pixeltable

v0.6.5 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Model Serving & MLOps

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

ai artificial-intelligence llm computer-vision data-science database

+7 more

feature-engineering feature-store genai machine-learning mlops multimodal vector-db

ReleasePort's take

Moderate signal

editorial:auto 1mo

Release v0.6.5 deprecates the HF_AUTH_TOKEN environment variable; all users must switch to HF_TOKEN.

Why it matters: The deprecated HF_AUTH_TOKEN (severity 70) will be removed in a future release, requiring immediate configuration updates for uninterrupted operation.

Summary

AI summary

Rename HF_AUTH_TOKEN to HF_TOKEN aligning with HuggingFace library expectations.

Changes in this release

Type	Severity	Summary	CVE
Breaking	High	Deprecates HF_AUTH_TOKEN environment variable; use HF_TOKEN. Deprecates HF_AUTH_TOKEN environment variable; use HF_TOKEN. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature
Feature	Medium	Adds export_iceberg functionality. Adds export_iceberg functionality. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Medium	Adds segmentation notebook images. Adds segmentation notebook images. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Medium	Integrates vLLM into the system. Integrates vLLM into the system. Source: llm_adapter@2026-06-12 Confidence: high	—
Feature	Medium	Disables stdout buffering on workers for real‑time output. Disables stdout buffering on workers for real‑time output. Source: llm_adapter@2026-06-12 Confidence: high	—
Dependency	High	Removes mkdocs dependency as part of security updates. Removes mkdocs dependency as part of security updates. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix
Bugfix	Medium	Fixes race condition in Catalog.create_user(). Fixes race condition in Catalog.create_user(). Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Fixes tarfile extraction filter issue during table restore. Fixes tarfile extraction filter issue during table restore. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Fixes Catalog lock ordering issue. Fixes Catalog lock ordering issue. Source: llm_adapter@2026-06-12 Confidence: high	—
Bugfix	Medium	Verifies all necessary locks on retry_loop re‑entry. Verifies all necessary locks on retry_loop re‑entry. Source: llm_adapter@2026-06-12 Confidence: high	—

Full changelog

What's Changed

random ops: disable stdout buffering on workers by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1389
[PXT-326] Add segmentation notebook images by @christopherpestano in https://github.com/pixeltable/pixeltable/pull/1394
Cleanup Pixeltable's logging infrastructure by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1379
[PXT-1073] Add export_iceberg by @christopherpestano in https://github.com/pixeltable/pixeltable/pull/1301
TypedDict for image get_metadata() by @aaron-siegel in https://github.com/pixeltable/pixeltable/pull/1393
PXT-1183: race in Catalog.create_user() by @mkornacker in https://github.com/pixeltable/pixeltable/pull/1384
OpenAI image/audio/moderation UDFs: typed JSON return schema by @mkornacker in https://github.com/pixeltable/pixeltable/pull/1295
Dependabot security updates 2026-06-02; remove mkdocs dependency by @aaron-siegel in https://github.com/pixeltable/pixeltable/pull/1388
Agent-friendly CLI by @mkornacker in https://github.com/pixeltable/pixeltable/pull/1333
Skip HF-dependent notebooks and unit tests in pull requests by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1398
Fix Catalog lock ordering by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1399
remove autouse from fault_injection fixture by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1382
fix(share): pass filter='data' to tarfile.extractall on table restore by @elfrost in https://github.com/pixeltable/pixeltable/pull/1378
Verify all necessary locks on retry_loop re-entry by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1391
Rename HF_AUTH_TOKEN to HF_TOKEN: the huggingface library looks for the latter by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1396
Update HF cache clearing after tests by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1401
new pull_request action should cancel the previous test run on the pr by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1403
Catalog.mark_modified_tvs is never passed more than one TV handle by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1404
Makefile fix by @aaron-siegel in https://github.com/pixeltable/pixeltable/pull/1407
Keep HuggingFace out of PR and merge CI by @mkornacker in https://github.com/pixeltable/pixeltable/pull/1402
[PXT-1169] rename FastAPIRouter._shutdown by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1409
Add a convenience function to MultiThreadedScenario for fault injection by @sergey-mkhitaryan in https://github.com/pixeltable/pixeltable/pull/1411
vLLM integration by @aaron-siegel in https://github.com/pixeltable/pixeltable/pull/1385

New Contributors

@elfrost made their first contribution in https://github.com/pixeltable/pixeltable/pull/1378

Full Changelog: https://github.com/pixeltable/pixeltable/compare/v0.6.4...v0.6.5

Breaking Changes

Rename environment variable HF_AUTH_TOKEN to HF_TOKEN

Security Fixes

Dependabot security updates applied on 2026-06-02

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track pixeltable

Get notified when new releases ship.

About pixeltable

Data Infrastructure providing a declarative, incremental approach for multimodal AI workloads.