1.5.10 changelogs - #4131
Merged
Merged
Conversation
|
|
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (26)
📝 WalkthroughWalkthroughThis PR releases version 1.5.18 for core and 1.3.18 for framework, plus a 1.5.10 hotfix for transports. Changelog and version files are updated across all packages to document two key behavioral fixes: explicit virtual-key usage tracking control via ChangesRelease version and changelog updates
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Suggested reviewers
Poem
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
akshaydeo
marked this pull request as ready for review
June 7, 2026 17:08
Contributor
Confidence Score: 5/5Changelog and version-bump only PR — no executable code changed, nothing that can regress at runtime. Every changed file is either a changelog.md or a version text file. The entries accurately describe the two hotfix changes from the referenced PRs, version increments are consistent across all modules, and there are no code paths to evaluate for correctness or concurrency issues. No files require special attention. Important Files Changed
Reviews (2): Last reviewed commit: "1.5.10 changelogs" | Re-trigger Greptile |
akshaydeo
force-pushed
the
06-07-1.5.10_changelogs
branch
from
June 7, 2026 17:12
6e8cb96 to
bf169a3
Compare
Contributor
Author
Merge activity
|
akshaydeo
added a commit
that referenced
this pull request
Jun 7, 2026
This is a hotfix release (v1.5.10) on top of v1.5.9 that addresses two targeted bugs in governance and provider model allow-listing. No new features, migrations, or behavioral opt-ins are introduced beyond the explicit opt-in flag described below. - **Virtual key usage dropped under user attribution (#4123):** When a request carried user attribution, virtual-key usage accounting was silently skipped, causing VK budget and rate-limit tracking to be incomplete. Governance now tracks both the virtual-key and user scopes by default. Callers that intentionally want user-only accounting can opt in by setting the new `BifrostContextKeySkipVirtualKeyUsageTracking` (`bifrost-skip-virtual-key-usage-tracking`) context key. - **Wildcard allow-lists rejected models on catalog-opaque providers (#4124):** A `*` allowed-models entry was incorrectly blocking requests to providers whose model list cannot be enumerated by the catalog — custom providers without list-models support and keyless self-hosted deployments (vLLM, Ollama, SGL). A new shared `IsCatalogOpaqueProvider` helper is used to resolve wildcard allow-lists to allow-all for these providers. - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ```sh go version go test ./... ``` **Virtual key usage tracking:** Send a request with user attribution set and verify that both the virtual-key and user usage scopes are incremented. Then set `bifrost-skip-virtual-key-usage-tracking` on the context and confirm only the user scope is tracked. **Wildcard allow-lists:** Configure a virtual key with `allowed_models: ["*"]` against a custom or keyless self-hosted provider (vLLM/Ollama/SGL). Confirm requests are permitted rather than rejected. - [ ] Yes - [x] No - Closes #4123 - Closes #4124 The new `BifrostContextKeySkipVirtualKeyUsageTracking` context key bypasses virtual-key usage accounting. Callers should ensure this flag is only set in controlled, intentional scenarios to avoid unintentionally circumventing budget and rate-limit enforcement on virtual keys. - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
2 tasks
akhsaul
pushed a commit
to akhsaul/bifrost
that referenced
this pull request
Aug 27, 2026
This is a hotfix release (v1.5.10) on top of v1.5.9 that addresses two targeted bugs in governance and provider model allow-listing. No new features, migrations, or behavioral opt-ins are introduced beyond the explicit opt-in flag described below. - **Virtual key usage dropped under user attribution (maximhq#4123):** When a request carried user attribution, virtual-key usage accounting was silently skipped, causing VK budget and rate-limit tracking to be incomplete. Governance now tracks both the virtual-key and user scopes by default. Callers that intentionally want user-only accounting can opt in by setting the new `BifrostContextKeySkipVirtualKeyUsageTracking` (`bifrost-skip-virtual-key-usage-tracking`) context key. - **Wildcard allow-lists rejected models on catalog-opaque providers (maximhq#4124):** A `*` allowed-models entry was incorrectly blocking requests to providers whose model list cannot be enumerated by the catalog — custom providers without list-models support and keyless self-hosted deployments (vLLM, Ollama, SGL). A new shared `IsCatalogOpaqueProvider` helper is used to resolve wildcard allow-lists to allow-all for these providers. - [x] Bug fix - [ ] Feature - [ ] Refactor - [ ] Documentation - [ ] Chore/CI - [x] Core (Go) - [x] Transports (HTTP) - [ ] Providers/Integrations - [x] Plugins - [ ] UI (React) - [ ] Docs ```sh go version go test ./... ``` **Virtual key usage tracking:** Send a request with user attribution set and verify that both the virtual-key and user usage scopes are incremented. Then set `bifrost-skip-virtual-key-usage-tracking` on the context and confirm only the user scope is tracked. **Wildcard allow-lists:** Configure a virtual key with `allowed_models: ["*"]` against a custom or keyless self-hosted provider (vLLM/Ollama/SGL). Confirm requests are permitted rather than rejected. - [ ] Yes - [x] No - Closes maximhq#4123 - Closes maximhq#4124 The new `BifrostContextKeySkipVirtualKeyUsageTracking` context key bypasses virtual-key usage accounting. Callers should ensure this flag is only set in controlled, intentional scenarios to avoid unintentionally circumventing budget and rate-limit enforcement on virtual keys. - [ ] I read `docs/contributing/README.md` and followed the guidelines - [ ] I added/updated tests where appropriate - [ ] I updated documentation where needed - [ ] I verified builds succeed (Go and UI) - [ ] I verified the CI pipeline passes locally if applicable
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is a hotfix release (v1.5.10) on top of v1.5.9 that addresses two targeted bugs in governance and provider model allow-listing. No new features, migrations, or behavioral opt-ins are introduced beyond the explicit opt-in flag described below.
Changes
Virtual key usage dropped under user attribution (adds budget count skip for user attribution #4123): When a request carried user attribution, virtual-key usage accounting was silently skipped, causing VK budget and rate-limit tracking to be incomplete. Governance now tracks both the virtual-key and user scopes by default. Callers that intentionally want user-only accounting can opt in by setting the new
BifrostContextKeySkipVirtualKeyUsageTracking(bifrost-skip-virtual-key-usage-tracking) context key.Wildcard allow-lists rejected models on catalog-opaque providers (allow catalog opaque providers in unknown models #4124): A
*allowed-models entry was incorrectly blocking requests to providers whose model list cannot be enumerated by the catalog — custom providers without list-models support and keyless self-hosted deployments (vLLM, Ollama, SGL). A new sharedIsCatalogOpaqueProviderhelper is used to resolve wildcard allow-lists to allow-all for these providers.Type of change
Affected areas
How to test
Virtual key usage tracking: Send a request with user attribution set and verify that both the virtual-key and user usage scopes are incremented. Then set
bifrost-skip-virtual-key-usage-trackingon the context and confirm only the user scope is tracked.Wildcard allow-lists: Configure a virtual key with
allowed_models: ["*"]against a custom or keyless self-hosted provider (vLLM/Ollama/SGL). Confirm requests are permitted rather than rejected.Breaking changes
Related issues
Security considerations
The new
BifrostContextKeySkipVirtualKeyUsageTrackingcontext key bypasses virtual-key usage accounting. Callers should ensure this flag is only set in controlled, intentional scenarios to avoid unintentionally circumventing budget and rate-limit enforcement on virtual keys.Checklist
docs/contributing/README.mdand followed the guidelinesSummary by CodeRabbit
New Features
Bug Fixes