Skip to content

Releases: gobifrost/bifrost

Release v0.9.1

12 May 17:28
89f6b9d

Choose a tag to compare

v0.9.1 — Fix-only patch release

Six commits since v0.9.0, focused on two user-visible bug fixes plus minor maintenance.

Bug Fixes

  • Saving a modern OpenAI model (o1, o3, gpt-5.x) in Settings → AI no longer fails with a 400 Unsupported parameter: 'max_tokens'. The test-completion call now sends max_completion_tokens, which all current OpenAI Chat Completions models accept (#241).
  • MCP system tools now emit items on array-typed parameters, so Gemini's schema validator accepts them. Previously, registering a system tool that exposed an array param would fail at Gemini's tool-registration step (#225 by @mlspivey).

Developer Experience

  • Untracked client/tsconfig*.tsbuildinfo build caches — these were churning the working tree on every TS rebuild (#232).
  • Docs-capture tooling now supports nav_via and goto_spa for SPA-routed pages, letting the screenshot pipeline navigate via UI clicks instead of direct URL loads where needed (#224).
  • Release skill now flags net-new feature surface before invoking the docs skill, so versioned releases don't silently ship new features without docs pages (#223).

Security & Supply-Chain Hardening

  • Bumped sigstore/cosign-installer to 4.1.2 and github/codeql-action to 4.35.4 (#236).

Contributors

  • @mlspivey — fixed a Gemini-compatibility regression in MCP system tools that prevented array-typed tool params from being accepted (#225).

Fixed CVEs

None in this release.

Breaking Changes

None in this release.

Docker Images

docker pull ghcr.io/jackmusick/bifrost-api:0.9.1
docker pull ghcr.io/jackmusick/bifrost-client:0.9.1

Also tagged: 0.9, 0, latest.

Signed Artifacts

Images are signed with Sigstore Cosign (keyless, GitHub OIDC). Verify with:

cosign verify ghcr.io/jackmusick/bifrost-api:0.9.1 \
  --certificate-identity-regexp 'https://github.com/jackmusick/bifrost/.github/workflows/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Type Stubs

pip install bifrost-stubs==0.9.1

Release v0.9.0

08 May 04:18
f168bc8

Choose a tag to compare

A substantial feature release: Bifrost can now connect to external MCP servers as a client (symmetric to its existing role as an MCP server), v2 apps get full Tailwind compilation, deploys are zero-downtime, and skills distribute via Claude Code plugins. 55 commits since v0.8.0; no breaking changes.

Features

  • External MCP client — Bifrost can now connect to remote MCP servers and surface their tools to agents and chat. Three-layer model: server template (platform), per-org connection (with two visibility flags: chat / autonomous), and per-agent grants (default-deny). Per-user delegated credentials let vendors see the user's identity instead of a shared service account. Streamable HTTP transport; OAuth discovery via /.well-known/oauth-authorization-server. (#176 spec, #177 implementation by @sdc53)
  • Tailwind compilation for v2 apps — Arbitrary values, @apply, @layer, per-app config. v2 apps now get the full Tailwind dev experience instead of the prior CDN-runtime restrictions. (#143)
  • Zero-downtime deploys — API rolling restart, worker drain, client version banner with retry. AMQP probe and publish retry close the deploy-window AMQP error class. (#174, #194)
  • Skills via Claude Code plugin — Bifrost skills are distributed as a Claude Code plugin, with a bifrost skill CLI for managing them. (#169)
  • Per-worktree debug stacks./debug.sh derives a project name from the worktree path; multiple worktrees can run debug stacks in parallel. New bifrost-debug skill. (#137)
  • Unified files model{location}/{scope}/{path} consolidates all file storage paths. Signed-URL location fix included. (#155)
  • Table access policies + redesigned policy editor — Per-table access controls. (#178)
  • Embeddings — Endpoint override + automatic reindex on model change; batch resilience and accurate reindex status. (#195, #199)
  • CLIworkflows execute with WebSocket streaming + requirements group (#168); ephemeral sessions + multi-instance auth (#151); access controls on form/workflow create/update (#163); --json flag position fix and pagination tiebreaker (#189).
  • Workflow hookserrorMessage is the canonical alias; error deprecated. (#166)
  • Execution hardening — Webhook rate limits, schedule overlap protection, stuck-execution fix. (#141)

Security & Supply-Chain Hardening

  • Close py/partial-ssrf in GitHubAPIClient (#219) and the embedding-endpoint validator (#216).
  • Close py/log-injection in the tables router (#215).
  • Unify access gates — close MCP cross-tenant leak + UUID coercion bug (#201).
  • Code scanning dismissal reason format fix (#220).
  • Agent stats roll up chat conversations (#221).

Bug Fixes

  • Firefox 150 bundle load failures fixed via static import map (#175 by @Cory-Covi). Without this, Firefox users couldn't load the app at all. Companion fix swaps JSPM for jsDelivr after JSPM tag 404s (#190).
  • Version-banner reload loop fix; banner moved into header (#209).
  • MCP: commit DB before refresh_workflow_tools() so new tools appear without a restart (#196); expose search_knowledge over MCP and scope by mount (#211).
  • Apps: toast wired to runtime registry (#204); preserve local source on create + sync app.yaml deps + .env from cwd (#161).
  • CLI: load .env from cwd, not pipx venv (#160); persist password-grant login to .env in cwd (#164); version check actually blocks stale CLIs (#207).
  • Tables: backfill admin_bypass policy on existing tables (#179).
  • Files: remove workspace .git/ write gate (#159).
  • Manifest import: refresh dependent caches after integration UUID rewrite (#150).
  • Watch: close echo race, block multi-session in workspace, fix validator dep classifier (#154).

Developer Experience

  • GitHub merge queue adopted (#210).
  • Semver dev image tags 0.8.1-dev.N (#218).
  • Drop app.yaml from app source dirs — manifest carries metadata (#191).
  • Drop redundant bifrost- prefix from plugin skill names (#202).
  • Plugin marketplace.json valid relative-path source (#180).
  • bifrost-issues skill drops stale env-copy guidance (#212).

Breaking Changes

None in this release.

Contributors

Huge thanks to the external contributors who shipped meaningful work this cycle:

  • @sdc53 — designed and implemented the external MCP client, the headline feature of v0.9.0. Spec PR (#176) and implementation PR (#177) — months of design plus ~10K lines across backend, frontend, and tests, including the per-agent grant model that closes a real authorization gap.
  • @Cory-Covi — fixed a regression that broke Bifrost's client bundle on Firefox 150 by introducing a static import map (#175). Without this, Firefox users couldn't load the app at all.

Fixed CVEs

None in this release. The npm group bump in #186 closed multiple Dependabot security advisories via dep bumps; see commit log for details.


Docker Images

API:

docker pull jackmusick/bifrost-api:v0.9.0

Client:

docker pull jackmusick/bifrost-client:v0.9.0

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support. See DISTRIBUTION.md for instructions.

Signed artifacts (Sigstore / cosign — keyless)

Each release asset has a matching .sigstore bundle (Sigstore's self-contained signature + certificate + Rekor inclusion proof, produced via keyless OIDC — no maintainer-held keys involved).

Verify with cosign (>= v2.4):

cosign verify-blob \
  --bundle bifrost-v0.9.0-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/jackmusick/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v0.9.0-source.tar.gz

A SLSA build-provenance attestation is also published and verifiable via:

gh attestation verify bifrost-v0.9.0-source.tar.gz --owner jackmusick

Release v0.8.0

27 Apr 03:14
72a50cb

Choose a tag to compare

Bifrost v0.8.0

This release is the supply-chain hardening cut: signed source releases, signed container images, hash-pinned Python deps, and OpenSSF Best Practices Baseline Level 1. It also closes two long-running E2E flakes (#101, #102) and migrates the backend from requirements.txt to pyproject.toml. 196 commits since v0.7.2.

Security & Supply-Chain Hardening

  • Release artifacts are now signed with Sigstore/cosign keyless OIDC, plus a SLSA build-provenance attestation per release (#111). Verify with cosign verify-blob ... --bundle <asset>.sigstore — see the "Signed artifacts" section below.
  • Published GHCR container images (ghcr.io/jackmusick/bifrost-api, bifrost-client) are also cosign-signed with keyless OIDC (#114).
  • Earned OpenSSF Best Practices Baseline Level 1; badge added to README (#124).
  • Pip dependencies are now hash-pinned (requirements.lock) so reproducible installs verify upstream signatures (#112), with remaining ad-hoc pip install calls in CI hardened the same way (#125).
  • Transitive Python deps pinned to silence OSV-Scanner false positives and shrink the actual exposure window (#109).
  • All GitHub Actions workflow tokens scoped to the minimum permissions Scorecard requires (#110); workflow_dispatch added to Scorecard + CodeQL so they can be re-run on demand (#108).
  • New auto-merge driver for Dependabot PRs and an auto-regen workflow for requirements.lock on Dependabot bumps (#113).
  • Docker base images pinned by digest, GHCR token permissions narrowed (#78).

Bug Fixes

  • LocalBackend._resolve_path no longer admits sibling-prefix path traversal (/sandbox vs /sandbox_evil) — replaced the byte-level startswith check with Path.relative_to() (#80, closes CodeQL alerts #138#142).
  • py/log-injection sweep across the API: all user-controlled values funneled through log_safe() (#82, #98, #103).
  • Persistent CodeQL findings closed: SSRF allowlist tightening, explicit Jinja autoescape, residual style cleanups (#85, #105).
  • tarfile.extractall calls in tests now use filter='data' (Python 3.12+ tarslip defense-in-depth) (#81).
  • Mechanical CodeQL cleanups: py/test-equals-none, unused imports, trivial conditionals (#97).
  • Workflows now honor timeout_seconds=0 (disable timeout) as documented, instead of always applying the default (#27 by @MTG-Thomas).
  • Narrower empty except clauses across the API + new debug logging at the previously-swallowed sites (#84).
  • Readiness health probes added for K8s deployments (#37 by @MTG-Thomas).
  • test.sh no longer races on stack readiness — waits for the API to actually serve traffic before declaring the test stack ready (#92, #104).

Reliability

  • Closed two intermittent E2E flakes that were thrashing CI (#101 fail 5x / #102 fail 11x in the prior 48h) — root cause was test isolation, fixed via partial unique index on system_configs plus an autouse reset fixture (#122).
  • Frontend test sweep: vitest coverage added for chat, integrations, events, jsx-app, agents, users, tables, roles surfaces.
  • pyright / ruff / tsc / eslint are now CI gates with the preexisting backlog cleared.

Developer Experience

  • Backend deps migrated from requirements.txt to pyproject.toml (#126). The legacy requirements.txt is gone; reproducible installs use requirements.lock (hash-pinned, generated from pyproject.toml). Editable installs: pip install -e . from api/.
  • CI skips on more non-code path changes (markdown-only commits, plan docs, etc.) (#128).
  • New developer skill: bifrost-documentation — automated docs screenshot pipeline for the integrations docs site (#96).
  • New security skills: bifrost-secaudit and bifrost-secupdate for snapshotting / draining the GitHub Security tab (#75).
  • CODEOWNERS narrowed to human-authored paths so generated/migration files don't trigger review noise (#88).

Features (carried forward from in-flight work)

  • Deferred / scheduled workflow executions: schedule a workflow to run at a future time, cancel scheduled runs, plus UI for the schedule controls (DateTimePicker, Scheduled badge, Scheduled filter on history).
  • Agent management M1: rebuilt FleetPage / AgentDetailPage / AgentTuneWorkbench, per-flag tuning conversations, dry-run impact pane, prompt version history, post-completion run summarization with cost tracking, summary backfill admin endpoint + UI.
  • Forms: new multi_select field type.
  • Embed: explicit hmac_scheme per secret (shopify | halopsa) (#23 by @sdc53).
  • OAuth refresh-token exchange now sends the documented scope (#26 by @MTG-Thomas).

Contributors

External contributors whose PRs landed in this release — thank you!

  • #23 by @sdc53 — embed: explicit hmac_scheme per secret
  • #26 by @MTG-Thomas — fix missing OAuth scope on authorization-code and refresh-token exchanges
  • #27 by @MTG-Thomas — fix(workflows): honor documented timeout range
  • #37 by @MTG-Thomas — add readiness health probes

Fixed CVEs

The following CVEs / GHSAs were closed by dependency bumps in this release:

  • aiohttp (>=3.13.4, then >=3.13.5) — closes ~20 CVEs including CVSS 9.1 request-smuggling and header-parsing issues (#106, #117).
  • asyncpg (>=0.30.0, then >=0.31.0) — closes CVE-2024-25737 (RCE, CVSS 9.8) (#106, #116).
  • GitPython (>=3.1.41, then >=3.1.47) — closes CVE-2023-40590 and CVE-2024-22190 (RCE-class, CVSS 9.8) plus 3 lower-severity GHSAs (#106, #118).
  • python-multipart (>=0.0.26) — closes 3 DoS CVEs from malformed boundaries (#106).
  • dompurify (^3.4.1 via overrides) — closes 8 medium-severity advisories (monaco-editor was pulling 3.2.7 transitively); also removed the unused @azure/static-web-apps-cli devDependency, which dropped 332 transitive packages and was the only remaining source of the open uuid (GHSA-w5hq-g745-h8pq) and tmp (GHSA-52f5-9888-hmc6) advisories (#123).
  • webauthn (>=2.7.1) — pulled forward to current line (#52).
  • mcp (>=1.27.0), fastmcp (>=3.2.4,<4) — pulled forward (#53, #55).
  • Frontend Dependabot bumps: axios, vite, postcss, node-forge, follow-redirects, lodash, minimatch, dompurify interim bumps — multiple Dependabot security advisories closed via dep bumps; see commit log for the full list.
  • GitHub Actions bumps (codeql-action v4, checkout v6, setup-node v6, codecov v6, docker/* family, softprops/action-gh-release v3, sigstore/cosign-installer v4, etc.) — pulls in upstream fixes.

Multiple additional Dependabot security advisories were closed via routine dep bumps; the full list is reachable via git log v0.7.2..v0.8.0 -- '**/requirements*.txt' '**/pyproject.toml' '**/package*.json'.

Breaking Changes

  • requirements.txt removed. If you were installing the backend from requirements.txt (e.g. building from source for local dev outside Docker), switch to pip install -e . from the api/ directory, or pip install -r requirements.lock for a hash-verified install. Container image users are unaffected — the Dockerfile already uses the new flow (#126).

Docker Images

API:

docker pull jackmusick/bifrost-api:v0.8.0

Client:

docker pull jackmusick/bifrost-client:v0.8.0

Both images are cosign-signed (keyless OIDC). Verify with:

cosign verify ghcr.io/jackmusick/bifrost-api:v0.8.0 \
  --certificate-identity-regexp 'https://github\.com/jackmusick/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.

Signed Artifacts (Sigstore / cosign — keyless)

Each release asset has a matching .sigstore bundle (Sigstore's self-contained signature + Fulcio cert + Rekor inclusion proof, produced via keyless OIDC — no maintainer-held keys involved).

Verify with cosign (>= v2.4):

cosign verify-blob \
  --bundle bifrost-v0.8.0-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/jackmusick/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v0.8.0-source.tar.gz

Verify the SLSA build provenance:

gh attestation verify bifrost-v0.8.0-source.tar.gz --owner jackmusick

Release v0.7.2

22 Apr 02:06

Choose a tag to compare

Bifrost v0.7.2

Docker Images

API:

docker pull jackmusick/bifrost-api:v0.7.2

Client:

docker pull jackmusick/bifrost-client:v0.7.2

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.

Release v0.7.1

21 Apr 10:27

Choose a tag to compare

Bifrost v0.7.1

Patch release — MCP OAuth flow fix.

🐛 Fixes

  • MCP OAuth redirect no longer corrupts absolute return_to URLs. Login.tsx was calling React Router's navigate() with the full URL, which treated it as a relative path and produced broken links like /login/https:/example.com/mcp/callback. Now same-origin absolute URLs route through SPA navigation (so MCPCallback.tsx mounts and renders the progress + success screens) and cross-origin URLs fall back to a full browser navigation. Reported with a full root-cause analysis and a proposed fix by @Fireworrks (#24).

🙌 Thanks

Docker Images

API:

docker pull ghcr.io/jackmusick/bifrost-api:0.7.1

Client:

docker pull ghcr.io/jackmusick/bifrost-client:0.7.1

Release v0.7

21 Apr 05:44

Choose a tag to compare

Bifrost v0.7

Docker Images

API:

docker pull jackmusick/bifrost-api:v0.7

Client:

docker pull jackmusick/bifrost-client:v0.7

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.

Autonomous Agents

06 Mar 19:23

Choose a tag to compare

Autonomous Agents

The headline feature of this release. Agents can now subscribe to platform events and execute workflows autonomously with budget
controls and full history tracking.

  • Agent runs & event-driven execution — agents trigger workflow runs in response to platform events, with per-run tracking
    (agent_run_id) threaded through AI usage and execution history
  • Agent subscriptions in manifests — agents with event subscriptions round-trip through git sync; manifest validation enforces
    correct target_type for agent targets
  • MCP workflow tool execution — fixed access control and stale kwargs issues when executing workflows as MCP tools
  • Budget fields — agent budget configuration serializes correctly through manifest round-trips

Git Sync Overhaul

Major rework of the CLI and sync pipeline for reliability, performance, and better UX.

  • bifrost sync replaced with bifrost git subcommands — bifrost git commit / bifrost git push replace the old monolithic sync
    command
  • Streaming progress — git sync now shows real-time progress phases in both the CLI terminal and the web editor
  • Performance optimizations — prefetch cache, manifest hashing, and bulk DB operations significantly reduce sync time
  • Delete confirmation & push fixes — safer entity deletion with user confirmation; fixed push reliability issues
  • Portable workflow refs — workflows referenced by forms, agents, and event subscriptions now use portable ref strings instead of
    raw UUIDs, enabling cross-environment sync
  • Dependency counts — entity management UI shows how many other entities depend on each workflow/form/agent
  • Git-enabled workspace warnings — CLI warns when push/watch is used in a workspace that has git sync configured (preventing
    conflicts)

CLI Improvements

  • Silent mode by default — CLI now defaults to direct execution with pipeable JSON output, making it script-friendly
  • Hardcoded path removal — replaced all hardcoded apps/, forms/, agents/ path assumptions with Application.repo_prefix and dynamic
    resolution
  • Deduplicated filter logic — CLI filter helpers consolidated, repo_prefix threaded through consistently

Configuration & SDK

  • Config resolution fixed — CLI config endpoints now use ConfigResolver with DB fallback instead of Redis-only reads;
    integration-scoped configs correctly excluded from config.get()/config.list()
  • Write-through cache for config.set() — config writes now update both Redis and DB atomically
  • SDK OAuth token refresh endpoint — new endpoint for refreshing OAuth tokens from within workflows
  • Secret config support — SDK properly handles secret-type configuration values
  • Provider org scope override guard — prevents accidental cross-org scope leaks

LLM & AI

  • Reasoning model compatibility — LLM config layer handles reasoning models (e.g., o1, o3) that don't support system prompts or
    temperature
  • Chat title fix — resolved issue with AI chat title generation
  • Agent context management — improved how agent context is passed through execution chains

Frontend

  • Execution context UI — execution detail view shows richer context (source, trigger, agent info)
  • Entity management UI improvements — better source control panel, disabled combobox state when all entities are assigned
  • Input mapping form for event subscriptions — new form component for mapping event payload fields to workflow inputs
  • File upload progress — upload progress now correctly wired to UI indicators
  • Execution logs panel — improved layout and usability
  • lazyWithReload — resilient code-split imports that auto-retry on chunk load failures (handles deployments mid-session)
  • Tailwind support — added to app rendering pipeline
  • ROI tracking UI — provider org support with ROI tracking display
  • Org-scoped resource management — event source org assignment UI

Performance

  • Execution performance fix — reordered virtual import hook so it runs last (avoiding overhead on stdlib/pip imports); added
    module caching to prevent redundant S3 reads
  • Git sync optimization — prefetch cache and manifest content hashing skip unchanged entities during sync

Database & Infrastructure

  • ondelete cascades — added SET NULL on executions.api_key_id FK; added cascades for workflow deletion by path presence
  • Eager loading fix — schedule_source relationship eagerly loaded in event repository queries to prevent N+1
  • Org-scoped resources — simplified sync flow with org-level scoping for tables and apps

Testing & CI

  • Comprehensive agent test coverage — new tests for agent run consumer error handling, event processor agent routing, AI usage
    agent_run_id tracking, manifest round-trips for agent budget/subscription fields, and event subscription validation
  • Test infrastructure fixes — workflow update test uses PATCH instead of re-registration, reindex test explicitly sets
    category=None, retry delivery test race condition resolved
  • test.sh improvements — now shows pass/fail/skip counts in summary; CI coverage flag fixed
  • ~18k lines of new code including significant test coverage expansion

v0.5.0 Arbritrary Version Jump

26 Feb 12:46

Choose a tag to compare

This is going to be a pretty big jump. I've been avoiding releases because fundamentally, we've moved from Azure Functions to a Docker-bases setup, so the releases are less important since they don't need to trigger annoying build steps. That being said, this feels like one of the first stable, usable versions where all functionality is in a decently usable state -- dare I say almost beta!

What's Changed

Platform Architecture

  • Complete workspace redesign: S3-first file storage with Redis write-through cache, dropped workspace_files table and
    workflows.code column
  • Migrated entire backend to FastAPI in Docker with hot reload, RabbitMQ, Redis, PostgreSQL
  • Multi-tenancy: organization scoping across all entities, OrgScopedRepository with cascade scoping and role-based
    access control
  • Git sync system with manifest-based serialization (.bifrost/*.yaml), persistent working tree, conflict resolution,
    and CLI bifrost sync command
  • Non-destructive upsert pattern for config schema and mappings to preserve user OAuth tokens during sync

App Builder

  • JSX/code engine with server-side Babel compilation, file-based routing, and platform hooks
  • Unified component model: flat props, children[] containers, discriminated union validation
  • npm dependency management via esm.sh with editor sidebar panel and auto-scan
  • HMAC-authenticated app embedding with JWT auth and embed secrets
  • Per-app styles.css support
  • Publish with snapshot versioning

SDK & CLI

  • Full Bifrost SDK: workflows, integrations, config, AI/knowledge (RAG), email, file operations (signed URLs)
  • Watch mode with file writeback and on-demand preflight checks
  • Dynamic secret scrubbing — secrets from config.get() and integrations.get() auto-redacted from logs
  • Server-side compilation: removed client-side Babel, apps compiled on write and served pre-compiled

MCP

  • Refactored to module-based tool registration with CallToolResult standardization
  • Replaced 7 schema tools with single get_docs tool wrapping llms.txt generation
  • Agent-scoped middleware, per-agent system tool control, restricted tool support

Forms

  • Form embedding with JWT auth, embed secrets, and dedicated /embed route
  • Auto-fill support, allow_as_query_param, checkbox default_value fix
  • Permanent deletion of inactive forms
  • Data provider field descriptions and overrides

Integrations

  • OAuth audience field, oauth_scope, client credentials flow refresh
  • Encrypted secret config values
  • Batch upsert endpoint for integration mappings

Agents

  • Private agents with owner-based visibility and can_promote_agent permission
  • Knowledge source CRUD with document management and embedding
  • Per-agent LLM model/temperature/max_tokens overrides with UI

Execution & Observability

  • Admin logs view with filtering, pagination, and execution drawer
  • Token usage tracking, execution resource metrics, AI usage reporting
  • Chat reliability: localId deduplication, unified message model, tool call grouping

Infrastructure & DX

  • Test reorganization: consolidated to unit/ and e2e/, JUnit XML export, Playwright support
  • Datetime standardization: DateTime(timezone=True) everywhere with enforcement tests
  • Fixed process pool race condition in worker dispatch
  • Redis caching for orgs/configs, module cache verification, Cache-Control headers on nginx proxy
  • Window management system with Framer Motion animations (app viewer, editor, execution drawer)

Security

  • WebAuthn passkey authentication with multi-origin support
  • MFA/2FA service
  • CSRF protection and rate limiting
  • SecretString class for masking sensitive config values

New Contributors

  • @sdc53 made numerous contributions. Thank you!

Full Changelog: v0.2.5...v0.5.0

Release v0.2.5

20 Nov 19:16

Choose a tag to compare

Bifrost API v0.2.5

Docker Images

docker pull ghcr.io/jackmusick/bifrost-api:v0.2.5
docker pull ghcr.io/jackmusick/bifrost-api:latest

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.

Release v0.2.4

20 Nov 00:43

Choose a tag to compare

Bifrost API v0.2.4

Docker Images

docker pull ghcr.io/jackmusick/bifrost-api:v0.2.4
docker pull ghcr.io/jackmusick/bifrost-api:latest

Type Stubs for IDEs

Download bifrost.pyi from the assets below and place it in your workspace directory for IDE autocomplete and type checking support.

See DISTRIBUTION.md for instructions.