Skip to content

OpenDPD Studio 2.2.18

Choose a tag to compare

View all tags
@gaochangw gaochangw released this 28 Sep 08:30
· 24 commits to main since this release
v2.2.18
186dbf0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenDPD Studio 2.2.18 is a security maintenance release for local and hosted Studio.

Security changes

  • Validate imported dataset specifications and package identities before training or publication. Reject unsafe portable paths, links and oversized NumPy or plot inputs.
  • Use short-lived, single-use desktop bootstrap links and private workspaces. Keep launcher credentials out of browser arguments.
  • Enforce shared-resource limits on public exports, cache immutable CSVs and tighten per-network concurrency and session budgets.
  • Keep GPU workers outside writable import paths, constrain incoming archives and collect output without following links. Bind the GPU agent lifecycle to the isolated VM.
  • Provide installed figure replay/reproduction commands, escape plot labels and CSV formulas, and strengthen checkpoint loading, dependency audits and protected-path checks.

Valid numerical configurations remain compatible. Files with unsupported specification fields, ambiguous paths or inconsistent embedded metadata are rejected. Direct figure helper scripts support isolated mode (python -I) on Python 3.10 and newer.

Verification

Local validation covered 2,285 ordinary Python cases, three installed-wheel checks and 282 frontend tests. Release staging verified the offline VM, cold CUDA forward/backward, PA/DPD training and inference, checkpoint hashes, and tenant/origin/download isolation. Final-commit frontend CI passed on Chromium, Firefox and WebKit, including mobile and reconnect flows. The detailed review records the rootful GPU agent, shared OS/driver and other remaining boundaries.

Open Studio · PyPI · Full release notes · Security review

Published and deployed — 2026-09-28

  • Release commit: 186dbf0764db07bc4e2076d5c77dd42ef207baf0 (PR #61). The final PR passed the Python 3.10–3.13 matrix, three-platform installation checks, API contract, docs and dependency audits.
  • Hosted frontend, isolated API and GPU agent/image now run 2.2.18. Production CUDA PA training, DPD training and inference succeeded. Model-download hashes matched, and origin, anonymous-access, cross-workspace and path-traversal checks passed.
  • The published wheel and source archive hashes match the release CI artifacts. An independent installation from PyPI reports 2.2.18 and includes the built frontend and figure CLI.
  • A fresh Chromium session imported an 8,192-sample CSV, simulated Virtual PA output and ended its temporary workspace with no page errors.
  • The GPU image is pinned to sha256:e57a0e76c220e4fca62e3d053405611ae2aad8260187f6f33d7e7dbbcc72cd2e. The API reset timer is active, and the GPU agent is bound to the VM service. Previous source, runtime, units and the 2.2.17 image are retained for rollback.

Final PR checks · Website deployment · PyPI publication

Assets 2
Loading