This release adds 2 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
Summary
AI summaryUpdates 👥 Contributors, ✨ Features, and 🐛 Bug Fixes across a mixed release.
Full changelog
What's New
✨ Features
-
Custom sandbox creation for client-side pools — Kotlin
SandboxPoolnow accepts a custom creator that returns aSandbox, allowing advanced creation flows while keeping pool ownership of health checks, TTL renewal, idle bookkeeping, direct-create fallback, and cleanup. Existing image/template based pool creation remains the default and is unchanged unless a creator is supplied. (https://github.com/opensandbox-group/OpenSandbox/pull/1125) -
Isolated execution session APIs — The Kotlin sandbox SDK now includes isolated-session models, services, and adapters for the new execd isolation runtime. Callers can create/delete isolated sessions and perform isolated filesystem operations through the SDK; server-side diff/commit support remains deferred in this phase. (https://github.com/opensandbox-group/OpenSandbox/pull/1008)
🐛 Bug Fixes
-
Preserve server error details in exception strings — Kotlin
SandboxException.toString()now appends parsed server error code/message andrequest_idwhen available. This avoids losing useful backend diagnostics in logs and exception rendering when the HTTP status alone is too generic. (https://github.com/opensandbox-group/OpenSandbox/pull/1122) -
Correct PVC cleanup semantics in SDK models and docs — Kotlin SDK model documentation for
deleteOnSandboxTerminationnow reflects the Kubernetes cleanup behavior for opted-in auto-created PVCs. The option still defaults tofalse, so existing PVC-backed sandboxes keep their previous behavior unless callers explicitly opt in. (https://github.com/opensandbox-group/OpenSandbox/pull/880)
📦 Misc
- Bumped the Kotlin sandbox SDK artifact version to
1.0.15. (https://github.com/opensandbox-group/OpenSandbox/pull/1125)
👥 Contributors
- @Pangjiping
- @ninan-nn
- @xfgong
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- vpython/sandbox/v0.1.14 Removes `CredentialMatch.ports`; port now derived from scheme.
- vjava/sandbox/v1.0.16 Removes CredentialMatch.ports; port derived from scheme instead.
- vdocker/egress/v1.1.4 `Match.Ports` field removed from Credential Vault bindings; ports derived from scheme.
- vdocker/egress/v1.1.4 'X-Forwarded-Proto' is trusted only from configured proxy CIDRs.
- vdocker/egress/v1.1.4 Credential Vault requires `dns+nft` enforcement for egress connections.
Beta — feedback welcome: [email protected]