release: 2.33.0

[github-actions]

Automated Release PR

2.33.0 (2026-09-09)

Features

• add rl checkpoint list endpoint (da2f441)
• cli: add list/delete aliases for beta endpoints ls/rm (ENG-92294) (#538) (b071670)
• CLI: add tg batches commands for the batch API (#525) (013976d)
• cli: introduce ExperimentalConfig for experimental opt-in features in jig (#543) (d653373)
• endpoints: List enum values for endpoint scaling metric values (be959b2)
• ENG-92086 - call prewarm API after volume upload and image build (#535) (b436f0c)
• Evals CLI: show files upload progress during evals create (#534) (37ddff1)
• expose RL GPU configurations in OpenAPI (91b508a)
• expose RL session policy state (e83ef66)
• rl: add forward-backward loss function outputs (c6d8f3b)
• rl: collapse forward into forward-backward (0b3b513)
• sync rollout step states in OpenAPI (2f7f4ba)

Bug Fixes

• cli: preserve endpoint API failure diagnostics (#537) (ba27d45)
• cli: preserve endpoint creation diagnostics (#541) (4641ddf)
• cli: preserve endpoint deletion failure diagnostics (#533) (6c706ae)
• cli: preserve missing argument diagnostics (#549) (d98ddc1)
• cli: remove --scale-to-zero-window from beta endpoints (#545) (53710f9)
• cli: show upload progress for batch submit (#546) (5b23e37)
• cli: stabilize UnknownOptionError telemetry (#539) (23c3498)
• Finetuning CLI: remove broken pagination on list-events command (#540) (cd8018d)

Chores

• cli: drop tqdm dependency (DX-458) (#523) (479dd6a)

Documentation

• openapi: sync rollout landing floor descriptions (222b48a)
• sync rollout final target semantics (be0aa66)
• sync rollout landing ceiling OpenAPI description (0ad50c7)
• sync rollout metric gate OpenAPI docs (f762db4)

---

This PR was generated with Release Please. See documentation.

[broly-code-security-scanner]

Broly Security Scan

Note

Summary

113 actionable finding(s) in this PR

• 🟡 113 medium

5 highest-priority actionable rows in the table below (critical/high first, then top medium).

No finding is at or above high, so this check is not blocking. The findings above are still tracked and reported.

Severity	Scanner	Issue	Location	Dismiss	Verdict
🟡 MEDIUM	SCA	GHSA-27mf-ghqm-j3j8: aiohttp@ → >= 3.10.11	pyproject.toml:1	—	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	GHSA-2fqr-mr3j-6wp8: aiohttp@ → >= 3.14.1	pyproject.toml:1	—	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	GHSA-2vrm-gr82-f7m5: aiohttp@ → >= 3.13.4	pyproject.toml:1	—	🔺 TRUE_POSITIVE · Confidence: MEDIUM
🟡 MEDIUM	SCA	GHSA-3pqx-4fqf-j49f: PyYAML@ → >= 5.2	pyproject.toml:1	d8	🔺 TRUE_POSITIVE · Confidence: HIGH
🟡 MEDIUM	SCA	GHSA-3wq7-rqq7-wx6j: aiohttp@ → >= 3.13.4	pyproject.toml:1	—	🔺 TRUE_POSITIVE · Confidence: HIGH

Dismiss false positives

Tick a box to dismiss the finding; untick it to bring the finding back. That is the same as replying /broly dismiss d1 and /broly undismiss d1. To record why it is a false positive, reply with /broly dismiss d1: your reason instead — Broly reuses those reasons to triage similar findings across the org.

• d1 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-h8pj-cxx2-jfg2: httpx@
• d2 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2022-183: httpx@
• d3 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-5jqp-qgf6-3pvh: pydantic@
• d4 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-mr82-8j83-vxmv: pydantic@
• d5 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2021-47: pydantic@
• d6 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2026-1812: pydantic@
• d7 · 🟡 MEDIUM   · pyproject.toml:1 · filelock@3.13.1 — 4 vulnerabilities (worst: GHSA-qmgc-5h2g-mvrw)
• d113 · 🟡 MEDIUM   · pyproject.toml:1 · pyarrow@16.1.0 — 3 vulnerabilities (worst: GHSA-rgxp-2hwp-jwgg)
• d8 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-3pqx-4fqf-j49f: PyYAML@
• d9 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-6757-jp84-gxfx: PyYAML@
• d10 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-8q59-q68h-6hv4: PyYAML@
• d11 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-rprw-h62v-c2w7: PyYAML@
• d12 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2018-49: PyYAML@
• d13 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2020-176: PyYAML@
• d14 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2020-96: PyYAML@
• d15 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2021-142: PyYAML@
• d16 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-6g87-ff9q-v847: websockets@
• d17 · 🟡 MEDIUM   · pyproject.toml:1 · GHSA-8ch4-58qp-g3mp: websockets@
• d18 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2018-79: websockets@
• d19 · 🟡 MEDIUM   · pyproject.toml:1 · PYSEC-2021-95: websockets@

93 more dismissable finding(s) omitted (max 20 per scan). Reply with /broly dismiss ID using the IDs above.

Note

Re-scan this PR anytime with /broly scan — useful after /broly undismiss, or to refresh findings without a new push.

Broly — SAST (zai-org/GLM-5.3) · Secrets · SCA · IaC · GH Actions · Base Images · Supply Chain Threats · Exploit Chains · Adversarial Verification

We're continuously improving Broly's accuracy and finding quality — your feedback is valuable. False positives, missed findings, bugs, and feature requests all welcome.