Starstruk Logo MarkStarstruk

v1.25.0

ByteDance-Seed/SeedVRv1.25.0May 14, 2026by albertvillanova

AI Summary

smolagents v1.25.0 focuses on security improvements and executor stability by fixing high-impact vulnerabilities and removing legacy pickle support. The update introduces a new MLflow integration and refactors agent deserialization to use a registry pattern.

Key Highlights

  • Fixed high impact vulnerability on remote executors
  • Removed support for legacy no-prefix pickle
  • Added MLflow integration documentation
  • Switched WasmExecutor wildcard bind to loopback-only endpoint
  • Refactored agent/model deserialization using registry pattern

Breaking Changes

  • Removed support for legacy no-prefix pickle

New Features

  • MLflow integration
  • Registry pattern for agent/model deserialization
  • Isolated WasmExecutor Deno cache to per-instance temp directory
  • Use token in Docker and Wasm executors

Full Release Notes

## What's Changed
* Bump dev version: v1.25.0.dev0 by @albertvillanova in https://github.com/huggingface/smolagents/pull/1939
* Fix import of TokenUsage by @albertvillanova in https://github.com/huggingface/smolagents/pull/1943
* Add MLflow integration doc by @B-Step62 in https://github.com/huggingface/smolagents/pull/1884
* Refactor agent/model deserialization: Replace importlib with registry pattern by @albertvillanova in https://github.com/huggingface/smolagents/pull/1944
* Update _function_type_hints_utils.py: CohereForAI -> CohereLabs by @Michellehbn in https://github.com/huggingface/smolagents/pull/1946
* Fix High impact vulnerability on remote executors by @nnfrog in https://github.com/huggingface/smolagents/pull/1637
* Fix SafeSerializer.get_deserializer_code by @albertvillanova in https://github.com/huggingface/smolagents/pull/1983
* Fix RemotePythonExecutor._deserialize_final_answer for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1984
* Test 'pickle:...' payloads are properly decoded by @albertvillanova in https://github.com/huggingface/smolagents/pull/1985
* Remove support for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1986
* Create docs reference page for Python executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/1987
* Isolate WasmExecutor Deno cache to per-instance temp directory by @albertvillanova in https://github.com/huggingface/smolagents/pull/1995
* Switch wildcard bind to loopback-only endpoint in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2025
* Use token in DockerExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2027
* Remove allow_origin from Docker and Modal executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2028
* Use token in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2031
* Fix evaluate_with() calling __exit__ on wrong object by @dubin555 in https://github.com/huggingface/smolagents/pull/2029
* Fix evaluate_with by suppressing exception if truthy __exit__ by @albertvillanova in https://github.com/huggingface/smolagents/pull/2033
* Use requests.Session in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2032
* Fix Rich MarkupError in AgentLogger.log_task by rendering untrusted text safely by @Barcavin in https://github.com/huggingface/smolagents/pull/1894
* Emphasise sandboxing is required; LocalPythonExecutor is not a security tool by @zsims in https://github.com/huggingface/smolagents/pull/2039
* Fix log_error rendering brackets as Rich markup by @albertvillanova in https://github.com/huggingface/smolagents/pull/2077
* Support huggingface-hub >= 1 by @merveenoyan in https://github.com/huggingface/smolagents/pull/2075
* Remove unused safe_serialization param from _websocket_run_code_raise_errors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2131
* Set allow_pickle default to False in internal calls by @albertvillanova in https://github.com/huggingface/smolagents/pull/2132
* 🔒 Pin GitHub Actions to commit SHAs by @paulinebm in https://github.com/huggingface/smolagents/pull/2149
* chore: bump doc-builder SHA for PR upload workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2194
* chore: bump doc-builder SHA for main doc build workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2219

## New Contributors
* @B-Step62 made their first contribution in https://github.com/huggingface/smolagents/pull/1884
* @Michellehbn made their first contribution in https://github.com/huggingface/smolagents/pull/1946
* @dubin555 made their first contribution in https://github.com/huggingface/smolagents/pull/2029
* @zsims made their first contribution in https://github.com/huggingface/smolagents/pull/2039
* @paulinebm made their first contribution in https://github.com/huggingface/smolagents/pull/2149
* @rtrompier made their first contribution in https://github.com/huggingface/smolagents/pull/2194

**Full Changelog**: https://github.com/huggingface/smolagents/compare/v1.24.0...v1.25.0