0.7.0 — November 12, 2026#
Note
Installing ansys-saf-sdk requires pip 26.2.2 or higher.
Dependency versions
The public package versions below were resolved for this version of ansys-saf-sdk.
ansys-bdm-api 0.5.0
No changes
ansys-bdm-shared-volume 0.4.0
No changes
ansys-saf-glow-engine 2.5.0
No changes
ansys-saf-desktop-installer 1.19.0
No changes
ansys-saf-desktop-orchestrator 1.14.0
No changes
ansys-iam-oidc 0.9.0
No changes
ansys-saf-product-configuration 0.26.0
No changes
ansys-saf-product-manager 0.6.0
🛡️ Security fixes |
Pull Request |
|---|---|
🔴 Critical - Upgraded Pillow Pillow: Heap buffer overflow in ImagingJpegDecode _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded tornado Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded aiohttp aiohttp server lacks an initial request/header timeout _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded aiohttp aiohttp: Multiple instances of excessive or unbounded memory/CPU use _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded Pillow Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded pillow Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310) _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded Pillow Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded Pillow Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded Pillow Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded Pillow Pillow: Out-of-bounds access in _imagingmorph on a zero-width image _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded graphql-core GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded graphql-core GraphQL-core: Denial of service via comment tokens bypassing the parser’s max_tokens limit _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded nbconvert nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded msgpack MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure _Closure reason:_ Fixed ( |
|
🟠 High - Upgraded oauthlib OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded tornado tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34) _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded aiohttp AIOHTTP: Secure attribute not enforced for shared cookie _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded pillow Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290) _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded Pillow Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded opentelemetry-api OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded tornado Tornado: Quadratic CPU usage when parsing HTTP headers with line folding _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded tornado Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks _Closure reason:_ Fixed ( |
|
🟡 Moderate - Upgraded joserfc joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection _Closure reason:_ Fixed ( |
|
⚪ Low - Upgraded tornado Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive ``**kwargs`` path in ``set_cookie`` _Closure reason:_ Fixed ( |
|
⚪ Low - Upgraded ipython IPython vulnerable to command injection via set_term_title _Closure reason:_ Fixed ( |
|
⚪ Low - Upgraded tornado Tornado: Open redirect in RedirectHandler via protocol-relative URLs _Closure reason:_ Fixed ( |
✨ Features |
Pull Request |
|---|---|
feat: update the visor client end points in |
|
feat: Add visor end points for access from PIM visor client in |
📚 Documentation |
Pull Request |
|---|---|
docs: Update contributor section in |
|
docs: set default theme to dark in |
|
docs: Fix API reference docs in |
|
docs: update corporate logo in centralized and package api documentation in |
🏗️ Build |
Pull Request |
|---|---|
build(deps): upgrade pyjwt,authlib,urllib3,virtualenv in |
|
build(deps): Upgrade anyio >= 4.15 in |
♾️ CI |
Pull Request |
|---|---|
ci(feat): enable Codecov Test Analytics in |
|
ci(refactor): improve ci for documentation in |
|
ci(feat): convert saf-cli to moon in |
|
ci(feat): convert glow-engine to moon in |
|
ci(feat): convert saf product manager in |
ansys-saf-projects-dashboard 0.2.0
No changes
The private-package versions were fetched separately as the latest available versions
Private package
Version
ansys-saf-pim-light-server
0.3.13
ansys-translation-utilities
0.4.1
ansys-saf-desktop-portal
0.3.1
ansys-saf-web-portal
0.1.0
ansys-minerva-python-client
0.5.0
ansys-datarepository-python-client
0.1.dev12
ansys-saf-hermes
0.1.dev13
ansys-saf-aspire
9.1.6
Note
The compatibility of this release has been tested with PyAnsys for the commit 23472db, from Python 3.12 to 3.14.
Please be aware that on Windows with Python 3.14, it is required to set the GRPC_PYTHON_CFLAGS environment variable to /std:c++17 /MT before installing the packages.