From 96b91f120f066caf7e1d7e828d5772aa49950749 Mon Sep 17 00:00:00 2001
From: Rohan <rohan@dynamicalsystemsgroup.com>
Date: Sat, 3 Oct 2026 22:49:03 +0530
Subject: [PATCH] chore(release): publish symbolic security patch versions

---
 docs/changelog.md                             | 29 +++++++++++++++++++
 packages/gds-domains/gds_domains/__init__.py  |  2 +-
 .../gds-symbolic/gds_symbolic/__init__.py     |  2 +-
 packages/gds-symbolic/pyproject.toml          |  2 +-
 4 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/docs/changelog.md b/docs/changelog.md
index db90da7..6d4ea40 100644
--- a/docs/changelog.md
+++ b/docs/changelog.md
@@ -3,6 +3,35 @@
 All notable changes to the GDS ecosystem are documented here. Each release
 lists affected packages, breaking changes, and new capabilities.
 
+## 2026-10-03 — Symbolic expression security fix
+
+### gds-domains v0.1.1
+
+Fix arbitrary Python execution from untrusted symbolic expression strings in
+ODE compilation, state/output linearization, and Hamiltonian dynamics and
+Lagrangian parsing. Expressions are now constructed directly from validated
+syntax, with checked symbol names and dummy arguments for code generation.
+
+**Compatibility:** only the [documented mathematical grammar](symbolic/index.md#expression-grammar-and-security)
+is accepted. Unknown symbols, arbitrary Python/SymPy constructors, unsupported
+syntax, and invalid symbol names raise `SymbolicError` when consumed. Existing
+models using supported arithmetic and math functions continue to work.
+
+Expression length, syntax node count, depth, and integer literal size are bounded;
+these limits do not bound subsequent symbolic computations.
+
+### gds-symbolic v0.99.1
+
+Require `gds-domains[symbolic]>=0.1.1` so upgrading this compatibility package
+requires the fixed implementation. The package remains deprecated in favor of
+`gds_domains.symbolic`.
+
+Users of affected versions should upgrade with
+`python -m pip install --upgrade "gds-domains[symbolic]>=0.1.1"` or
+`python -m pip install --upgrade "gds-symbolic>=0.99.1"`.
+
+---
+
 ## 2026-04-07 — gds-proof Layer 1 Integration
 
 Promotes gds-proof from standalone (Layer 0, protocol-only) to Layer 1
diff --git a/packages/gds-domains/gds_domains/__init__.py b/packages/gds-domains/gds_domains/__init__.py
index 86bacab..35e4565 100644
--- a/packages/gds-domains/gds_domains/__init__.py
+++ b/packages/gds-domains/gds_domains/__init__.py
@@ -1,3 +1,3 @@
 """gds-domains — Domain-specific languages for the GDS ecosystem."""
 
-__version__ = "0.1.0"
+__version__ = "0.1.1"
diff --git a/packages/gds-symbolic/gds_symbolic/__init__.py b/packages/gds-symbolic/gds_symbolic/__init__.py
index 9b46454..f8e40e7 100644
--- a/packages/gds-symbolic/gds_symbolic/__init__.py
+++ b/packages/gds-symbolic/gds_symbolic/__init__.py
@@ -9,7 +9,7 @@
     stacklevel=2,
 )
 
-__version__ = "0.99.0"
+__version__ = "0.99.1"
 
 from gds_domains.symbolic import (  # noqa: E402
     HamiltonianSpec,
diff --git a/packages/gds-symbolic/pyproject.toml b/packages/gds-symbolic/pyproject.toml
index c843d86..d084348 100644
--- a/packages/gds-symbolic/pyproject.toml
+++ b/packages/gds-symbolic/pyproject.toml
@@ -28,7 +28,7 @@ classifiers = [
     "Typing :: Typed",
 ]
 dependencies = [
-    "gds-domains[symbolic]>=0.1.0",
+    "gds-domains[symbolic]>=0.1.1",
 ]
 
 [project.urls]