Product Roundup 26.Q3.1

Welcome to the July edition of the CVAT Digest. This month, we shipped three releases, v2.70.0, v2.71.0, and v2.72.0, with updates across AI-assisted annotation, CLI and SDK workflows, annotation usability, and security, including:

• Better control for AI-assisted annotation
• More flexible CLI profiles and saved authentication
• Better support for interaction auto-annotation functions
• Improved annotation usability and reliability
• Security and infrastructure updates

Better control for AI-assisted annotation

In v2.70.0, CVAT added region of interest support for automatic annotation detector and interactor functions.

This gives teams more control over where AI-assisted annotation is applied, which is especially useful when only part of an image needs to be processed. Instead of running automation across the full frame every time, users can focus AI tools on the area that matters for the task at hand.

Learn more about Region of Interest

We also added interface and agent support for interaction auto-annotation functions in v2.71.0. This expands the foundation for more interactive AI-assisted workflows and makes these functions easier to integrate into agent-based annotation pipelines.

More flexible CLI profiles and saved authentication

July brought a meaningful quality-of-life upgrade for people working with CVAT through the CLI and SDK.

In v2.70.0, the SDK gained persistent authentication with saved profiles, making it easier to store server and credential settings and reconnect without re-entering them each time. In v2.71.0, the CLI added a new --profile option and a cvat-cli config default-server command for managing default server settings.

In v2.72.0, we expanded this further with new cvat-cli profile commands to list, create, set the default, and delete saved Personal Access Token profiles.

Together, these changes make it much easier to work across multiple CVAT environments, especially for teams that switch between local, staging, and production instances.

Improved annotation usability

July also included several smaller updates that improve day-to-day work in the annotation interface.

In v2.70.0, CVAT added a confirmation dialog when leaving the annotation guide editor with unsaved changes.

In v2.71.0, skeleton control points were updated to be more visually distinguishable from annotation points, making skeleton-heavy tasks easier to read on the canvas.

We also improved pagination behavior when refreshing or navigating back to resource pages, kept project and job cards clickable while previews are loading, improved annotation response performance, and fixed a mask bounding box issue when using the “Remove underlying pixels” option.

Reliability and security updates

July releases also included several fixes that improve reliability across annotation and infrastructure workflows.

These include more reliable handling in the Requests API, improved behavior when creating tasks from Azure Blob Storage images, and a fix for saving annotations that could fail with a spec_id is invalid error.

We also added a startup safeguard in v2.71.0 that refuses to launch CVAT if keys/secret_key.py contains arbitrary code.

On the security side, July included fixes for an XSS vulnerability related to annotation guides, tighter authorization rules for lambda function requests, and protections against users blocking automatic annotation for tasks they cannot access.

Other technical updates

July releases also included additional SDK, CLI, self-hosted deployment, and API updates, including SDK filtering improvements, webhook event log behavior changes, and Helm fixes for backup and export workers.

For the full technical list, see the release notes for v2.70.0, v2.71.0, and v2.72.0.