Skip to content

python: v0.7.27

Choose a tag to compare

View all tags
@rogeriochaves rogeriochaves released this 21 May 14:03
python/v0.7.27
97ede73
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

0.7.27 (2026-05-21)

Features

  • #350: voice agents — first-class voice in scenario.run() (#355) (128ac94)
  • #452: voice docs surface — legacy deprecation + new section scaffold (#456) (1b07abb)
  • add GOAT strategy with dynamic technique selection for RedTeamAgent (#346) (2896c97)
  • ci/#364: add pr-auto-approve.yml as passive observer (PR #1 of 4) (#485) (4d84597)
  • red-team: zero-friction report dashboard — auto-save + scenario redteam-report CLI (2896c97)

Bug Fixes

  • deps: bump filelock to >=3.20.3 for TOCTOU/symlink CVEs (#481) (479ec82)
  • deps: bump pytest to >=9.0.3 for CVE-2025-71176 (#479) (4f4ffd4)
  • deps: bump python-liquid to >=2.2.0 for high severity CVE (#459) (60bad76)
  • deps: bump urllib3 to >=2.7.0 for high severity CVEs (#457) (50c3cea)
  • deps: bump virtualenv to >=20.36.1 for CVE-2026-22702 (#483) (8f10690)
  • deps: override minimatch to >=9.0.6 (CVE-2026-26996) (#395) (ceb0b59)
  • deps: resolve 4 high-severity Dependabot security alerts (#393) (97f257d)
  • docs: exclude scenario.report.app from pdoc to unblock Publish Docs (#388) (3736c87)
  • examples: stabilize custom LLM judge criteria matching (#396) (f4b536c)
  • examples: stabilize vegetarian-agent parallel tests on python-ci (#389) (e40eee3)
  • examples: strengthen vegetarian-agent prompt to stabilize parallel tests (e40eee3)
  • examples: use positional index matching in custom judge examples (f4b536c)
  • judge: harden forceVerdict so discovery tools cannot leak (JS + Python) (#377) (0e2859f)
  • red-team: annotate H_attacker when post-hoc injection fires (#326, #334) (2896c97)
  • security: bump litellm to fix 4 high-severity CVEs (#411) (f6ff8a3)
  • security: patch CVE-2026-27903 in minimatch (#398) (b61cc60)
  • security: patch flatted prototype pollution via parse() (#421) (3a20e6c)
  • security: patch glob CLI command injection in lovable_clone npm lockfile (#413) (d1b3297)
  • security: patch glob CLI command injection in lovable_clone template npm lockfile (d1b3297)
  • security: patch picomatch ReDoS in lovable_clone npm lockfile (#409) (70a5ff9)
  • security: patch react-router XSS and open redirect CVEs (#418) (2b6797a)
  • security: patch rollup arbitrary file write via path traversal (#399) (55a0259)
  • security: patch rollup path traversal CVE (>= 4.0.0, < 4.59.0) (55a0259)
  • security: upgrade aiohttp to fix zip bomb and other CVEs (#417) (a747624)
  • security: upgrade black to fix arbitrary file write CVE (#403) (6583942)
  • security: upgrade black to fix arbitrary file write via cache file name (6583942)
  • security: upgrade mcp Python SDK to fix DoS and DNS rebinding CVEs (#406) (25e2e1c)
  • security: upgrade pyasn1 to fix DoS via unbounded recursion (2880a73)
  • security: upgrade pyasn1 to fix DoS vulnerabilities (#401) (2880a73)
  • security: upgrade pydantic-ai to fix SSRF vulnerability (#405) (f7ec414)
  • security: upgrade python-multipart to fix arbitrary file write CVE (#407) (1f2bb80)
  • security: upgrade starlette to fix DoS via Range header merging (#402) (11135a7)
  • security: upgrade urllib3 to fix decompression bomb CVEs (#404) (1b00ea2)
  • voice: render audio messages cleanly in the terminal (#497) (bb4ff9b)
  • voice: stub bot barge-in cancelled STT mid-pipeline, dropping user transcripts (#499) (5cb3596)

Miscellaneous

  • deps-dev: bump vite, @vitejs/plugin-react-swc and lovable-tagger (e43f938)
  • deps-dev: bump vite, @vitejs/plugin-react-swc and lovable-tagger in /python/examples/lovable_clone/template (#429) (e43f938)
  • deps: bump black from 25.1.0 to 26.3.1 in /python (#431) (07db40a)
  • deps: bump gitpython from 3.1.49 to 3.1.50 in /python (#447) (3fcd1fa)
  • deps: bump mako from 1.3.10 to 1.3.12 in /python (#448) (ab4d576)
  • deps: bump protobuf from 5.29.5 to 5.29.6 in /python (#433) (6ea6ed7)
  • deps: bump pyasn1 from 0.6.1 to 0.6.3 in /python (#432) (ee837e7)
  • deps: bump python-multipart from 0.0.20 to 0.0.26 in /python (#430) (0b29bbb)
  • deps: bump python-multipart from 0.0.26 to 0.0.27 in /python (#449) (e5467b3)
  • deps: bump starlette from 0.47.0 to 0.49.1 in /python (#434) (5263fed)
  • deps: bump urllib3 from 1.26.20 to 2.6.3 in /python (#435) (1793d64)
Assets 2
Loading