v0.28.0 v2.10.0
huggingface/smolagentsAug 26, 2026 → Aug 26, 20260 days between releases
What's New
Project pivoted from ML inference to security scanning tooling
Breaking Changes
- bitsandbytes support migrated to out-of-tree plugin
- Transformers bumped to version 5.15.0
- Removed deprecated `calculate_kv_scales` runtime KV scale calculation
- Removed `override_attention_dtype`
- New config keys like `SKILLSPECTOR_OUTPUT_LANGUAGE`
New Features
- Inspect hidden files and nested artifacts (ZIP, DOCX, etc.)
- Support for AISOP/AISP structured skill bundles
- EA5 detection for external model or provider selection
- Bounded transitive reference scanning
- Human-readable LLM finding text
Improvements
- Fail-closed completeness reporting for transitive scanning
- Localized LLM finding text for better readability
- Bounded traversal to prevent infinite loops
- Expose highest reported issue severity
- AMD ROCm enablement on gfx11 and gfx950
Bug Fixes
- Prevents incomplete analysis results from being mistaken for clean results
- Narrowed eager CUDA graph regions for DeepSeek V4
- Async scheduling auto-enabled for draft models
- Optional shared-expert sharding saving memory
- Speculative decoding improvements
Upgrade Notes
This is a complete architectural shift from inference to security scanning. You must migrate configuration settings as the new version introduces security-specific flags like `--transitive` and `SKILLSPECTOR_OUTPUT_LANGUAGE`.
The Two Releases
v0.28.0
Aug 26, 2026· 2 months ago
A major release featuring extensive performance optimizations for Kimi-K3 and DeepSeek V4, the maturation of Model Runner V2, and expanded Rust frontend and gRPC capabilities.
Full release notesSkillSpector v2.10.0
Aug 26, 2026· 2 months ago
SkillSpector 2.10.0 expands security coverage across concealed artifacts, referenced skills, structured skill bundles, and external model selection. It also makes incomplete analysis harder to mistake for a clean result and exposes the highest reported issue severity.
Full release notes