Skip to main content
​
Bifrost Enterprise
v1.5.5

​
Changelog

Release on transports/v1.6.5. Ships identity-aware proxy authentication for inference (Cloudflare Access, AWS ALB, and generic JWKS proxies) with configurable dual-credential conflict handling, identity-scoped guardrail rules with streaming replay pacing, windowed audit log archival with S3 support, and cluster-wide async webhook delivery. Also picks up the new Wafer AI provider and reasoning token tracking from OSS.

​
✨ Features

  • Identity-Aware Proxy Authentication - New AuthProxy support for authenticating inference requests behind identity-aware proxies: Cloudflare Access, AWS ALB, and generic JWKS-based providers, with JWKS-explicit JWT validation, a publicKeyBaseUrl override for GovCloud and custom ALB partitions, and IAP configuration in the SCIM setup wizard UI.
  • Dual-Credential Conflict Behavior - Configurable handling when an inference request carries both an identity provider access token and a virtual key: reject the request, prefer the virtual key, or prefer the IDP identity so governance attributes usage to the user instead of the virtual key.
  • Identity Scoping in Guardrail Rules - Guardrail CEL rules can now match on virtual key, team, customer, and user through searchable entity selectors, evaluated against resolved governance IDs rather than raw header values; provider and model fields also gained multi-select editors.
  • Streaming Guardrail Replay Pacing - New per-rule streamReplayDurationMs option controlling how buffered streaming responses are replayed to the client after guardrail approval, letting the delivery duration be tuned per rule; disabled by default.
  • Windowed Audit Log Archival - Per-flush audit archival replaced with a watermarked, window-based archiver running as a durable background job: events stream as JSONL part objects with a manifest commit record, windows and max object size are configurable, and S3 object storage is now supported for audit logs.
  • Async Webhook Dispatch - Webhook dispatcher wired into the enterprise server with cluster-wide propagation of webhook configuration and a dedicated RBAC resource. Docs
  • Alerting Enhancements - Alert history can be stored in ClickHouse, alert suppression state moved to the KV store for cluster consistency, the evaluation interval is configurable via evaluation_interval_seconds in config.json, and a cleaner prunes old alert history.
  • MCP Metrics in Datadog - MCP tool call metrics are now exported through the Datadog connector.

​
🌎 Open Source Features

  • Wafer AI Provider - Wafer AI added as a supported provider. Docs
  • Async Webhooks - New webhook delivery system for async jobs: configurable webhook endpoints (config.json, admin API, and UI), SSRF-safe delivery dispatcher with retries, delivery history with server-side pagination, search, and filtering, and inference request_id propagation through async jobs and webhook payloads; failed jobs now inline error/error_omitted fields. Docs
  • Reasoning Token Tracking - Anthropic extended-thinking tokens are tracked as ReasoningTokens across chat, responses, and passthrough.
  • Retain Content Toggle - New toggle to always retain request/response content in object storage regardless of retention cleanup.
  • Throughput Metrics - Tokens/sec throughput histogram endpoints, dashboard metrics, and throughput in model rankings and trend data.
  • MCP Metrics - MCP metrics exported via OTEL and the telemetry (Prometheus) plugin, plus a resource parameter on the MCP OAuth handshake.
  • Routing Rule Validation - Routing CEL expressions and scope_id references are validated at write time in create and update handlers.
  • Network Config - Configurable keep-alive duration in network config.
  • Object Storage Archival Settings - New archiveInterval, archiveGracePeriod, and archiveMaxObjectBytes settings.
  • Connector User Email Export - Connectors can now export user emails.
  • Logs UI - Server fallback model shown in logs, content-disabled message on the logs UI, persisted page-size preference, and prompt_tokens/completion_tokens in search stats.

​
🐞 Fixed

  • Session-First OIDC Auth - OIDC authentication is session-first, preventing premature sign-outs; virtual keys are prefetched instead of re-queried from the database
  • OIDC Issuer URL - Issuer URL comparison now tolerates trailing slashes
  • Webhooks RBAC Backfill - The Webhooks RBAC resource is backfilled onto existing roles
  • Datadog Content Attributes - The Datadog connector uses the central content attribute method so content redaction settings are respected
  • Access Profile Role Attach - Attaching an access profile to a role upserts on conflict instead of failing on duplicates
  • OIDC Additional Scopes - Fixed array handling for additional scopes in OIDC configuration
  • ARM64 Binary Build - Fixed the enterprise binary build for arm64
  • Anthropic Fallbacks - Fixed fallback handling and refusal responses on the Anthropic surface; billing now attributes usage to the fallback model actually served
  • Bedrock Reasoning - Fixed double emission of reasoning content on Bedrock streams
  • Fallback Model Names - Made RefineModelForProvider idempotent so fallback routing no longer truncates model names (fixes Groq/Replicate/Parasail prefix handling)
  • OpenAI Image Blocks - input_image blocks now default detail to auto, fixing strict downstream validators such as vLLM
  • Streaming Responses Surface - Completed visible thinking items, completed Cohere terminal events with the output array, fixed reasoning item streaming in the mux, and handled line-by-line errors in streaming
  • Azure Structured Output - Structured output format is converted to a tool for Azure in the Anthropic integration; unsupported reasoning summary values are dropped for the Azure model router
  • DeepSeek and SGLang - Anthropic-compatible APIs supported via key-level setting for SGLang and used for DeepSeek chat/responses; count-tokens handling added for both
  • vLLM - Moved vLLM to the native Responses API
  • Fireworks - Added support for Anthropic APIs in Fireworks
  • Mistral OCR - Raw request capture and log storage enabled for Mistral OCR requests
  • Rolling Deploy Safety - Materialized-view read path is gated on a shape check to prevent “column does not exist” errors during rolling deploys
  • MCP Tool Sync - Out-of-range tool_sync_interval minutes are rejected to prevent nanosecond-scale sync loops
  • Routing Rules - Unresolved virtual keys are excluded from the scope ID set and empty routing rule fields are normalized
  • Pricing Fallback - Chat and Responses pricing fallback now works bidirectionally
  • OTEL Content Attributes - OTEL now uses the central method for content attribute checks

​
🐙 Closed OSS Issues

  • #5074 - Fallback routing model selection is truncating model names
  • #5108 - Bedrock Converse: reasoning_config/thinking silently dropped on cross-provider translation, fallbacks lose extended thinking
  • #5308 - Responses API image blocks missing required “detail” field when converted from non-OpenAI providers

​
📀 Base OSS version

transports/v1.6.5

​
🔌 If you are compiling plugin against this release - use following deps