chore: release main - #1785
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7443a9b4b3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), | ||
| and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). | ||
|
|
||
| ## [0.2.53](https://github.com/promptfoo/modelaudit/compare/v0.2.52...v0.2.53) (2026-07-27) |
There was a problem hiding this comment.
Move this release below ## [Unreleased] and fold the existing Windows cache bullet into the 0.2.53 notes (or remove it as a duplicate). As written, the already-shipped cache fix remains classified as unreleased, so a later release can incorrectly include it again and the changelog no longer presents the unreleased section first.
AGENTS.md reference: AGENTS.md:L82-L82
Useful? React with 👍 / 👎.
3a3ce02 to
b35fc94
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cfcbce8b27
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), | ||
| and this package adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). | ||
|
|
||
| ## [0.1.11](https://github.com/promptfoo/modelaudit/compare/modelaudit-picklescan-v0.1.10...modelaudit-picklescan-v0.1.11) (2026-08-01) |
There was a problem hiding this comment.
This package changelog now inserts the 0.1.11 release block before ## [Unreleased] (currently below it at line 14), whereas the file previously kept the active Unreleased section first. In this state future modelaudit-picklescan changes can be appended beneath a released version or omitted from the next release notes, so move ## [Unreleased] back above the 0.1.11 block.
AGENTS.md reference: AGENTS.md:L82-L82
Useful? React with 👍 / 👎.
94ff649 to
ddd7053
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 76ac63fdb3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| ### Bug Fixes | ||
|
|
||
| - **cache:** isolate Windows probes and stabilize nightly checks ([#1782](https://github.com/promptfoo/modelaudit/issues/1782)) ([47f94ee](https://github.com/promptfoo/modelaudit/commit/47f94eef3feba8e74c517114094e035c7ea837e8)) |
There was a problem hiding this comment.
For users installing modelaudit-picklescan 0.1.11 expecting this fix, the release is misleading: between the 0.1.10 release commit (89125b5) and this commit's parent, the package's src/ and rust/ trees are unchanged, and the only package changes are to AGENTS.md and a test; the cache implementation changed under root modelaudit/cache/, which is a separately versioned package. Remove this standalone changelog/version bump rather than publishing an artifact that does not contain the advertised behavior.
AGENTS.md reference: AGENTS.md:L14-L21
Useful? React with 👍 / 👎.
a1cf042 to
18dbf42
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 85c5e7e1cb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| - **docker:** upgrade vulnerable util-linux runtime packages ([#1813](https://github.com/promptfoo/modelaudit/issues/1813)) ([521e941](https://github.com/promptfoo/modelaudit/commit/521e94164e0e1b7ce488f0b405b7ab48404776cd)) | ||
| - **network:** block README remote-code trust bypasses ([#1788](https://github.com/promptfoo/modelaudit/issues/1788)) ([65111fe](https://github.com/promptfoo/modelaudit/commit/65111fe16b263a31e989ba327f1c84ff84c6f964)) | ||
| - **network:** preserve detections in README environment files ([#1790](https://github.com/promptfoo/modelaudit/issues/1790)) ([5c1b267](https://github.com/promptfoo/modelaudit/commit/5c1b2671f372655177992fda5a35039b602d67a9)) | ||
| - **picklescan:** safely parse bounded PyTorch tensor batches ([#1783](https://github.com/promptfoo/modelaudit/issues/1783)) ([705059c](https://github.com/promptfoo/modelaudit/commit/705059c4280056a4b72106fbd474c00e270ecf0b)) |
There was a problem hiding this comment.
This release advertises the bounded PyTorch tensor-batch fix from the independently released modelaudit-picklescan 0.1.11, but pyproject.toml:55 still permits 0.1.10. Any installation that resolves or pins the older allowed version will run ModelAudit 0.2.53 with the unfixed parser, so the documented scanner behavior is not guaranteed; raise the floor to >=0.1.11 and update the lockfile and dependency regression constant accordingly.
AGENTS.md reference: AGENTS.md:L14-L21
Useful? React with 👍 / 👎.
| The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), | ||
| and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). | ||
|
|
||
| ## [0.2.53](https://github.com/promptfoo/modelaudit/compare/v0.2.52...v0.2.53) (2026-08-24) |
There was a problem hiding this comment.
Adding the 0.2.53 release without updating the reference at CHANGELOG.md:2585 leaves the rendered [Unreleased] link pointing to v0.2.52...HEAD. After this release, that comparison includes all already-released 0.2.53 commits rather than only subsequent work, so change its base to v0.2.53.
Useful? React with 👍 / 👎.
c9c434d to
172fdae
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ee98d35ec4
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
|
||
| - **cache:** isolate Windows probes and stabilize nightly checks ([#1782](https://github.com/promptfoo/modelaudit/issues/1782)) ([47f94ee](https://github.com/promptfoo/modelaudit/commit/47f94eef3feba8e74c517114094e035c7ea837e8)) | ||
| - **picklescan:** diagnose Windows call-graph source-stability failures ([#1789](https://github.com/promptfoo/modelaudit/issues/1789)) ([89b5024](https://github.com/promptfoo/modelaudit/commit/89b50246fc9226770d46b26e8582a6d161dc0244)) | ||
| - **picklescan:** safely parse bounded PyTorch tensor batches ([#1783](https://github.com/promptfoo/modelaudit/issues/1783)) ([705059c](https://github.com/promptfoo/modelaudit/commit/705059c4280056a4b72106fbd474c00e270ecf0b)) |
There was a problem hiding this comment.
The 0.1.11 comparison includes commit 705059c, which introduced the user-visible fix described below under [Unreleased] as “Keep scanning storage members between the trusted and expanded pickle probe sizes.” The new release section does not promote that entry, so after publishing 0.1.11 the changelog still classifies an already-shipped security-scanning fix as unreleased and can repeat it in the next release; moving only the [Unreleased] heading, as suggested elsewhere, would not correct this.
Useful? React with 👍 / 👎.
2d54bfc to
9abe11f
Compare
4f3a861 to
f86d693
Compare
🤖 I have created a release beep boop
0.2.53
0.2.53 (2026-08-31)
Bug Fixes
modelaudit-picklescan: 0.1.11
0.1.11 (2026-08-31)
Bug Fixes
This PR was generated with Release Please. See documentation.