> ## Documentation Index > Fetch the complete documentation index at: https://docs.getbifrost.ai/llms.txt > Use this file to discover all available pages before exploring further. # v2.1.0 > v2.1.0 changelog - 2026-09-08 ## Changelog v2.1.0 moves the enterprise gateway onto OSS transports v2.1.0 and ships four governance changes at once. Projects give a named, budgeted scope that a request opts into per call, with per-member budget and rate-limit shares. Virtual MCPs replace MCP Tool Groups and are wired into access profiles and projects. Business Units become a property of the user instead of the team, and Data Access Control can now be set per RBAC resource on a role. Users can hold several access profiles at the same time, with scheduled automatic key rotation and a toggle that governs keys members create themselves. The OSS base adds the Databricks and GitHub Copilot providers, embedding-based complexity routing, prompt-cache auto-injection, and a large set of streaming and reasoning fixes. ## ⚠️ Breaking Changes * **Business Units Move from Teams to Users** - A business unit is now assigned to users directly through a user-to-BU table, not through the user's team. SCIM and OIDC sync write BU membership onto the user, DAC derives the caller's BU from the user, and the Teams page renames "Members" to "Users". Existing team-level assignments are copied onto every current team member by migration. The legacy `business_unit_id` column on teams is no longer read or written but is not dropped in this release. * **MCP Tool Groups Replaced by Virtual MCPs** - The tool-group routes are deprecated and RBAC grants on `MCPToolGroups` are copied onto a new `VirtualMCPs` resource. `mcp.tool_groups` in config.json is deprecated in favour of `mcp.virtual_mcps`. Existing tool groups keep working through the deprecated routes until they are migrated. * **Access-Profile-Managed Keys No Longer Carry a Governance Mirror** - Provider configs, budgets, rate limits, and MCP configs that were copied onto access-profile-managed virtual keys are stripped by migration, and the `SyncVKFromAccessProfile` propagation path is removed. Governance for those keys is resolved from the profile at request time, so edits to a profile take effect without a propagation job. * **User-Scoped Model Configs Retired** - Creating model configs with `scope: user` is no longer possible. Existing rows that uniquely match an access profile's declared per-model budget or rate limit are re-stamped to `scope: access_profile`; unmatched rows are left in place and still enforced. * **Routing Metadata and Governance Error Codes Renamed (OSS)** - The routing field on responses and log rows is renamed from `routing_debug` to `routing_metadata` with no alias. Governance error codes `virtual_key_not_found` and `virtual_key_blocked` are renamed to `access_not_found` and `access_blocked`. Update any consumer matching on those names. * **`allow_on_all_virtual_keys` Renamed (OSS)** - The MCP client field is now `allow_by_default` (the old key is still accepted) and the list filter `all_virtual_keys` becomes `allowed_by_default`. Default-allowed MCP clients are granted to access profiles and keyless users unconditionally. * **Plugin `version` Field Removed (OSS)** - Plugin sync is now driven by a SHA-256 hash of the config entry. A leftover `version` key in config.json, the API, or Helm values is ignored. * **Project Delete `force` Flag Removed** - Deleting a project always drops its members with it. ## ✨ Features * **Projects** - A named, budgeted governance scope that a request opts into with the `x-bf-project-id` or `x-bf-project-name` header. A project carries an access rule, members, budgets, rate limits, provider configs, MCP configs, virtual MCPs, and `allow_all_providers`. Members can receive equal-split or explicit shares of each project cap, and shares are redivided by a background job when membership changes or a user is deleted. Projects are managed through `/api/governance/projects`, reconciled from `governance.projects` in config.json with hash-based sync, gossiped across the cluster, scoped by DAC, and audited. A request naming a project it cannot use is refused with `access_blocked`. `project_id` and `project_name` land on logs, MCP tool logs, span attributes, metric labels, and the BigQuery, Datadog, and Splunk connectors, with a `project_ids` filter on user rankings. The UI adds a Governance → Projects page with overview, budgets and limits, provider, MCP, and Members tabs, per-member cap meters, and warnings when an equal split leaves a member without a whole unit. * **Virtual MCPs Across the Enterprise Surface** - Virtual MCPs get a dedicated RBAC resource (with grants migrated from tool groups), DAC scoping, cluster gossip, and an Access Profiles section. They can be attached to access profiles (replacing the per-server tool overrides, which are folded into per-client allowlists) and to projects, and are resolved from the live governance cache at request time. Direct MCP servers gain an `endpoint_slug` and are served at `/mcp/`. config.json and Helm accept `mcp.virtual_mcps`, and virtual MCP e2e coverage is added. * **Per-Entity Data Access Control** - A role's data visibility can now be set independently for each scopable RBAC resource (logs, MCP logs, virtual keys, RBAC, and the rest) instead of one global default. Overrides are stored in a new role DAC table, fail closed to own-data on invalid values, and are editable from a Data Access tab on the role sheet with an effective-scope badge on the roles table. The role API, `me/permissions`, and config.json sync carry the overrides. [Docs](https://docs.getbifrost.ai/enterprise/data-access-control) * **Optimistic Concurrency on Role Updates** - Roles carry a `revision` counter that every mutation increments inside one transaction. Sending the loaded revision turns an update into a compare-and-swap; a stale write is refused with HTTP 412 and the UI reloads the latest role and asks the editor to reapply. Omitting the revision keeps last-writer-wins for older clients. [Docs](https://docs.getbifrost.ai/enterprise/rbac) * **Business Units per User** - Users can belong to several business units, each edge carrying its source (`manual` or `attribute_mapping`). SCIM group push and OIDC claims sync are authoritative for their own edges, with delta removes, stale-edge pruning, and a live per-user BU roster endpoint. Group push now runs the same side effects as team sync (claims mirror, role recompute, governance and access-profile reload), and BU changes are broadcast so peers refresh DAC. The Business Units UI is rebuilt as a per-user property. * **Multiple Access Profiles per User** - A user can hold several active access profiles at once. Each holder is stamped with its source (`manual`, `role_default`, or `attribute_mapping`), sources are ranked so an attribute-mapping row is adopted as the role default when the role grants the same template, and role-detach only revokes role-default holders. A role can grant more than one profile and a SCIM attribute mapping rule can target several profiles. At request time exactly one profile pays per attempt (a payable profile wins over an exhausted one), rate limits are unioned across all live profiles, and provider-candidate exclusion mirrors the same logic. The user detail sheet is restructured into tabs with expandable profile cards, a Customers tab, team and BU deep links, and confirm dialogs for membership removal. [Docs](https://docs.getbifrost.ai/enterprise/access-profiles) * **Scheduled Virtual Key Rotation** - Access profiles gain `auto_rotation_interval` (1h to 365d, off by default) with `next_rotation_at` and read-only `last_rotation_at`. A cluster-deduplicated background job rotates managed keys in batches, honours the rotation cooldown, posts dashboard notifications, and advances the schedule; a manual rotation inside the window is respected. [Docs](https://docs.getbifrost.ai/enterprise/access-profiles) * **Govern Member-Created Virtual Keys** - The "Govern virtual keys created by members" behaviour is now an RBAC operation, `VirtualKeys:CreateStandalone`, granted by migration to every role that already holds `VirtualKeys:Create`. Members without it have keys they create adopted into their active profile (budgets, rate limits, provider and model scope, MCP grants applied and the key locked); if adoption fails the key is rolled back. `GET /api/governance/users/me/vk-creation-policy` reports the outcome ahead of time so the create form can lock fields, and auto-provisioned keys are named after the user's display name or email with a short unique suffix. * **Allow All Providers on Access Profiles and Projects** - `allow_all_providers` on an access profile or project grants every configured provider, including ones added later, without listing them in `provider_configs`. Explicit provider entries still apply their model lists. Exposed in the UI, the API, config.json, and Helm, with e2e coverage. * **Access-Profile-Scoped Model Limits** - Per-model budgets and rate limits materialized from an access profile are stored under `scope: access_profile` keyed by the user's profile copy, tagged with a structured `SourceRef` naming the owning profile, and rendered read-only in the UI with a notice naming the profile. User access profiles can serve live usage with `from_memory=true`, per-model budget lines cascade on delete, and legacy user-scoped limits are still gathered for enforcement. * **Virtual Key Reveal and Copy Audit** - Revealing or copying a key value in the dashboard fires `GET /api/governance/virtual-keys/{id}/reveal` or `/copy`, which records an `access` audit event with the target key and returns 204. The two paths let operators tell a reveal from a clipboard copy when filtering audit logs. Audit logs also gain server-side sorting with URL-persisted sort state. * **Guardrails: Conversation Window and Native Redaction** - Guardrail rules gain an explicit `send_all_conversation_turns` toggle; when off, "Previous conversation turns to include" counts only preceding turns, fixing an off-by-one in the window. Redaction now rewrites native raw passthrough requests (Claude Code style traffic), synchronizes native SSE stream rewriting with the normalized redaction output, and supports multi-target Responses stream redaction with per-field segment state. The CrowdStrike guardrail receives the user id and name. [Docs](https://docs.getbifrost.ai/enterprise/guardrails) * **Cluster: Dead-Node Archive and Config Gossip** - Usage counters of dead nodes are archived to the config store instead of being held in memory forever, bounding governance memory on long-lived clusters; a node's own unflushed usage is preserved when it archives a peer. Complexity-analyzer config changes are gossiped so every node refetches the authoritative config. MCP client updates are broadcast even when the enable or edit dial fails, and peers acknowledge committed-but-dial-failed messages instead of retrying forever. [Docs](https://docs.getbifrost.ai/enterprise/clustering) * **Kubernetes Discovery Hardening** - Peer discovery only returns pods that are ready and not terminating, so an address about to be recycled is never handed out. At startup the node checks the configured `k8s_namespace` against the namespace projected by the service account and verifies that its own pod matches `k8s_label_selector`, refusing to join another deployment's pods when a config was copied between environments. A missing namespace falls back to `default` with a warning, a missing selector warns that every pod in the namespace will be treated as a peer, and the local pod lookup is bounded by a timeout. [Docs](https://docs.getbifrost.ai/enterprise/clustering) * **Per-Instance MCP Failure Reasons** - The node-state heartbeat carries each instance's last MCP failure alongside its connection state, so the aggregate breakdown in the server sheet shows why each pod failed even when every pod agrees on `Unstable`. The KV key prefix is bumped so mixed-version rolling upgrades degrade cleanly. * **Tracing for Async Jobs and Overhead Span Toggle** - Batch and video settlement emit spans from the async sweeper, and the Datadog, Kafka, and Pub/Sub plugins gain an `export_overhead_spans` toggle so internal overhead spans can be kept out of the export. * **SCIM Wizard Refinements** - Group role mappings accept a wildcard `*` value, the trusted-networks trigger moves into the provider-config step for self-hostable providers, the breadcrumb shows the selected provider name, and role profiles are reconciled when a token carries no access-profile mapping attribute. * **MCP Self-Service Routes on View Permission** - Session re-auth and per-user header flow routes are gated on `MCPGateway:View` instead of the create and update permissions, so view-only roles can re-authenticate their own sessions without MCP client management rights. * **Edge License Enforcement on Agent Token Endpoints** - The agent token and refresh endpoints now check license expiry on every call and return HTTP 402 with the message "Edge trial expired" when the Edge trial has lapsed, and the license state re-checks expiry on every read instead of relying on the async watcher. ## 🌎 Open Source Features Enterprise-labelled items in the OSS release notes (Projects, scheduled rotation, allow-all-providers, per-instance MCP failure detail, tracing controls) are described above and not repeated here. * **Databricks Provider** - First-class `databricks/` provider covering Model Serving and Unity AI Gateway with PAT or OAuth M2M auth via `databricks_key_config` (`workspace_url`, `api_format`, `client_id`/`client_secret`, `forward_gateway_tags`). Requests are sanitized per model against datasheet capabilities, `reasoning_effort` is translated to Anthropic `thinking` on Claude endpoints, remote images are inlined, native Responses calls fall back to chat emulation, and upstream error messages are surfaced. The UI adds the key form and a guided migration from a custom provider named `databricks`. [Docs](https://docs.getbifrost.ai/providers/supported-providers/databricks) * **GitHub Copilot Provider** - `github_copilot` provider that mints installation tokens server-to-server from GitHub App credentials (`github_copilot_key_config`: `app_id`, `installation_id`, `repository_id`, `private_key`, optional `github_domain`), supporting chat completions, Responses, and list models with cost tracked in GitHub AI Credits. Configurable through config.json and the API only; it is hidden from the Add Provider picker pending release testing. * **Semantic Complexity Routing** - The keyword scorer in the complexity router is replaced by an embedding-based classifier over three tiers with curated exemplar phrases (backfilled by migration, 750 combined phrase cap), a pluggable vector store including an embedded `chromem` backend with cross-node warm coordination, an optional LLM classifier fallback (`semantic.fallback: llm`), and session-aware routing that keeps a session at its highest observed tier. New status, generations, and retry endpoints under `/api/routing/complexity-analyzer-*`, `complexity_*` log columns and filters, and routing embedding and LLM request and cost counters. `tier_boundaries` is deprecated and ignored. [Docs](https://docs.getbifrost.ai/features/governance/complexity-router) * **Per-Request Grants** - Every request settles its identity (virtual key, MCP JWT, WebSocket key, ephemeral secret, GenAI session) onto one resolved access grant that governance checks, charges, and filters with, so checked and billed limits cannot diverge and async jobs, WebRTC relays, and WebSocket upgrades keep their identity. MCP runs a single shared server with tool visibility decided per request by governance admission, and every models listing (including integration routes) is narrowed by resolved access. * **Virtual Key Rotation Cooldown** - New `client.vk_rotation_cooldown` setting (duration string, e.g. "5m"): after a rotation the previous key value keeps authenticating until the grace window expires. config.json VK sync treats a changed value as an explicit rotation (with console warning) and recognizes the previously rotated-out value as "no change". * **Prompt Cache Auto-Injection** - New provider `prompt_cache` block (`auto_inject`, `ttl`, `cache_control_injection_points`) synthesizes cache breakpoints for clients that send none, so agentic clients like Codex stop paying the cache-write rate every turn. Off by default, capped at four markers, never touches caller-supplied markers, overridable per request with `x-bf-prompt-cache-auto-inject`. Edited from a Prompt Caching tab in the provider sheet and extended to the gpt-5.6 family. * **Azure DeepSeek Chat Completions Routing** - Responses requests to Azure DeepSeek models from coding harnesses are routed to Chat Completions because the DeepSeek Responses endpoint rejects `reasoning.effort`; models without a Responses endpoint fall back the same way, including on Bedrock Mantle. Controlled by `compat.azure_deepseek` (default true). The compat plugin also logs every dropped parameter and request-type conversion as structured per-request log entries. * **Native Passthrough Redaction** - Guardrail PII redaction applies to Anthropic Messages and Gemini GenAI passthrough traffic, rewriting only content-bearing fields, and to native SSE streams through a paused-buffer codec that rewrites `content_block_delta` text before release. * **Video Job Accounting** - Async video generation is billed at settlement: a settler polls jobs to a terminal state, prices from captured params or provider-reported dimensions with resolution-banded per-second rates (480p, 720p, 1024p, 1080p, 4k), records failures at zero, and parks unpriceable jobs for backfill. The `batch_jobs` table is generalised into a provider job table with `kind` and `params` columns, and the log detail sheet gains a Video Details block. * **Webhook Deliveries Page** - `GET /api/webhooks/deliveries` searches delivery history across all endpoints by endpoint, event, outcome, status class, request or delivery ID, and time window, paginated by delivery group. A Webhooks → Deliveries page adds filters, live polling, manual redelivery, and deep links from each endpoint. [Docs](https://docs.getbifrost.ai/features/webhooks) * **Request ID Lookup and Period Comparison in Logs** - Logs, stats, and histogram endpoints accept an exact `request_id` that bypasses the time window; the search box auto-detects a UUID or `id:` prefix. `GET /api/logs/stats?compare_to_previous=true` returns the previous period, powering a segmented metric strip with sparklines and change badges. * **Hidden Request Types** - `logs_store.hidden_request_types` (Helm `storage.logsStore.hiddenRequestTypes`) hides whole request types such as `count_tokens` from every log read path without affecting writes, cost recalculation, or access control; shown read-only under Config → Logging. * **Tool Call Names Filter** - Logs gain a `tool_call_names` column, recorded even when content logging is off, with a matching filter on the logs and histogram endpoints and in the logs sidebar. * **Served and Canonical Model in Logs** - The model the provider actually served is persisted as `served_model` and shown when it differs from the request, and the logs model column displays the canonical name with the requested name as fallback. * **MCP Connection Failure Details** - `GET /api/mcp/clients` returns `last_failure` (stage, message, timestamps) and per-node `node_states`, OAuth tokens record a `status_reason`, and the server sheet shows the failure in the state badge popover plus a credential block with scopes, refresh-token presence, and expiry. * **Scoped Model Limits and Quota Sources** - Model configs and quota budgets carry a structured `SourceRef` naming what governs them, `GET /api/governance/model-configs` accepts a comma-separated `scope`, quota responses tag each budget and rate limit with its `source` and list every contributing `rate_limits` entry, and read-only scopes render as view-only in the UI. Provider-scoped budgets now participate in load-balancing candidate exclusion. * **Plugin Config Hash Reconciliation** - Plugin sync is driven by a SHA-256 hash of the config entry, so a changed entry syncs automatically. Custom Go plugins can use `SecretVar` in their config, and a plugin's `created_at` survives updates. * **Tracing Controls** - New `export_overhead_spans` toggle (Helm and the Configure Tracing sheet) controls whether internal overhead spans are exported, converter work is split into finer span buckets, and a Latency and Overhead Breakdown docs page explains the log detail view. * **Log Level Tabs for Plugin and Routing Logs** - Routing decision and plugin logs carry a level and can be filtered by it in the log detail view. * **UI Improvements** - Custom providers whose name collides with a first-party integration prompt a switch, access-profile-managed keys get a fallback creation view, sheets get a refreshed design with sticky headers, the logs page handles small screens, cached and uncached input tokens are broken down in a tooltip, and the Raw JSON tab explains when raw storage is disabled. * **Helm Chart Updates** - Values and schema for projects, Databricks keys, access-profile mappings, VK rotation cooldown, virtual MCPs, `allow_all_providers`, hidden request types, and guardrail `send_all_conversation_turns`; the SCIM block renders as-is when `enabled: false`. * **Baseten on Hugging Face** - Baseten is discoverable as a Hugging Face inference provider. * **Magic Hour in MCP Library** - Magic Hour is added to the MCP library. ## 🐞 Fixed * **Dead-Node Archive Loses Local Usage** - Archiving a dead node moved the local baselines and current usage by the same amount through the store's CAS loops, so this node's own unflushed delta is preserved and concurrent request accounting is retained. * **Access Profile Budget and Rate-Limit Persistence** - Budget IDs survive team and profile edits, zero-limit budgets are dropped and invalid rate limits rejected on save, presence flags cover every nullable field, per-model rate-limit IDs are collected before a wipe and provider-budget join rows deleted explicitly to avoid FK violations, and provider rate limits that cap nothing are dropped instead of stored. * **Access Profile Lifecycle** - Cascade delete removes every user copy of a profile, not just the first; orphaned user profiles are purged and the parent FK cascades; `scope=access_profile` model configs are deleted on force delete; legacy user-scoped model configs are deleted when the user is deleted; virtual keys are reclaimed only when a user's last profile is revoked; non-manual detach is blocked while a user holds several profiles; the highest-precedence profile is returned in user listings; higher-ranked source rows are skipped during source sync to avoid spurious governance reloads; reconcile errors are logged instead of discarded; and config.json user-copy propagation is deferred to a queued job so it cannot fail before initialization. * **Access-Profile-Backed Keys Pruned by config.json** - A prune guard keeps config.json reconciliation from deleting access-profile-owned virtual keys, and those keys are excluded from direct Virtual MCP assignments. * **Project Member Shares** - Equal-split member adds and cap edits that leave no whole unit per member are refused, member shares are zeroed beside their source on budget reset, equal split now divides provider and model caps by head count, member share IDs are included in calendar-alignment adoption, roster reads and member removal are scoped to the caller's DAC principal, and redivision after user deletion is queued instead of run inline. * **Virtual MCP Resolution** - Access-profile and project virtual MCPs are resolved from the live cache, project-attached virtual MCPs are deleted on cascade, and the MCP and Virtual MCP loaders are consistent in the UI. * **Complexity Routing Dependencies** - The complexity router's dependencies are wired at enterprise bootstrap, so the semantic classifier and vector store are available on the enterprise build. * **Inspect Handler Identity** - The inspect handler settles identity onto the grant so pre-hooks are not refused as unsettled requests. * **SCIM and Sessions** - Logout no longer leaves a stale session, BU group push now mirrors claims, recomputes roles, and reloads governance like team sync does, and user BU changes are broadcast so peers refresh DAC. * **Guardrail Reasoning Blocks** - Reasoning content stays immutable across every redaction path. * **Governance Usage Snapshot** - A focused usage snapshot replaces the full-state snapshot on hot paths. * **UI Fixes** - Sheet header padding, access-profile badge and truncated-badge tooltips, "+N" chips for budget and rate-limit cells, container-query mapping editors and a chip-based profile multi-select, attribute-mapping button overflow, a read-only notice naming the owning profile with model budgets re-synced on calendar-aligned flips, Projects styling and breadcrumbs, the per-user profile list invalidated on detach, the redundant "Managed by" prefix removed, humanized entity names in the DAC override list, and a free-text BigQuery location input. * **Streaming Hangs and Connection Leaks (OSS)** - A patched fasthttp fixes a race when closing streams, abandoned streams are drained in the background so the upstream connection returns to the pool, streams that send only heartbeats after `finish_reason` now terminate, and a `does_not_send_done_marker` toggle on custom providers ends the stream at `finish_reason` for upstreams that never send `[DONE]`. * **DeepSeek Reasoning Lost on Multi-Turn (OSS)** - Assistant `reasoning_content` is aliased instead of stripped for Groq and Cerebras, so thinking survives multi-turn requests on the OpenAI-compatible inbound. * **Reasoning Summary Stream Events (OSS)** - `summary_index`, summary text, and signatures are populated on `reasoning_summary_*` events for Anthropic, Bedrock, and Gemini. * **Responses-to-Chat finish\_reason (OSS)** - Chat `finish_reason` is derived from the Responses terminal state and incomplete details instead of being dropped. * **Anthropic Stream Truncation (OSS)** - `response.incomplete` and `response.failed` emit proper `message_delta`, `message_stop`, and `error` events instead of truncating the stream, and a missing terminal text suffix is synthesized from `output_text.done`. * **Anthropic-on-Vertex Passthrough (OSS)** - Usage and stream terminal detection for Anthropic models in Vertex GenAI passthrough mode go through the Anthropic parsers. * **Anthropic Passthrough for Non-Claude Models (OSS)** - Raw-body passthrough is cleared based on the resolved provider and model pair, so non-Claude models on Vertex, Azure, and Bedrock Mantle are converted instead of forwarded as Anthropic payloads, and also when the provider does not support the output config format. * **Unsupported Reasoning Signature (OSS)** - The encrypted reasoning signature is stripped when the upstream reports the field as unsupported, such as Bedrock Converse replaying a Claude signature onto a non-Anthropic model. * **Bedrock Reasoning Blocks (OSS)** - Unsigned reasoning blocks are dropped from Converse replays to Claude, while Nova and MiniMax keep receiving them, and native Grok or OpenAI reasoning summaries on Converse responses are rendered instead of dropped. * **Bedrock Null Content on Empty Assistant Messages (OSS)** - An assistant message with no text and no tool calls no longer serializes as `content:null`, which Converse rejected. * **Bedrock Model Routing to Converse (OSS)** - Bedrock models route to the Converse API as intended. * **GenAI Signature Drop (OSS)** - Standalone `thoughtSignature` parts with empty text are no longer dropped on native GenAI. * **Ollama max\_tokens (OSS)** - Ollama receives `max_tokens` instead of the unsupported `max_completion_tokens`. * **Cohere Rerank Documents (OSS)** - Rerank documents are sent as Cohere v2 strings rather than objects. * **Nullable Response Fields (OSS)** - Spec-required nullable response fields are marshalled as `null` instead of omitted. * **Model Arrays from OpenAI-Compatible APIs (OSS)** - Top-level arrays returned by OpenAI-compatible model listings are accepted. * **GPT-6 Astra Reasoning Effort (OSS)** - Max reasoning effort is preserved instead of being downgraded to high. * **Forced Tool Choice (OSS)** - Anthropic `tool_choice: any` maps to `required` on OpenAI egress, gated on the provider capability flag. * **Azure Reasoning Efforts (OSS)** - Reasoning effort handling for Azure-hosted models. * **Thinking Block Modification Error (OSS)** - Replayed thinking blocks no longer trigger a modification error. * **Custom Provider in List Models (OSS)** - Custom providers are skipped in list models when the request is not allowed to use them. * **Vertex GenAI Model Names (OSS)** - Vertex GenAI resource model names are normalised to bare IDs for governance and key selection. * **Allowed Models Wildcard (OSS)** - `allowed_models: ["*"]` no longer returns `model_blocked` when the live list-models store is empty for a provider. * **OpenRouter Prompt Caching on Responses (OSS)** - `cache_control` breakpoints are translated correctly for OpenRouter Claude models on the Responses API. * **Plugin Config Reverted on Restart (OSS)** - Plugin config edited via UI or API is no longer reverted from config.json on restart under `source_of_truth: split`. * **Realtime Observability and Auth (OSS)** - WebSocket Responses turns emit `llm.call` spans, realtime auth survives KV replication, and realtime WebSocket and WebRTC routes honour `enforce_auth_on_inference`. * **Budget State Preserved Across Edits (OSS)** - Changing a budget's reset frequency or fiscal-quarter setting no longer resets accumulated usage or drops `quarter_start_month`, new model budgets start empty, and budget IDs survive edits. * **Routing Rule Persistence (OSS)** - Stale routing rules are deleted inside the merge transaction to avoid priority collisions, and rule reads honour the row-visibility query scope. * **created\_at Preserved on Sync (OSS)** - `created_at` survives config sync and updates for budgets, rate limits, teams, customers, model configs, pricing overrides, routing rules, and plugins. * **Vault Encryption Deadlocks at Boot (OSS)** - Rows are encrypted one per transaction with cursor pagination and concurrent vault writes, preventing deadlocks and boot hangs. * **MCP Client Deletion (OSS)** - Legacy FK constraints on `oauth_user_tokens` and `oauth_user_sessions` are dropped so deleting an MCP client no longer fails, and the client ID is resolved before vault hooks run. * **SSRF Hardening for MCP (OSS)** - Unauthenticated callers cannot register stdio MCP clients or private addresses, all MCP HTTP clients dial through the SSRF guard, and the Teredo prefix is blocked. * **Rate Limits on Model-less Passthrough (OSS)** - Rate limits apply to passthrough requests that carry no model. * **Redis Semantic Cache (OSS)** - Hex value fields are handled and the score filter is removed from the Redis store. * **Prompt Child Scoping (OSS)** - Prompt child reads and writes are scoped to their parent prompt. * **Billed Usage on Failed Requests (OSS)** - Tracing emits billed token and cost attributes on failed requests. * **File Response MIME Type (OSS)** - File responses carry the MIME type. * **Logs Filter Search Case (OSS)** - Filter data search is case-insensitive on SQLite, Postgres, and ClickHouse. * **UI Fixes (OSS)** - Logout no longer cascades into 401s, virtual key loading state is consistent, managed VK state uses the server flag, and background polling pauses while an edit sheet is open. * **Dependency and Security Updates (OSS)** - Dependabot and CodeQL fixes across modules. ## 🗄️ Database Migrations Enterprise config store: * **ent\_add\_projects\_tables** - Creates `enterprise_projects` and its child tables (provider configs, MCP configs, members, member budget shares, member rate-limit shares) plus the budget join tables, with cascading FKs. Rollback drops every project table and discards all projects. * **ent\_add\_projects\_rbac\_resource** - Seeds the `Projects` RBAC resource with Create, View, Update, and Delete; Admin gets all four, Developer and Viewer get View. Rollback is a no-op. * **ent\_add\_project\_virtual\_mcps\_table** - Creates the project-to-Virtual-MCP link table. Rollback is a no-op so assignments are never dropped. * **ent\_add\_project\_allow\_all\_providers\_column** - Adds `allow_all_providers` (default false) to `enterprise_projects`. Reversible. * **ent\_add\_access\_profile\_allow\_all\_providers\_column** - Adds `allow_all_providers` (default false) to `enterprise_access_profiles` and `enterprise_user_access_profiles`. Reversible. * **ent\_add\_access\_profile\_auto\_rotation\_columns** - Adds `auto_rotation_interval_ns`, `next_rotation_at`, and `last_rotation_at` to `enterprise_access_profiles` with an index on `next_rotation_at`. Reversible. * **ent\_add\_role\_entity\_dac\_table** - Creates `enterprise_governance_role_dac` keyed by (role\_id, resource\_id) for per-entity DAC overrides. Rollback drops the table and every override. * **ent\_add\_role\_revision\_column** - Adds `revision BIGINT NOT NULL DEFAULT 0` to `enterprise_governance_roles`. Reversible. * **ent\_add\_user\_business\_units\_table** - Creates `enterprise_user_business_units` for per-user BU edges. Reversible. * **ent\_backfill\_user\_business\_units\_from\_teams** - Copies each team's manual BU onto every current team member, then resolves attribute BU mappings against each user's stored SCIM profile and claims. One-way; rollback is a no-op. * **ent\_relabel\_legacy\_scim\_business\_unit\_edges** - Rewrites edges whose source is the legacy `scim` literal to `attribute_mapping`, in batches of 500. One-way; rollback is a no-op. * **ent\_add\_user\_access\_profile\_source\_column** - Adds an indexed `source` column to `enterprise_user_access_profiles`. Reversible. * **ent\_backfill\_user\_access\_profile\_source** - Stamps `role_default` on holders whose parent is the user's current role default and `manual` on every remaining blank row. Rollback is a no-op. * **ent\_add\_virtual\_keys\_create\_standalone\_rbac\_operation** - Adds the `VirtualKeys:CreateStandalone` operation and grants it to every role that holds `VirtualKeys:Create`. Rollback is a no-op. * **ent\_drop\_access\_profile\_virtual\_key\_mirror** - Deletes mirrored provider configs, VK-scoped model configs, budgets, rate limits, and MCP configs from access-profile-managed virtual keys. Non-reversible: the mirror was derived state. * **ent\_adopt\_legacy\_user\_model\_configs\_to\_access\_profile\_scope** - Re-stamps `scope=user` model configs that uniquely match a profile's declared per-model limits to `scope=access_profile`; ambiguous rows are left as-is. Non-reversible. * **ent\_ap\_per\_model\_budget\_lines\_fks\_cascade** - Recreates four per-model budget line FKs with ON DELETE CASCADE. Rollback is a no-op. * **ent\_delete\_orphan\_user\_access\_profiles\_cascade\_parent\_fk** - Deletes user profile copies with no parent (and their budget and rate-limit rows), then makes the parent FK cascade. Non-reversible. * **ent\_fold\_access\_profile\_mcp\_servers\_overrides\_into\_configs** - Folds the legacy per-server MCP override tables into per-client allowlist config tables for profiles and user copies, then drops the four legacy tables. Rollback recreates the legacy tables empty; folded data is not reconstructed. * **ent\_migrate\_mcp\_tool\_groups\_rbac\_to\_virtual\_mcps** - Creates the `VirtualMCPs` RBAC resource and copies every grant on `MCPToolGroups` onto it. Rollback is a no-op. * **ent\_add\_governance\_node\_archives\_table** - Creates the dead-node governance archive table. Rollback drops the table and any archived usage. * **ent\_add\_guardrail\_rule\_send\_all\_conversation\_turns\_column** - Adds `send_all_conversation_turns` to `enterprise_guardrail_rules` and sets it false for rules with `max_turns_to_send > 0`. Reversible. OSS config store (from transports v2.1.0): * **backfill\_default\_complexity\_exemplars\_v2** - Rewrites the `complexity_semantic_config` governance row, appending curated default exemplar phrases and seeding the semantic row on pre-split installs. Non-reversible. * **add\_vk\_rotation\_cooldown\_columns**, **add\_vk\_rotation\_cooldown\_client\_column** - Adds `previous_value`, `previous_value_hash`, `previous_value_expires_at`, `rotated_at`, and an index to `governance_virtual_keys`, and `vk_rotation_cooldown_ns` to `config_client`. Reversible. * **drop\_legacy\_oauth\_user\_fk\_constraints** - Drops the MCP client and virtual key FK constraints on `oauth_user_tokens` and `oauth_user_sessions`. Reversible unless orphan rows accumulated. * **add\_virtual\_mcp\_tables**, **add\_mcp\_client\_endpoint\_slug** - Creates the virtual MCP and VK-to-virtual-MCP tables, adds `endpoint_slug` to `config_mcp_clients`, and backfills unique slugs. Non-reversible. * **add\_video\_resolution\_pricing\_columns** - Adds resolution-banded video per-second rate columns to `model_pricing`. Non-reversible; additive. * **add\_provider\_job\_kind\_columns**, **swap\_provider\_job\_indexes** - Adds `kind` (default `batch`) and `params` to `batch_jobs` and swaps the identity and sweeper indexes to include `kind`, concurrently on Postgres. Reversible only while no non-batch jobs exist. * **add\_compat\_azure\_deepseek\_column** - Adds `compat_azure_deepseek` to `config_client`, true on existing rows. Reversible. * **clear\_plugin\_config\_hashes** - Blanks `config_hash` on every plugin row so hash-based reconciliation starts clean. Rollback is a no-op. * **add\_mcp\_oauth\_token\_status\_reason\_column** - Adds `status_reason` to `mcp_oauth_tokens`. Reversible. * **add\_databricks\_key\_config\_columns** - Adds the five `databricks_*` key columns. Reversible. * **add\_github\_copilot\_config\_columns** - Adds the five `github_copilot_*` key columns. Non-reversible; additive. * **add\_allow\_all\_providers\_to\_virtual\_key**, **backfill\_vk\_allow\_all\_providers\_hash** - Adds `allow_all_providers` (default false) to `governance_virtual_keys` and recomputes every VK `config_hash`. Column add is reversible; hash rollback is a no-op. * **add\_prompt\_cache\_json\_column** - Adds `prompt_cache_json` to the provider table. Reversible. OSS log store (from transports v2.1.0): nine additive migrations (`logs_add_complexity_routing_columns`, `logs_add_session_id_column`, `logs_add_routing_metadata_column`, `webhook_deliveries_add_filter_indexes_v1`, `logs_add_video_debug_column`, `logs_add_project_columns`, `mcp_tool_logs_add_project_columns`, `logs_add_served_model_column`, `logs_add_tool_call_names_column`) add nullable columns to `logs` and `mcp_tool_logs` and filter indexes on `webhook_deliveries`. No backfill, no data rewrite. All reversible. This release adds new columns to the log store. Each `ADD COLUMN` takes an `ACCESS EXCLUSIVE` lock on `logs`, the highest-volume table, and on Postgres the migration waits at most 5 seconds for that lock before failing the boot and retrying on the next one. Upgrade during a low-activity window so the lock is acquired immediately and no queries queue behind it. **To apply the log store schema ahead of the upgrade**, run the statements below against the log store database. They match what the migrator executes, and every statement is idempotent. After the DDL you must also record the nine migration IDs in the `migrations` table (shown after the SQLite block) so the next boot treats them as applied. Postgres: ```sql theme={null} -- logs_add_complexity_routing_columns BEGIN; SET LOCAL lock_timeout = '5s'; ALTER TABLE logs ADD COLUMN IF NOT EXISTS complexity_tier varchar(50); ALTER TABLE logs ADD COLUMN IF NOT EXISTS complexity_mechanism varchar(50); ALTER TABLE logs ADD COLUMN IF NOT EXISTS complexity_score decimal; COMMIT; -- logs_add_session_id_column BEGIN; SET LOCAL lock_timeout = '5s'; ALTER TABLE logs ADD COLUMN IF NOT EXISTS session_id varchar(255); COMMIT; -- logs_add_routing_metadata_column BEGIN; SET LOCAL lock_timeout = '5s'; ALTER TABLE logs ADD COLUMN IF NOT EXISTS routing_metadata text; COMMIT; -- webhook_deliveries_add_filter_indexes_v1 is a no-op on Postgres; its indexes are built concurrently below -- logs_add_video_debug_column ALTER TABLE logs ADD COLUMN IF NOT EXISTS video_debug text; -- logs_add_project_columns ALTER TABLE logs ADD COLUMN IF NOT EXISTS project_id varchar(255); ALTER TABLE logs ADD COLUMN IF NOT EXISTS project_name varchar(255); -- mcp_tool_logs_add_project_columns ALTER TABLE mcp_tool_logs ADD COLUMN IF NOT EXISTS project_id varchar(255); ALTER TABLE mcp_tool_logs ADD COLUMN IF NOT EXISTS project_name varchar(255); -- logs_add_served_model_column ALTER TABLE logs ADD COLUMN IF NOT EXISTS served_model varchar(255); -- logs_add_tool_call_names_column BEGIN; SET LOCAL lock_timeout = '5s'; ALTER TABLE logs ADD COLUMN IF NOT EXISTS tool_call_names text; COMMIT; -- Indexes Bifrost builds after startup, outside a transaction CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_logs_complexity_tier ON logs(complexity_tier) WHERE complexity_tier IS NOT NULL; CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_logs_complexity_mechanism ON logs(complexity_mechanism) WHERE complexity_mechanism IS NOT NULL; CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_logs_session_id ON logs(session_id) WHERE session_id IS NOT NULL; CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_logs_tool_call_names_arr ON logs USING GIN (string_to_array(tool_call_names, ',')) WHERE tool_call_names IS NOT NULL; CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_logs_project_id ON logs(project_id); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_mcp_logs_project_id ON mcp_tool_logs(project_id); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_webhook_deliveries_endpoint_created ON webhook_deliveries(endpoint_id, created_at DESC); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_webhook_deliveries_outcome ON webhook_deliveries(outcome); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_webhook_deliveries_event ON webhook_deliveries(event); CREATE INDEX CONCURRENTLY IF NOT EXISTS idx_webhook_deliveries_request_id ON webhook_deliveries(request_id); ``` SQLite (no `IF NOT EXISTS` on `ADD COLUMN`; skip any column that already exists): ```sql theme={null} ALTER TABLE logs ADD COLUMN complexity_tier varchar(50); ALTER TABLE logs ADD COLUMN complexity_mechanism varchar(50); ALTER TABLE logs ADD COLUMN complexity_score real; ALTER TABLE logs ADD COLUMN session_id varchar(255); CREATE INDEX IF NOT EXISTS idx_logs_session_id ON logs(session_id) WHERE session_id IS NOT NULL; ALTER TABLE logs ADD COLUMN routing_metadata text; CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_endpoint_created ON webhook_deliveries(endpoint_id, created_at DESC); CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_outcome ON webhook_deliveries(outcome); CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_event ON webhook_deliveries(event); CREATE INDEX IF NOT EXISTS idx_webhook_deliveries_request_id ON webhook_deliveries(request_id); ALTER TABLE logs ADD COLUMN video_debug text; ALTER TABLE logs ADD COLUMN project_id varchar(255); ALTER TABLE logs ADD COLUMN project_name varchar(255); ALTER TABLE mcp_tool_logs ADD COLUMN project_id varchar(255); ALTER TABLE mcp_tool_logs ADD COLUMN project_name varchar(255); ALTER TABLE logs ADD COLUMN served_model varchar(255); ALTER TABLE logs ADD COLUMN tool_call_names text; ``` Then record the migrations in the log store's `migrations` table (Postgres and SQLite). Run in this order. On SQLite use `CURRENT_TIMESTAMP` instead of `NOW()`: ```sql theme={null} INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_complexity_routing_columns', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_session_id_column', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_routing_metadata_column', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'webhook_deliveries_add_filter_indexes_v1', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_video_debug_column', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_project_columns', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'mcp_tool_logs_add_project_columns', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_served_model_column', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; INSERT INTO migrations (id, sequence, applied_at, status) SELECT 'logs_add_tool_call_names_column', COALESCE(MAX(sequence), 0) + 1, NOW(), 'success' FROM migrations; ``` ClickHouse has no migration ledger; Bifrost reconciles missing columns on boot with `ADD COLUMN IF NOT EXISTS` (add `ON CLUSTER` when configured): ```sql theme={null} ALTER TABLE logs ADD COLUMN IF NOT EXISTS complexity_tier Nullable(String); ALTER TABLE logs ADD COLUMN IF NOT EXISTS complexity_mechanism Nullable(String); ALTER TABLE logs ADD COLUMN IF NOT EXISTS complexity_score Nullable(Float64); ALTER TABLE logs ADD COLUMN IF NOT EXISTS session_id Nullable(String); ALTER TABLE logs ADD COLUMN IF NOT EXISTS routing_metadata String; ALTER TABLE logs ADD COLUMN IF NOT EXISTS video_debug String; ALTER TABLE logs ADD COLUMN IF NOT EXISTS project_id Nullable(String); ALTER TABLE logs ADD COLUMN IF NOT EXISTS project_name Nullable(String); ALTER TABLE logs ADD COLUMN IF NOT EXISTS served_model Nullable(String); ALTER TABLE logs ADD COLUMN IF NOT EXISTS tool_call_names Nullable(String); ALTER TABLE mcp_tool_logs ADD COLUMN IF NOT EXISTS project_id Nullable(String); ALTER TABLE mcp_tool_logs ADD COLUMN IF NOT EXISTS project_name Nullable(String); ``` ## 🐙 Closed OSS Issues * [#2765](https://github.com/maximhq/bifrost/issues/2765) - Bedrock provider does not sanitize empty content blocks (regression from #1189 fix) * [#5887](https://github.com/maximhq/bifrost/issues/5887) - DeepSeek thinking silently lost on ALL multi-turn requests via OpenAI-compat inbound (v1.6.7; regression from v1.6.3) * [#6073](https://github.com/maximhq/bifrost/issues/6073) - GenAI passthrough in Vertex mode breaks Anthropic models * [#6132](https://github.com/maximhq/bifrost/issues/6132) - Ollama provider: max\_tokens / max\_completion\_tokens silently dropped from forwarded request * [#6143](https://github.com/maximhq/bifrost/issues/6143) - data race - fasthttp requestStream released to pool while SSE reader is still inside Read (stream cancellation) * [#6180](https://github.com/maximhq/bifrost/issues/6180) - explicit prompt cache for Bedrock Mantle GPT-5.6 Responses * [#6265](https://github.com/maximhq/bifrost/issues/6265) - Realtime/WebSocket Responses turns produce no llm.call span, so span-based observability connectors export them unattributed * [#6290](https://github.com/maximhq/bifrost/issues/6290) - OpenRouter Claude prompt caching remains broken on Responses API * [#6434](https://github.com/maximhq/bifrost/issues/6434) - Plugin config edited via UI/API is reverted from config.json on every restart under source\_of\_truth: split * [#6624](https://github.com/maximhq/bifrost/issues/6624) - Bedrock reasoning signature field is dropped for Anthropic models, which require it present * [#6631](https://github.com/maximhq/bifrost/issues/6631) - add Baseten to Hugging Face inference providers * [#6640](https://github.com/maximhq/bifrost/issues/6640) - v2.0.0 rerank sends documents as objects to Cohere-based custom providers, breaking servers that expect Cohere v2 strings * [#6657](https://github.com/maximhq/bifrost/issues/6657) - Fireworks virtual key with allowed\_models: \["\*"] blocks every model (empty synced catalog; explicit list works) * [#6689](https://github.com/maximhq/bifrost/issues/6689) - Responses omit spec-required nullable fields * [#6690](https://github.com/maximhq/bifrost/issues/6690) - \[MCP Library] Add: Magic Hour * [#6711](https://github.com/maximhq/bifrost/issues/6711) - Support array responses from OpenAI-compatible model APIs * [#6730](https://github.com/maximhq/bifrost/issues/6730) - Native GenAI drops empty text from standalone thoughtSignature parts * [#6775](https://github.com/maximhq/bifrost/issues/6775) - OSS ui typecheck fails since #6618 (VKCreationPolicyResponse missing from fallback types) * [#6784](https://github.com/maximhq/bifrost/issues/6784) - Chat completion stream hangs forever after finish\_reason when upstream omits \[DONE] but keeps sending heartbeats * [#6831](https://github.com/maximhq/bifrost/issues/6831) - Responses-to-Chat mux drops non-streaming finish\_reason * [#6880](https://github.com/maximhq/bifrost/issues/6880) - GPT-6 Astra max reasoning effort is silently downgraded to high * [#6887](https://github.com/maximhq/bifrost/issues/6887) - Anthropic tool\_choice `{type: any}` forwarded to OpenAI as "any" instead of "required" * [#6914](https://github.com/maximhq/bifrost/issues/6914) - Team current spend is reset after adjusting budget limit even when choosing Preserve Usage ## 📀 Base OSS version `transports/v2.1.0` (pinned as `github.com/maximhq/bifrost/transports v1.6.12-0.20260908151718-096d5c8b3736`), with core `v1.8.5`, framework `v1.6.1`, governance `v1.7.1`, and logging `v1.7.1`. ## 🔌 If you are compiling plugin against this release - use following deps ```go theme={null} module github.com/maximhq/bifrost-enterprise/transports go 1.27.0 require ( github.com/bytedance/sonic v1.15.3-0.20260730064818-2a36d6da63e2 github.com/coreos/go-oidc/v3 v3.18.0 github.com/fasthttp/router v1.5.4 github.com/google/cel-go v0.30.0 github.com/google/uuid v1.6.0 github.com/maximhq/bifrost-enterprise/core v0.0.0 github.com/maximhq/bifrost-enterprise/framework v0.0.0 github.com/maximhq/bifrost-enterprise/plugins v0.0.0 github.com/maximhq/bifrost/core v1.8.5 github.com/maximhq/bifrost/framework v1.6.1 github.com/maximhq/bifrost/plugins/governance v1.7.1 github.com/maximhq/bifrost/plugins/logging v1.7.1 github.com/maximhq/bifrost/plugins/routing v1.0.1 github.com/maximhq/bifrost/plugins/semanticcache v1.6.1 github.com/maximhq/bifrost/transports v1.6.12-0.20260908151718-096d5c8b3736 github.com/stretchr/testify v1.11.1 github.com/valyala/fasthttp v1.74.0 golang.org/x/sync v0.22.0 gorm.io/driver/sqlite v1.6.0 gorm.io/gorm v1.31.1 ) require ( cel.dev/expr v0.25.2 // indirect cloud.google.com/go v0.123.0 // indirect cloud.google.com/go/auth v0.20.0 // indirect cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect cloud.google.com/go/bigquery v1.74.0 // indirect cloud.google.com/go/compute/metadata v0.9.0 // indirect cloud.google.com/go/iam v1.7.0 // indirect cloud.google.com/go/monitoring v1.24.3 // indirect cloud.google.com/go/pubsub/v2 v2.4.0 // indirect cloud.google.com/go/secretmanager v1.16.0 // indirect cloud.google.com/go/storage v1.62.1 // indirect dario.cat/mergo v1.0.2 // indirect github.com/Azure/azure-sdk-for-go/sdk/azcore v1.20.0 // indirect github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 // indirect github.com/Azure/azure-sdk-for-go/sdk/internal v1.11.2 // indirect github.com/AzureAD/microsoft-authentication-library-for-go v1.6.0 // indirect github.com/BobuSumisu/aho-corasick v1.0.3 // indirect github.com/ClickHouse/ch-go v0.65.0 // indirect github.com/ClickHouse/clickhouse-go/v2 v2.32.0 // indirect github.com/DataDog/datadog-agent/comp/core/tagger/origindetection v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/obfuscate v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/opentelemetry-mapping-go/otlp/attributes v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/proto v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/template v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/trace v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/log v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/otel v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/stats v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/trace/traceutil v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/util/log v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/util/scrubber v0.77.0 // indirect github.com/DataDog/datadog-agent/pkg/version v0.77.0 // indirect github.com/DataDog/datadog-go/v5 v5.8.3 // indirect github.com/DataDog/dd-trace-go/v2 v2.8.2 // indirect github.com/DataDog/go-libddwaf/v4 v4.9.0 // indirect github.com/DataDog/go-runtime-metrics-internal v0.0.4-0.20260217080614-b0f4edc38a6d // indirect github.com/DataDog/go-sqllexer v0.1.13 // indirect github.com/DataDog/go-tuf v1.1.1-0.5.2 // indirect github.com/DataDog/sketches-go v1.4.8 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect github.com/Masterminds/goutils v1.1.1 // indirect github.com/Masterminds/semver/v3 v3.4.0 // indirect github.com/Masterminds/sprig/v3 v3.3.0 // indirect github.com/Microsoft/go-winio v0.6.2 // indirect github.com/ProtonMail/go-crypto v1.1.6 // indirect github.com/STARRY-S/zip v0.2.1 // indirect github.com/andybalholm/brotli v1.2.2 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/apache/arrow/go/v15 v15.0.2 // indirect github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect github.com/armon/go-metrics v0.4.1 // indirect github.com/aws/aws-sdk-go-v2 v1.42.0 // indirect github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.10 // indirect github.com/aws/aws-sdk-go-v2/config v1.32.14 // indirect github.com/aws/aws-sdk-go-v2/credentials v1.19.14 // indirect github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.21 // indirect github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.29 // indirect github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.29 // indirect github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6 // indirect github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 // indirect github.com/aws/aws-sdk-go-v2/service/bedrockruntime v1.50.6 // indirect github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 // indirect github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 // indirect github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 // indirect github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 // indirect github.com/aws/aws-sdk-go-v2/service/s3 v1.99.0 // indirect github.com/aws/aws-sdk-go-v2/service/secretsmanager v1.42.3 // indirect github.com/aws/aws-sdk-go-v2/service/signin v1.0.9 // indirect github.com/aws/aws-sdk-go-v2/service/sso v1.30.15 // indirect github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.19 // indirect github.com/aws/aws-sdk-go-v2/service/sts v1.41.10 // indirect github.com/aws/smithy-go v1.27.1 // indirect github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect github.com/bahlo/generic-list-go v0.2.0 // indirect github.com/beorn7/perks v1.0.1 // indirect github.com/blevesearch/go-porterstemmer v1.0.3 // indirect github.com/bodgit/plumbing v1.3.0 // indirect github.com/bodgit/sevenzip v1.6.0 // indirect github.com/bodgit/windows v1.0.1 // indirect github.com/buger/jsonparser v1.2.0 // indirect github.com/bytedance/gopkg v0.1.3 // indirect github.com/bytedance/sonic/loader v0.5.2 // indirect github.com/cenkalti/backoff v2.2.1+incompatible // indirect github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cenkalti/backoff/v5 v5.0.3 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/charmbracelet/colorprofile v0.3.1 // indirect github.com/charmbracelet/lipgloss v1.1.0 // indirect github.com/charmbracelet/x/ansi v0.10.1 // indirect github.com/charmbracelet/x/cellbuf v0.0.13 // indirect github.com/charmbracelet/x/term v0.2.1 // indirect github.com/cihub/seelog v0.0.0-20170130134532-f561c5e57575 // indirect github.com/cloudflare/circl v1.6.3 // indirect github.com/cloudwego/base64x v0.1.6 // indirect github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect github.com/coreos/go-semver v0.3.1 // indirect github.com/coreos/go-systemd/v22 v22.6.0 // indirect github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect github.com/dsnet/compress v0.0.2-0.20230904184137-39efe44ab707 // indirect github.com/dustin/go-humanize v1.0.1 // indirect github.com/ebitengine/purego v0.10.0 // indirect github.com/emicklei/go-restful/v3 v3.13.0 // indirect github.com/emirpasic/gods v1.18.1 // indirect github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect github.com/fasthttp/websocket v1.5.12 // indirect github.com/fatih/color v1.18.0 // indirect github.com/fatih/semgroup v1.2.0 // indirect github.com/felixge/httpsnoop v1.0.4 // indirect github.com/fsnotify/fsnotify v1.9.0 // indirect github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/gitleaks/go-gitdiff v0.9.1 // indirect github.com/go-faster/city v1.0.1 // indirect github.com/go-faster/errors v0.7.1 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect github.com/go-git/go-billy/v5 v5.9.0 // indirect github.com/go-git/go-git/v5 v5.19.2 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/go-openapi/analysis v0.24.2 // indirect github.com/go-openapi/errors v0.22.5 // indirect github.com/go-openapi/jsonpointer v0.22.4 // indirect github.com/go-openapi/jsonreference v0.21.4 // indirect github.com/go-openapi/loads v0.23.2 // indirect github.com/go-openapi/runtime v0.29.2 // indirect github.com/go-openapi/spec v0.22.3 // indirect github.com/go-openapi/strfmt v0.25.0 // indirect github.com/go-openapi/swag v0.25.4 // indirect github.com/go-openapi/swag/cmdutils v0.25.4 // indirect github.com/go-openapi/swag/conv v0.25.4 // indirect github.com/go-openapi/swag/fileutils v0.25.4 // indirect github.com/go-openapi/swag/jsonname v0.25.4 // indirect github.com/go-openapi/swag/jsonutils v0.25.4 // indirect github.com/go-openapi/swag/loading v0.25.4 // indirect github.com/go-openapi/swag/mangling v0.25.4 // indirect github.com/go-openapi/swag/netutils v0.25.4 // indirect github.com/go-openapi/swag/stringutils v0.25.4 // indirect github.com/go-openapi/swag/typeutils v0.25.4 // indirect github.com/go-openapi/swag/yamlutils v0.25.4 // indirect github.com/go-openapi/validate v0.25.1 // indirect github.com/go-viper/mapstructure/v2 v2.5.0 // indirect github.com/goccy/go-json v0.10.5 // indirect github.com/gogo/protobuf v1.3.2 // indirect github.com/golang-jwt/jwt/v5 v5.3.1 // indirect github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect github.com/golang/protobuf v1.5.4 // indirect github.com/google/btree v1.1.3 // indirect github.com/google/flatbuffers v23.5.26+incompatible // indirect github.com/google/gnostic-models v0.7.0 // indirect github.com/google/pprof v0.0.0-20260802141513-ef3492d7dac3 // indirect github.com/google/s2a-go v0.1.9 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.16 // indirect github.com/googleapis/gax-go/v2 v2.22.0 // indirect github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect github.com/grandcat/zeroconf v1.0.0 // indirect github.com/grpc-ecosystem/grpc-gateway/v2 v2.29.0 // indirect github.com/h2non/filetype v1.1.3 // indirect github.com/hashicorp/consul/api v1.34.3 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-hclog v1.6.3 // indirect github.com/hashicorp/go-immutable-radix v1.3.1 // indirect github.com/hashicorp/go-metrics v0.5.4 // indirect github.com/hashicorp/go-msgpack/v2 v2.1.5 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect github.com/hashicorp/go-retryablehttp v0.7.8 // indirect github.com/hashicorp/go-rootcerts v1.0.2 // indirect github.com/hashicorp/go-secure-stdlib/parseutil v0.2.0 // indirect github.com/hashicorp/go-secure-stdlib/strutil v0.1.2 // indirect github.com/hashicorp/go-sockaddr v1.0.7 // indirect github.com/hashicorp/go-version v1.8.0 // indirect github.com/hashicorp/golang-lru v1.0.2 // indirect github.com/hashicorp/golang-lru/v2 v2.0.7 // indirect github.com/hashicorp/hcl v1.0.1-vault-7 // indirect github.com/hashicorp/memberlist v0.5.4 // indirect github.com/hashicorp/serf v0.10.1 // indirect github.com/hashicorp/vault/api v1.23.0 // indirect github.com/huandu/xstrings v1.5.0 // indirect github.com/invopop/jsonschema v0.13.0 // indirect github.com/jackc/pgpassfile v1.0.0 // indirect github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect github.com/jackc/pgx/v5 v5.9.2 // indirect github.com/jackc/puddle/v2 v2.2.2 // indirect github.com/jaswdr/faker/v2 v2.8.0 // indirect github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect github.com/jinzhu/inflection v1.0.0 // indirect github.com/jinzhu/now v1.1.5 // indirect github.com/json-iterator/go v1.1.12 // indirect github.com/kevinburke/ssh_config v1.2.0 // indirect github.com/klauspost/compress v1.20.0 // indirect github.com/klauspost/cpuid/v2 v2.3.0 // indirect github.com/klauspost/pgzip v1.2.6 // indirect github.com/kylelemons/godebug v1.1.0 // indirect github.com/linkdata/deadlock v0.5.5 // indirect github.com/lucasb-eyer/go-colorful v1.2.0 // indirect github.com/lufia/plan9stats v0.0.0-20260216142805-b3301c5f2a88 // indirect github.com/magiconair/properties v1.8.10 // indirect github.com/mailru/easyjson v0.9.1 // indirect github.com/mark3labs/mcp-go v0.43.2 // indirect github.com/mattn/go-colorable v0.1.14 // indirect github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-runewidth v0.0.17 // indirect github.com/mattn/go-sqlite3 v1.14.32 // indirect github.com/maximhq/bifrost/plugins/compat v0.2.1 // indirect github.com/maximhq/bifrost/plugins/maxim v1.7.1 // indirect github.com/maximhq/bifrost/plugins/mocker v1.6.1 // indirect github.com/maximhq/bifrost/plugins/modelcatalogresolver v1.1.1 // indirect github.com/maximhq/bifrost/plugins/otel v1.5.1 // indirect github.com/maximhq/bifrost/plugins/prompts v1.1.1 // indirect github.com/maximhq/bifrost/plugins/telemetry v1.6.1 // indirect github.com/maximhq/maxim-go v0.2.1 // indirect github.com/mholt/archives v0.1.2 // indirect github.com/miekg/dns v1.1.68 // indirect github.com/minio/minlz v1.0.0 // indirect github.com/minio/simdjson-go v0.4.5 // indirect github.com/mitchellh/copystructure v1.2.0 // indirect github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/mapstructure v1.5.0 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/molecule-man/go-brrr v1.0.1 // indirect github.com/muesli/termenv v0.16.0 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect github.com/nakabonne/tstorage v0.3.6 // indirect github.com/nwaples/rardecode/v2 v2.2.2 // indirect github.com/oapi-codegen/runtime v1.1.1 // indirect github.com/oklog/ulid v1.3.1 // indirect github.com/outcaste-io/ristretto v0.2.3 // indirect github.com/paulmach/orb v0.11.1 // indirect github.com/pelletier/go-toml/v2 v2.2.3 // indirect github.com/petermattis/goid v0.0.0-20260226131333-17d1149c6ac6 // indirect github.com/philhofer/fwd v1.2.0 // indirect github.com/philippgille/chromem-go v0.7.0 // indirect github.com/pierrec/lz4/v4 v4.1.22 // indirect github.com/pinecone-io/go-pinecone/v5 v5.3.0 // indirect github.com/pion/datachannel v1.6.0 // indirect github.com/pion/dtls/v3 v3.1.5 // indirect github.com/pion/ice/v4 v4.2.1 // indirect github.com/pion/interceptor v0.1.44 // indirect github.com/pion/logging v0.2.4 // indirect github.com/pion/mdns/v2 v2.1.0 // indirect github.com/pion/randutil v0.1.0 // indirect github.com/pion/rtcp v1.2.16 // indirect github.com/pion/rtp v1.10.1 // indirect github.com/pion/sctp v1.9.2 // indirect github.com/pion/sdp/v3 v3.0.18 // indirect github.com/pion/srtp/v3 v3.0.10 // indirect github.com/pion/stun/v3 v3.1.6 // indirect github.com/pion/transport/v4 v4.0.2 // indirect github.com/pion/turn/v4 v4.1.4 // indirect github.com/pion/webrtc/v4 v4.2.9 // indirect github.com/pjbgf/sha1cd v0.6.0 // indirect github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect github.com/pkg/errors v0.9.1 // indirect github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/prometheus/client_golang v1.23.2 // indirect github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.67.5 // indirect github.com/prometheus/procfs v0.19.2 // indirect github.com/puzpuzpuz/xsync/v3 v3.5.1 // indirect github.com/qdrant/go-client v1.16.2 // indirect github.com/redis/go-redis/v9 v9.17.2 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/rs/zerolog v1.34.0 // indirect github.com/ryanuber/go-glob v1.0.0 // indirect github.com/sagikazarmark/locafero v0.7.0 // indirect github.com/sagikazarmark/slog-shim v0.1.0 // indirect github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect github.com/savsgio/gotils v0.0.0-20250408102913-196191ec6287 // indirect github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529 // indirect github.com/secure-systems-lab/go-securesystemslib v0.10.0 // indirect github.com/segmentio/asm v1.2.0 // indirect github.com/segmentio/kafka-go v0.4.51 // indirect github.com/sergi/go-diff v1.4.0 // indirect github.com/shirou/gopsutil/v4 v4.26.3 // indirect github.com/shopspring/decimal v1.4.0 // indirect github.com/skeema/knownhosts v1.3.1 // indirect github.com/sorairolake/lzip-go v0.3.5 // indirect github.com/sourcegraph/conc v0.3.0 // indirect github.com/spf13/afero v1.15.0 // indirect github.com/spf13/cast v1.10.0 // indirect github.com/spf13/pflag v1.0.10 // indirect github.com/spf13/viper v1.19.0 // indirect github.com/spiffe/go-spiffe/v2 v2.7.0 // indirect github.com/stretchr/objx v0.5.3 // indirect github.com/subosito/gotenv v1.6.0 // indirect github.com/tetratelabs/wazero v1.11.0 // indirect github.com/therootcompany/xz v1.0.1 // indirect github.com/tidwall/gjson v1.18.0 // indirect github.com/tidwall/match v1.1.1 // indirect github.com/tidwall/pretty v1.2.1 // indirect github.com/tidwall/sjson v1.2.5 // indirect github.com/tinylib/msgp v1.6.3 // indirect github.com/tklauser/go-sysconf v0.3.16 // indirect github.com/tklauser/numcpus v0.11.0 // indirect github.com/trailofbits/go-mutexasserts v0.0.0-20250514102930-c1f3d2e37561 // indirect github.com/twitchyliquid64/golang-asm v0.15.1 // indirect github.com/ulikunitz/xz v0.5.15 // indirect github.com/valyala/bytebufferpool v1.0.0 // indirect github.com/wasilibs/go-re2 v1.9.0 // indirect github.com/wasilibs/wazero-helpers v0.0.0-20240620070341-3dff1577cd52 // indirect github.com/weaviate/weaviate v1.38.0 // indirect github.com/weaviate/weaviate-go-client/v5 v5.7.1 // indirect github.com/wk8/go-ordered-map/v2 v2.1.8 // indirect github.com/wlynxg/anet v0.0.5 // indirect github.com/x448/float16 v0.8.4 // indirect github.com/xanzy/ssh-agent v0.3.3 // indirect github.com/xdg-go/pbkdf2 v1.0.0 // indirect github.com/xdg-go/scram v1.1.2 // indirect github.com/xdg-go/stringprep v1.0.4 // indirect github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect github.com/yosida95/uritemplate/v3 v3.0.2 // indirect github.com/yusufpapurcu/wmi v1.2.4 // indirect github.com/zeebo/xxh3 v1.1.0 // indirect github.com/zricethezav/gitleaks/v8 v8.30.1 // indirect go.etcd.io/etcd/api/v3 v3.6.11 // indirect go.etcd.io/etcd/client/pkg/v3 v3.6.11 // indirect go.etcd.io/etcd/client/v3 v3.6.11 // indirect go.mongodb.org/mongo-driver v1.17.7 // indirect go.opencensus.io v0.24.0 // indirect go.opentelemetry.io/auto/sdk v1.2.1 // indirect go.opentelemetry.io/collector/component v1.51.1-0.20260205185216-81bc641f26c0 // indirect go.opentelemetry.io/collector/featuregate v1.51.1-0.20260205185216-81bc641f26c0 // indirect go.opentelemetry.io/collector/pdata v1.51.1-0.20260205185216-81bc641f26c0 // indirect go.opentelemetry.io/collector/pdata/pprofile v0.145.1-0.20260205185216-81bc641f26c0 // indirect go.opentelemetry.io/contrib/detectors/gcp v1.44.0 // indirect go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect go.opentelemetry.io/otel v1.44.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.44.0 // indirect go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.44.0 // indirect go.opentelemetry.io/otel/metric v1.44.0 // indirect go.opentelemetry.io/otel/sdk v1.44.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.44.0 // indirect go.opentelemetry.io/otel/trace v1.44.0 // indirect go.opentelemetry.io/proto/otlp v1.10.0 // indirect go.starlark.net v0.0.0-20260102030733-3fee463870c9 // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.27.1 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/arch v0.23.0 // indirect golang.org/x/crypto v0.55.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.58.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect golang.org/x/term v0.45.0 // indirect golang.org/x/text v0.41.0 // indirect golang.org/x/time v0.15.0 // indirect golang.org/x/tools v0.48.0 // indirect golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect google.golang.org/api v0.282.0 // indirect google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect google.golang.org/grpc v1.83.1 // indirect google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/ini.v1 v1.67.1 // indirect gopkg.in/warnings.v0 v0.1.2 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect gorm.io/driver/clickhouse v0.7.0 // indirect gorm.io/driver/postgres v1.6.0 // indirect k8s.io/api v0.36.1 // indirect k8s.io/apimachinery v0.36.1 // indirect k8s.io/client-go v0.36.1 // indirect k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect sigs.k8s.io/yaml v1.6.0 // indirect ) ```