v1.6.1

Security

• Auth bypass fixed: the no-Cognito/no-IdP local-dev bypass previously activated automatically for any request — including unauthenticated ones — silently granting super-admin access. It now requires an explicit LOOM_ALLOW_UNAUTHENTICATED_LOCAL_DEV opt-in plus a loopback client, and fails closed with 401 otherwise. (#12)
• SSRF hardening for OAuth discovery: OAuth2/OIDC well-known URLs and the token endpoints they advertise are user-supplied via MCP/A2A registration and were previously fetched with no validation, allowing SSRF against internal/metadata addresses (including the 169.254.169.254 cloud metadata endpoint) and, in on-behalf-of mode, forwarding of the caller's real access token to an attacker-controlled host. Outbound calls now go through a new hardened fetcher (net_guard.py) that forces HTTPS, resolves and rejects private/loopback/link-local/reserved addresses, and pins the connection to the validated IP to prevent DNS rebinding between the check and the request. (#12)
• Support corporate TLS proxy via OS trust store for JWKS fetch, closing a gap where JWKS retrieval could fail or bypass TLS validation behind corporate MITM proxies (#6)

Features

• Add i18n support with react-i18next and a language switcher (English/Japanese) (#5)

Fixes

• Fix harness provider and API-key connector invocation (#10)
• Fix Entra ID logout URL (#3)

Docs

• Fix clone command and authorization scope count in deployment quickstart (#4)

Dependencies

• Bump postcss 8.5.15 → 8.5.25 (frontend)
• Bump ip-address 10.2.0 → 10.4.0 (frontend)
• Bump fast-uri 3.1.2 → 3.1.5 (frontend)
• Bump brace-expansion 5.0.6 → 5.0.7 (frontend)

Stats

29 files changed, 1067 insertions(+), 94 deletions(-)

v1.6.0

Features

• Multi-provider LLM support — added provider abstraction to invoke models beyond Amazon Bedrock using LiteLLM router integration.
  • New model catalog service and provider configuration management (backend).
  • LiteLLM router service (backend/app/services/litellm.py) for proxying/routing requests across providers.
  • Provider-aware updates to the Strands Agent runtime (agents/strands_agent) for model invocation and configuration.
  • Frontend Settings page updates for configuring LLM providers and models.
  • Infrastructure updates (shared/iac/infra.yaml, privatelink.yaml, role.yaml) to support the new provider integrations.
• Closes #1.

Stats

58 files changed, 5,479 insertions(+), 329 deletions(-)