diff --git a/CHANGELOG.md b/CHANGELOG.md index cad9de8e..1cdff528 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,8 @@ Status of the `main` branch. Changes prior to the next official version change will appear here. +# v1.7.0 (2026-08-09) + * General: - Fix: Race conditions in ProjectServer when used by multiple clients in parallel - Fix: `GitignoreParser` interpolated a directory's name unescaped into gitignore pattern position; @@ -21,13 +23,17 @@ Status of the `main` branch. Changes prior to the next official version change w - Project activation errors are now reported to the client in Serena's system prompt, instead of failures being visible only in the log. This applies both to a failed activation of an explicitly given project and to a failed `--project-from-cwd` auto-detection (#1773). - - ProjectServer: Configure trusted hosts (local hosts only) when listening on localhost - - SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) - Enclose sub-prompts in XML-like tags to make scopes explicit - Prompts and prompt templates: - Allow initial project prompts and project-specific newly activated modes to use templating - Support function `embed_memory` in prompt templates to inline a memory's contents +* Security: + - ProjectServer: Configure trusted hosts (local hosts only) when listening on localhost + - SerenaDashboardTrayManager: Configure trusted hosts (local hosts only) + - Use sandboxed environment for prompt templating, preventing attackers from using custom prompts to + execute commands in an uncontrolled manner + * CLI: - Fix: `start-mcp-server` help text for `--project-from-cwd` falsely promised a fallback to the CWD, which was removed in v1.0.0 #1773 diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f607233c..8ddbff4e 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -22,7 +22,7 @@ See the corresponding [memory](.serena/memories/adding_new_language_support_guid Before submitting a PR, be sure to document your relevant changes (i.e. new features, fixes) in `CHANGELOG.md`. Use a concise style and add your change to the appropriate section -("Language Servers", "Tools", "JetBrains", "CLI", "Memories", "Dashboard", "Hooks", "General"). +("Language Servers", "Tools", "JetBrains", "CLI", "Memories", "Dashboard", "Hooks", "General", "Security"). ## Python Environment Setup diff --git a/news/20260414.html b/news/20260414.html index 5e2a0d46..5e15e6a0 100644 --- a/news/20260414.html +++ b/news/20260414.html @@ -10,6 +10,6 @@

Maintenance Update. The new v1.1.2 release adds several improvements and fixes.
If you have already switched to the uv tool installation of Serena, upgrade as follows:
- uv tool upgrade serena-agent --prerelease=allow + uv tool upgrade serena-agent --prerelease=allow

\ No newline at end of file diff --git a/news/20260427.html b/news/20260427.html index 0cdba681..e20530b1 100644 --- a/news/20260427.html +++ b/news/20260427.html @@ -22,6 +22,6 @@

Update Now. If you are using the uv tool installation of Serena, upgrade as follows:
- uv tool upgrade serena-agent --prerelease=allow + uv tool upgrade serena-agent --prerelease=allow

\ No newline at end of file diff --git a/news/20260512.html b/news/20260512.html index 066b94eb..af527840 100644 --- a/news/20260512.html +++ b/news/20260512.html @@ -36,6 +36,6 @@

Update Now. If you are using the uv tool installation of Serena, upgrade as follows:
- uv tool upgrade serena-agent --prerelease=allow + uv tool upgrade serena-agent --prerelease=allow

diff --git a/news/20260716.html b/news/20260716.html index 129820f5..a2b93922 100644 --- a/news/20260716.html +++ b/news/20260716.html @@ -40,6 +40,6 @@

Update Now. If you are using the uv tool installation of Serena, upgrade as follows:
- uv tool upgrade serena-agent + uv tool upgrade serena-agent

diff --git a/news/20260809.html b/news/20260809.html new file mode 100644 index 00000000..8f517e3a --- /dev/null +++ b/news/20260809.html @@ -0,0 +1,68 @@ +
+

Serena v1.7.0

+

August 9, 2026

+

+ Here are the highlights of the v1.7.0 release: +

+

+ Grok Support. + Serena now supports Grok Build as a client, including the grok context, setup via the CLI, + and hooks (serena-hooks --client=grok) with Grok-native PreToolUse allow/deny output. +

+

+ Expanded Language Server Support. + Added: Gleam (via gleam lsp), Nextflow (official language server, JAR downloaded + automatically, Java 17+ required), Deno and Wolfram (both experimental) as well as + python_basedpyright as an alternative Python language server.
+ The managed Java and Kotlin language server were updated.
+ Furthermore, you now have the option of specifying language server priorities, which affect auto-detection during + project creation, allowing you to change the default language server for a given language. +

+

+ Renamed Project Setting. + The languages key in project configurations is now called language_servers, + which better reflects its actual semantics. Existing configurations are migrated automatically. +

+

+ Security Hardening. + The project server and the dashboard tray manager now configure trusted hosts (local hosts only) when + listening on localhost, and prompt templating runs in a sandboxed environment, preventing attackers from + using custom prompts to execute commands in an uncontrolled manner. +

+

+ Prompts & Templating. + Initial project prompts and project-specific newly activated modes can now use templating, and the new + embed_memory function inlines a memory's contents into a prompt template. + Sub-prompts are enclosed in XML-like tags to make scopes explicit. +

+

+ More Liberal Handling of Ignored Paths. + Tools that explicitly target a single file (create_text_file, read_file, + replace_content) no longer consider ignored paths at all – when a path is explicitly + accessed, the agent is assumed to have a good reason for doing so. + Tools that traverse a subtree (list_dir, find_file, search_for_pattern) + now uniformly offer a skip_ignored_files option. +

+

+ Better Diagnosability. + Project activation errors are now reported to the client in Serena's system prompt instead of being visible + only in the log, get_current_config includes the language server status, and + project health-check exits with a non-zero code when the check fails. +

+

+ Robustness & Fixes. + A multitude of fixes across the board, including Scala/Metals (build import and monorepos with several build + roots), TypeScript (incomplete reference results on large projects), Erlang (name paths for functions), + F#, Nix, Ansible, Rust memory usage, orphaned language server processes on Linux, + race conditions in the project server, blocked tool call timeouts, and the dashboard, + which now uses the tray_manager interface by default on macOS. +

+

+ See our change log for the full list of changes. +

+

+ Update Now. + If you are using the uv tool installation of Serena, upgrade as follows:
+ uv tool upgrade serena-agent +

+
diff --git a/pyproject.toml b/pyproject.toml index 96ed8e12..05bebe08 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ requires = ["hatchling"] [project] name = "serena-agent" -version = "1.6.2.dev0" +version = "1.7.1.dev0" description = "A powerful MCP toolkit for coding, providing semantic retrieval and editing capabilities - the IDE for your agent" authors = [{ name = "Oraios AI", email = "info@oraios-ai.de" }] readme = "README.md" diff --git a/src/interprompt/jinja_template.py b/src/interprompt/jinja_template.py index 32220155..85dec9fe 100644 --- a/src/interprompt/jinja_template.py +++ b/src/interprompt/jinja_template.py @@ -4,6 +4,7 @@ import jinja2 import jinja2.meta import jinja2.nodes import jinja2.visitor +from jinja2.sandbox import SandboxedEnvironment from interprompt.util.class_decorators import singleton @@ -19,7 +20,7 @@ class _JinjaEnvProvider: def get_env(self) -> jinja2.Environment: if self._env is None: - self._env = jinja2.Environment() + self._env = SandboxedEnvironment() return self._env diff --git a/src/serena/__init__.py b/src/serena/__init__.py index 46350818..507168a7 100644 --- a/src/serena/__init__.py +++ b/src/serena/__init__.py @@ -1,4 +1,4 @@ -__version__ = "1.6.2.dev0" +__version__ = "1.7.1.dev0" import logging diff --git a/uv.lock b/uv.lock index a7fc25c2..a223423c 100644 --- a/uv.lock +++ b/uv.lock @@ -428,7 +428,7 @@ name = "clr-loader" version = "0.3.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "cffi" }, + { name = "cffi", marker = "python_full_version < '3.13' or sys_platform == 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/e4/46/7eea92b6aa2d68af78e049cbecec5f757f1aad44ecdecdc16bbad7eead51/clr_loader-0.3.1.tar.gz", hash = "sha256:2e073e9aaf49d1ae2f56ecba27987ad5fb68be4bcd9dd34a5bed8f0e4e128366", size = 86805, upload-time = "2026-04-18T17:49:44.287Z" } wheels = [ @@ -942,17 +942,17 @@ resolution-markers = [ "python_full_version < '3.12'", ] dependencies = [ - { name = "colorama", marker = "sys_platform == 'win32'" }, - { name = "decorator" }, - { name = "ipython-pygments-lexers" }, - { name = "jedi" }, - { name = "matplotlib-inline" }, - { name = "pexpect", marker = "sys_platform != 'emscripten' and sys_platform != 'win32'" }, - { name = "prompt-toolkit" }, - { name = "pygments" }, - { name = "stack-data" }, - { name = "traitlets" }, - { name = "typing-extensions" }, + { name = "colorama", marker = "python_full_version < '3.12' and sys_platform == 'win32'" }, + { name = "decorator", marker = "python_full_version < '3.12'" }, + { name = "ipython-pygments-lexers", marker = "python_full_version < '3.12'" }, + { name = "jedi", marker = "python_full_version < '3.12'" }, + { name = "matplotlib-inline", marker = "python_full_version < '3.12'" }, + { name = "pexpect", marker = "python_full_version < '3.12' and sys_platform != 'emscripten' and sys_platform != 'win32'" }, + { name = "prompt-toolkit", marker = "python_full_version < '3.12'" }, + { name = "pygments", marker = "python_full_version < '3.12'" }, + { name = "stack-data", marker = "python_full_version < '3.12'" }, + { name = "traitlets", marker = "python_full_version < '3.12'" }, + { name = "typing-extensions", marker = "python_full_version < '3.12'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/c5/25/daae0e764047b0a2480c7bbb25d48f4f509b5818636562eeac145d06dfee/ipython-9.10.1.tar.gz", hash = "sha256:e170e9b2a44312484415bdb750492699bf329233b03f2557a9692cce6466ada4", size = 4426663, upload-time = "2026-03-27T09:53:26.244Z" } wheels = [ @@ -971,16 +971,16 @@ resolution-markers = [ "python_full_version == '3.12.*'", ] dependencies = [ - { name = "colorama", marker = "sys_platform == 'win32'" }, - { name = "decorator" }, - { name = "ipython-pygments-lexers" }, - { name = "jedi" }, - { name = "matplotlib-inline" }, - { name = "pexpect", marker = "sys_platform != 'emscripten' and sys_platform != 'win32'" }, - { name = "prompt-toolkit" }, - { name = "pygments" }, - { name = "stack-data" }, - { name = "traitlets" }, + { name = "colorama", marker = "python_full_version >= '3.12' and sys_platform == 'win32'" }, + { name = "decorator", marker = "python_full_version >= '3.12'" }, + { name = "ipython-pygments-lexers", marker = "python_full_version >= '3.12'" }, + { name = "jedi", marker = "python_full_version >= '3.12'" }, + { name = "matplotlib-inline", marker = "python_full_version >= '3.12'" }, + { name = "pexpect", marker = "python_full_version >= '3.12' and sys_platform != 'emscripten' and sys_platform != 'win32'" }, + { name = "prompt-toolkit", marker = "python_full_version >= '3.12'" }, + { name = "pygments", marker = "python_full_version >= '3.12'" }, + { name = "stack-data", marker = "python_full_version >= '3.12'" }, + { name = "traitlets", marker = "python_full_version >= '3.12'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/3a/73/7114f80a8f9cabdb13c27732dce24af945b2923dcab80723602f7c8bc2d8/ipython-9.12.0.tar.gz", hash = "sha256:01daa83f504b693ba523b5a407246cabde4eb4513285a3c6acaff11a66735ee4", size = 4428879, upload-time = "2026-03-27T09:42:45.312Z" } wheels = [ @@ -1638,7 +1638,7 @@ name = "pexpect" version = "4.9.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "ptyprocess" }, + { name = "ptyprocess", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/42/92/cc564bf6381ff43ce1f4d06852fc19a2f11d180f23dc32d9588bee2f149d/pexpect-4.9.0.tar.gz", hash = "sha256:ee7d41123f3c9911050ea2c2dac107568dc43b2d3b0c7557a33212c398ead30f", size = 166450, upload-time = "2023-11-25T09:07:26.339Z" } wheels = [ @@ -2096,7 +2096,7 @@ name = "pyobjc-framework-cocoa" version = "12.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pyobjc-core" }, + { name = "pyobjc-core", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/02/a3/16ca9a15e77c061a9250afbae2eae26f2e1579eb8ca9462ae2d2c71e1169/pyobjc_framework_cocoa-12.1.tar.gz", hash = "sha256:5556c87db95711b985d5efdaaf01c917ddd41d148b1e52a0c66b1a2e2c5c1640", size = 2772191, upload-time = "2025-11-14T10:13:02.069Z" } wheels = [ @@ -2113,8 +2113,8 @@ name = "pyobjc-framework-quartz" version = "12.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pyobjc-core" }, - { name = "pyobjc-framework-cocoa" }, + { name = "pyobjc-core", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, + { name = "pyobjc-framework-cocoa", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/94/18/cc59f3d4355c9456fc945eae7fe8797003c4da99212dd531ad1b0de8a0c6/pyobjc_framework_quartz-12.1.tar.gz", hash = "sha256:27f782f3513ac88ec9b6c82d9767eef95a5cf4175ce88a1e5a65875fee799608", size = 3159099, upload-time = "2025-11-14T10:21:24.31Z" } wheels = [ @@ -2131,8 +2131,8 @@ name = "pyobjc-framework-security" version = "12.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pyobjc-core" }, - { name = "pyobjc-framework-cocoa" }, + { name = "pyobjc-core", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, + { name = "pyobjc-framework-cocoa", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/80/aa/796e09a3e3d5cee32ebeebb7dcf421b48ea86e28c387924608a05e3f668b/pyobjc_framework_security-12.1.tar.gz", hash = "sha256:7fecb982bd2f7c4354513faf90ba4c53c190b7e88167984c2d0da99741de6da9", size = 168044, upload-time = "2025-11-14T10:22:06.334Z" } wheels = [ @@ -2149,8 +2149,8 @@ name = "pyobjc-framework-uniformtypeidentifiers" version = "12.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pyobjc-core" }, - { name = "pyobjc-framework-cocoa" }, + { name = "pyobjc-core", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, + { name = "pyobjc-framework-cocoa", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/65/b8/dd9d2a94509a6c16d965a7b0155e78edf520056313a80f0cd352413f0d0b/pyobjc_framework_uniformtypeidentifiers-12.1.tar.gz", hash = "sha256:64510a6df78336579e9c39b873cfcd03371c4b4be2cec8af75a8a3d07dff607d", size = 17030, upload-time = "2025-11-14T10:23:02.222Z" } wheels = [ @@ -2162,8 +2162,8 @@ name = "pyobjc-framework-webkit" version = "12.1" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "pyobjc-core" }, - { name = "pyobjc-framework-cocoa" }, + { name = "pyobjc-core", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, + { name = "pyobjc-framework-cocoa", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/14/10/110a50e8e6670765d25190ca7f7bfeecc47ec4a8c018cb928f4f82c56e04/pyobjc_framework_webkit-12.1.tar.gz", hash = "sha256:97a54dd05ab5266bd4f614e41add517ae62cdd5a30328eabb06792474b37d82a", size = 284531, upload-time = "2025-11-14T10:23:40.287Z" } wheels = [ @@ -2265,7 +2265,7 @@ name = "python-xlib" version = "0.33" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "six" }, + { name = "six", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/86/f5/8c0653e5bb54e0cbdfe27bf32d41f27bc4e12faa8742778c17f2a71be2c0/python-xlib-0.33.tar.gz", hash = "sha256:55af7906a2c75ce6cb280a584776080602444f75815a7aff4d287bb2d7018b32", size = 269068, upload-time = "2022-12-25T18:53:00.824Z" } wheels = [ @@ -2277,7 +2277,7 @@ name = "pythonnet" version = "3.1.0" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "clr-loader" }, + { name = "clr-loader", marker = "python_full_version < '3.13' or sys_platform == 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/05/57/da1992e44663b71365c6e842c8d7fa453d4ec45fb99a68cfee5b7e944d3c/pythonnet-3.1.0.tar.gz", hash = "sha256:7b34c382905d10a371509ffafd64cae0416305c28817738a9cd138336f4e9991", size = 250599, upload-time = "2026-05-23T20:30:21.578Z" } wheels = [ @@ -2424,7 +2424,7 @@ name = "qtpy" version = "2.4.3" source = { registry = "https://pypi.org/simple" } dependencies = [ - { name = "packaging" }, + { name = "packaging", marker = "python_full_version < '3.13' or sys_platform != 'win32'" }, ] sdist = { url = "https://files.pythonhosted.org/packages/70/01/392eba83c8e47b946b929d7c46e0f04b35e9671f8bb6fc36b6f7945b4de8/qtpy-2.4.3.tar.gz", hash = "sha256:db744f7832e6d3da90568ba6ccbca3ee2b3b4a890c3d6fbbc63142f6e4cdf5bb", size = 66982, upload-time = "2025-02-11T15:09:25.759Z" } wheels = [ @@ -2784,7 +2784,7 @@ wheels = [ [[package]] name = "serena-agent" -version = "1.6.2.dev0" +version = "1.7.1.dev0" source = { editable = "." } dependencies = [ { name = "anthropic" },