  • Turned the Continuous Eval Name filter into a searchable dropdown populated with the task's continuous evaluations, while preserving free-text substring search (#2114)
  • Added multi-select support to the Continuous Eval Run Status and Status Code trace filters, so a trace matches if it satisfies any of the selected values (#2115)

These filtering upgrades make it easier to discover available evals and build more flexible queries directly in the Observe-tab traces view.

Datasets & Experiments

Navigation

  • Added deep-linking from experiment test case results to dataset rows—Row IDs in the "Dataset Row Data" modal are now clickable links that open the specific row in a read-only drawer on a shareable URL (#2106)

Users can now jump straight from an experiment result to the underlying dataset row in context, with shareable and browser-back-compatible URLs.

Model Providers

Configuration

  • Introduced an optional model whitelist that lets admins curate which models appear in provider dropdowns, backed by new GET/PUT endpoints and a Visible models section under Settings → Model Providers (#2011)

Admins can now restrict provider model selections to only the options relevant to their organization, with full backward compatibility for existing providers.

Security

Vulnerability Remediation

  • Moved genai-engine to cryptography 50.0.0 to address three CVEs in X.509 verification and PKCS#7 handling, and re-triaged the VEX to reduce open Trivy findings from 11 to 3 (#2147)
  • Dropped build-time Python tooling (pip, setuptools, uv) from the ml-engine runtime image, eliminating two CVEs and closing all remaining Trivy findings (#2153)
  • Resolved 9 of 10 open Dependabot alerts across four projects and restored dependency resolution in genai-engine (#2144)
  • Updated pypdf to v6.15.0 to fix two medium-severity DoS vulnerabilities in font processing and text extraction (#2113)

VEX Maintenance

  • Cleaned up VEX statements, removing 10 entries for remediated Python 3.11 CVEs and CVEs re-rated below the HIGH/CRITICAL scope (#2154)

This release closes out a large batch of container-image vulnerabilities and keeps VEX metadata aligned with the platform's true security posture.

Supply Chain & Dependency Safety

Guardrails

  • Enforced a 3-day dependency cooldown at the Yarn install layer, extending release-age protection to plain yarn add and transitive resolution while exempting first-party @arthur/* packages (#2109)
  • Resumed auto-merge and auto-approve for low-risk Renovate updates while retaining the 3-day soak, required CI checks, and human review for major bumps (#2122)

These safeguards protect against supply-chain compromise without slowing down routine dependency maintenance.

Developer Experience & CI

Build & Pipeline Reliability

  • Fixed the observability-SDK build by moving the README into the package directory for compatibility with hatchling 1.32 (#2141)
  • Added a check-dependency-automation CI gate that catches pyproject.toml/uv.lock drift before it merges (#2145)
  • Made the Renovate auto-fixer goal-oriented so it reliably lands completed fixes and can resolve dependency conflicts automatically (#2138)
  • Stabilized CI against uv network flakes when fetching the en-core-web-lg direct-URL wheel by adding retries, capping concurrency, and refining trigger filters (#2119)
  • Allowed the claude[bot] actor through the Claude review gate and synchronized SDK workflow gate logic to prevent review failures on bot-authored PRs (#2142)

Together these changes reduce false CI failures, eliminate silent dependency drift, and keep automated reviews and builds running smoothly.

Dependency Updates

Storage & Data

  • Updated gcsfs to v2026.8.0, introducing adaptive concurrent prefetching that dramatically improves sequential read throughput for ML/AI workloads (#2150)
  • Updated adlfs to v2026.8.0, adding blob content settings on write and fixing incorrect ls() results for shared-prefix files (#2133)
  • Updated fsspec filesystem packages to their 2026 versions, which now default to Azure credentials and remove ADLS Gen1 support in favor of the az:// protocol (#2127)
  • Updated pyarrow to v25 for improved Apache Arrow data-processing performance (#2121)

AI & Integrations

  • Updated openai to v3, migrating to HTTPX2 as the default HTTP client—applications using custom HTTPX configurations must update to remain compatible (#2134)
  • Updated oracledb to v4, adding Oracle AI Database 26ai security, real-time notifications, and improved data frame support (#2103)
  • Updated the New Relic agent to v13, improving Redis observability and fixing LlmChatCompletion tracking for Gemini with LangChain tools (#2098)
  • Updated python-keycloak to v7 for the latest Keycloak client improvements and fixes (#2124)
  • Updated langchain and openai dependency sets to their latest patch versions (#2131)
  • Updated langchain, langsmith, and openai with upstream fixes including RunTree replica handling and git credential sanitization (#2116)
  • Updated langchain-openai to v1.4.3 (#2128)

Tooling & Security Libraries

  • Updated bcrypt to v5 for the latest password-hashing security and performance improvements (#2068)
  • Updated mypy to v2 for improved static type checking across projects (#2097)
  • Updated isort to v8, adding Python 3.14 stdlib support and removing deprecated flags (#2091)
  • Updated pytest-cov to v7 with more consistent coverage computation (#2123)
  • Updated more-itertools to v11, bringing iterator utility fixes alongside the removal of deprecated functions like zip_equal and pairwise (#2096)

Routine Maintenance

  • Updated arthur-client to v1.4.2417 (#2148)
  • Updated arthur-client to v1.4.2418 (#2149)
  • Updated arthur-client to v1.4.2419 (#2151)
  • Updated core Python packages including FastAPI, BigQuery client, and the AWS SDK with the latest security patches and bug fixes (#2101)
  • Applied routine Python minor and patch updates across arthur-client, boto3, litellm, and sqlalchemy (#2132)
  • Applied routine Python minor and patch updates across arthur-client, boto3, pre-commit, and pyarrow (#2129)
  • Applied routine Python minor and patch updates across arthur-client, arthur-common, boto3, nltk, pypdf, and uvicorn (#2146)

This dependency wave keeps the platform current with upstream performance gains, security patches, and new capabilities—note the breaking changes in the openai and fsspec updates for teams with custom configurations.

Release Management

  • Incremented the arthur-engine version and merged development into production to trigger the deployment pipeline (#2137)

This internal version increment carries the release's feature, security, and dependency work into production.

Release notes generated by Louisa

Assets 2
Loading