Skip to main content
​
v1.5.8

​
Changelog

This release adds JIT provisioning for first-time SSO users hitting inference endpoints directly, an order role-resolution strategy for SCIM/OIDC role mapping conflicts, and AWS ALB as a selectable Identity-Aware Proxy option in the SCIM wizard. It also fixes access-profile budget propagation gaps (calendar-aligned resets, large profiles), a soft-deleted-user reactivation inconsistency between the proxy and OAuth login paths, and isolates cluster peer-liveness tracking from bulk sync backlog.

​
✨ Features

  • Inference JIT Provisioning for First-Time SSO Users - A first-time SSO user hitting an inference endpoint directly (no prior interactive login) is now JIT-provisioned from their IdP bearer JWT instead of receiving a flat 401, with claims enriched from the provider’s userinfo endpoint so group/role mappings resolve the same way they would through the login flow. Resurrection of a deliberately deprovisioned identity is blocked; a user with no matching role mapping is denied with a 403.
  • order Role-Resolution Strategy for SCIM/OIDC - When a user matches multiple attribute-role mappings at once, admins can now choose order (first-listed mapping wins, by list position) as an alternative to the default highestPermissionCount. Role sync from SCIM group and attribute pushes is also unified into a single RecomputeUserRole path, so a role granted by one signal (e.g. a group) is no longer cleared by an unrelated push that only carries a different signal (e.g. an attribute).
  • AWS ALB as a Selectable IAP Option - AWS ALB is now exposed as a selectable Identity-Aware Proxy provider in the SCIM setup wizard, alongside Cloudflare Access and Generic OIDC.
  • Configurable Outbound HTTP Buffer Sizes - ClientReadBufferSize and ClientWriteBufferSize in the config.json server block now control the outbound HTTP client’s fasthttp buffer sizes, for workloads that need to tune beyond the 64KB default.
  • AP-Managed VK Quota Visibility Without Access-Profile Permission - The managed-virtual-key notice now renders for users without access-profile view permissions, using a dedicated isManagedByProfile signal instead of depending on the full profile object. The underlying VK quota endpoint also now surfaces the access profile’s rate limit alongside its budgets, so AP-managed keys no longer show stale or zeroed-out rate limit data.

​
🌎 Open Source Features

  • WebSocket Proxy Support - Realtime and Responses WebSocket connections now route through the configured provider-level proxy (HTTP, SOCKS5, env-based) instead of always dialing direct.
  • Configurable SCIM Buffer Sizes - WithFasthttpBufferSizes on the HTTP client factory lets IdP token endpoints returning headers larger than the 4KB default work without failing SCIM/OAuth clients.

​
🐞 Fixed

  • Calendar-Aligned Budget Resets Not Reaching Existing Users - Toggling calendar_aligned on an access profile now propagates to user copies that already exist, not just newly assigned users. Previously, existing users’ budgets kept resetting on a rolling 30-day window instead of the calendar boundary, permanently, with no self-healing restart or re-save.
  • Access-Profile Propagation Failing on Large Profiles - Propagating changes from an access profile template to its user copies no longer fails when the profile is large.
  • Soft-Deleted User Reactivation via Proxy/Inference JWT - The auth-proxy and inference bearer-JWT paths now reactivate a soft-deleted user when their claims resolve to a valid role, matching the existing behavior of the interactive OAuth login flow instead of permanently blocking with a deprovisioned error.
  • SCIM Provisioning vs. Periodic Role/Team Sync - The periodic OIDC pull-based role/team sync now skips itself when SCIM provisioning is configured, since the IdP is already pushing changes in real time; the Okta API token field (only used by the pull sync) is hidden from the wizard in that mode.
  • Cluster Peer Liveness Isolated from Bulk Sync Backlog - Peer liveness pings now travel on a dedicated gRPC stream, separate from the bulk config-sync stream, so a slow or backed-up sync no longer delays or masks whether a peer is actually reachable.
  • Role Conflict Resolution Copy - Clarified the “order” strategy’s label and hint text in the SCIM role-mapping UI.
  • Proactive SSE Disconnect Detection - SSE heartbeat handling now detects a client disconnect during streaming proactively instead of only when a producer loop attempts a write, fixing false-success logging on fast/bursty upstreams like Vertex.
  • Closed Channel Panic on Stream Shutdown - Fixed a race where a heartbeat goroutine mid-send on the event channel at shutdown could panic with “send on closed channel”.
  • Budget Pruning Crash with config.json Source of Truth - Budget/config pruning now tolerates a not-found error on cascade-deleted rows, fixing a startup crash for API-created model configs absent from config.json.
  • Bedrock Header Signing Denylist - Caller headers stored for Anthropic OAuth passthrough are no longer forwarded to other providers, preventing SigV4 signature mismatches on Bedrock.
  • Deterministic Bedrock Tool Ordering - Fixed non-deterministic tool ordering in toolConfig caused by map iteration, which was breaking Bedrock prompt-cache hits.
  • Bedrock cache_control Translation - cache_control markers on Anthropic-format content blocks, system blocks, and tools are now correctly translated through the Bedrock invoke and Converse paths instead of being silently dropped.
  • Bedrock Adaptive Thinking Fixes - Reasoning/thinking max_tokens validation errors now return HTTP 400 instead of 500; tool.defer_loading is gated on its own beta header; Nova2 web search and code execution tools are handled correctly.
  • Encrypted Reasoning Content Mismatch - Replaying OpenAI Responses API reasoning items through the Anthropic surface no longer mints a fresh item id while forwarding the original encrypted content, which OpenAI was rejecting.
  • Bedrock Invoke Content Retention - Bedrock’s InvokeModel route now correctly decodes Anthropic’s type-discriminated image/tool_use/tool_result blocks instead of silently dropping them.
  • Bedrock Document Message Placeholder - Messages containing a document block without accompanying text no longer get rejected by Bedrock’s Converse API.
  • VK Provider Bulk Replace - Virtual key provider config replacement is now a single bulk operation instead of per-provider round trips, fixing a hot-path slowdown at scale.

​
🗄️ Database Migrations

No new database migrations in this release, in either the OSS transports layer or the enterprise repo.

​
🐙 Closed OSS Issues

  • #5010 - Server-side SSE keepalive (comment heartbeat) to keep long-idle streams alive through intermediaries
  • #5186 - Anthropic-surface replay of OpenAI encrypted reasoning mints a fresh item id, OpenAI 400s with “Encrypted content item_id did not match the target item id”

​
📀 Base OSS version

transports/v1.6.8

​
🔌 If you are compiling plugin against this release - use following deps