Starstruk Logo MarkStarstruk

v1.25.0

GraphiteEditor/Graphitev1.25.0May 14, 2026by albertvillanova

AI Summary

This release focuses on security hardening and executor improvements, specifically addressing vulnerabilities in remote executors and deprecating legacy pickle formats. It also introduces documentation for MLflow integration and updates dependencies.

Key Highlights

  • Fixed high impact vulnerability on remote executors
  • Removed support for legacy no-prefix pickle format
  • Isolated WasmExecutor Deno cache to per-instance temp directories
  • Switched wildcard bind to loopback-only endpoint in WasmExecutor
  • Added MLflow integration documentation

Breaking Changes

  • Removed support for legacy no-prefix pickle
  • Set allow_pickle default to False in internal calls

New Features

  • Refactored agent/model deserialization using a registry pattern
  • Updated _function_type_hints_utils.py to use CohereLabs
  • Fixed SafeSerializer.get_deserializer_code
  • Isolated WasmExecutor Deno cache
  • Switched wildcard bind to loopback-only endpoint

Full Release Notes

## What's Changed
* Bump dev version: v1.25.0.dev0 by @albertvillanova in https://github.com/huggingface/smolagents/pull/1939
* Fix import of TokenUsage by @albertvillanova in https://github.com/huggingface/smolagents/pull/1943
* Add MLflow integration doc by @B-Step62 in https://github.com/huggingface/smolagents/pull/1884
* Refactor agent/model deserialization: Replace importlib with registry pattern by @albertvillanova in https://github.com/huggingface/smolagents/pull/1944
* Update _function_type_hints_utils.py: CohereForAI -> CohereLabs by @Michellehbn in https://github.com/huggingface/smolagents/pull/1946
* Fix High impact vulnerability on remote executors by @nnfrog in https://github.com/huggingface/smolagents/pull/1637
* Fix SafeSerializer.get_deserializer_code by @albertvillanova in https://github.com/huggingface/smolagents/pull/1983
* Fix RemotePythonExecutor._deserialize_final_answer for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1984
* Test 'pickle:...' payloads are properly decoded by @albertvillanova in https://github.com/huggingface/smolagents/pull/1985
* Remove support for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1986
* Create docs reference page for Python executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/1987
* Isolate WasmExecutor Deno cache to per-instance temp directory by @albertvillanova in https://github.com/huggingface/smolagents/pull/1995
* Switch wildcard bind to loopback-only endpoint in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2025
* Use token in DockerExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2027
* Remove allow_origin from Docker and Modal executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2028
* Use token in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2031
* Fix evaluate_with() calling __exit__ on wrong object by @dubin555 in https://github.com/huggingface/smolagents/pull/2029
* Fix evaluate_with by suppressing exception if truthy __exit__ by @albertvillanova in https://github.com/huggingface/smolagents/pull/2033
* Use requests.Session in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2032
* Fix Rich MarkupError in AgentLogger.log_task by rendering untrusted text safely by @Barcavin in https://github.com/huggingface/smolagents/pull/1894
* Emphasise sandboxing is required; LocalPythonExecutor is not a security tool by @zsims in https://github.com/huggingface/smolagents/pull/2039
* Fix log_error rendering brackets as Rich markup by @albertvillanova in https://github.com/huggingface/smolagents/pull/2077
* Support huggingface-hub >= 1 by @merveenoyan in https://github.com/huggingface/smolagents/pull/2075
* Remove unused safe_serialization param from _websocket_run_code_raise_errors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2131
* Set allow_pickle default to False in internal calls by @albertvillanova in https://github.com/huggingface/smolagents/pull/2132
* 🔒 Pin GitHub Actions to commit SHAs by @paulinebm in https://github.com/huggingface/smolagents/pull/2149
* chore: bump doc-builder SHA for PR upload workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2194
* chore: bump doc-builder SHA for main doc build workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2219

## New Contributors
* @B-Step62 made their first contribution in https://github.com/huggingface/smolagents/pull/1884
* @Michellehbn made their first contribution in https://github.com/huggingface/smolagents/pull/1946
* @dubin555 made their first contribution in https://github.com/huggingface/smolagents/pull/2029
* @zsims made their first contribution in https://github.com/huggingface/smolagents/pull/2039
* @paulinebm made their first contribution in https://github.com/huggingface/smolagents/pull/2149
* @rtrompier made their first contribution in https://github.com/huggingface/smolagents/pull/2194

**Full Changelog**: https://github.com/huggingface/smolagents/compare/v1.24.0...v1.25.0