Release v1.3.0

Bifrost v1.3.0

Bifrost v1.3.0 turns Chat and AI configuration into durable, governed platform capabilities, adds independent V2 Apps and Microsoft event sources, and strengthens scheduling, deployment, and security boundaries across 76 commits since v1.2.0.

Release cadence going forward

Full releases will land roughly monthly. Between them, Bifrost will cut -rc.N pre-releases intended to be safer but more frequent. :dev remains bleeding edge and will contain bugs the maintainer intends to find in his own production first.

Features

• Added independently deployed V2 Apps with immutable versions, live switching, and a matching build workflow. (#671)
• Rebuilt Chat around governed model profiles, attachments, durable realtime runs, reconnect recovery, cancellation, and authoritative state replay. (#600, #626, #698)
• Added capability-aware Chat artifacts for generated documents, spreadsheets, text, images, and videos, with durable storage and an artifact library. (#608)
• Added a portable Bifrost Agent gateway with package metadata, private user memory, consolidated capability discovery, and bounded async execution polling. (#577, #581, #583, #585)
• Added non-blocking agent SDK execution and queued delegation so long-running agent work no longer has to hold the caller open. (#592, #636)
• Scaled the scheduler into a leader-plus-worker replica model and added durable platform-job observability, memory admission, cancellation, and progress. (#557, #560, #628)
• Added authenticated Microsoft Graph and Teams event-source handling, including multi-tenant Teams activities and Graph tenant validation. (#660, #668, #675)
• Added preferred SSO redirect and expanded organization administration. The SSO work was prompted by issue #567 from @pszatkowski. (#569, #593)

Security & Supply-Chain Hardening

• Enforced claim-backed file path containment so callers cannot escape authorized resource paths. (#700)
• Preserved the caller's organization boundary when agents invoke workflow tools. (#687)
• Added Microsoft Graph tenant authentication and Bot Framework bearer-token validation for inbound webhooks. (#660, #668, #675)
• Enforced subscription event-type and payload filters before delivery fan-out, following issue #652 from @MTG-Thomas. (#653)
• Added Event Log records for file- and table-policy denials. (#644)
• Hardened portable bootstrap, OAuth expiry handling, and V2 app token rotation. (#595, #683, #689)
• Strengthened merge-candidate, artifact, image-publication, signing, and local pre-PR gates. (#602, #610, #611, #615, #616, #673)

Reliability

• Replaced custom agent loops with the Pydantic AI runtime and preserved OpenRouter usage accounting. (#597, #601, #607, #643)
• Standardized AI retries, including burst-resistant handling for provider rate limits. (#648, #664)
• Streamlined synchronous workflow execution and improved deployment recovery for executions, subscriptions, app assets, and Solution deploys. (#596, #621, #638)
• Fixed optional workflow helper imports so a missing optional dependency no longer prevents discovery. (#646 by @MTG-Thomas)
• Fixed Chat sequencing, tool-session lifetime, unified workflow-tool dispatch, truncated terminal state, loading regressions, and route changes. (#623, #624, #629, #631, #686, #698)
• Fixed user, role, and execution-history pagination consistency. (#662, #697)
• Improved form sharing, public attribution, embedded dropdowns, agent lifecycle actions, list loading, route transitions, and entity-logo delivery. (#562, #563, #565, #580, #598, #613, #614)
• Added OpenAI transport detection for Azure Foundry and other OpenAI-compatible endpoints, following issue #666 and the proposed approach in #667 from @MTG-Thomas. (#694)

Developer Experience

• Fixed CLI downloads for uv-backed pipx installs and added configurable signed-URL expiration for SDK file access. (#587, #672)
• Simplified the Bifrost build skill, guarded direct file writes, and refreshed generated contracts and documentation gates. (#568, #616)
• Made dev versions chronologically monotonic and tightened exact merge-candidate proof. (#611, #673)

Breaking Changes

• The minimum compatible CLI is now 1.2.3. Run bifrost update before managing agents or AI model settings. (#595, #626)
• Root MCP discovery now uses bifrost_search_capabilities; replace calls to bifrost_find_agents, bifrost_get_agent, and bifrost_get_tool_schema. Async workflow calls return an execution ID for bifrost_get_execution. (#585)
• Successful bifrost_execute_tool calls now return the selected tool's JSON value directly instead of wrapping it in another result envelope. Update clients that dereference the old nested value. (#578)
• Confirmed REST and MCP agent deletion is now permanent and cascades run history. Use deactivation when the agent may be needed again. (#580)
• Agent model configuration now uses llm_profile_id; the database migration converts existing provider and Fast/Balanced/Pro settings automatically, but custom API clients must send the new field. (#626)
• Subscription event-type and payload filters are now actually enforced. Review subscriptions that previously received events outside their configured filter. (#653)
• Custom Chat clients should move from the former conversation stream flow to POST /api/chat/runs, observe chat:{conversation_id} on /ws/connect, restore through GET /api/chat/conversations/{conversation_id}/state, and cancel through POST /api/chat/runs/{run_id}/cancel. (#698)

Contributors

• @MTG-Thomas — fixed optional workflow helper imports so missing extras no longer break discovery. (#646)

Community thanks

• @MTG-Thomas — reported the subscription-filtering and Azure/OpenAI compatibility gaps in #652 and #666, and contributed the initial transport proposal in #667.
• @pszatkowski — raised the preferred-SSO flow in #567, which led to #569.

Fixed CVEs and advisories

• nanoid was updated past the fix for CVE-2026-67213 / GHSA-2v37-7h3g-55p8. (#641)
• js-yaml in the documentation toolchain was updated past the fix for GHSA-5p4m-2wfm-xmqj; no CVE has been assigned to that advisory. (#616)

Docker Images

API:

docker pull ghcr.io/gobifrost/bifrost-api:1.3.0

Client:

docker pull ghcr.io/gobifrost/bifrost-client:1.3.0

This final release also updates the :latest, :1.3, and :1 channels.

Type Stubs for IDEs

No standalone bifrost.pyi asset is included in v1.3.0. Use the API-matched CLI package from your Bifrost instance for current SDK types and editor support.

Signed artifacts (Sigstore / cosign — keyless)

The source archive has a matching .sigstore bundle containing its signature, certificate, and Rekor inclusion proof. Verify it with cosign 2.4 or newer:

cosign verify-blob \
  --bundle bifrost-v1.3.0-source.tar.gz.sigstore \
  --certificate-identity-regexp 'https://github\.com/gobifrost/bifrost/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  bifrost-v1.3.0-source.tar.gz

A SLSA build-provenance attestation is also published:

gh attestation verify bifrost-v1.3.0-source.tar.gz \
  --owner gobifrost