genkit

v1.40.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 10d LLM Frameworks

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

agents ai embedders genkit llm multimodal

+1 more

vector-db

Affected surfaces

rce_ssrf

ReleasePort's take

Moderate signal

editorial:auto 10d

The release adds security hardening to genkit-tools and introduces several new features across plugins and testing utilities.

Why it matters: Security: Prevents path traversal and restricts binding to localhost in genkit‑tools runtime (severity 90). Feature additions include Claude Sonnet 5 support, multi‑region Google GenAI configuration, and new testing helpers. Deprecates shutdown VEO models in google‑genai.

Summary

AI summary

Updates js, plugins, and google-genai across a mixed release.

Changes in this release

Type	Severity	Summary	CVE
Security	Critical	Prevent path traversal and bind to localhost in genkit-tools. Prevent path traversal and bind to localhost in genkit-tools. Source: llm_adapter@2026-07-17 Confidence: high	—
Feature
Feature	Low	Add mockModel and echoModel utilities to genkit/testing. Add mockModel and echoModel utilities to genkit/testing. Source: llm_adapter@2026-07-17 Confidence: high	—
Feature	Low	Support Claude sonnet 5 in js/plugins/anthropic. Support Claude sonnet 5 in js/plugins/anthropic. Source: llm_adapter@2026-07-17 Confidence: high	—
Feature	Low	Add support for claude-sonnet-5 in js/plugins/vertexai/modelgarden. Add support for claude-sonnet-5 in js/plugins/vertexai/modelgarden. Source: llm_adapter@2026-07-17 Confidence: high	—
Feature	Low	Add multi-region support to js/plugins/google-genai. Add multi-region support to js/plugins/google-genai. Source: llm_adapter@2026-07-17 Confidence: high	—
Feature	Low	Add Agents section to README documentation. Add Agents section to README documentation. Source: llm_adapter@2026-07-17 Confidence: low	—
Deprecation	Low	Remove shutdown veo models from js/plugins/google-genai. Remove shutdown veo models from js/plugins/google-genai. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix
Bugfix	Medium	Serialize callable middleware functions in reflection v2 listValues. Serialize callable middleware functions in reflection v2 listValues. Source: llm_adapter@2026-07-17 Confidence: high	—
Bugfix	Medium	Return not found for missing snapshots in agents. Return not found for missing snapshots in agents. Source: llm_adapter@2026-07-17 Confidence: low	—
Bugfix	Low	Accumulate streamed tool-call arguments in chunks for OpenAI compatibility. Accumulate streamed tool-call arguments in chunks for OpenAI compatibility. Source: llm_adapter@2026-07-17 Confidence: high	—

Full changelog

What's Changed

docs(js/genkit): add Agents section to README by @pavelgj in https://github.com/genkit-ai/genkit/pull/5641
chore(js/plugins/google-genai): remove shutdown veo models by @ifielker in https://github.com/genkit-ai/genkit/pull/5680
fix(agents)!: return not found for missing snapshots by @MichaelDoyle in https://github.com/genkit-ai/genkit/pull/5715
feat(js/testing): mockModel + echoModel for genkit/testing by @cabljac in https://github.com/genkit-ai/genkit/pull/5475
feat(js/plugins/anthropic): Support for Claude sonnet 5 by @ifielker in https://github.com/genkit-ai/genkit/pull/5747
fix(genkit-tools): prevent path traversal and bind to localhost by @pavelgj in https://github.com/genkit-ai/genkit/pull/5751
feat(js/plugins/vertexai/modelgarden): support for claude-sonnet-5 by @ifielker in https://github.com/genkit-ai/genkit/pull/5721
fix(js): serialize callable middleware functions in reflection v2 listValues by @MichaelDoyle in https://github.com/genkit-ai/genkit/pull/5748
feat(js/plugins/google-genai): Multi-region support by @ifielker in https://github.com/genkit-ai/genkit/pull/5753
fix(compat-oai): accumulate streamed tool-call arguments in chunks by @pavelgj in https://github.com/genkit-ai/genkit/pull/5754

New Contributors

@IzaakGough made their first contribution in https://github.com/genkit-ai/genkit/pull/5648

Full Changelog: https://github.com/genkit-ai/genkit/compare/v1.39.0...v1.40.0

Security Fixes

genkit-tools: prevent path traversal and bind server to localhost

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track genkit

Get notified when new releases ship.

About genkit

Open-source framework for building AI-powered apps in JavaScript, Go, and Python, built and used in production by Google

All releases →