v0.8.0

10xgraph-api 0.8.0

A security and scalability pass over the API, following an external review. Authorization now
fails closed, defaults are stricter, and run and connection caps are shared across workers when
Redis is configured.

This release has breaking changes. Read "Before you upgrade" first.

pip install -U "10xgraph-api==0.8.0"

Before you upgrade

• Authorization defaults to ownership whenever auth is on, in every mode.
  • Before, it was allow_all unless MODE=production.
  • To keep the old development behaviour, set "authorization": "allow_all".
• Ownership checks fail closed.
  • With auth on, the server refuses to start if your checkpointer cannot resolve thread owners (aget_thread_owner not implemented).
  • Implement it, or choose allow_all or a custom backend.
• Unowned threads only allow creating actions.
  • Reading, deleting, stopping or fixing a thread that doesn't exist now answers 403.
  • Before, these returned an empty result.
• gunicorn is no longer a dependency.
  • Images built with 10xgraph build install it themselves.
  • If you run gunicorn yourself, install it alongside the API: pip install gunicorn uvicorn-worker.
  • The worker class is now uvicorn_worker.UvicornWorker. Regenerate with 10xgraph build --force, or update -k.
• POST /v1/graph/fix returns state as a JSON object, not a JSON-encoded string. Drop any JSON.parse/json.loads on that field.
• /v1/graph/invoke no longer returns meta.thread_name. The name is generated in the background and appears on the thread (GET /v1/threads).
• Realtime init frames can no longer replace the system prompt unless you add "system_prompt" to websocket.realtime_client_overrides.
• trusted_proxy_headers: true now trusts only loopback and private networks. List your proxies in trusted_proxies.
• Production defaults are stricter:
  • MEDIA_REQUIRE_OWNER is on.
  • graph_introspection is scoped, so the graph structure, tools and state schema need the graph:read scope.
  • IS_DEBUG is forced off.
• Production 4xx responses keep their message; only 5xx responses are made generic.
• Generated Dockerfiles install only the dependencies you list. 10xgraph build warns if your requirements file or pyproject.toml does not list 10xgraph-api.

Security

• Log injection: values a client controls (ids, paths, rate-limit keys, run config, messages) are logged through log_safe(), so a request can't forge log lines.
• ReDoS fix: the JWT detection pattern in the log sanitizer now runs in linear time on crafted input.
• Token revocation: the new token_revocation key refuses revoked tokens before they expire, on HTTP and on every WebSocket run.
• Size limit for WebSocket frames: JSON frames over MAX_REQUEST_SIZE are refused.
• Strict production checks: STRICT_PRODUCTION_CHECKS=true refuses to start on wildcard ALLOWED_HOST/ORIGINS or enabled API docs.
• Example fixes: examples/security/ no longer prints key or secret fragments, and API keys are hashed with HMAC-SHA-256 and API_KEY_PEPPER.

New

• runs key:
  • thread_ids (client | server).
  • config_keys and state_keys allow-lists.
  • max_concurrent_per_user, default 10.
  • timeout.
• Readiness probe: GET /health/ready checks the checkpointer, Redis and the store. The k8s manifest uses it.
• Shared caps: run and WebSocket connection caps are shared across workers through Redis when it is configured.
• Lighter images: Dockerfiles are built in two stages, so the runtime image ships only your code and a virtualenv: no compiler, no curl.
• Dependency changes:
  • JSON responses are serialized by pydantic-core.
  • orjson and platformdirs are dropped.
  • The uvicorn floor is 0.36.

See CHANGELOG.md for the full list.

What's Changed

• Fix/security review by @Iamsdt in #57
• fix(security): resolve open CodeQL alerts by @Iamsdt in #58
• chore: trim dependencies, serialize with pydantic-core, two-stage Dockerfile by @Iamsdt in #59

Full Changelog: v0.7.0...v0.8.0

v0.7.0

What's Changed

• Feat/setup by @Iamsdt in #55
• Rename by @Iamsdt in #56

Full Changelog: v0.5.1...v0.7.0

v0.5.1

What's Changed

• Improve/cli UI ux by @Mothilal-M in #52

Full Changelog: v0.5.0...v0.5.1

v0.5.0

What's Changed

• Playground by @Iamsdt in #45

Full Changelog: v0.4.0...v0.5.0

What's Changed

• Playground by @Iamsdt in #45

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• Feature/qa2 by @Iamsdt in #33
• Qa3 by @Iamsdt in #34
• Eval01 by @Iamsdt in #35
• Fix/qa eval by @Iamsdt in #37
• Added WS api by @Iamsdt in #38
• Feature/otel by @Iamsdt in #39
• Add unit tests for CLI commands, Graph API router, Graph service, and… by @Iamsdt in #41
• docs: add engineering guide for agentflow-api (API server + CLI) by @Iamsdt in #42
• Fix/realtime by @Iamsdt in #43
• Enhance eval command for global confeval.py discovery by @Iamsdt in #44

Full Changelog: 0.3.2.2...v0.4.0

0.3.2.2

What's Changed

• Fix/cli by @Iamsdt in #32
• Optimized agentflow init and now onboarding is smooth

Full Changelog: 0.3.2.1...0.3.2.2

Minor Release: 0.3.2.1

What's Changed

• Add StreamEmitter reference documentation for live progress updates by @Iamsdt in #31

Full Changelog: 0.3.2...0.3.2.1

V 0.3.2

What's Changed

• Feature/rate limit by @Iamsdt in #30

Full Changelog: 0.3.1...0.3.2

0.3.1

What's Changed

• CLI is working by @Iamsdt in #1
• Feature/pyagenity 0.2.1 by @Iamsdt in #2
• feat: Refactor CheckpointerService and GraphService, remove ThreadSer… by @Sarthak422004 in #4
• Feature/new version by @Iamsdt in #3
• Change Name and New APIS by @Iamsdt in #5
• V2 by @Iamsdt in #6
• refactor: Enhance Sentry integration and error handling, update setti… by @Iamsdt in #7
• 10 bug attributeerror str object has no attribute text during stream graph by @Iamsdt in #11
• Fix/tests by @Iamsdt in #13
• 14 api crashes with 500 when jwt auth is enabled by @Iamsdt in #15
• Fix/streaming by @Iamsdt in #16
• 18 feature request pass request object to custom auth backend by @Iamsdt in #19
• feat: Validate custom authentication path and method in auth_config by @Iamsdt in #20
• fix: Update thread saving logic to handle existing threads and increm… by @Iamsdt in #21
• New Version by @Iamsdt in #22
• fix: proper input validation, error codes, and defensive error handling by @MutharasuArchunan13 in #23
• add server for a2a by @atharvacoolkni in #24
• Multimodal by @Iamsdt in #25
• Fix/import by @Iamsdt in #26
• Skills by @Mothilal-M in #28
• Add unit tests for Sentry configuration, SnowFlake ID generator, stor… by @Iamsdt in #29

New Contributors

• @Iamsdt made their first contribution in #1
• @Sarthak422004 made their first contribution in #4
• @MutharasuArchunan13 made their first contribution in #23
• @atharvacoolkni made their first contribution in #24
• @Mothilal-M made their first contribution in #28

Full Changelog: https://github.com/10xHub/agentflow-cli/commits/0.3.1