0.9.1

What's Changed

• chore(deps): bump svgo in /docs by @dependabot[bot] in #1114
• chore(deps): bump js-yaml from 4.3.1 to 4.3.2 in /docs by @dependabot[bot] in #1118
• chore(deps): bump sharp, @astrojs/starlight, astro, astro-contributors and starlight-ion-theme in /docs by @dependabot[bot] in #1120
• fix(schemas): lowercase user emails and require model type by @leoguillaume in #1126
• refacto(qos): remove current QoS, celery worker, and timeseries metrics by @leoguillaume in #1131
• feat(organization): make organization membership mandatory for users by @tibo-pendino in #1137
• refacto(chat): refacto POST /v1/chat/completions endpoint toward clean architecture by @benjaminpilia in #1138
• fix(chat): follow-up fixes after chat completions clean architecture by @leoguillaume in #1140
• feat(langfuse): trace model-forward requests after clean architecture by @leoguillaume in #1142
• chore(doc): update generated documentation and release versions by @github-actions[bot] in #1144
• feat(organization): let authenticated users retrieve their organization by @leoguillaume in #1149
• feat(keys): display expired keys in the keys list by @lboitel in #1076
• feat(keys): revoke keys, filter by status, and rename via PATCH by @leoguillaume in #1152
• feat(usage): persist inference usage with PostgresUsageRecorder by @leoguillaume in #1150
• refacto: remove all legacy code by @benjaminpilia in #1159
• fix(keys): reject the names the API upserts for itself by @tanguychenier in #1134
• fix(usage): persist failure status and measure latency on the recorder by @leoguillaume in #1165
• feat(usage): use Langfuse as alternative usage data source by @leoguillaume in #1168
• chore: remove markers by @leoguillaume in #1169
• chore(doc): update generated documentation and release versions by @github-actions[bot] in #1172
• refactor(rate-limit): charge router limits from the forwarding use case by @bakr-a in #1171
• chore: emit api logs as json by @benjaminpilia in #1176
• fix(chat): bill the tokens already delivered when a stream is interrupted by @benjaminpilia in #1151
• feat(models): remove all unnecessary schema arguments by @leoguillaume in #1173
• chore(doc): update generated documentation and release versions by @github-actions[bot] in #1181
• feat(playground): force ProConnect 2FA via oauth2-proxy alpha config by @leoguillaume in #1175
• chore(doc): update generated documentation and release versions by @github-actions[bot] in #1183
• refacto(logging): let the endpoints rely on RequestLogMiddleware for unexpected errors by @benjaminpilia in #1185
• fix(usage): Fix endpoint filter with langfuse usage backend by @cyrillay in #1186
• refactor(budget): remove user budget and the @hooks decorator by @bakr-a in #1177
• 1216 bug remove the module level configuration singleton by @benjaminpilia in #1220
• fix(key): stop rejecting keys that contain sk- after the prefix by @benjaminpilia in #1223
• test(integration): reuse Postgres connections across integration tests by @benjaminpilia in #1226
• 1225 chore run the integration tests in parallel with pytest xdist by @benjaminpilia in #1227
• fix(deps): pin sqlalchemy[asyncio] in the playground extra by @tibo-pendino in #1208
• ci(deps): commit uv.lock and build the API and playground images from it by @benjaminpilia in #1231
• chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /docs by @dependabot[bot] in #1228
• chore(deps): bump sharp from 0.35.4 to 0.35.5 in /docs by @dependabot[bot] in #1229
• chore(deps): bump virtualenv from 21.2.0 to 21.7.13 by @dependabot[bot] in #1233
• chore(deps): bump anyio from 4.13.0 to 4.14.2 by @dependabot[bot] in #1234
• chore(deps): bump devalue from 5.8.1 to 5.9.4 in /docs by @dependabot[bot] in #1210
• ci(deploy): tag the images with their commit SHA and deploy that tag instead of latest) by @benjaminpilia in #1239
• fix(deps): replace python-jose with PyJWT to clear CVE-2026-85394 and… by @benjaminpilia in #1241
• fix(ci): tag the 6 Semgrep SQL findings on hard-coded identifiers as … by @benjaminpilia in #1243
• ci(deploy): deploy dev only, require an image tag and link the GitLab… by @benjaminpilia in #1247
• docs(github): fix the pull request template by @benjaminpilia in #1249
• ci(deploy): wait for the GitLab deployment pipeline and deploy builds… by @benjaminpilia in #1252
• ci(build): run the tests on main and deploy dev from the build workfl… by @benjaminpilia in #1254
• ci(build): delete the GHCR images of a pull request when it is closed by @benjaminpilia in #1257
• ci(build): decrypt and render the playground config without third-party actions by @benjaminpilia in #1259
• ci(build): scan the images with Trivy before pushing them, and pin tr… by @benjaminpilia in #1261
• ci(build): build and scan the images on every pull request push, publ… by @benjaminpilia in #1263
• 1264 ci split buildyml into a pipeline and one reusable workflow per image family by @benjaminpilia in #1265
• (rate-limiting/usage) read vLLM token usage and discount cached tokens in rate limits by @bakr-a in #1245
• chore(deps): bump astral-sh/setup-uv from 5.4.2 to 10.2.0 in /.github/actions/test-dependencies by @dependabot[bot] in #1268
• chore(deps): bump astral-sh/setup-uv from 5.4.2 to 10.2.0 by @dependabot[bot] in #1267
• chore(deps): bump python-socketio from 5.16.1 to 5.16.2 by @dependabot[bot] in #1238
• feat(playground): flag external sidebar links and move them to the bottom by @tibo-pendino in #1213
• ci(dependabot): group the security updates per ecosystem, propose wee… by @benjaminpilia in #1271
• feat(organizations): add a search bar to filter organizations by name by @tibo-pendino in #1270
• fix(playground): trim organization and user search text before calling the API by @tibo-pendino in #1279
• ci(build): start the api image with the example configuration and env… by @benjaminpilia in #1280
• ci(tests): publish the coverage badge from main with python-coverage-… by @benjaminpilia in #1282
• chore(deps): bump aquasecurity/trivy-action from 0.35.0 to 0.36.0 in /.github/actions/trivy-scan in the github-actions group across 1 directory by @dependabot[bot] in #1283
• fix(users): reject passwords longer than 72 bytes with a 422 by @shetsecure in #1285
• fix(alembic): build the database URLs with make_url instead of string… by @benjaminpilia in #1291
• fix(playground): declare the login form setters that reflex 0.9 no lo… by @benjaminpilia in #1293
• chore(deps): bump the python-minor-and-patch group with 19 updates by @dependabot[bot] in #1273
• fix(alembic): drop the orphan collectionvisibility type so b2d58fce4b… by @benjaminpilia in #1294
• fix(alembic): name the constraints dropped by seven downgrades instea… by @benjaminpilia in #1298
• fix(alembic): drop the enum types left behind by the first two downgr… by @benjaminpilia in #1300
• fix(alembic): make every downgrade run on a database with rows by @benjaminpilia in #1302
• fix(rate-limiting): report the most restrictive limit and include the current request by @shetsecure in #1286
• fix(deps): bump certifi to 2026.10.19 (GHSA-6q48-6c7w-9gw2) by @benjaminpilia in #1304
• fix(docs): adapt the documentation build to Astro 7 and Starlight 0.42 by @tibo-pendino in #1307
• refacto(usage): trace every request in Langfuse and keep the usage table for successful requests by @benjaminpilia in #1206
• refactor(bootstrap): BootstrapModelsUseCase does not import infrastructure anymore by @benjaminpilia in #1215
• refactor(configuration): read request dependencies and lifespan configuration from the app given to create_app by @benjaminpilia in #1221

New Contributors

• @lboitel made their first contribution in #1076
• @tanguychenier made their first contribution in #1134
• @shetsecure made their first contribution in #1285

Full Changelog: 0.8.0...0.9.1