This release includes 1 security fix for security teams reviewing exposed deployments.
Topics
+14 more
Affected surfaces
Summary
AI summaryBroad release touches 🐛 Fixes, 📚 Documentation, 🚀 Features, and 👷 CI.
Full changelog
python/v1.48.0
Auto-drafted from commits in python/v1.47.0..python/v1.48.0, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.
🚀 Features
- feat: add community agent governance kit strands invervention handler (#3256) (4297fb1b)
- feat(py): add unified storage interface (#3259) (1aff2707)
- feat(context-offloader): auto-namespace unified Storage under offloader (#3258) (d6a2636c)
- feat: add interventions community package (#3219) (9bebb317)
- feat: added gen_ai_span_attributes_only var to skip event attributes (#3194) (9dfc2ed9)
- feat: add unified storage interface (#3099) (60fc4433)
- feat: add gen_ai_span_attributes_only env var (#3191) (b1e1c2ba)
- feat(site): revamp docs search with doc-type filtering (#3192) (56d44bfd)
- feat: expose client_name parameter on MCPClient for clientInfo identification (#3113) (612f47f7)
- feat(port): allow ports in either direction (#3160) (e385f74a)
🐛 Fixes
- fix(session): prevent symlink attacks in FileSessionManager (#2937) (8658b9e0)
- fix(models/openai): use /openai/v1 Mantle base URL for the Responses API (#3280) (d1fbd75b)
- fix(site): escape all regex metacharacters in API counterpart anchor pattern (#3263) (3897c3b9)
- fix(bedrock): place cache point before non-PDF document blocks (#2001) (beddc3f7)
- fix(models/gemini): detect throttling via ClientError status attribute (#3228) (4c517857)
- fix(sagemaker): support vLLM v0.16.0+ reasoning field in streaming and non-streaming paths (#3252) (4ca81da5)
- fix(site): mobile header nav dropdown pushed off screen (#3210) (c649c1ba)
- fix(bidi): set Strands user agent for Nova Sonic client (#2132) (c5003050)
- fix(site): language toggle 404s on API reference pages (#3205) (21994027)
- fix(tools): load directory tools under a namespaced module key (#2994) (70028932)
- fix(ci): pin npm@11 in release workflow to avoid npm 12 breakage (#3188) (4a778352)
- fix(docs): resolve TS API cross-links to variables and enums (#3177) (64e564f6)
♻️ Refactoring
- refactor(ts): extract generic async Queue from multiagent (#3262) (abd9f079)
- refactor(ts): export Checkpoint APIs only from /experimental (#3180) (ab5402bb)
📚 Documentation
- docs(typescript): deduplicate testing guide and agents file (#3291) (8a292d9e)
- docs: deduplicate pr guidelines summary in sdk agents files (#3293) (13c4325e)
- docs(changelog): sync strands-agents/evals backfill (#3202) (6223f55b)
- docs(py): document Bedrock strict_tools schema constraints (#3261) (7fb9a306)
- docs(bidi): update Nova Sonic docs for v2 and fix stale references (#3195) (4321fc22)
- docs(blog): add Harness Optimizer blog post (#3132) (e579bded)
- docs(changelog): sync strands-agents/harness-sdk typescript/v1.9.0 (#3200) (dad124e5)
- docs(changelog): sync strands-agents/harness-sdk typescript/v1.8.0 (#3187) (bf05c1ac)
- docs(changelog): sync strands-agents/harness-sdk python/v1.47.0 (#3186) (c402a6ef)
- docs(pr-writer): scale description length to diff size (#3183) (642c9b9d)
- docs(changelog): sync strands-agents/harness-sdk python/v1.46.0 (#3181) (8929c113)
👷 CI
- ci: bump actions/setup-node from 6 to 7 (#3229) (4330a231)
- ci(docs): bump prettier from 3.9.4 to 3.9.5 in /site (#3172) (eaeb7ba5)
- ci(docs): bump @astrojs/markdown-satteri from 0.3.3 to 0.3.4 in /site (#3231) (e2c6ddee)
- ci(docs): bump vite from 8.1.3 to 8.1.5 in /site (#3296) (754d1653)
- ci(changelog): guard sync job to upstream; document workflow-scope requirement (#3278) (37dc28a4)
- ci(release): trigger changelog sync directly from the release workflows (#3193) (6a01417b)
- ci(changelog): sync bot fork with upstream before opening PRs (#3179) (381091f4)
- ci: run docs CI on python and typescript changes (#3178) (05cc4f7f)
- ci(deps): group Python dev tooling by name pattern (#3171) (c8c53809)
- ci: bump actions/checkout from 6 to 7 (#3138) (b5a828f3)
🔧 Chores
- chore(site): remove dead files and fix stale nav config (#3289) (f21c4330)
- chore(python): remove dead private code (#3286) (e8fee979)
- chore(typescript): remove dead barrel and obsolete types package (#3285) (d81803b4)
⏪ Reverts
- revert: revert chore(deps): relax litellm upper bound to <2.0.0 (#3149) (#3223) (ba89c8f9)
- revert(site): revamp docs search with doc-type filtering (#3192) (#3204) (941d5251)
Security Fixes
- Fix session symlink attacks in FileSessionManager preventing potential file system exploits
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About harness-sdk
A model-driven approach to building AI agents in just a few lines of code.
Related context
Related tools
Earlier breaking changes
- vtypescript/v1.9.0 Rename LocalMemoryStore to TestMemoryStore (breaking change).
- vpython/v1.47.0 Renames LocalMemoryStore to TestMemoryStore (breaking change).
- vtypescript/v1.5.0 Change memory store return type on add in strands-py.
Beta — feedback welcome: [email protected]