Breaking Changes:
- make req_llm an optional dependency (#224) by @maennchen (#224)
Features:
-
mcp: publish structured tool outputs (#223) by Rodolfo Torres (#223)
-
add get_by argument to tool definitions (#222) by @maennchen (#222)
-
tools: add load_strict? and select tool options by @zachdaniel (#219)
-
tools: add load_strict? and select tool options by @maennchen (#219)
Bug Fixes:
-
generate ownership authorization policies for ash_ai.gen.chat resources by @zachdaniel
-
do not leak raw embedding provider errors into user-facing errors (CVE-2026-75760) by @zachdaniel
-
reject operator-map values in identity-based tool lookups (CVE-2026-82564) by @maennchen
-
route raised tool errors through the safe formatter, not raw messages (CVE-2026-82580) by @zachdaniel
-
terminate the tool loop when no unprocessed tool calls remain (CVE-2026-82579) by @zachdaniel
-
reject spoofable Host/X-Forwarded-Proto in MCP origin check (CVE-2026-81315) by @zachdaniel
-
don't evaluate runtime prompt content as EEx templates (CVE-2026-77956) by @zachdaniel
-
tools: reject a non-object tool
inputwith an actionable error by @zachdaniel (#220) -
tools: reject a non-object tool
inputwith an actionable error by @maennchen (#220) -
tools: describe filter errors instead of "unexpected error occurred" by @zachdaniel (#221)
-
tools: describe filter errors instead of "unexpected error occurred" by @maennchen (#221)
-
tools: omit fields withheld by field policies by @damir (#218)