v0.3.18

What's Changed

• chore(deps): bump github.com/onsi/ginkgo/v2 from 2.32.1 to 2.33.0 in /clients/ui/bff by @dependabot[bot] in #3263
• fix(core): propagate filterQuery in GetServingEnvironments and GetModelArtifacts by @rishabhsai in #3220
• feat(catalog): add RFC 8594 deprecation headers to alpha catalog APIs by @DsThakurRawat in #3221
• fix(catalog): keep float precision in pagination cursors by @DsThakurRawat in #3213
• fix: reject an orderBy the v1 spec does not declare with 400 by @DsThakurRawat in #3222
• preserve sub-resource filter parameters in OpenAPI handlers by @vjkumar2756 in #3237
• upgrade mongo db driver by @adysenrothman in #3266
• Add storage to MCP runtimeMetadata (catalog server + BFF DTO) by @dkuc in #3238
• chore: replace minio with seaweedfs by @dbasunag in #3270
• chore: add dbasunag as approver by @dbasunag in #3268
• refactor(ui): share catalog settings UI shells across Model and MCP by @manaswinidas in #3135
• fix: updates to ensure upstream tests would run against openshiftcluster by @dbasunag in #3273
• chore(deps): bump huggingface-hub from 1.32.0 to 2.0.0 in /jobs/async-upload by @dependabot[bot] in #3286
• chore(deps): bump k8s.io/apimachinery from 0.37.0 to 0.37.1 by @dependabot[bot] in #3274
• chore(deps): bump huggingface-hub from 1.31.0 to 2.0.0 in /clients/python by @dependabot[bot] in #3280
• chore(deps): bump github/codeql-action/upload-sarif from 4.38.1 to 4.38.2 by @dependabot[bot] in #3282
• chore(deps): bump httpcore2 from 2.3.0 to 2.10.0 in /jobs/async-upload by @dependabot[bot] in #3288
• chore(deps-dev): bump ruff from 0.16.7 to 0.16.9 in /clients/python by @dependabot[bot] in #3279
• chore(deps): bump nest-asyncio2 from 1.7.2 to 1.7.3 in /clients/python by @dependabot[bot] in #3281
• chore(deps): bump platformdirs from 4.11.7 to 4.11.14 in /jobs/async-upload by @dependabot[bot] in #3285
• chore(deps): bump httpcore2 from 2.3.0 to 2.10.0 in /clients/python by @dependabot[bot] in #3289
• chore(deps): bump platformdirs from 4.11.7 to 4.12.0 in /clients/python by @dependabot[bot] in #3283
• chore(deps): bump httpx2 from 2.3.0 to 2.12.0 in /jobs/async-upload by @dependabot[bot] in #3287
• chore(deps): bump webpack-dev-middleware from 7.4.2 to 7.4.6 in /clients/ui/frontend by @dependabot[bot] in #3291
• chore(deps): bump github.com/onsi/gomega from 1.43.0 to 1.44.0 in /clients/ui/bff by @dependabot[bot] in #3275
• chore(deps): bump github.com/brianvoe/gofakeit/v7 from 7.17.0 to 7.17.1 in /clients/ui/bff by @dependabot[bot] in #3276
• fix(ui): rename Container size to Container image size by @manaswinidas in #3269
• chore(deps): bump sigs.k8s.io/controller-runtime from 0.25.0 to 0.25.1 in /clients/ui/bff by @dependabot[bot] in #3278
• chore(deps): bump k8s.io/apimachinery from 0.37.0 to 0.37.1 in /clients/ui/bff by @dependabot[bot] in #3277
• fix(ui): show configured catalog credentials immediately by @dkuc in #3290
• fix(ci): cache public ECR images for Kind jobs by @pboyd in #3294
• fix(catalog): support MCP architecture filtering by @dkuc in #3297
• hide All models toggle when only one category has models by @ConorOM1 in #3157
• chore(deps-dev): bump virtualenv from 20.36.1 to 21.7.12 in /catalog/clients/python by @dependabot[bot] in #3298
• chore(deps): bump pyjwt from 2.13.0 to 2.15.0 in /jobs/async-upload by @dependabot[bot] in #3295
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /jobs/async-upload by @dependabot[bot] in #3296
• chore(deps-dev): bump virtualenv from 21.7.12 to 21.7.13 in /catalog/clients/python by @dependabot[bot] in #3300
• chore(deps): bump pyjwt from 2.13.0 to 2.15.0 in /clients/python by @dependabot[bot] in #3302
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /catalog/clients/python by @dependabot[bot] in #3303
• chore(deps): bump urllib3 from 2.7.0 to 2.8.0 in /clients/python by @dependabot[bot] in #3304
• chore(deps-dev): bump oauthlib from 3.3.1 to 4.0.0 in /jobs/async-upload by @dependabot[bot] in #3306
• fix(catalog): avoid rolling upgrade initialization deadlock by @pboyd in #3308
• chore(deps): bump cirello.io/pglock from 1.16.2 to 1.17.0 by @dependabot[bot] in #3310
• chore(deps): bump mikefarah/yq from 4.53.6 to 4.54.1 by @dependabot[bot] in #3314
• chore(deps): bump boto3 from 1.43.92 to 1.43.107 in /clients/python by @dependabot[bot] in #3315
• chore(deps-dev): bump pytest-mock from 3.15.1 to 3.16.0 in /clients/python by @dependabot[bot] in #3318
• chore(deps-dev): bump uvloop from 0.22.1 to 0.23.0 in /clients/python by @dependabot[bot] in #3319
• fix(async-upload): validate archive extraction by @hbelmiro in #3322
• chore(deps-dev): bump ruff from 0.16.9 to 0.16.10 in /clients/python by @dependabot[bot] in #3317
• chore(deps): bump anchore/sbom-action from 0.24.2 to 0.24.3 by @dependabot[bot] in #3316
• fix(catalog): report missing saved Hugging Face token by @adysenrothman in #3321
• feat(catalog): add evaluation-metrics artifact type by @pboyd in #3332
• fix(async-upload): update fsspec to 2026.9.0 by @kaikaila in #3331
• chore(deps-dev): bump werkzeug from 3.1.6 to 3.1.9 in /clients/python by @dependabot[bot] in #3334
• fix(core): keep quotes that are part of a filterQuery string value by @anishmehta24 in #3329
• fix(python): use forward slashes in S3 object keys on Windows by @anishmehta24 in #3330
• chore(deps): bump postcss-selector-parser from 7.1.5 to 7.1.6 in /clients/ui/frontend by @dependabot[bot] in #3327
• chore(deps): bump source-map-js from 1.2.1 to 1.2.2 in /clients/ui/frontend by @dependabot[bot] in #3325
• chore(deps): bump shell-quote from 1.10.0 to 1.12.0 in /clients/ui/frontend by @dependabot[bot] in #3326
• chore(deps): bump handlebars from 4.7.9 to 4.7.10 in /clients/ui/frontend by @dependabot[bot] in #3335
• chore(deps): bump adm-zip and @module-federation/enhanced in /clients/ui/frontend by @dependabot[bot] in #3307
• chore(deps): bump serialize-javascript from 7.1.1 to 7.1.2 in /clients/ui/frontend by @dependabot[bot] in #3299
• chore(deps-dev): bump brace-expansion from 1.1.18 to 1.1.21 in /clients/ui/frontend by @dependabot[bot] in #3305
• chore(deps): bump proxy-addr from 2.0.7 to 2.0.8 in /clients/ui/frontend by @dependabot[bot] in #3323
• chore(deps-dev): bump werkzeug from 3.1.6 to 3.1.9 in /catalog/clients/python by @dependabot[bot] in #3337
• chore(deps): bump cirello.io/pglock from 1.17.0 to 1.18.0 by @dependabot[bot] in #3338
• chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 by @dependabot[bot] in #3340
• chore(deps): bump rh-model-signing from 1.0.3 to 1.0.4 in /clients/python by @dependabot[bot] in #3341
• chore(deps): bump github/codeql-action/upload-sarif from 4.38.2 to 4.38.3 by @dependabot[bot] in #3342
• chore(deps): bump golang.org/x/sync from 0.23.0 to 0.24.0 by @dependabot[bot] in #3339
• chore(deps): bump helm/kind-action from 1.15.0 to 1.15.1 by @dependabot[bot] in #3343
• chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 by @dependabot[bot] in #3344
• chore(deps): bump actions/setup-node from 7.0.0 to 7.1.0 by @dependabot[bot] in #3346
• test(catalog): isolate skill fixtures from local git config by @pboyd in #3350
• fix(openapi): wrap Model Catalog responses in data envelope by @antowaddle in #3351
• fix(catalog): keep array filter options above 50 distinct values by @dkuc in #3361
• fix(catalog): fall back to default when Hugging Face syncInterval is not positive by @jackiectl2 in #3352
• fix(catalog): decode Hugging Face cardData directly without nested data wrapper by @DsThakurRawat in #3267
• chore(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.5.0 by @dependabot[bot] in #3354
• chore(deps): bump ossf/scorecard-action from 2.4.4 to 2.5.0 by @dependabot[bot] in #3356
• chore(deps): bump github/codeql-action/upload-sarif from 4.38.3 to 4.39.0 by @dependabot[bot] in #3357
• chore(deps-dev): bump aiohttp from 3.14.3 to 3.14.4 in /jobs/async-upload by @dependabot[bot] in #3359
• fix(catalog): match skill refs exactly when probing ls-remote by @antcybersec in #3363
• fix(catalog): stop restrictToOrg from mutating the shared source collection by @princemittalr in #3364
• fix(openapi): wrap BFF errors in error envelope by @antowaddle in #3360
• fix(bff): decouple OCI base image from destination registry by @kaikaila in #3353
• Require explicit OCI base image for async upload by @kaikaila in #3348
• chore(deps): bump certifi from 2026.5.20 to 2026.10.19 in /jobs/async-upload by @dependabot[bot] in #3372
• increase timeout by @adysenrothman in #3376
• fix(catalog): read license_link from MCP catalog YAML by @antcybersec in #3369
• chore(deps): bump aiohttp from 3.14.3 to 3.14.4 in /clients/python by @dependabot[bot] in #3373
• fix(async-upload): scope S3 downloads to directory prefix by @immanuwell in #3066
• fix(catalog): store int customProperties of YAML agents as int properties by @antcybersec in #3375
• chore(deps): bump boto3 from 1.43.107 to 1.43.114 in /clients/python by @dependabot[bot] in #3345
• reject stored credentials in skill previews / confine YAML preview path mode to catalog directories by @pboyd in #3378
• chore(deps): bump github.com/brianvoe/gofakeit/v7 from 7.17.1 to 7.18.0 in /clients/ui/bff by @dependabot[bot] in #3355
• chore(deps): bump follow-redirects from 1.16.0 to 1.16.1 in /clients/ui/frontend by @dependabot[bot] in #3370
• chore(deps): bump launch-editor from 2.14.1 to 2.14.2 in /clients/ui/frontend by @dependabot[bot] in #3371
• chore: update manifests for release v0.3.18 by @pboyd in #3379

New Contributors

• @rishabhsai made their first contribution in #3220
• @hbelmiro made their first contribution in #3322
• @anishmehta24 made their first contribution in #3329
• @antowaddle made their first contribution in #3351
• @jackiectl2 made their first contribution in #3352
• @antcybersec made their first contribution in #3363
• @princemittalr made their first contribution in #3364

Full Changelog: v0.3.17...v0.3.18