Skip to content

0.5.610

Choose a tag to compare

View all tags
@a-ratz a-ratz released this 03 Sep 13:35
· 376 commits to main since this release
0.5.610
333c9b0
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Release Highlights

This bugfix release rolls up security, REST artifact correctness, visibility enforcement, Dapr demo, and CI compatibility improvements merged since 0.5.600.

Artifact API safety and correctness

  • Enforced Visibility rules on the default ArtifactsComponent list, detail, and summary endpoints, with trusted identity resolution and 404 responses for inaccessible details.
  • Added strict validation for REST visibility policies and publish support for visibility, tags, and partition keys.
  • Canonicalized and validated dict-published artifact types and payloads before persistence across the shared publish path.
  • Preserved generated REST correlation IDs as artifact metadata and retained consumption metadata when no correlation ID is present.

Dapr and runtime stabilization

  • Added runnable Redis-backed Dapr durability and shared-blackboard demos.
  • Improved example-stack persistence and documentation.
  • Applied configured external log levels to DSPy, LiteLLM, and HTTPX.
  • Restored the frontend test baseline on current Node releases and stabilized Dapr warning assertions.
  • Removed pytest-asyncio from runtime dependencies.

Dependency security

  • Updated LiteLLM, Vitest, and Jupyter Server to patched versions for their respective security advisories.
  • Removed the unused Codecov integration while retaining CI coverage enforcement.

Notes

This release closes #417 for the default ArtifactsComponent artifact endpoints. Visibility audits and hardening of other read surfaces remain separate follow-up work.

What's Changed

  • fix: update LiteLLM for security patches by @swolg in #418
  • Remove Codecov integration from CI by @swolg in #419
  • fix(frontend): update Vitest for Dependabot alert 176 by @swolg in #420
  • fix(deps): update jupyter-server for Dependabot alert 246 by @swolg in #421
  • Dapr demos + dict-publish type resolution and validation by @AndreRatzenberger in #422
  • chore: bump version to 0.5.602 by @AndreRatzenberger in #423
  • fix(api): REST correlation id on the artifact, optional consumption correlation id, external log levels by @AndreRatzenberger in #424
  • fix(server): ArtifactsComponent publish carries a correlation id; optional consumption correlation id by @AndreRatzenberger in #425
  • fix: enforce ArtifactsComponent visibility and restore CI by @AndreRatzenberger in #426

Full Changelog: 0.5.600...0.5.610

Contributors

a-ratz and swolg
Assets 2
Loading