Who contributed to Google on May 11, 2026?

1 developer shipped this update, including copybara-service[bot].

What were the notable Google updates?

PR #37441: docs(export): note deserialize trust boundary, Using avals for deserialization of the py_tree, and Update XLA dependency to use revision http://github.com/openxla/xla/commit/59031c7d1c120837166ad812f64b4e4bbf05b7b6.

Google

JAX, the GenAI SDK, and the Cloud libs - Google's open source layer

Pick a date

Topics: AI / ML Python Full archive →

The Wire · Showcase

JAX HARDENS DESERIALIZATION TRUST MODEL AFTER SECURITY ADVISORY

By RepoJournal · Filed 06:02 UTC on May 11, 2026 · About Google

1 person shipped this

copybara-service[bot] @copybara-service[bot] 1 cited

JAX is documenting a critical trust boundary in its export deserialization path after identifying potential security risks in untrusted blob handling.

The JAX team issued a security advisory [1] flagging that `jax.export.deserialize` was accepting untrusted serialized objects without sufficient safeguards, prompting immediate documentation hardening. A new admonition in the export docs [1] now explicitly warns developers that deserialization expects trusted input only—closing the gap between API capability and safe usage. In parallel, the team shipped a structural fix [2] that uses abstract value information during deserialization to ensure py_tree objects maintain consistent shapes and dtypes throughout unflattening, rather than defaulting to placeholder floats. This prevents shape mismatches that could silently introduce bugs in downstream computations. The XLA dependency was also bumped [3] to pull in upstream fixes that likely complement these changes. Together, these moves harden JAX's serialization layer without breaking existing workflows.

Action items

→ Review any code deserializing JAX exports from untrusted sources—this is now unsupported google/jax [immediate]
→ Update JAX to pick up deserialization structural improvements and XLA fixes google/jax [plan]

References

[1] PR #37441: docs(export): note deserialize trust boundary google/jax
[2] Using avals for deserialization of the py_tree. ↗ google/jax
[3] Update XLA dependency to use revision http://github.com/openxla/xla/commit/59031c7d1c120837166ad812f64b4e4bbf05b7b6 google/jax

Quick answers

What shipped in Google on May 11, 2026?: JAX is documenting a critical trust boundary in its export deserialization path after identifying potential security risks in untrusted blob handling. In total, 3 commits and 1 pull requests landed.
Who contributed to Google on May 11, 2026?: 1 developer shipped this update, including copybara-service[bot].
What were the notable Google updates?: PR #37441: docs(export): note deserialize trust boundary, Using avals for deserialization of the py_tree, and Update XLA dependency to use revision http://github.com/openxla/xla/commit/59031c7d1c120837166ad812f64b4e4bbf05b7b6.

JAX FIXES REMAT3 CONSTANT HANDLING CRASH, GOOGLE CLOUD PYTHON CENTRALIZES REST TRANSCODING

Matthew Johnson patched a critical remat3 regression where closed-over constants were silently dropped, causing immediate crashes in production rematerialization pipelines [ref:1].

ai 50 shipped 1-min read

Google 1 day ago

JAX TIGHTENS XLA OPTIMIZATION CONTROLS, GOOGLE CLOUD PYTHON SETS UP FEATURE GATES

JAX makes XLA optimization levels human-readable while Google Cloud Python client libraries prepare a unified feature gating system for observability.

ai 54 shipped 1-min read

Google 2 days ago

GENAI AUDIO TRANSCRIPTION SHIPS, PROTO-PLUS FIXES RACE CONDITIONS

Google's AI SDK gains native audio processing while the core Python cloud libraries ship critical stability fixes across the stack.

ai 60 shipped 1-min read

Google 3 days ago

JAX CUTS ASYNC COLLECTIVE PRIMITIVES, GENAI SDK ADDS LIVE API VOCABULARY

JAX is simplifying its async collective operations while the Python GenAI SDK ships custom vocabulary support for the Live API, marking a shift toward leaner abstractions and richer real-time capabilities.

ai 100 shipped 1-min read

Elsewhere on the wire

AI Agents about 9 hours ago

CLAUDE OPUS 5 LANDS ACROSS THE STACK

The newest Anthropic model is now live in langchain, Cline, and llama-index, with native support for extended reasoning and 1M context windows.

ai-agents 28 shipped 1-min read

Local LLMs about 9 hours ago

OLLAMA LANDS LAGUNA SUPPORT AND CRUSHES MEMORY LEAKS WHILE SGLANG HITS V0.5.16 WITH CONFIDENCE-DRIVEN SPECULATIVE DECODING

Ollama shipped three critical performance and reliability fixes for Metal residency and concurrent access patterns, while SGL-Lang released 0.5.16 with a new speculative algorithm hitting 383.7 tok/s on DeepSeek-V4.