v1..5.7

[akshaydeo]

🔒 Security

• Go Dependency CVE Remediation — Updated golang.org/x dependencies flagged by Docker Scout, clearing 20 advisories (severity up to 10.0): crypto v0.49.0 → v0.52.0, net v0.52.0 → v0.55.0, sys v0.42.0 → v0.45.0, text v0.35.0 → v0.37.0, term v0.41.0 → v0.43.0 (cli). Verified with govulncheck against the live Go vulnerability database: zero vulnerabilities remain in any module (docker scout fixes #3900)
• Hardened Container Image — Removed the standalone GNU wget package from the Alpine runtime image, eliminating CVE-2025-69194 (8.8); the HEALTHCHECK now uses the built-in busybox wget applet, with no functional change

🐞 Fixed

• Ollama Streaming Auth — Ollama streaming text and chat requests now forward the configured API key as an Authorization: Bearer header (ollama streaming auth header #3906)
• SGL Streaming Auth — SGL provider now sends the Authorization header on streaming requests (fix: SGL provider - send Authorization header on streaming requests #3307) (thanks @hensapir!)
• Governance & Logging APIs — Removed the from_memory query parameter; virtual key and config list APIs now return consistent DB-backed results, with VK names batch-fetched in a single query (removes from_memory for APIs #3903)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ hensapir
❌ akshaydeo
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6a877793-5e12-4ca8-a6ff-f4e10782b0b5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch dev

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[greptile-apps]

Confidence Score: 4/5

Safe to merge; all functional changes are targeted bug fixes with corresponding tests, and the dependency and container updates are verified clean.

The streaming auth fix is correct and consistent across both providers, but Ollama's path has no regression test while SGL's does. Everything else — the governance from_memory removal, the DAC-scoped cache fix, the MCP batch-fetch, and the weaviate readiness rework — is well-covered by new unit tests or explicit script-level checks.

core/providers/ollama/ollama.go — the streaming auth change is untested; consider adding a test analogous to the SGL regression tests.

Important Files Changed

Filename	Overview
core/providers/ollama/ollama.go	Streaming text and chat completion now forward the API key as Authorization: Bearer; fix is correct but lacks regression tests unlike the parallel SGL fix.
core/providers/sgl/sgl.go	Streaming paths now correctly build the Authorization header from key.Value; backed by two new regression tests in chat_test.go.
core/providers/sgl/chat_test.go	Adds testLogger stub, streaming client setup, and two regression tests that verify the Authorization header is sent on ChatCompletionStream and TextCompletionStream.
transports/bifrost-http/handlers/governance.go	Removes from_memory parameter from all governance list/get handlers; all paths now go to the DB-backed ConfigStore, with VK names batch-fetched in MCP handler.
transports/bifrost-http/handlers/logging.go	Introduces shouldUseFilterDataCache that correctly excludes DAC-scoped requests from the shared filterdata cache, preventing cross-tenant data exposure.
transports/bifrost-http/handlers/mcp.go	MCP VK name lookup migrated from in-memory governance data to a single batch DB query via GetRedactedVirtualKeys; errors are logged and handled gracefully.
.github/workflows/configs/docker-compose.yml	Removes the weaviate Docker healthcheck; all three test scripts now poll the readiness endpoint directly via curl with a 60-second timeout, which replaces the previous in-compose check.

Comments Outside Diff (1)

1. core/providers/ollama/ollama.go, line 156-177 (link)

   Missing Ollama streaming auth regression tests

   The SGL auth fix ships with two new regression tests (TestChatCompletionStream_SetsAuthorizationHeader / TestTextCompletionStream_SetsAuthorizationHeader in core/providers/sgl/chat_test.go) that verify the Authorization: Bearer header is forwarded on streaming requests. The equivalent Ollama fix in both TextCompletionStream and ChatCompletionStream is structurally identical but has no corresponding test coverage. If the auth-header wiring ever regresses in the Ollama path, there is nothing to catch it at the unit level.

   Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

_{Reviews (1): Last reviewed commit: "changelogs (#3909)" | Re-trigger Greptile}