PyPI: security advisories, deprecations and releases

In a pickle: Why every pickle defense in machine learning is bypassed the same way

Six documented bypasses beat PyTorch weights_only, Keras safe_mode, and picklescan. See which ML formats are safe and what runtime detection catches.

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

AWS Neuron 2.33 adds TorchNeuron and Neuron Observer

Neuron 2.33 brings native PyTorch support via TorchNeuron for Trainium, plus sub-second health monitoring with Neuron Observer.

AWS TorchNeuron public beta: native PyTorch on Trainium

AWS released TorchNeuron, an open-source PyTorch backend that lets you run PyTorch code on Trainium chips with .to('neuron') and torch.compile.

Envoy v1.38.7 released with security and bug fixes

Envoy 1.38.7 updates wasmtime to fix CVE-2026-54786, resolves multiple race conditions in route configuration handling, and corrects Prometheus histogram bucket indexing.

CVE-2026-54786

Agent Platform Workbench JupyterLab client-side logging to Cloud Logging

JupyterLab now forwards client-side errors, exceptions, promise rejections, and failed requests to Cloud Logging for debugging.

JupyterLab client logs now sent to Cloud Logging

Console errors, uncaught exceptions, unhandled promise rejections, and failed network requests are forwarded to the backend for easier debugging.