Skip to content

v1.6.3 changelogs - #4969

Merged
akshaydeo merged 1 commit into
devfrom
07-06-v1.6.3_changelogs
Jul 6, 2026
Merged

v1.6.3 changelogs#4969
akshaydeo merged 1 commit into
devfrom
07-06-v1.6.3_changelogs

Conversation

@akshaydeo

@akshaydeo akshaydeo commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR bumps core to v1.6.3, framework to v1.4.3, and all dependent plugins to their next patch versions, shipping a large batch of new features and bug fixes accumulated since v1.6.2.

Changes

New providers and integrations

  • DeepSeek added as a first-class provider with dedicated request handling and thinking-mode gating
  • bedrock_mantle added as a first-class provider with SigV4 key config, native-Anthropic and OpenAI-compatible routing
  • ClickHouse added as a log store backend with a hybrid store mode

Auth and security

  • Full OAuth 2.1 authorization server for /mcp: discovery, dynamic client registration, PKCE authorize/token with refresh token rotation, consent page, JWT Bearer auth, session listing/revocation, sweep worker, and mcp_server_auth_mode config
  • Virtual key expiry field with governance enforcement
  • VK-mode OAuth2 grants revoked on VK deletion with user-liveness checks at refresh and request time
  • Virtual key values now use schemas.SecretVar to support env-store references
  • virtualKeysByID secondary index with cached signing key and VK lookups on the /mcp JWT auth path

Provider and API fixes

  • Round-trip Anthropic redacted_thinking blocks so tool-use turns with extended thinking replay correctly
  • Emit contentBlockStop events on Bedrock ConverseStream egress
  • Clear per-attempt stream close claim so streaming retries and fallbacks survive SSE-embedded provider errors
  • Report cached_tokens as reads only per the OpenAI spec so cache writes are not billed as reads
  • Preserve Anthropic file ID document sources and forward file IDs and content type on the files integration
  • Surface Gemini batch inline responses from the response field instead of dest
  • Guard Gemini tool call config, fix 2.5-pro thinking budget value, OpenAI-through signature compatibility, and video reference field mapping
  • Signal Bedrock max_output_tokens truncation on the Responses API
  • Propagate max_tokens from the OpenAI integration and pass chunking_strategy as an extra param
  • Preserve codex tool_search_call and tool_search_output input items on the Responses API streaming path
  • Fixed Perplexity Responses API compatibility and Bedrock error type setting across all integrations

Observability and logging

  • Error responses now carry latency information
  • Cost recalculation streams progress via SSE with batch processing
  • Sweep orphaned deferred spans in trace store TTL cleanup and complete deferred LLM spans on streaming goroutine exit
  • Sanitize ErrorDetailsParsed so raw payloads honor disable_content_logging
  • Fixed stats and log state for cancelled requests
  • Fixed billing on failed Responses stream requests for Anthropic and Bedrock, and cost for image generation and edit streaming
  • Tier costs now evaluated via input tokens instead of total tokens

MCP

  • Per-MCP-server tool execution timeout configuration
  • Deterministic MCP tool ordering for prompt cache stability
  • Fixed MCP reconnect failure when ListTools fails during startup
  • Skip background token refresh for disabled or unconfigured MCP clients
  • Added connection_type, auth_type, state, virtual_key, and server/client_id filters with pagination to the MCP clients list

Other features

  • IPv6 support added to the HTTP transport
  • Models marked is_deprecated in pricing and catalog APIs instead of being filtered out
  • Added user, team, customer, and business-unit name columns to the logs list
  • Connectors can now attach multiple teams, customers, and business units
  • Extended Bedrock vendor-prefix pricing fallback to OpenAI, Google, and xAI models
  • Added stemming alongside exact keyword match and a no-signal fallback to the complexity analyzer
  • Added missing OpenAI Responses lifecycle methods with explicit per-verb governance flags
  • Refactored Anthropic request building into BuildAnthropicChatRequestBody, shared completeRequest across Anthropic, Azure, and Bedrock, lazy BodySigner SigV4 signing, and BearerAuthHeader helper

Type of change

  • Bug fix
  • Feature
  • Refactor
  • Documentation
  • Chore/CI

Affected areas

  • Core (Go)
  • Transports (HTTP)
  • Providers/Integrations
  • Plugins
  • UI (React)
  • Docs

How to test

# Core/Transports
go version
go test ./...
  • OAuth 2.1 MCP auth: configure mcp_server_auth_mode, register a client via DCR, complete the PKCE authorize/token flow, and verify JWT Bearer auth on /mcp requests.
  • DeepSeek provider: configure a DeepSeek key and send a chat completion request; verify thinking mode is disabled when tool choice is required.
  • bedrock_mantle: configure SigV4 credentials and verify both native-Anthropic and OpenAI-compatible routing paths.
  • ClickHouse log store: configure the ClickHouse DSN and verify logs are written and queryable, including the hybrid mode token usage columns.
  • Virtual key expiry: set an expiry on a VK and confirm requests are rejected after expiration.
  • Streaming retries: trigger an SSE-embedded provider error and confirm the retry/fallback path completes successfully.
  • Cache token accounting: issue a cached request and confirm cached_tokens in usage reflects reads only.

Breaking changes

  • Yes
  • No

Related issues

Closes #2347, #3106, #3121, #3139, #3357, #3951, #4262, #4314, #4402, #4446, #4679, #4689, #4720, #4721, #4756, #4777, #4788, #4816, #4851, #4863, #4868, #4872, #4942

Security considerations

  • The OAuth 2.1 authorization server introduces new token issuance, PKCE enforcement, refresh token rotation, and session revocation surfaces — these paths should be reviewed for token leakage, replay, and CSRF risks.
  • Virtual key values stored as schemas.SecretVar may now reference env-store entries; ensure env-store access controls are correctly scoped.
  • disable_content_logging bypass via ErrorDetailsParsed has been patched; verify no other raw-payload paths bypass this flag.
  • SigV4 credentials for bedrock_mantle are handled via the new BedrockMantleKeyConfig; confirm sensitive fields are cleared before persistence.

Checklist

  • I read docs/contributing/README.md and followed the guidelines
  • I added/updated tests where appropriate
  • I updated documentation where needed
  • I verified builds succeed (Go and UI)
  • I verified the CI pipeline passes locally if applicable

@coderabbitai

coderabbitai Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: a6f43e6a-f783-49b4-9ef5-3bbd86077f04

📥 Commits

Reviewing files that changed from the base of the PR and between 9a73b4e and ec72253.

📒 Files selected for processing (28)
  • core/changelog.md
  • core/version
  • framework/changelog.md
  • framework/version
  • plugins/compat/changelog.md
  • plugins/compat/version
  • plugins/governance/changelog.md
  • plugins/governance/version
  • plugins/jsonparser/changelog.md
  • plugins/jsonparser/version
  • plugins/logging/changelog.md
  • plugins/logging/version
  • plugins/maxim/changelog.md
  • plugins/maxim/version
  • plugins/mocker/changelog.md
  • plugins/mocker/version
  • plugins/modelcatalogresolver/changelog.md
  • plugins/modelcatalogresolver/version
  • plugins/otel/changelog.md
  • plugins/otel/version
  • plugins/prompts/changelog.md
  • plugins/prompts/version
  • plugins/semanticcache/changelog.md
  • plugins/semanticcache/version
  • plugins/telemetry/changelog.md
  • plugins/telemetry/version
  • transports/changelog.md
  • transports/version

📝 Walkthrough

Summary by CodeRabbit

  • New Features

    • Added broader provider, auth, logging, and transport capabilities, including JWT-based access for MCP, IPv6 support, ClickHouse log storage, and expanded model/tool handling.
  • Bug Fixes

    • Improved streaming, caching, billing, and compatibility behavior across AI providers and integrations.
    • Fixed several edge cases around tool calls, file handling, secret values, idle-timeout recovery, and request forwarding.
  • Chores

    • Updated changelog entries and released new versions across core, framework, and related plugins.

Walkthrough

This PR updates changelog files and version identifiers across core, framework, transports, and eleven plugin modules. Core, framework, and transports changelogs are expanded with structured feat/fix/chore entries; all version files are incremented to reflect the new release (core 1.6.3, framework 1.4.3, transports 1.6.3, and corresponding plugin version bumps).

Changes

Release changelog and version bumps

Layer / File(s) Summary
Core changelog and version bump
core/changelog.md, core/version
Core changelog restructured with new feat/fix entries (DeepSeek, bedrock_mantle, JWT Bearer auth, tool timeouts, streaming fixes, etc.) and version bumped 1.6.2 → 1.6.3.
Framework changelog and version bump
framework/changelog.md, framework/version
Framework changelog expanded with ClickHouse log-store, OAuth 2.1 gateway, virtual key, MCP filtering, and pricing/query fixes; version bumped 1.4.2 → 1.4.3.
Transports changelog and version bump
transports/changelog.md, transports/version
Transports changelog restructured into Features/Fixed/Closed Issues sections; version bumped 1.6.2 → 1.6.3.
Plugin changelogs and version bumps
plugins/compat/*, plugins/governance/*, plugins/jsonparser/*, plugins/logging/*, plugins/maxim/*, plugins/mocker/*, plugins/modelcatalogresolver/*, plugins/otel/*, plugins/prompts/*, plugins/semanticcache/*, plugins/telemetry/*
Each plugin's changelog gets new entries (feature/fix/chore items reflecting core/framework dependency bumps) and version files are incremented accordingly.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: danpiths

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 07-06-v1.6.3_changelogs

Warning

Tools execution failed with the following error:

Failed to run tools: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)


Comment @coderabbitai help to get the list of available commands.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@akshaydeo
akshaydeo marked this pull request as ready for review July 6, 2026 18:07

Copy link
Copy Markdown
Contributor Author

This stack of pull requests is managed by Graphite. Learn more about stacking.

@greptile-apps

greptile-apps Bot commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

Confidence Score: 5/5

All changes are changelog entries and version file bumps — no executable code is modified.

Every file touched is either a changelog.md or a version file. Version increments are consistent one-patch-level bumps across all 14 modules (core, framework, transports, and 11 plugins). Changelog content is well-structured, references PRs and closed issues, and matches the scope of a v1.6.3 release. There is nothing here that can introduce a runtime regression.

No files require special attention.

Important Files Changed

Filename Overview
core/changelog.md Replaces prior-release entries with full v1.6.3 changelog covering 14 features and ~25 fixes, all with PR/issue references and contributor attributions.
core/version Patch bump 1.6.2 → 1.6.3.
framework/changelog.md Replaces prior-release entries with full v1.4.3 changelog covering OAuth 2.1 gateway auth, ClickHouse store, VK expiry, and related fixes.
framework/version Patch bump 1.4.2 → 1.4.3.
transports/changelog.md Replaced single fix entry with comprehensive release notes using emoji-grouped sections (Features, Fixed, Closed Issues); substantially more detailed than other module changelogs but accurate.
transports/version Patch bump 1.6.2 → 1.6.3.
plugins/governance/changelog.md Newly populated from empty; lists 4 features and 3 fixes for v1.6.3 including virtual key expiry enforcement and complexity analyzer stemming.
plugins/compat/changelog.md Newly populated; documents reasoning-drop feat and DeepSeek thinking-disable fix.
plugins/logging/changelog.md Extended with latency-on-errors, SSE cost recalculation, and cancelled-state fixes for v1.5.26.
plugins/semanticcache/changelog.md Newly populated; two fixes for internal embedding key resolution and body-transport state clearing.
plugins/jsonparser/changelog.md Newly populated with a single chore entry noting the core/framework dependency upgrades.
plugins/maxim/changelog.md Newly populated with a single chore entry for dependency upgrades.
plugins/mocker/changelog.md Newly populated with a single chore entry for dependency upgrades.
plugins/modelcatalogresolver/changelog.md Newly populated with a single chore entry for dependency upgrades; version bumped 1.0.6 → 1.0.7.
plugins/otel/changelog.md Newly populated with a single chore entry; version bumped 1.3.2 → 1.3.3.
plugins/prompts/changelog.md Newly populated with a single chore entry; version bumped 1.0.25 → 1.0.26.
plugins/telemetry/changelog.md Newly populated with a single chore entry; version bumped 1.5.25 → 1.5.26.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[v1.6.3 Release] --> B[core v1.6.3]
    A --> C[framework v1.4.3]
    A --> D[transports v1.6.3]
    A --> E[plugins]

    B --> B1[14 features\nDeepSeek, Bedrock Mantle,\nOAuth 2.1 MCP auth, IPv6,\nClickHouse, VK expiry...]
    B --> B2[~25 bug fixes\nStreaming retries, cache tokens,\nGemini fixes, MCP ordering...]

    C --> C1[OAuth 2.1 gateway auth\nClickHouse log store\nVK expiry + SecretVar\nSQL pagination]

    D --> D1[Rich release notes\nFeatures / Fixed / Issues]

    E --> E1[governance v1.6.3\nVK expiry enforcement\nComplexity stemming]
    E --> E2[compat v0.1.25\nReasoning drop + DeepSeek thinking]
    E --> E3[logging v1.5.26\nLatency on errors\nSSE cost progress]
    E --> E4[semanticcache v1.5.26\nEmbedding key resolution]
    E --> E5[Other plugins v+1\nChore: dep upgrades only]
Loading
%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[v1.6.3 Release] --> B[core v1.6.3]
    A --> C[framework v1.4.3]
    A --> D[transports v1.6.3]
    A --> E[plugins]

    B --> B1[14 features\nDeepSeek, Bedrock Mantle,\nOAuth 2.1 MCP auth, IPv6,\nClickHouse, VK expiry...]
    B --> B2[~25 bug fixes\nStreaming retries, cache tokens,\nGemini fixes, MCP ordering...]

    C --> C1[OAuth 2.1 gateway auth\nClickHouse log store\nVK expiry + SecretVar\nSQL pagination]

    D --> D1[Rich release notes\nFeatures / Fixed / Issues]

    E --> E1[governance v1.6.3\nVK expiry enforcement\nComplexity stemming]
    E --> E2[compat v0.1.25\nReasoning drop + DeepSeek thinking]
    E --> E3[logging v1.5.26\nLatency on errors\nSSE cost progress]
    E --> E4[semanticcache v1.5.26\nEmbedding key resolution]
    E --> E5[Other plugins v+1\nChore: dep upgrades only]
Loading

Reviews (2): Last reviewed commit: "v1.6.3 changelogs" | Re-trigger Greptile

@akshaydeo
akshaydeo force-pushed the 07-06-v1.6.3_changelogs branch from 37dd806 to ec72253 Compare July 6, 2026 18:12

akshaydeo commented Jul 6, 2026

Copy link
Copy Markdown
Contributor Author

Merge activity

  • Jul 6, 6:13 PM UTC: A user started a stack merge that includes this pull request via Graphite.
  • Jul 6, 6:13 PM UTC: @akshaydeo merged this pull request with Graphite.

@akshaydeo
akshaydeo merged commit dd73ce5 into dev Jul 6, 2026
12 of 14 checks passed
@akshaydeo
akshaydeo deleted the 07-06-v1.6.3_changelogs branch July 6, 2026 18:13
@coderabbitai coderabbitai Bot mentioned this pull request Jul 14, 2026
18 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: MCP tool ordering is non-deterministic, breaking prefix-based prompt caching

2 participants