Skip to content

harness-sdk

vtypescript/v1.10.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

agent-framework agentic agentic-ai agents ai ai-agents
+14 more
anthropic autonomous-agents bedrock generative-ai harness llm llm-agent mcp multi-agent-systems openai python sdk strands-agents typescript

Affected surfaces

auth

Summary

AI summary

Broad release touches 🐛 Fixes, 🚀 Features, 📚 Documentation, and 👷 CI.

Full changelog

typescript/v1.10.0

Auto-drafted from commits in typescript/v1.9.0..typescript/v1.10.0, grouped by conventional-commit type. Edit on the release page after publish if you want a polished writeup; the canonical release notes live on the website.

🚀 Features

  • feat: add community agent governance kit strands invervention handler (#3256) (4297fb1b)
  • feat(py): add unified storage interface (#3259) (1aff2707)
  • feat(context-offloader): auto-namespace unified Storage under offloader (#3258) (d6a2636c)
  • feat: add interventions community package (#3219) (9bebb317)
  • feat: added gen_ai_span_attributes_only var to skip event attributes (#3194) (9dfc2ed9)
  • feat: add unified storage interface (#3099) (60fc4433)
  • feat: add gen_ai_span_attributes_only env var (#3191) (b1e1c2ba)
  • feat(site): revamp docs search with doc-type filtering (#3192) (56d44bfd)

🐛 Fixes

  • fix(session): prevent symlink attacks in FileSessionManager (#2937) (8658b9e0)
  • fix(models/openai): use /openai/v1 Mantle base URL for the Responses API (#3280) (d1fbd75b)
  • fix(site): escape all regex metacharacters in API counterpart anchor pattern (#3263) (3897c3b9)
  • fix(bedrock): place cache point before non-PDF document blocks (#2001) (beddc3f7)
  • fix(models/gemini): detect throttling via ClientError status attribute (#3228) (4c517857)
  • fix(sagemaker): support vLLM v0.16.0+ reasoning field in streaming and non-streaming paths (#3252) (4ca81da5)
  • fix(site): mobile header nav dropdown pushed off screen (#3210) (c649c1ba)
  • fix(bidi): set Strands user agent for Nova Sonic client (#2132) (c5003050)
  • fix(site): language toggle 404s on API reference pages (#3205) (21994027)

♻️ Refactoring

  • refactor(ts): extract generic async Queue from multiagent (#3262) (abd9f079)

📚 Documentation

  • docs(typescript): deduplicate testing guide and agents file (#3291) (8a292d9e)
  • docs: deduplicate pr guidelines summary in sdk agents files (#3293) (13c4325e)
  • docs(changelog): sync strands-agents/evals backfill (#3202) (6223f55b)
  • docs(py): document Bedrock strict_tools schema constraints (#3261) (7fb9a306)
  • docs(bidi): update Nova Sonic docs for v2 and fix stale references (#3195) (4321fc22)
  • docs(blog): add Harness Optimizer blog post (#3132) (e579bded)
  • docs(changelog): sync strands-agents/harness-sdk typescript/v1.9.0 (#3200) (dad124e5)
  • docs(changelog): sync strands-agents/harness-sdk typescript/v1.8.0 (#3187) (bf05c1ac)

👷 CI

  • ci: bump actions/setup-node from 6 to 7 (#3229) (4330a231)
  • ci(docs): bump prettier from 3.9.4 to 3.9.5 in /site (#3172) (eaeb7ba5)
  • ci(docs): bump @astrojs/markdown-satteri from 0.3.3 to 0.3.4 in /site (#3231) (e2c6ddee)
  • ci(docs): bump vite from 8.1.3 to 8.1.5 in /site (#3296) (754d1653)
  • ci(changelog): guard sync job to upstream; document workflow-scope requirement (#3278) (37dc28a4)
  • ci(release): trigger changelog sync directly from the release workflows (#3193) (6a01417b)
  • ci(changelog): sync bot fork with upstream before opening PRs (#3179) (381091f4)

🔧 Chores

  • chore(site): remove dead files and fix stale nav config (#3289) (f21c4330)
  • chore(python): remove dead private code (#3286) (e8fee979)
  • chore(typescript): remove dead barrel and obsolete types package (#3285) (d81803b4)

⏪ Reverts

  • revert: revert chore(deps): relax litellm upper bound to <2.0.0 (#3149) (#3223) (ba89c8f9)
  • revert(site): revamp docs search with doc-type filtering (#3192) (#3204) (941d5251)

Security Fixes

  • fix(session): prevent symlink attacks in FileSessionManager

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track harness-sdk

Get notified when new releases ship.

Sign up free

About harness-sdk

A model-driven approach to building AI agents in just a few lines of code.

All releases →

Related context

Earlier breaking changes

Beta — feedback welcome: [email protected]