The Wire · Showcase
JAX CLEANS HOUSE WHILE GENAI ADDS AUDIO, CLOUD-PYTHON PATCHES INJECTION FLAW
By RepoJournal · Filed · About Google
JAX removes deprecated pipelining APIs and patches mpmath warnings as the Python client libraries ship multimodal audio support and a critical Spanner identifier injection fix.
JAX's experimental custom pipelining APIs are gone [1], clearing out code that never shipped publicly and would have required substantial work to land. The same release kills mpmath 1.4+ deprecation warnings that were breaking pytest runs [2] by triggering module-level attribute lookups. On the random side, JAX now ships a faster approximate Poisson sampler with derivative support, though the derivative estimates carry bias since the underlying distribution isn't truly continuous [3]. Meanwhile, python-genai landed two major feature waves: enterprise mode now accepts API keys alongside project and location parameters [4], and GenerateContentConfig now supports audio transcription configuration with a new Part.audio_transcription field [5]. The critical story is google-cloud-python, where Spanner's escape_name function was allowing identifier injection through unescaped backticks (CWE-89) [6], now patched to double-escape embedded backticks. The same monorepo bumped grpcio to 1.59.0 and dropped Python 3.9 support [7], consolidating versions across the dependency tree. Generator improvements switched unit test imports from recursive to flat references, eliminating transitive _pb2 imports and deleting legacy post-processing scripts [8], though the removal had to be partially reverted pending a generator bump [9].
One email a day. Unsubscribe in one click.
Keep up with Google in about 3 minutes a day: what actually shipped — the commits, pull requests, releases, and security advisories that matter.
One email a day. Unsubscribe in one click. Read a past issue →
Action items
- → Upgrade google-cloud-spanner immediately to patch identifier injection in escape_name googleapis/google-cloud-python [immediate]
- → Plan grpcio 1.59.0 upgrade and Python 3.10+ migration for google-cloud-python googleapis/google-cloud-python [plan]
- → Update JAX to latest for mpmath 1.4+ compatibility and Poisson sampler google/jax [plan]
- → Monitor python-genai enterprise auth and audio transcription APIs for stability googleapis/python-genai [monitor]
References
- [1] Delete unused custom pipelining APIs from Pallas in JAX. google/jax
- [2] Ignore mpmath 1.4+ module deprecation warnings in pytest. google/jax
- [3] Add faster approximate poisson random generator ↗ google/jax
- [4] feat: Allow api key + proj/location for enterprise mode googleapis/python-genai
- [5] feat: [GenerateContentConfig] Add GenerationConfig.audio_transcription_config and Part.audio_transcription. googleapis/python-genai
- [6] fix(spanner): escape embedded backticks in dbapi escape_name (#17810) googleapis/google-cloud-python
- [7] fix: bump grpcio to 1.59.0; require Python 3.10+ (#17351) googleapis/google-cloud-python
- [8] fix(generator): use flat_ref_types in test templates and delete remove-unused-imports (#17900) googleapis/google-cloud-python
- [9] chore(generator): add remove unused import script (#17917) googleapis/google-cloud-python