changelogs for 1.6.0

[akshaydeo]

Summary

This PR bumps core to v1.6.0, framework to v1.4.0, and transports to v1.6.0, shipping a batch of new provider integrations, a typed secret-reference system, streaming reliability improvements, and a broad set of bug fixes across Bedrock, Gemini, Anthropic, and the Responses API.

Changes

• Runware & Runway — Added Runware provider with image and video generation operations, and Runway image generation operations
• Customer Attribution — Added x-bf-customer-id and x-bf-customer-name header support for per-customer attribution (governance plugin)
• Enriched Model Listing — list models now returns ContextLength, MaxInputTokens, MaxOutputTokens, Architecture, and WebSearch pricing from pricing entries; Fireworks models enriched from config
• Streaming Pause/Resume — Added pause/resume flows for streaming calls and reduced streaming memory usage
• SecretVar — Introduced typed SecretVar env/vault reference support (env.*, vault.*) with store/resolve/remove hooks, replacing EnvVar across core, framework, and plugins. Note: TableVirtualKey.Value was rolled back to a plain string; virtual key values do not support env/vault references in this release
• GORM Vault Callbacks — Added global GORM vault callbacks with VaultPathKeyer interface and map[string]EnvVar support, replacing per-model BeforeSave/AfterDelete hooks
• Circuit Breaker UI — Added circuit breaker config schema and UI per provider
• SSO — Added SailPoint and generic SSO providers; refactored SCIM attribute-mapping schemas into shared $defs
• OTEL Plugin — Added group_traces_by_session support, root-span content logging disable toggle, and typed SecretVar support
• Mantle — Added Mantle list models endpoint and OpenAI-compatible endpoint support
• OpenCode Gateways — Added Go and Zen gateway providers
• Advisor Tool — Added advisor tool compatibility for Claude
• Bedrock — Corrected GLM-5 stop sequences, removed erroneous web search error, broadened document file extension support (xlsx/xls/doc/docx), inlined mid-conversation system reminders to preserve prompt cache, preserved tool_result order to match parallel tool_use blocks, and set TTL in cache points
• Gemini — Fixed video reference fields mapping to instances; preserved request conversion for Gemini/Vertex batch requests
• Responses API — Preserved author, recipient, and encrypted_content in multi-agent items and message copies; accepted object-valued tool-call arguments (e.g. tool_search_call) on the streaming path; populated error message in streaming error events
• Anthropic — Fixed tool call handling; surfaced prompt-cache diagnostics via new CacheDiagnostics/CacheMissReason schema
• Reliability — Added retry on stale connections; fixed ctx panic in fasthttp; recovered from closeBodyStream panic in idle-timeout timer goroutine; dropped assistant reasoning for Cerebras
• Provider Config Sync — allow_all_keys and blacklisted_models now sync from config.json source of truth; PUT /api/providers/{provider} no longer silently discards keys/blocked-model edits
• MCP — Deterministic MCP tool ordering for prompt cache stability
• Key Pool — Added key pool filter; committed routing-pinned key ID to reserved BifrostContextKeyAPIKeyID after PreRequestHook unblock
• Misc — Preserved extra_content on ChatAssistantMessageToolCall for lossless round-tripping; preserved structured errors for streaming plugin blocks; configurable server logs; raw SQL column-add migrations; responses_input_history fallback for hybrid logstore logs UI

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (React)
• Docs

How to test

# Core/Transports
go version
go test ./...

# UI
cd ui
pnpm i || npm i
pnpm test || npm test
pnpm build || npm run build

• Verify Runware and Runway image generation endpoints respond correctly with valid credentials
• Confirm x-bf-customer-id / x-bf-customer-name headers are forwarded and attributed in logs
• Confirm list models returns enriched fields (ContextLength, MaxInputTokens, etc.)
• Test env.* and vault.* references in provider config fields resolve correctly; confirm virtual key values remain plain strings
• Validate streaming pause/resume behavior under load and confirm reduced memory footprint
• Confirm Bedrock document uploads with xlsx/xls/doc/docx formats are no longer rewritten to pdf

Breaking changes

• Yes
• No

EnvVar has been renamed to SecretVar across core, framework, and several plugins (jsonparser, maxim, mocker, semanticcache, telemetry). Any code or config referencing EnvVar directly will need to be updated to SecretVar. Virtual key values (TableVirtualKey.Value) do not support env/vault references in this release; that capability was reverted.

Related issues

• Closes #2347 — Non-deterministic MCP tool ordering breaking prefix-based prompt caching
• Closes #3443 — Anthropic→OpenAI streaming tool_call deltas violate OpenAI spec on continuation chunks
• Closes #4068 — Bedrock mid-conversation system messages break prompt caching
• Closes #4413 — OpenAI Responses streaming returns empty error.message on context_length_exceeded
• Closes #4460 — GLM-5.2 reasoning_effort "max" silently downgraded to "high"
• Closes #4496 — Frequent broken pipe / closed connection errors with vllm provider
• Closes #4544 — Cerebras + /anthropic endpoint fails after first turn with 400 error
• Closes #4608 — ResponsesMessage drops author/recipient/encrypted_content, breaking Codex multi_agent_v2 subagent spawning
• Closes #4617 — idle-timeout timer goroutine can panic in closeBodyStream and crash the process
• Closes #4622 — Bedrock Converse document blocks with xlsx/xls/doc/docx silently rewritten to pdf
• Closes #4627 — Gemini video reference fields sent under parameters
• Closes #4640 — Provider config key_ids:["*"] not synced to allow_all_keys for existing virtual keys
• Closes #4648 — PUT /api/providers/{provider} silently discards payload.Keys

Security considerations

• SecretVar introduces typed env/vault references for secret fields; ensure vault paths and env variable names do not leak sensitive identifiers in logs or error responses
• Internal error details (stack traces, SQL) are now sanitized before being sent to clients, reducing information disclosure risk
• Virtual key values remain plain strings in this release; vault/env reference support for that field was explicitly reverted to avoid unintended exposure

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[akshaydeo]

• changelogs for 1.6.0 #4692 👈 (View in Graphite)
• dev

This stack of pull requests is managed by Graphite. Learn more about stacking.

[coderabbitai]

Warning

Review limit reached

@akshaydeo, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 23 minutes and 42 seconds. Learn how PR review limits work.

To continue reviewing without waiting, enable usage-based billing in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 96d23a79-b3ab-44c4-ba1a-d6f738e607ec

📥 Commits

Reviewing files that changed from the base of the PR and between 89b5c26 and 0c57f92.

📒 Files selected for processing (30)

• Makefile
• core/changelog.md
• core/version
• framework/changelog.md
• framework/configstore/migrations_test.go
• framework/version
• plugins/compat/changelog.md
• plugins/compat/version
• plugins/governance/changelog.md
• plugins/governance/version
• plugins/jsonparser/changelog.md
• plugins/jsonparser/version
• plugins/logging/changelog.md
• plugins/logging/version
• plugins/maxim/changelog.md
• plugins/maxim/version
• plugins/mocker/changelog.md
• plugins/mocker/version
• plugins/modelcatalogresolver/changelog.md
• plugins/modelcatalogresolver/version
• plugins/otel/changelog.md
• plugins/otel/version
• plugins/prompts/changelog.md
• plugins/prompts/version
• plugins/semanticcache/changelog.md
• plugins/semanticcache/version
• plugins/telemetry/changelog.md
• plugins/telemetry/version
• transports/changelog.md
• transports/version

📝 Walkthrough

Walkthrough

Changelog entries and version files were updated across core, framework, transports, and several plugins. The Makefile gained a JUnit report summary target, and migration tests were adjusted for formatting and decrypted secret assertions.

Changes

Release metadata propagation and test summaries

Layer / File(s)	Summary
Core, framework, and transport release notes core/changelog.md, core/version, framework/changelog.md, framework/version, transports/changelog.md, transports/version	Core, framework, and transports gained expanded changelog entries, and each version file was bumped to the new release number.
Plugin release notes and versions plugins/compat/..., plugins/governance/..., plugins/jsonparser/..., plugins/logging/..., plugins/maxim/..., plugins/mocker/..., plugins/modelcatalogresolver/..., plugins/prompts/..., plugins/semanticcache/...	These plugin changelogs were updated with upgrade notes, rename notes, and customer-header entries, and the matching version files were incremented.
Observability plugin notes plugins/otel/..., plugins/telemetry/...	The OTel-related changelogs add trace-grouping, logging-toggle, typed-secret, and upgrade notes, and both plugin versions were bumped.
Test summary target Makefile	A reusable Make target prints JUnit report summaries, and core, plugin, framework, and governance test targets now invoke it when reports exist.
Migration test assertions framework/configstore/migrations_test.go	Legacy migration setup SQL formatting was adjusted, and one decrypted secret assertion now reads the wrapped value field.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• maximhq/bifrost#4504: Also updates framework/configstore/migrations_test.go around TableVirtualKey.Value/SecretVar handling in migration-related assertions.

Suggested reviewers

• danpiths
• Pratham-Mishra04

Poem

I hopped through changelogs, nibbling thyme,
Bumping versions in tidy time.
A summary table now sings out bright,
While migration tests keep secrets right,
Hoppy releases make me beam! 🐰

🚥 Pre-merge checks | ✅ 2 | ❌ 3

❌ Failed checks (3 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The PR description is the untouched template and lacks a filled summary, changes, testing, and issue details.	Fill in the template with a real summary, change list, affected areas, testing steps, related issues, and any security or breaking-change notes.
Linked Issues check	⚠️ Warning	The PR only updates changelogs and versions; it does not add File API support or POST /v1/files handling for #123.	Implement file upload support for POST /v1/files and provider integrations for fine-tuning, RAG, and larger context storage.
Out of Scope Changes check	⚠️ Warning	All changes are release-note and version bumps, which are unrelated to the requested File API support in #123.	Remove unrelated changelog/version-only edits or retarget the PR to the File API implementation required by #123.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the PR's actual changelog/version bump focus.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 06-25-changelogs_for_1.6.0

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

Confidence Score: 5/5

Safe to merge — all changes are changelogs, version bumps, and a non-functional Makefile reporting addition with a single correct test assertion fix.

The only executable changes are the Makefile test-summary helper (pure display logic with no effect on build or test outcomes) and the migrations_test.go assertion update that correctly follows the TableKey.Value type change to SecretVar. No core logic, migrations, providers, or streaming paths are touched.

No files require special attention.

Important Files Changed

Filename	Overview
Makefile	Adds print-test-summary target and wires it into test-core, test-framework, test-plugins, and test-governance; logic is correct and consistent with existing Make patterns.
framework/configstore/migrations_test.go	Trailing-whitespace cleanup in SQL strings and a single assertion fix (key.Value → key.Value.Val) that correctly tracks the TableKey.Value SecretVar type promotion; TableVirtualKey.Value remains a plain string per the revert.
transports/changelog.md	Expanded from a single bullet to a structured release-notes document covering features, fixes, and 14 closed issues for the 1.6.0 release.
core/changelog.md	Complete 1.6.0 changelog for the core module, crediting contributors and linking resolved issues.
framework/changelog.md	1.4.0 changelog for the framework module; includes the explicit revert of TableVirtualKey.Value to a plain string.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[test-core / test-governance / test-framework / test-plugins] --> B{REPORT_FILE set and exists?}
    B -- Yes --> C[Derive SUMMARY_PREFIX from basename]
    B -- No --> D[Skip summary]
    C --> E[print-test-summary target]
    F[test-plugins / test-framework] --> E
    E --> G[For each XML in SUMMARY_FILES]
    G --> H[Parse testsuites attrs: tests / failures / errors]
    G --> I[Sum skipped from testsuite elements]
    H & I --> J[Compute pass = tests - fail - err - skip]
    J --> K[Print colored row]
    K --> L{More files?}
    L -- Yes --> G
    L -- No --> M[Print totals row]
    M --> N{total_fail + total_err == 0?}
    N -- Yes --> O[ALL TESTS PASSED]
    N -- No --> P[TESTS FAILED]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[test-core / test-governance / test-framework / test-plugins] --> B{REPORT_FILE set and exists?}
    B -- Yes --> C[Derive SUMMARY_PREFIX from basename]
    B -- No --> D[Skip summary]
    C --> E[print-test-summary target]
    F[test-plugins / test-framework] --> E
    E --> G[For each XML in SUMMARY_FILES]
    G --> H[Parse testsuites attrs: tests / failures / errors]
    G --> I[Sum skipped from testsuite elements]
    H & I --> J[Compute pass = tests - fail - err - skip]
    J --> K[Print colored row]
    K --> L{More files?}
    L -- Yes --> G
    L -- No --> M[Print totals row]
    M --> N{total_fail + total_err == 0?}
    N -- Yes --> O[ALL TESTS PASSED]
    N -- No --> P[TESTS FAILED]

Loading

_{Reviews (2): Last reviewed commit: "changelogs for 1.6.0" | Re-trigger Greptile}