diff --git a/docs/changelog.md b/docs/changelog.md index db90da7..6d4ea40 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -3,6 +3,35 @@ All notable changes to the GDS ecosystem are documented here. Each release lists affected packages, breaking changes, and new capabilities. +## 2026-10-03 — Symbolic expression security fix + +### gds-domains v0.1.1 + +Fix arbitrary Python execution from untrusted symbolic expression strings in +ODE compilation, state/output linearization, and Hamiltonian dynamics and +Lagrangian parsing. Expressions are now constructed directly from validated +syntax, with checked symbol names and dummy arguments for code generation. + +**Compatibility:** only the [documented mathematical grammar](symbolic/index.md#expression-grammar-and-security) +is accepted. Unknown symbols, arbitrary Python/SymPy constructors, unsupported +syntax, and invalid symbol names raise `SymbolicError` when consumed. Existing +models using supported arithmetic and math functions continue to work. + +Expression length, syntax node count, depth, and integer literal size are bounded; +these limits do not bound subsequent symbolic computations. + +### gds-symbolic v0.99.1 + +Require `gds-domains[symbolic]>=0.1.1` so upgrading this compatibility package +requires the fixed implementation. The package remains deprecated in favor of +`gds_domains.symbolic`. + +Users of affected versions should upgrade with +`python -m pip install --upgrade "gds-domains[symbolic]>=0.1.1"` or +`python -m pip install --upgrade "gds-symbolic>=0.99.1"`. + +--- + ## 2026-04-07 — gds-proof Layer 1 Integration Promotes gds-proof from standalone (Layer 0, protocol-only) to Layer 1 diff --git a/packages/gds-domains/gds_domains/__init__.py b/packages/gds-domains/gds_domains/__init__.py index 86bacab..35e4565 100644 --- a/packages/gds-domains/gds_domains/__init__.py +++ b/packages/gds-domains/gds_domains/__init__.py @@ -1,3 +1,3 @@ """gds-domains — Domain-specific languages for the GDS ecosystem.""" -__version__ = "0.1.0" +__version__ = "0.1.1" diff --git a/packages/gds-symbolic/gds_symbolic/__init__.py b/packages/gds-symbolic/gds_symbolic/__init__.py index 9b46454..f8e40e7 100644 --- a/packages/gds-symbolic/gds_symbolic/__init__.py +++ b/packages/gds-symbolic/gds_symbolic/__init__.py @@ -9,7 +9,7 @@ stacklevel=2, ) -__version__ = "0.99.0" +__version__ = "0.99.1" from gds_domains.symbolic import ( # noqa: E402 HamiltonianSpec, diff --git a/packages/gds-symbolic/pyproject.toml b/packages/gds-symbolic/pyproject.toml index c843d86..d084348 100644 --- a/packages/gds-symbolic/pyproject.toml +++ b/packages/gds-symbolic/pyproject.toml @@ -28,7 +28,7 @@ classifiers = [ "Typing :: Typed", ] dependencies = [ - "gds-domains[symbolic]>=0.1.0", + "gds-domains[symbolic]>=0.1.1", ] [project.urls]