ansys-saf-sdk 0.7.0

Note: Installing ansys-saf-sdk requires pip 26.2.2 or higher.

Dependency Versions

The following versions were resolved when this version of the ansys-saf-sdk was generated.

ansys-bdm-api 0.5.0

No changes

ansys-bdm-shared-volume 0.4.0

No changes

ansys-saf-glow-engine 2.5.0

No changes

ansys-saf-desktop-installer 1.19.0

No changes

ansys-saf-desktop-orchestrator 1.14.0

No changes

ansys-iam-oidc 0.9.0

No changes

ansys-saf-product-configuration 0.26.0

No changes

ansys-saf-product-manager 0.6.0

🛡️ Security fixes

• 🔴 Critical - Upgraded Pillow
  Pillow: Heap buffer overflow in ImagingJpegDecode
  Closure reason: Fixed (#364)
  
  
• 🟠 High - Upgraded tornado
  Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop
  Closure reason: Fixed (#15)
  
  
• 🟠 High - Upgraded aiohttp
  aiohttp server lacks an initial request/header timeout
  Closure reason: Fixed (#298)
  
  
• 🟠 High - Upgraded aiohttp
  aiohttp: Multiple instances of excessive or unbounded memory/CPU use
  Closure reason: Fixed (#299)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
  Closure reason: Fixed (#365)
  
  
• 🟠 High - Upgraded pillow
  Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
  Closure reason: Fixed (#367)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
  Closure reason: Fixed (#368)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
  Closure reason: Fixed (#369)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
  Closure reason: Fixed (#371)
  
  
• 🟠 High - Upgraded Pillow
  Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
  Closure reason: Fixed (#372)
  
  
• 🟠 High - Upgraded graphql-core
  GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
  Closure reason: Fixed (#457)
  
  
• 🟠 High - Upgraded graphql-core
  GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
  Closure reason: Fixed (#458)
  
  
• 🟠 High - Upgraded nbconvert
  nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidoc
  Closure reason: Fixed (#456)
  
  
• 🟠 High - Upgraded msgpack
  MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
  Closure reason: Fixed (#543)
  
  
• 🟠 High - Upgraded oauthlib
  OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
  Closure reason: Fixed (#591)
  
  
• 🟡 Moderate - Upgraded tornado
  tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)
  Closure reason: Fixed (#14)
  
  
• 🟡 Moderate - Upgraded aiohttp
  AIOHTTP: Secure attribute not enforced for shared cookie
  Closure reason: Fixed (#297)
  
  
• 🟡 Moderate - Upgraded pillow
  Pillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
  Closure reason: Fixed (#366)
  
  
• 🟡 Moderate - Upgraded Pillow
  Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limit
  Closure reason: Fixed (#370)
  
  
• 🟡 Moderate - Upgraded opentelemetry-api
  OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
  Closure reason: Fixed (#455)
  
  
• 🟡 Moderate - Upgraded tornado
  Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
  Closure reason: Fixed (#574)
  
  
• 🟡 Moderate - Upgraded tornado
  Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
  Closure reason: Fixed (#576)
  
  
• 🟡 Moderate - Upgraded joserfc
  joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
  Closure reason: Fixed (#589)
  
  
• ⚪ Low - Upgraded tornado
  Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`
  Closure reason: Fixed (#13)
  
  
• ⚪ Low - Upgraded ipython
  IPython vulnerable to command injection via set_term_title
  Closure reason: Fixed (#279)
  
  
• ⚪ Low - Upgraded tornado
  Tornado: Open redirect in RedirectHandler via protocol-relative URLs
  Closure reason: Fixed (#575)
  
  

✨ Features

• feat: update the visor client end points by @ansBAkula in #472
• feat: Add visor end points for access from PIM visor client by @ansBAkula in #405

📚 Documentation

• docs: Update contributor section by @iazehaf in #238
• docs: set default theme to dark by @anskfletcher in #67
• docs: Fix API reference docs by @iazehaf in #63
• docs: update corporate logo in centralized and package api documentation by @anskfletcher in #55

🏗️ Build

• build(deps): upgrade pyjwt,authlib,urllib3,virtualenv by @alexciurana in #184
• build(deps): Upgrade anyio >= 4.15 by @alexciurana in #76

♾️ CI

• ci(feat): enable Codecov Test Analytics by @vgelbgras in #454
• ci(refactor): improve ci for documentation by @vgelbgras in #255
• ci(feat): convert saf-cli to moon by @vgelbgras in #234
• ci(feat): convert glow-engine to moon by @vgelbgras in #214
• ci(feat): convert saf product manager by @vgelbgras in #179

🧹 Chores

• chore: update joserfc by @vgelbgras in #411
• chore: update authlib msgpack dnspython fastmcp mcp by @vgelbgras in #386
• chore: update ipython by @vgelbgras in #372

ansys-saf-projects-dashboard 0.2.0

No changes

PyAnsys compatibility

The compatibility of this release has been tested with PyAnsys for the commit 23472db, from Python 3.12 to 3.14.

Please be aware that on Windows with Python 3.14, it is required to set the GRPC_PYTHON_CFLAGS environment variable to /std:c++17 /MT before installing the packages.