V2.19.0

CLI

• New: Add polyaxon sbx as an alias for the polyaxon sandbox command group.
• Enhancement: pip install polyaxon no longer installs the Kubernetes Python clients.
• Enhancement: Support the Kubernetes Python client 37. Polyaxonfile schemas no longer use the client's models, so the kubernetes<37 pin is removed. Python specs accept V1Container and other models built with kubernetes 36 or 37.
• Fix: Apply operation flags such as -P, --queue and --presets after -f files and inline options in polyaxon run and polyaxon check. An overlay file using the default post_merge strategy overrode values passed on the command line.
• Fix: polyaxon ops shell and polyaxon ops exec through a proxy failed with 'Configuration' object has no attribute 'no_proxy'.
• Fix: Ping the polyaxon ops shell and polyaxon ops exec websocket every 5 seconds instead of on every read.
• Fix: Pod failure policy rules built with the Kubernetes Python client were not applied.
• Fix: environment.securityContext is now validated as a Pod security context, so fsGroup, supplementalGroups and sysctls work. Container-only fields such as privileged and capabilities had no effect there and are now rejected; set them in container.securityContext. Python specs use V1PodSecurityContext instead of V1SecurityContext.
• Fix: Render Polyaxonfile templates in a Jinja sandbox and require Jinja 3.1.6 or later. Templates can no longer read internal attributes such as __class__, call .format() (use the format or map_format filters), mutate lists or dicts, or use cycler, joiner, lipsum and loop.cycle(). Allowed method calls: string lower, upper, strip, lstrip, rstrip, split, rsplit, replace, startswith, endswith, join; dict get, items, keys, values; date isoformat, strftime.
• Fix: Limit integer powers and products to 4,096 bits, sequence repetition to 100,000 items, and nested template rendering to 8 passes. Param values that are themselves templates, such as "{{ globals.artifacts_path }}/data", still resolve.
• Fix: Correct the polyaxon ops logs --no-follow help, which described the opposite behavior.

Core

• Enhancement: The agent, sidecar, events-handlers and streams use the official kubernetes.aio client instead of the kubernetes_asyncio fork.
• Enhancement: Improve run exec and shell sessions restrictions to the run's own pods and containers.
• Enhancement: Improve agent restarts restrictions to the agent's own namespace and deployment.
• Enhancement: Improve event asset packaging restrictions to paths inside the run.
• Enhancement: Improve streams auth cache restrictions to the request's credentials and expiry.
• Enhancement: Improve agent logs restrictions to the agent's own log services.
• Enhancement: Upgrade core and fs requirements.

UI

• Enhancement: Load the Bokeh and Vega scripts only when a page renders a Bokeh or Vega/Altair chart, instead of on every page load.
• Enhancement: Remove unused legacy charts and charting libraries from the UI bundle to reduces the bundle size.
• Fix: Render HTML and notebook artifact previews in a sandboxed iframe.

Commercial

• Enhancement: Improve public projects strict restrictions; prevent read-only or anonymous users access to several run routes to improve security.
• Enhancement: Improve and harden SSO auth security.
• Enhancement: Bind exec, sandbox and services access to the run's namespace.
• Enhancement: Improve resumed runs restrictions to the project's current connections.
• Enhancement: Improve multi-run events restrictions to runs the caller can list.
• Security: Remove critical vulnerabilities.

---