inferstep/ATLAS v3.1.7

V3.1.7 "Maia"

on GitHub

A security release, with installer and build fixes. 3.1.7 fixes four defects with an advisory and several more without one; the advisories are GHSA-543g-qfqh-q498, GHSA-f7jr-f255-59p6, GHSA-cjfr-rrgx-2g38 and GHSA-62cf-6h99-6cv9. Please upgrade.

Security

• The service token could go to an address outside the stack. Each service now adds it only to a request for one of the stack's own addresses, checks every step of a redirect again, and drops the token on a redirect to another origin. The Hugging Face token goes only with a download from huggingface.co. (GHSA-543g-qfqh-q498)
• The proxy could read project files outside the workspace. Eight of its own reads of project files, and the steering status, now read through one confined reader, as the file tools do. (GHSA-f7jr-f255-59p6)
• The TUI wrote control characters from the proxy to the terminal. It now shows each control character and direction mark marked; the stored text does not change. (GHSA-cjfr-rrgx-2g38)
• A tool could use a path the workspace check had not passed. The workspace check and a tool could read different values from one tool call, so the tool could use a path the check had not passed. The check now reads a call's arguments once and hands the tool that one reading; a call it cannot read that way is refused before the tool runs. (GHSA-62cf-6h99-6cv9)

Security fixes without an advisory

• The lens and the V3 service could not read the token file that atlas init makes, so they ran without the token check. They now run as the installing user, every service stops with a message when the token file is there but cannot be read, and atlas doctor reports it.
• atlas rollback checks the target images' signatures before it changes .env or pulls anything, as atlas upgrade does.
• atlas lens check reads cost_field.pt only in torch's restricted mode, as the lens service does.
• The proxy refuses a POST whose body is not JSON (415) and a request from a web origin that is not on the new ATLAS_ALLOWED_ORIGINS setting (403). The TUI and the CLI send neither, so they are not affected.
• A workspace's .atlas/config.toml can no longer make run_command run on the host: only the operator chooses the host, with ATLAS_VERIFY_IN=host together with ATLAS_TRUST_MODE=fully-trusted.

Fixes

• Each build of the model server names the processor level of its CPU part, so the image runs on every amd64 processor with AVX2, whatever processor built it. (#427)
• uninstall.sh --data names every folder it removes, the projects folder included, and refuses an empty setting. (#414)
• The bootstrap script tries a failed download again (#406), and the installer keeps its downloads and logs in a temporary folder of its own (#409). The bootstrap's TUI build runs the Go that the script found (#535).
• The proxy image and the TUI build with Go 1.26.10, which has the fixes of the Go standard library. The TUI's modules move to their fixed versions: x/net v0.60.0 and x/text v0.42.0 (#542), and goldmark v1.7.17.

Known issues in 3.1.x (fixes planned for 3.2.0)

Review what ATLAS writes and run your project's own tests before you rely on a "done".

• A failing V3 candidate can be written as verified (3.1.0 to 3.1.7). When the V3 pipeline handles an edit and no candidate passes its tests, even after repair, ATLAS writes the best-scoring candidate anyway and tells the model the edit was verified. The fix is on dev (e8112d3).
• C, C++, Swift, JSX, Vue and Svelte files are checked as Python (3.1.6 and 3.1.7). Their candidates fail, and the issue above then applies.
• The lens gives no usable signal (3.1.3 to 3.1.7). It reports calibrated and interventions active, but its per-token scoring cannot run under the default settings, so it cannot veto or alert, and its scores barely change between inputs (#281).

Upgrade

• Existing install: in your ATLAS folder, run git pull first, then atlas upgrade. Or re-run the install command.
• New install: curl -fsSL https://raw.githubusercontent.com/inferstep/ATLAS/main/scripts/atlas-bootstrap.sh | bash
• The lens and the V3 service now run as the installing user. If a service says at start that its volume is not writable, its message names the repair.
• A web front-end that calls the proxy needs its origin on ATLAS_ALLOWED_ORIGINS.

Verify

• The tag v3.1.7 is SSH-signed by a key in .github/allowed_signers (in a checkout: git -c gpg.ssh.allowedSignersFile=.github/allowed_signers verify-tag v3.1.7).
• The images are signed by the inferstep/ATLAS build workflow:

  cosign verify --certificate-identity https://github.com/inferstep/ATLAS/.github/workflows/build-images.yml@refs/tags/v3.1.7 \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com ghcr.io/inferstep/atlas-proxy:3.1.7
  

  atlas rollback and atlas upgrade need cosign 3 or newer to read these signatures.

To hear about releases only, choose Watch → Custom → Releases on the repository page.

Full list: CHANGELOG.md.