python: v0.7.27

: voice agents — first-class voice in scenario.run() ()

) () (: add pr-auto-approve.yml as passive observer (PR ) ()

Bug Fixes

• deps: bump filelock to >=3.20.3 for TOCTOU/symlink CVEs ()


• deps: bump pytest to >=9.0.3 for ) () () ( ()


• deps: override minimatch to >=9.0.6 () () () () () ()


• examples: use positional index matching in custom judge examples () (, )


• security: bump litellm to fix 4 high-severity CVEs ()


• security: patch ) () () ()


• security: patch picomatch ReDoS in lovable_clone npm lockfile ()


• security: patch react-router XSS and open redirect CVEs ()


• security: patch rollup arbitrary file write via path traversal ()


• security: patch rollup path traversal CVE (>= 4.0.0, < 4.59.0) () () ()


• security: upgrade mcp Python SDK to fix DoS and DNS rebinding CVEs ()


• security: upgrade pyasn1 to fix DoS via unbounded recursion () () () () () () () ()


• deps-dev: bump vite, @vitejs/plugin-react-swc and lovable-tagger in /python/examples/lovable_clone/template ()


• deps: bump black from 25.1.0 to 26.3.1 in /python ()


• deps: bump gitpython from 3.1.49 to 3.1.50 in /python ()


• deps: bump mako from 1.3.10 to 1.3.12 in /python ()


• deps: bump protobuf from 5.29.5 to 5.29.6 in /python ()


• deps: bump pyasn1 from 0.6.1 to 0.6.3 in /python ()


• deps: bump python-multipart from 0.0.20 to 0.0.26 in /python ()


• deps: bump python-multipart from 0.0.26 to 0.0.27 in /python ()


• deps: bump starlette from 0.47.0 to 0.49.1 in /python ()


• deps: bump urllib3 from 1.26.20 to 2.6.3 in /python ()