Starstruk Logo MarkStarstruk

v1.25.0

ruvnet/auto-browserv1.25.0May 14, 2026by albertvillanova

AI Summary

A security-focused release for the Hugging Face smolagents library addressing critical vulnerabilities in remote executors and removing legacy pickle support. It also includes refactoring for better deserialization and MLflow integration.

Key Highlights

  • Fix for high-impact vulnerability in remote executors
  • Removal of legacy no-prefix pickle support for security
  • Refactored agent/model deserialization using registry pattern
  • New MLflow integration documentation
  • WasmExecutor security isolation with per-instance temp directories

Breaking Changes

  • Removal of legacy no-prefix pickle support

New Features

  • MLflow integration
  • Registry pattern for deserialization
  • Improved WasmExecutor security
  • Token-based Docker executor authentication
  • Isolated WasmExecutor Deno cache

Full Release Notes

## What's Changed
* Bump dev version: v1.25.0.dev0 by @albertvillanova in https://github.com/huggingface/smolagents/pull/1939
* Fix import of TokenUsage by @albertvillanova in https://github.com/huggingface/smolagents/pull/1943
* Add MLflow integration doc by @B-Step62 in https://github.com/huggingface/smolagents/pull/1884
* Refactor agent/model deserialization: Replace importlib with registry pattern by @albertvillanova in https://github.com/huggingface/smolagents/pull/1944
* Update _function_type_hints_utils.py: CohereForAI -> CohereLabs by @Michellehbn in https://github.com/huggingface/smolagents/pull/1946
* Fix High impact vulnerability on remote executors by @nnfrog in https://github.com/huggingface/smolagents/pull/1637
* Fix SafeSerializer.get_deserializer_code by @albertvillanova in https://github.com/huggingface/smolagents/pull/1983
* Fix RemotePythonExecutor._deserialize_final_answer for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1984
* Test 'pickle:...' payloads are properly decoded by @albertvillanova in https://github.com/huggingface/smolagents/pull/1985
* Remove support for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1986
* Create docs reference page for Python executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/1987
* Isolate WasmExecutor Deno cache to per-instance temp directory by @albertvillanova in https://github.com/huggingface/smolagents/pull/1995
* Switch wildcard bind to loopback-only endpoint in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2025
* Use token in DockerExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2027
* Remove allow_origin from Docker and Modal executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2028
* Use token in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2031
* Fix evaluate_with() calling __exit__ on wrong object by @dubin555 in https://github.com/huggingface/smolagents/pull/2029
* Fix evaluate_with by suppressing exception if truthy __exit__ by @albertvillanova in https://github.com/huggingface/smolagents/pull/2033
* Use requests.Session in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2032
* Fix Rich MarkupError in AgentLogger.log_task by rendering untrusted text safely by @Barcavin in https://github.com/huggingface/smolagents/pull/1894
* Emphasise sandboxing is required; LocalPythonExecutor is not a security tool by @zsims in https://github.com/huggingface/smolagents/pull/2039
* Fix log_error rendering brackets as Rich markup by @albertvillanova in https://github.com/huggingface/smolagents/pull/2077
* Support huggingface-hub >= 1 by @merveenoyan in https://github.com/huggingface/smolagents/pull/2075
* Remove unused safe_serialization param from _websocket_run_code_raise_errors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2131
* Set allow_pickle default to False in internal calls by @albertvillanova in https://github.com/huggingface/smolagents/pull/2132
* 🔒 Pin GitHub Actions to commit SHAs by @paulinebm in https://github.com/huggingface/smolagents/pull/2149
* chore: bump doc-builder SHA for PR upload workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2194
* chore: bump doc-builder SHA for main doc build workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2219

## New Contributors
* @B-Step62 made their first contribution in https://github.com/huggingface/smolagents/pull/1884
* @Michellehbn made their first contribution in https://github.com/huggingface/smolagents/pull/1946
* @dubin555 made their first contribution in https://github.com/huggingface/smolagents/pull/2029
* @zsims made their first contribution in https://github.com/huggingface/smolagents/pull/2039
* @paulinebm made their first contribution in https://github.com/huggingface/smolagents/pull/2149
* @rtrompier made their first contribution in https://github.com/huggingface/smolagents/pull/2194

**Full Changelog**: https://github.com/huggingface/smolagents/compare/v1.24.0...v1.25.0