This release includes 2 breaking changes for platform teams planning a safe upgrade.
Published 16d
Containers & Orchestration
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
ai
ai-agent
ai-infra
kubernetes
sandbox
Affected surfaces
breaking_upgrade
crypto_tls
Summary
AI summarySandbox.Close and SandboxManager.Close now return an error to satisfy io.Closer, and TLS 1.2 is the minimum for SDK‑created HTTP clients.
Full changelog
What's New
⚠️ Breaking Changes
Sandbox.Close/SandboxManager.Closenow returnerrorto satisfyio.Closer. Callers that previously ignored the return value need to update signatures (and ideally check the returned error). Same PR also drains HTTP response bodies after read so the underlying connection is reused, replaces manualurl.QueryEscapewithurl.Values, drops the deprecatedcrypto/dsaimport + DSA public-key branch, and trims unusedgo.moddependencies. (#851)- TLS 1.2 minimum for SDK-created HTTP clients, enforcing the NIST 2030 minimum certificate key/hash length policy. Environments still serving TLS 1.0/1.1 endpoints must upgrade before adopting this release. Compatibility escape hatches are exposed for legacy weaker certificates. (#790)
✨ Features
- Multi-file upload: new
UploadFileshelper onSandboxperforms multipart uploads against execd's existing/files/uploadmulti-file contract. The single-fileUploadFileis now a thin wrapper over the batch path./files/downloadremains single-file streaming, so noDownloadFilescounterpart is added. (#843) - User-Agent header (
OpenSandbox-Go-SDK/1.0.1) is now set on every outgoing request —doRequestOnce,doStreamRequest,GetCommandLogs,UploadFiles,DownloadFile. (#850)
🐛 Bug Fixes
- Forward all
GetEndpointheaders on subsequent execd/egress requests, matching the Python SDK. The previous code only forwardedX-EXECD-ACCESS-TOKEN/OPENSANDBOX-EGRESS-AUTHand dropped everything else, breaking routing whenever the server added new headers (sticky-session keys, routing hints, etc.). Closes #886. (#900) - Empty SSE stream now surfaces an error instead of silently returning a "successful but empty"
Execution(stdout=[],stderr=[],results=[],error=nil,complete=nil).streamSSE()now counts dispatched events and returnsopensandbox: empty sse streamwhen the body closes with zero events, so transport/proxy/execd failures stop masquerading as successful executions. (#778)
👥 Contributors
Thanks to these contributors ❤️
- @Pangjiping
- @zpzjzj
- @hittyt
- @skyler0513
go get github.com/alibaba/OpenSandbox/sdks/sandbox/[email protected]
Breaking Changes
- `Sandbox.Close` and `SandboxManager.Close` now return an error (previously void). Callers must handle the returned error.
- Minimum TLS version for SDK‑created HTTP clients is raised to TLS 1.2; environments using TLS 1.0/1.1 must upgrade before adopting this release.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]