Changelog
A routing and platform release ontransports/v1.5.12. The headline work is a new complexity router with CEL-based tier routing, per-alias provider overrides backed by a full routing audit trail, a browsable MCP server library, and vault backends (AWS, GCP, HashiCorp) for sensitive config fields. Vault is not yet enabled for everyone - it will be enabled gradually over the next few releases.Note: Thedisable_auth_on_inferenceconfig field, deprecated in v1.4.0 of the OSS gateway, has been removed. Useenforce_auth_on_inferenceinstead, which enforces Virtual key authentication on inference endpoints.
✨ Features
- Complexity Router (OSS) - Route requests by prompt complexity using
complexity_tierCEL expressions, with a configurable complexity analyzer wired through config, DB, API, UI, and Helm. - Per-Alias Provider Overrides (OSS) - Key aliases now support alias-level Azure endpoint/API version/Anthropic version, Bedrock region/ARN, Vertex project/region, and Replicate deployments-endpoint overrides, backed by a rich deployments table with per-deployment model family and canonical name.
- Routing Audit Trail (OSS) - Responses and errors now carry
RoutingInfoextra fields with a retry/fallback audit trail from the core routing engine, including alias resolution context. - MCP Server Library (OSS) - New browsable MCP server catalog with background sync, search and filters, install sheet, custom entries with soft-delete, 100+ initial servers, and a multi-harness agent connect sheet.
- Vault Backends for Secrets (OSS + enterprise) - Sensitive config fields can now be stored in AWS Secrets Manager, GCP Secret Manager, or HashiCorp Vault as an alternative to AES encryption, backed by a new enterprise vault package with backend integration tests.
- Vertex AI Files and Batches API (OSS) - Added support for the Vertex AI Files and Batches endpoints.
- Per-Turn Guardrails Evaluation (enterprise) - Guardrails can now evaluate each conversation turn individually instead of only the full request.
- Direct SCIM Attribute Role Mappings (enterprise) - SCIM provisioning supports direct user-attribute to role mappings that bypass team/business-unit resolution, with new
attributeType/attributeValuemapping schemas in config and Helm. - Load-Balanced Routing Engine Improvements (enterprise) - The LB provider selector now reads the model catalog on demand (replacing the refresh ticker), tracks candidate selection reasons eagerly, surfaces dropped fallbacks caused by unhealthy direction state, treats new providers with no direction metrics as healthy during exploration, and adds live-mutable failed-direction reroute/prune toggles.
- Plugin Span Filtering Across Connectors (OSS + enterprise) - Plugin spans can now be filtered per connector via
plugin_span_filters, covering OTEL, Datadog, BigQuery, Kafka, and PubSub. - BigQuery Dimensions Export (enterprise) - The BigQuery connector now supports exporting dimensions alongside metrics.
- Access Profile Lifecycle Hardening (enterprise) -
KeyIDsare now part of access profile hash generation with order-insensitive comparison, and a new force-delete operation cascade-deletes user copies of an access profile. - Per-Model Usage in Quota API (OSS) - The virtual key quota API now reports usage broken down per model.
- Richer Logging (OSS) - Added
canonical_model_nameandalias_model_familycolumns to logs, and request metadata is now included in object-storage log exports. - OTEL HTTP Metrics (OSS) - The OTEL connector now emits HTTP-level metrics.
- Datadog Connector Enhancements (enterprise) - Agent address and DogStatsD address can now be set via environment variables, with DD env var support added to the Helm chart.
- Configurable Server Read Buffer (enterprise + OSS) - The HTTP server read buffer size is now configurable via
server.readBufferSizeinstead of a fixed 64kb. key_idsin Provider Config (OSS) - Providers can be scoped to specific keys via the newkey_idsfield in the config schema and Helm chart.- Helm Chart Improvements (OSS) - Named ingresses map format alongside the legacy single ingress, Helm charts published as OCI artifacts to GHCR and Docker Hub, and complexity analyzer config values.
- Anthropic Fable Compatibility (OSS) - Added support for Anthropic Fable models, including fast mode pricing fixes.
- E2E Routing Test Harness (enterprise) - New end-to-end LB routing wiring suite covering three-layer exclusion, VK wildcard gating, virtual-key and catalog interplay, and fallback scenarios.
🐞 Fixed
- Governance Log Mappings - Fixed teams and customers name mappings on logs (with fallback to the governance store), fixed the customer FK column issue, and added a unique-name constraint migration on the customer table.
- Virtual Key Handling - Generate a UUID when a virtual key is created without an ID, propagate the VK in GenAI file upload sessions, stamp the VK tool allowlist when the
include-clientsfilter is present, and enforce the VK tool-grant boundary on caller-providedx-bf-mcp-include-*headers. - “Allow All” Provider Routing - “Allow All” in VK provider config now properly routes to all allowed models in key configurations.
- Datadog Cost and Metrics - Fixed DD plugin cost calculation and metrics, agent-mode tracking, and the cost recording type.
- KV Decoder Registration - KV decoders are now registered during bootstrap, fixing decode failures for KV-backed config values.
- Provider Reload -
ReloadProviderupsert now useslib.ErrNotFoundcorrectly, and failed provider configs are preserved from the in-file config instead of the runtime config. - User Deletion - Removed the pre-transaction vault secret cleanup from
DeleteUser, so secrets are no longer deleted before the transaction commits. - Postgres Logstore Filters - Fixed metadata filters and pagination
total_countfor the Postgres logstore. - Vertex Fixes - The Vertex Embedding method now supports API key authentication, and reasoning effort
noneis dropped for Vertex requests. - Bedrock Cohere Usage - Cohere embed/rerank usage on Bedrock is now filled from the response header.
- OpenAI File Upload - Fixed
expires_atfields in OpenAI file uploads. - Governance Cache Exemption - Cache creation requests are now exempt from model checks in governance.
- DeepSeek v4 Reasoning - Fixed max reasoning effort handling for DeepSeek v4.
- Gemini Tool Responses - Fixed parts handling in Gemini tool responses.
- OpenRouter Cache Control -
cache_controlblocks are now preserved in OpenRouter chat requests. - Trace Attributes - Refactored tracers to correctly set trace-level attributes.
- Auth Middleware - Authentication is now enforced on inference endpoints in the auth middleware.
📀 Base OSS version
transports/v1.5.12