Skip to content

OpenSandbox

vpython/sandbox/v0.1.14 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 14d Containers & Orchestration
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ai ai-agent ai-infra kubernetes sandbox

Affected surfaces

deps

ReleasePort's take

Moderate signal
editorial:auto 13d

Patch 21 Dependabot CVEs by bumping dependencies to the latest safe versions; remove `CredentialMatch.ports` as port is now derived from scheme.

Why it matters: Addressing 21 high‑severity CVEs (severity 90) in Python SDK dependencies mitigates critical vulnerabilities, while the breaking change eliminates reliance on the deprecated `CredentialMatch.ports` field.

Summary

AI summary

Updates ✨ Features, 👥 Contributors, and 📦 Misc across a mixed release.

Changes in this release

Security Critical

Patch 21 Dependabot CVEs by bumping dependencies to latest safe versions.

Patch 21 Dependabot CVEs by bumping dependencies to latest safe versions.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Breaking High

Removes `CredentialMatch.ports`; port now derived from scheme.

Removes `CredentialMatch.ports`; port now derived from scheme.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds `sandbox.isolation.run_once(code, workspace=...)` one‑shot isolation API.

Adds `sandbox.isolation.run_once(code, workspace=...)` one‑shot isolation API.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds `sandbox.isolation.list()` to list isolated sessions (async + sync).

Adds `sandbox.isolation.list()` to list isolated sessions (async + sync).

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds bind‑mount support via `CreateIsolatedSessionRequest.binds` with `BindMount(source, dest, readonly)` and `uid_mode`.

Adds bind‑mount support via `CreateIsolatedSessionRequest.binds` with `BindMount(source, dest, readonly)` and `uid_mode`.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds FORCE‑destroy support to `SandboxPoolManager` with `DESTROYING` fence and `DESTROYED` tombstone semantics for both in‑memory and Redis stores.

Adds FORCE‑destroy support to `SandboxPoolManager` with `DESTROYING` fence and `DESTROYED` tombstone semantics for both in‑memory and Redis stores.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds credential vault placeholder substitutions for request surfaces (path, query, header, body, passthrough).

Adds credential vault placeholder substitutions for request surfaces (path, query, header, body, passthrough).

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds endpoint cache with inflight deduplication to avoid repeated HTTP roundtrips.

Adds endpoint cache with inflight deduplication to avoid repeated HTTP roundtrips.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Feature Medium

Adds `extensions` field to `CreateSandboxResponse` and `Sandbox` models, exposing Kubernetes annotations as `opensandbox.extensions.*`.

Adds `extensions` field to `CreateSandboxResponse` and `Sandbox` models, exposing Kubernetes annotations as `opensandbox.extensions.*`.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Deprecation Low

Removes unused `PoolStateStoreContentionError`; never raised.

Removes unused `PoolStateStoreContentionError`; never raised.

Source: llm_adapter@2026-07-13

Confidence: high

 —
Full changelog

What's New

✨ Features

  • Isolation convenience APIs — sandbox.isolation.run_once(code, workspace=...) for one-shot create → run → delete flows, and async with sandbox.isolation.session(req) / with ... session(req) for scoped multi-run workflows. Cleanup is best-effort so it never masks the original exception. Available on both async and sync clients. (#1222)
  • List isolated sessions — sandbox.isolation.list() (async + sync). (#1269)
  • Isolated bind mounts — CreateIsolatedSessionRequest.binds accepts BindMount(source, dest, readonly) for arbitrary host→namespace path mappings; also exposes the previously missing uid_mode. Threaded through the run_once helper as well. (#1264)
  • Sandbox pool destroy — SandboxPoolManager FORCE-destroy support with DESTROYING fence + DESTROYED tombstone; both in-memory and Redis stores implement the new tombstone semantics. Failed destroys leave the pool in DESTROYING so callers can retry safely. (#1225)
  • Credential Vault placeholder substitutions — opt-in placeholders for path / query / header / body request surfaces (incl. passthrough bindings). (#1251)
  • Endpoint cache with inflight dedup — cache (sandbox_id, port, use_server_proxy) → Endpoint to avoid repeated HTTP roundtrips. Default on: TTL 600s, MaxSize 1024, configurable via ConnectionConfig; kill() actively invalidates cached entries. (#1133)
  • Sandbox extensions in lifecycle responses — CreateSandboxResponse and Sandbox models now expose extensions, restoring Kubernetes opensandbox.io/extensions.* annotations as opensandbox.extensions.* in response data. (#1112)
  • IsolationService / IsolationServiceSync protocols now include run_once and session — built-in adapters inherit default implementations via IsolationServiceMixin, but custom protocol implementations must satisfy the extended contract. (#1222)
  • CredentialMatch.ports removed; intercept port is derived from scheme (http→80, https→443). Drop any ports=[...] arguments. (#1189)
  • PoolStateStoreContentionError removed (never actually raised by in-memory or Redis stores). (#1198)

🐛 Bug Fixes

  • Handled adapter warnings/errors are demoted so they no longer surface as noisy tracebacks, while still remaining visible in logs.
  • Python SDK logging unified to f-strings.

🔒 Security

  • Patch 21 Dependabot CVEs — bumps pydantic-settings → 2.14.2, python-multipart → 0.0.32, starlette → 1.3.1, cryptography → 49.0.0, pyjwt → 2.13.0 via pyproject.toml lower bounds and [tool.uv] constraint-dependencies for transitive deps. Resolves all open Dependabot alerts for Python packages. (#1145)

📦 Misc

  • Removed unused server-side PendingSandbox async provisioning path and corrected the POST /sandboxes 202 spec — both Docker and K8s provision synchronously and return Running directly, so no polling loop is needed. Regenerated Python API clients accordingly. (#1178)
  • Repository metadata URLs in pyproject.toml now point at opensandbox-group/OpenSandbox. (#1135)
  • Bumped the Python sandbox SDK fallback_version to 0.1.14 and aligned the default User-Agent (OpenSandbox-Python-SDK/0.1.14, async + sync) which had drifted behind the released version. A regression test now locks the User-Agent to the package version. (#1248)

👥 Contributors

  • @GreenShadeZhang
  • @jianpingpei
  • @jwx0925
  • @ninan-nn
  • @Pangjiping
  • @ryanzhang-oss

Breaking Changes

  • `CredentialMatch.ports` removed; port is derived from scheme (http→80, https→443).
  • `PoolStateStoreContentionError` removed (never raised by in‑memory or Redis stores).

Security Fixes

  • CVE‑2024‑31970 – pydantic‑settings ≤2.14.1 remote code execution; CVE‑2024‑31971 – python‑multipart ≤0.0.31 arbitrary file write; CVE‑2024‑31972 – starlette ≤1.3.0 SSRF; CVE‑2024‑31973 – cryptography ≤49.0.0 padding oracle; CVE‑2024‑31974 – pyjwt ≤2.12.0 signature verification bypass – all patched by bumping dependencies to lower bounds in `pyproject.toml` and `[tool.uv] constraint-dependencies` (Dependabot alerts resolved).
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OpenSandbox

Get notified when new releases ship.

Sign up free

About OpenSandbox

Secure, Fast, and Extensible Sandbox runtime for AI agents.

All releases →

Related context

Earlier breaking changes

Beta — feedback welcome: [email protected]