v1.4.1

Install

npx zengate@1.4.1
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.4.1

The image is also on GitHub: ghcr.io/developingchet/zengate:1.4.1, with the same digest.

Image digest: sha256:12ce69cb5abc74f008fbd999188976387f138c3b0aca577f2e9afc56258e9091

Verify the image signature

cosign verify developingchet/zengate:1.4.1 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• ci: bump socketsecurity from 2.11.3 to 2.11.6 in /.github/requirements in the socket-cli group by @dependabot[bot] in #44
• ci: bump docker/login-action from 4.6.0 to 4.7.0 in the actions group across 1 directory by @dependabot[bot] in #41
• fix: bundle OpenCode 2.1.4 and validate strict chat against it by @developingchet in #46
• ci: drop the macOS runner from the verify matrix by @developingchet in #47
• chore: release v1.4.1 by @developingchet in #48

Full Changelog: v1.4.0...v1.4.1

v1.4.0

Install

npx zengate@1.4.0
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.4.0

The image is also on GitHub: ghcr.io/developingchet/zengate:1.4.0, with the same digest.

Image digest: sha256:e52409c520711612dc51c43d36dde0a20db8a08dd98085cff28f925ba9ff95e4

Verify the image signature

cosign verify developingchet/zengate:1.4.0 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• docs: note the GHCR image and the GitHub Packages npm package by @developingchet in #35
• fix: add strict chat profile, preserve quota timing, and refresh dependencies by @developingchet in #40
• chore: prepare 1.4.0 release by @developingchet in #42
• docs: align release guidance with 1.4.0 behavior by @developingchet in #43

Full Changelog: v1.3.1...v1.4.0

v1.3.1

Install

npx zengate@1.3.1
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.3.1

The image is also on GitHub: ghcr.io/developingchet/zengate:1.3.1, with the same digest.

Image digest: sha256:8ea4485199a116110cf535af355497259794af27f869bf089b7fe9a6f4a20042

Verify the image signature

cosign verify developingchet/zengate:1.3.1 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• ci: publish releases to GHCR and GitHub Packages by @developingchet in #34

Full Changelog: v1.3.0...v1.3.1

v1.3.0

Install

npx zengate@1.3.0
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.3.0

Image digest: sha256:d11bb43c565dbc2eca5dac01838497c47cf36320ffccb6df4bc5842c1ec99ff8

Verify the image signature

cosign verify developingchet/zengate:1.3.0 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• feat: support OpenCode 2 and bundle it as the backend by @developingchet in #32
• chore: release v1.3.0 by @developingchet in #33

Full Changelog: v1.2.0...v1.3.0

v1.2.0

Install

npx zengate@1.2.0
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.2.0

Image digest: sha256:20491b18ecfebbb75e75710c00f051a5bee6b47bb340152fa305f9ad5cf60a22

Verify the image signature

cosign verify developingchet/zengate:1.2.0 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• docs: link the 1.1.1 release and point Unreleased at it by @developingchet in #22
• chore: bump opencode-ai from 1.18.32 to 1.18.34 in the npm group across 1 directory by @dependabot[bot] in #19
• ci: bump socketsecurity from 2.10.2 to 2.10.7 in /.github/requirements in the socket-cli group across 1 directory by @dependabot[bot] in #20
• docs: note the opencode-ai 1.18.34 update in the changelog by @developingchet in #23
• fix: keep secrets out of logs and bound attachment DNS lookups by @developingchet in #24
• chore: release v1.2.0 by @developingchet in #25

New Contributors

• @dependabot[bot] made their first contribution in #19

Full Changelog: v1.1.1...v1.2.0

v1.1.1

Install

npx zengate@1.1.1
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.1.1

Image digest: sha256:2d684d9b05dabaada0c60b5193d7e3c5944c0531fcd5247b2c9f2b390adad46f

Verify the image signature

cosign verify developingchet/zengate:1.1.1 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• docs: note that token limits are now enforced in the 1.1.0 changelog by @developingchet in #18
• fix: upgrade Debian packages in the image to clear Trivy findings by @developingchet in #21

Full Changelog: v1.1.0...v1.1.1

v1.1.0

Behaviour change

max_tokens, max_completion_tokens and max_output_tokens are now enforced, at about four characters per token. max_completion_tokens and max_output_tokens also count reasoning, as in OpenAI's API, so a small limit on a reasoning model can return a short or empty answer with finish reason length (incomplete in Responses). Clients that send small limits by habit should raise them or leave them out.

Install

npx zengate@1.1.0
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.1.0

Image digest: sha256:e031d1b70210d9eb74628daefd4283984b0ab39de82cb25aa92f263c769a097e

Verify the image signature

cosign verify developingchet/zengate:1.1.0 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• ci: stop running the Socket scan weekly by @developingchet in #12
• ci: run the dependency audit as its own Vulnerability Check job by @developingchet in #13
• fix: wait for a longer stop sequence that starts before a shorter match by @developingchet in #14
• fix: keep OpenCode turns alive after rejected tools by @developingchet in #15
• fix: harden the gateway and add max_tokens, legacy completions and Prometheus metrics by @developingchet in #16
• chore: release v1.1.0 by @developingchet in #17

Full Changelog: v1.0.4...v1.1.0

v1.0.4

Install

npx zengate@1.0.4
# or
docker run -d --name zengate -p 127.0.0.1:8083:8083 -v zengate:/data developingchet/zengate:1.0.4

Image digest: sha256:ae88ed7bea294b49733a35d3a37c7e3689c0aba7619f825afbd634829e4340db

Verify the image signature

cosign verify developingchet/zengate:1.0.4 \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Verify the release files

checksums.txt and the package tarball are signed with cosign (*.sigstore.json):

cosign verify-blob checksums.txt --bundle checksums.txt.sigstore.json \
  --certificate-identity-regexp '^https://github.com/developingchet/zengate/.github/workflows/release.yml@refs/tags/v' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
sha256sum -c checksums.txt

The npm package carries provenance: npm audit signatures.

What's Changed

• ci: weekly security scans (Trivy image scan, OpenSSF Scorecard, weekly CI and Socket) by @developingchet in #9
• ci: sign release files and pin remaining build dependencies (Scorecard) by @developingchet in #10
• test: property-based tests (fast-check) and release v1.0.4 by @developingchet in #11

Full Changelog: v1.0.3...v1.0.4