Remote executor vulnerability patched; legacy pickle support removed

What's Changed

• Bump dev version: v1.25.0.dev0 by @albertvillanova in https://github.com/huggingface/smolagents/pull/1939
• Fix import of TokenUsage by @albertvillanova in https://github.com/huggingface/smolagents/pull/1943
• Add MLflow integration doc by @B-Step62 in https://github.com/huggingface/smolagents/pull/1884
• Refactor agent/model deserialization: Replace importlib with registry pattern by @albertvillanova in https://github.com/huggingface/smolagents/pull/1944
• Update _function_type_hints_utils.py: CohereForAI -> CohereLabs by @Michellehbn in https://github.com/huggingface/smolagents/pull/1946
• Fix High impact vulnerability on remote executors by @nnfrog in https://github.com/huggingface/smolagents/pull/1637
• Fix SafeSerializer.get_deserializer_code by @albertvillanova in https://github.com/huggingface/smolagents/pull/1983
• Fix RemotePythonExecutor._deserialize_final_answer for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1984
• Test 'pickle:...' payloads are properly decoded by @albertvillanova in https://github.com/huggingface/smolagents/pull/1985
• Remove support for legacy no-prefix pickle by @albertvillanova in https://github.com/huggingface/smolagents/pull/1986
• Create docs reference page for Python executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/1987
• Isolate WasmExecutor Deno cache to per-instance temp directory by @albertvillanova in https://github.com/huggingface/smolagents/pull/1995
• Switch wildcard bind to loopback-only endpoint in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2025
• Use token in DockerExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2027
• Remove allow_origin from Docker and Modal executors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2028
• Use token in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2031
• Fix evaluate_with() calling exit on wrong object by @dubin555 in https://github.com/huggingface/smolagents/pull/2029
• Fix evaluate_with by suppressing exception if truthy exit by @albertvillanova in https://github.com/huggingface/smolagents/pull/2033
• Use requests.Session in WasmExecutor by @albertvillanova in https://github.com/huggingface/smolagents/pull/2032
• Fix Rich MarkupError in AgentLogger.log_task by rendering untrusted text safely by @Barcavin in https://github.com/huggingface/smolagents/pull/1894
• Emphasise sandboxing is required; LocalPythonExecutor is not a security tool by @zsims in https://github.com/huggingface/smolagents/pull/2039
• Fix log_error rendering brackets as Rich markup by @albertvillanova in https://github.com/huggingface/smolagents/pull/2077
• Support huggingface-hub >= 1 by @merveenoyan in https://github.com/huggingface/smolagents/pull/2075
• Remove unused safe_serialization param from _websocket_run_code_raise_errors by @albertvillanova in https://github.com/huggingface/smolagents/pull/2131
• Set allow_pickle default to False in internal calls by @albertvillanova in https://github.com/huggingface/smolagents/pull/2132
• 🔒 Pin GitHub Actions to commit SHAs by @paulinebm in https://github.com/huggingface/smolagents/pull/2149
• chore: bump doc-builder SHA for PR upload workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2194
• chore: bump doc-builder SHA for main doc build workflow by @rtrompier in https://github.com/huggingface/smolagents/pull/2219

New Contributors

• @B-Step62 made their first contribution in https://github.com/huggingface/smolagents/pull/1884
• @Michellehbn made their first contribution in https://github.com/huggingface/smolagents/pull/1946
• @dubin555 made their first contribution in https://github.com/huggingface/smolagents/pull/2029
• @zsims made their first contribution in https://github.com/huggingface/smolagents/pull/2039
• @paulinebm made their first contribution in https://github.com/huggingface/smolagents/pull/2149
• @rtrompier made their first contribution in https://github.com/huggingface/smolagents/pull/2194

Full Changelog: https://github.com/huggingface/smolagents/compare/v1.24.0...v1.25.0