Skip to main content
​
v1.4.5
Breaking changes in v1.4.0. See the v1.4.0 Migration Guide for full before/after examples, automatic migration details, and a step-by-step checklist before upgrading.

​
Changelog

Bifrost Enterprise v1.4.5 is a release on transports/v1.5.6 centered on identity lifecycle and MCP per-user authentication. Headline items: new onboarding and IdP deprovisioning flows that sync user activeness on login, token refresh, and a periodic 15-minute reconcile (with Okta scoped to app-associated groups and users), end-to-end MCP per-user header auth with credential storage, lazy submission, TLS configuration, and sessions filtering, and a large governance UI overhaul that moves users, teams, business units, RBAC, and access profiles off dialogs onto keyboard-navigable sheets. The release also brings OSS additions like a direct API-key request header, dimension rankings dashboards, key rotation on auth failures, model pricing attributes, Opus 4.8 support, and OTel spec-compatible metrics.

​
✨ Features

​
Access & Identity

  • Onboarding and IdP deprovisioning flows : new user onboarding and extension flows, with deprovisioning wired into login, token refresh, and a periodic sync so accounts removed at the IdP are reconciled automatically.
  • User activeness sync : user active state is checked on each session refresh and synced with the IdP every 15 minutes, so disabled users lose access promptly.
  • Okta app-scoped sync : Okta now syncs only the groups and users associated with the app, rather than the entire directory.
  • App removal deletes the user : removing an app now deletes the associated user even on app disassociation, keeping membership consistent.

​
MCP

  • MCP per-user authentication : new per-user header auth type with credential storage, lazy-auth submission, and reconciliation of per-user credentials on virtual-key and MCP-client changes (OSS + enterprise).
  • MCP TLS configuration : configurable TLS (insecureSkipVerify, caCertPem) for HTTP/SSE MCP client connections (OSS).
  • MCP sessions filtering : filter, search, and pagination on the MCP sessions list API and table, plus a can_reauth identity gate (OSS + enterprise).

​
Governance UI

  • Governance UI moved to sheets : users, teams, business units, RBAC, and access profiles moved off dialogs onto sheets, with full prev/next keyboard navigation and URL state across each sheet (OSS + enterprise).
  • Attach business units from teams : teams can attach to a business unit directly from the teams sheet, with a warning surfaced for teams already attached.
  • SearchSelect adoption : governance pages start using the SearchSelect component for faster filtering, alongside assorted governance view fixes.

​
OSS Base (transports/v1.5.6)

  • Direct API key header : pass a provider API key directly via a request header.
  • Dimension rankings dashboard : new dashboard tabs for team, customer, business-unit, and user rankings, backed by a GetDimensionRankings API.
  • Tool-call execution UI : inline tool-call execution, stop streaming, bulk execute and submit, and a redesigned tool-call UI.
  • Model pricing attributes : additional_attributes on model pricing rows, with a management API and UI editor.
  • Key rotation on auth failures : rotate keys on 401/402/403 and return a 502 upstream_credentials_exhausted when all keys are permanently dead.
  • Opus 4.8 support : system-message handling and compatibility for Opus 4.8.
  • OTel spec-compatible metrics : OTel-spec metrics with provider and semantic-cache attributes in the metrics export, backward compatible with existing dashboards.
  • Prompt cache retention : prompt cache retention parameter on responses requests.
  • Go 1.26.3 : toolchain upgraded to Go 1.26.3.

​
🐞 Fixed

​
Guardrails

  • Grayswan full conversation history : the outbound side of the Grayswan guardrail provider now receives the full conversation history rather than a truncated view.

​
MCP & Access

  • MCP per-user OAuth deferred flow : removed the deferred user-id flow in MCP per-user OAuth and the deferred-fill user-mode OAuth flow, gating user-mode flows on the caller user_id and skipping temp-token mint where it does not apply.
  • MCP header temp-token toggle : the MCP header temp-token flow now follows the UI toggle.
  • Models endpoint allowlist : /v1/models is allowed through the access-profile model allowlist check.
  • PKCE code challenge : code-challenge generation moved to the backend.

​
Cluster & Config

  • URL query escaping : escaped characters in URL query parameters are now supported.
  • Broadcast model attribute updates : model attribute updates are broadcast across the cluster.
  • Tool attribute data : tool attribute data is no longer sent.

​
OSS Base (transports/v1.5.6)

  • Virtual-key associations : removed created_by as a user association for virtual keys; optional fields are no longer overridden during virtual-key update.
  • Matview sync interval : materialized-view sync interval increased to 1 minute.
  • Bedrock tool names and guardrails : Bedrock function/tool names are truncated to the provider length limit, and guardrail config is set in Bedrock requests built from responses.
  • Anthropic tool use : Anthropic tool_use input defaults to {} when arguments are absent.
  • Responses streaming : fixed responses stream events.
  • Compat flow parsing : fixed missing parameter parsing on the compat flow.
  • Passthrough API version : a default API version is set in passthrough requests as a fallback.
  • Partial tool calls : partial tool-call execution failures are handled and successful results returned.
  • MCP auth errors : inline banner and retry support for MCP auth-required errors.
  • UI nitpicks : assorted UI fixes and build fixes.

​
📀 Base OSS version

transports/v1.5.6This release pins clean tagged OSS modules:

​
🔌 If you are compiling plugin against this release - use following deps