Skip to main content
v2.3.2

Changelog

v2.3.2 is a security release. It moves the enterprise gateway onto OSS transports v2.3.2 and builds every enterprise module with Go 1.27.3, which fixes CVE-2026-111943 in crypto/x509. There are no feature changes and no new database migrations.

🔒 Security

  • Go 1.27.3 - Security release for CVE-2026-111943 in crypto/x509: certificate chains through a small set of intermediates from a specific Certificate Authority are no longer accepted by Verify. This covers every TLS connection Bifrost makes to providers, MCP servers and other upstreams. The enterprise core, framework, plugins and transports modules now build with Go 1.27.3, and the gateway Docker images move to golang:1.27.3-alpine3.24. Custom Go plugins must be rebuilt with Go 1.27.3 to load.

🔧 Maintenance

  • OSS Dependency Upgrades - Moves to OSS core v1.13.1, framework v1.10.1, governance and logging plugins v1.10.1, routing v1.2.2, semanticcache v1.7.2, telemetry v1.9.2 and transports v2.3.2.

🗄️ Database Migrations

Enterprise

  • No new database migrations in this release.

Open Source

  • No new database migrations in this release.

📀 Base OSS version

transports/v2.3.2

🔌 If you are compiling plugin against this release - use following deps