v1.4.1

[1.4.1] — 2026-08-07

A dependency-security patch for the web toolchain and the embedded dashboard.
No gateway code changes.

Changed — the web toolchain clears every open dependency advisory

The dashboard's router moves to react-router 8.3.0 — the package that
absorbed react-router-dom, whose 7.x line advisory scanners flag on an
uncorrected affected range — together with React 19.2.8 (Router 8's peer
floor is React 19.2.7). The client routing API is unchanged and the rendered
browser suites pass unmodified.

Seven build- and tooling-time packages move onto their patched releases:
undici, ip-address, fast-uri, postcss, @hono/node-server (reached
through the component tooling's MCP SDK), brace-expansion, and hono. None
of them ships in the embedded bundle. npm audit reports zero
vulnerabilities.

Contributors

Thanks to everyone who shipped this release:

• Build(deps-dev): Bump js-yaml from 4.3.0 to 4.3.1 in /web (#393) — @dependabot[bot]
• fix(web): v1.4.1 — clear every open dependency security advisory (#392) — @MitulShah1

---

Full changelog: https://github.com/ferro-labs/ai-gateway/blob/v1.4.1/CHANGELOG.md