Skip to main content
​
v2.1.41

​
Changelog

  • Added bifrost.governance.roles[].access_profiles for granting multiple access profiles to a role. The plural list takes precedence over the deprecated singular access_profile; an explicit empty list removes all profile grants.
  • Added bifrost.scim.trustedNetworks — the private IP/CIDR allowlist the SSRF guard consults before the generic provider’s outbound OIDC discovery calls (Discover endpoints / Discover claims), so a self-hosted IdP on 10.x, 172.16-31.x, or 192.168.x is reachable from a declarative install instead of only from the dashboard. Each entry is { cidr, description }: a bare IP is treated as a single host (/32, or /128 for IPv6) and hostnames are rejected. Declaring the key makes Helm own the whole list - it replaces whatever is stored, and an explicit trustedNetworks: [] clears dashboard-added ranges - while omitting it leaves them untouched.
  • Added mcp.clientConfigs[].perUserHeaderKeys — the header names each caller must individually supply under authType: per_user_headers (e.g. ["Authorization"]).
  • Added bifrost.plugins.otel.config.overhead_breakdown_enabled (default false) and bifrost.plugins.telemetry.config.overhead_breakdown_enabled - exports the per-component overhead histogram bifrost_overhead_component_microseconds, overhead latency split by the overhead_component label.
  • Fixed bifrost.plugins.otel.config.export_overhead_spans not rendering into config.json.