maximhq · akshaydeo · May 25, 2026 · May 21, 2026 · May 21, 2026 · May 21, 2026
diff --git a/core/changelog.md b/core/changelog.md
@@ -0,0 +1,7 @@
+- fix: idle timeout panic in the streaming idle-timeout reader
+- fix: short-circuit `IdleTimeoutReader` reads when the connection is already closed (#3672)
+- fix: preserve tool call stop reason in Anthropic streaming fallback (#3640) (thanks [@dicnunz](https://github.com/dicnunz)!)
+- fix: correct start-time setting for accurate TTFT metric value (#3668)
+- fix: map Vertex traffic type to Bifrost service tier (#3662)
+- fix: ListModels for keyless providers (#3655)
+- fix: remove manual `type: custom` for Anthropic tools (#3652)
diff --git a/docs/enterprise/guardrails.mdx b/docs/enterprise/guardrails.mdx
@@ -155,7 +155,7 @@ Guardrail Rules are custom policies that define when and how content validation
 | `cel_expression` | string | Yes | CEL expression for rule evaluation |
 | `apply_to` | enum | Yes | When to apply: `input`, `output`, or `both` |
 | `sampling_rate` | integer | No | Percentage of requests to evaluate (0-100) |
-| `timeout` | integer | No | Execution timeout in milliseconds |
+| `timeout` | integer | No | Execution timeout in seconds (default: 60) |
 | `provider_config_ids` | array | No | IDs of profiles to use for evaluation |
 
 ### Creating Rules
@@ -185,7 +185,7 @@ Guardrail Rules are custom policies that define when and how content validation
   - `both` - Validate both inputs and outputs
 - **CEL Expression**: Define the validation logic
 - **Sampling Rate**: Set percentage of requests to evaluate (default: 100%)
-- **Timeout**: Set maximum execution time in milliseconds
+- **Timeout**: Set maximum execution time in seconds (default: 60)
 
 3. **Link Profiles**
    - Select one or more profiles to use for evaluation

diff --git a/framework/changelog.md b/framework/changelog.md
@@ -0,0 +1,5 @@
+- feat: `created_by` user attribution column for virtual keys (#3672)
+- feat: `blacklisted_models` column for virtual key provider configs (#3653)
+- fix: add monotonic `inc_number` log cursor so node usage reconciliation does not skip late async log writes (#3664)
+- revert: `access_profile_id` direct access profile assignment on virtual keys (#3669)
+- chore: drop the `access_profile_id` column from `governance_virtual_keys` (#3670)
@@ -725,13 +725,14 @@ bifrost:
       #   cel_expression: "!contains(request.body, 'SSN')"
       #   apply_to: "input"
       #   sampling_rate: 100
-      #   timeout: 1000
+      #   timeout: 60        # Timeout in seconds for rule execution (default: 60)
       #   max_turns_to_send: 0
     providers: []
       # - id: 1
       #   provider_name: "bedrock"
       #   policy_name: "content-filter"
       #   enabled: true
+      #   timeout: 30        # Timeout in seconds for provider execution (default: 30)
       #   config: {}
 
   # Access profiles (enterprise): seed RBAC access profile templates from Helm.

diff --git a/plugins/compat/changelog.md b/plugins/compat/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/governance/changelog.md b/plugins/governance/changelog.md
@@ -0,0 +1,2 @@
+- feat: virtual key blocked-models enforcement — reject requests when the requested model is blocked at the VK provider-config level (#3653)
+- fix: clear stale `governanceRejectedContextKey` on an allow decision so successful fallback retries count toward budgets and rate limits (#3645)
diff --git a/plugins/jsonparser/changelog.md b/plugins/jsonparser/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/logging/changelog.md b/plugins/logging/changelog.md
@@ -0,0 +1 @@
+- feat: stamp MCP tool logs with governance ownership (user, team, customer, and business unit IDs) from the request context
diff --git a/plugins/maxim/changelog.md b/plugins/maxim/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/mocker/changelog.md b/plugins/mocker/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/otel/changelog.md b/plugins/otel/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/prompts/changelog.md b/plugins/prompts/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/semanticcache/changelog.md b/plugins/semanticcache/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/plugins/telemetry/changelog.md b/plugins/telemetry/changelog.md
@@ -0,0 +1 @@
+- chore: upgraded core to v1.5.12 and framework to v1.3.12
diff --git a/transports/changelog.md b/transports/changelog.md
@@ -0,0 +1,22 @@
+## ✨ Features
+
+- **Virtual Key Blocked Models** — Block specific models at the virtual key provider-config level; blocked models take priority over allowed models and are enforced by governance (#3653)
+- **Virtual Key Ownership** — Virtual keys now capture and display a `created_by` user attribution (#3672)
+- **MCP Log Attribution** — MCP tool logs are stamped with user, team, customer, and business unit IDs so MCP usage can be traced like LLM usage
+- **Team & Business Unit Filters** — Added team and business unit filters across the dashboard and logs views (#3650)
+- **Sticky Time Filters** — Time filter selections are preserved when navigating between sidebar items (#3647)
+
+## 🐞 Fixed
+
+- **Idle Timeout Panic** — Fixed a panic in the streaming idle-timeout reader and added a guard to skip reads once the connection is closed (#3672)
+- **Anthropic Streaming** — Preserve the tool-call stop reason in the Anthropic streaming fallback (#3640) (thanks [@dicnunz](https://github.com/dicnunz)!)
+- **TTFT Metric** — Fixed the request start-time setting so the time-to-first-token metric is accurate (#3668)
+- **Vertex Service Tier** — Map the Vertex traffic type to the correct Bifrost service tier (#3662)
+- **Keyless Providers** — Fixed `ListModels` for providers configured without an API key (#3655)
+- **Anthropic Tools** — Stopped forcing `type: custom` on Anthropic tool definitions (#3652)
+- **Node Usage Reconciliation** — Added a monotonic log cursor so reconciliation no longer skips late async log writes (#3664)
+- **Fallback Budget Tracking** — Clear the stale governance rejection flag on allow so successful fallback retries count toward budgets and rate limits (#3645)
+- **Virtual Keys Table** — Table now fills available height with a sticky header and scrollable body (#3676)
+- **Sheet Layout** — Removed save/cancel icons and fixed sheet layout growth in routing rule and virtual key sheets (#3675)
+- **Toast Click-Through** — Toasts remain clickable above modal overlays (#3674)
+- **Direct Access Control** — Reverted the virtual key `access_profile_id` direct access profile assignment shipped in v1.5.3; the `access_profile_id` column has been dropped (#3669, #3670)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- chore: upgraded core to v1.5.12 and framework to v1.3.12
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		- feat: virtual key blocked-models enforcement — reject requests when the requested model is blocked at the VK provider-config level (#3653)
		- fix: clear stale `governanceRejectedContextKey` on an allow decision so successful fallback retries count toward budgets and rate limits (#3645)
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		- feat: stamp MCP tool logs with governance ownership (user, team, customer, and business unit IDs) from the request context