This release includes 1 breaking change for platform teams planning a safe upgrade.
Published 1mo
Containers & Orchestration
✓ No known CVEs patched
✓ No known CVEs patched in this version
Topics
ai
ai-agent
ai-infra
kubernetes
sandbox
Affected surfaces
breaking_upgrade
Summary
AI summaryUpdates Breaking Changes, Bug Fixes, and What's New across a mixed release.
Full changelog
What's New
Breaking Changes
- Code Interpreter runtime paths have moved from
/opt/opensandboxto/opt/code-interpreter, and the Go SDKCodeInterpreterEntrypointconstant now points at the new path. If you callCreateCodeInterpreter()without overriding the entrypoint, no change is needed. If you hardcoded the old path, update to/opt/code-interpreter/code-interpreter.shwhen upgrading to images and SDK constants that include this migration. https://github.com/opensandbox-group/OpenSandbox/pull/1012
Features
- Added
resourceRequeststo sandbox creation so Kubernetes-backed sandboxes can set resource requests separately from limits. Omitting the field preserves the existing behavior where requests match limits. - Added line-based file reads through
GET /files/downloadwithoffsetandlimitquery parameters, enabling Go callers to read large text files by line range. - Added directory listing support through the new execd directory API. The Go SDK now has a plain
ListDirectory(ctx, path)method that uses the server default depth andListDirectoryWithDepth(ctx, path, depth)for explicit depth control. https://github.com/opensandbox-group/OpenSandbox/pull/1001 - Added detailed replace-content feedback without breaking existing callers. Existing replace behavior remains available, while detailed response types expose per-file
replacedCountvalues so callers can detect no-match and multi-match replacements. https://github.com/opensandbox-group/OpenSandbox/pull/991 - Added Credential Vault support to the Go SDK surface, including model, adapter, sandbox creation, unit test, and E2E coverage. https://github.com/opensandbox-group/OpenSandbox/pull/1009 https://github.com/opensandbox-group/OpenSandbox/pull/1023
Bug Fixes
- Directory listing now omits depth for the default path and uses an explicit method when callers need
depth=0or another override. Entries are documented as lexically ordered within each directory. https://github.com/opensandbox-group/OpenSandbox/pull/1001 - Fixed resourceRequests-related Go SDK tests and generated model handling.
- Fixed replace-content detailed response handling while keeping existing replace usage compatible. https://github.com/opensandbox-group/OpenSandbox/pull/991
Misc
- Prepared the Go Sandbox SDK module for tag
sdks/sandbox/go/v1.0.3.
Contributors
- @Pangjiping
- @asiudgufgbukbsa
- @jwx0925
- @ninan-nn
Breaking Changes
- Code Interpreter runtime paths moved from `/opt/opensandbox` to `/opt/code-interpreter`; `CodeInterpreterEntrypoint` constant now points to the new path. Hardcoded old paths must be updated to `/opt/code-interpreter/code-interpreter.sh` on upgrade.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Earlier breaking changes
- vpython/sandbox/v0.1.14 Removes `CredentialMatch.ports`; port now derived from scheme.
- vjava/sandbox/v1.0.16 Removes CredentialMatch.ports; port derived from scheme instead.
- vdocker/egress/v1.1.4 `Match.Ports` field removed from Credential Vault bindings; ports derived from scheme.
- vdocker/egress/v1.1.4 'X-Forwarded-Proto' is trusted only from configured proxy CIDRs.
- vdocker/egress/v1.1.4 Credential Vault requires `dns+nft` enforcement for egress connections.
Beta — feedback welcome: [email protected]