6.5.0

🐳 Docker Image

This release is distributed as a Docker image:

docker pull labsai/eddi:6.5.0

Verify image signature

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/labsai/EDDI/\.github/workflows/ci\.yml@refs/(heads/main|tags/[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?)$' \
  labsai/eddi:6.5.0

Note: EDDI is distributed exclusively as a Docker image. There are no binary downloads.
See the Docker Hub page for all available tags.

What's Changed

• chore(monorepo): move EDDI-Manager and EDDI-Chat-UI into ui/ and build them with Maven by @ginccc in #757
• feat(context): secret context values — usable for one turn, never stored or returned by @ginccc in #774
• fix(auth): give the shipped realm's tokens an identity again by @ginccc in #771
• fix(ui): clear the 30 npm advisories OpenSSF Scorecard reports by @ginccc in #770
• fix(manager): show a person icon instead of "?" in the user avatar by @ginccc in #772
• chore(ui): move the UI toolchain to Node 22; Stryker 10, Vitest 5 for the Chat UI by @ginccc in #776
• fix(ui): a dialog no longer takes focus from a field the user is typing in by @ginccc in #788
• fix(ui): closing a dialog hands focus back to what opened it by @ginccc in #792
• chore(ci): broaden and document the dependency-review licence policy by @ginccc in #780
• fix(a2a): permit anonymous Agent Card discovery, authenticate the roster by @ginccc in #782
• refactor(ingestion): HTML→Markdown converter, used by WebScraperTool by @ginccc in #784
• feat(ingestion): web crawler — streaming, bounded, robots-aware by @ginccc in #786
• fix(security): sanitizing log handler for CR/LF in exception messages (CWE-117) by @ginccc in #800
• chore(changelog): per-branch fragments instead of one shared file by @ginccc in #812
• fix(security): fail closed on an authenticated identity with no principal name by @ginccc in #773
• fix(operator): let the Platform Operator inspect knowledge bases by @ginccc in #777
• docs(mcp): document reaching an authenticated /mcp, and plan the fix by @ginccc in #802
• chore: replace a customer name in examples and tests with a generic one by @ginccc in #797
• fix(security): sanitize the agent-deployment log lines flagged for CWE-117 by @ginccc in #799
• fix(operator): target EDDI's own address, not the browser's, and retire the operator a reconfigure replaces by @ginccc in #795
• feat(rag): knowledge-base sources and the ingestion pipeline by @ginccc in #787
• fix(llm): echo Gemini's thoughtSignature so Gemini 3.x can use tools by @ginccc in #794
• fix(apicalls): configuration references work in templated HTTP-call fields; data-supplied ones are refused by @ginccc in #775
• fix(rag): register ai.labs.rag so RAG workflow steps can be deployed by @ginccc in #783
• feat(rag): REST and scheduling for ingestion sources by @ginccc in #789
• fix(hitl): sanitize MCP get_approval_status detail=full like REST by @ginccc in #793
• feat(mcp): advertise /mcp as an OAuth protected resource by @ginccc in #803
• feat(keycloak): ship an eddi-mcp client for MCP clients to log in through by @ginccc in #804
• fix(security): validate the access token audience by @ginccc in #805
• feat(manager): ingestion sources panel for knowledge bases by @ginccc in #790
• fix(migration): survive a first boot against an EDDI 5 database by @ginccc in #781
• feat(ingestion): document state and run history for RAG sources by @ginccc in #785
• chore(docker): bump oss-fuzz-base/base-builder-jvm from cc3c3da to 5e6c559 in /.clusterfuzzlite by @dependabot[bot] in #822
• chore(deps): bump the quarkus group with 2 updates by @dependabot[bot] in #821
• chore(deps): bump the minor-and-patch group across 1 directory with 8 updates by @dependabot[bot] in #814
• docs(changelog): collate 17 pending fragment(s) by @github-actions[bot] in #825
• docs(planning): more knowledge-base source types — sitemap, upload, Drive, SharePoint, mail by @ginccc in #798
• fix(llm): escape every configuration reference before templating an LLM parameter by @ginccc in #808
• fix(llm): run Jlama on the Vector API instead of the scalar fallback by @ginccc in #801
• feat(rag): ingest uploaded PDF, Word, Excel, PowerPoint and text files by @ginccc in #806
• fix(rag): stop embedding queries as documents by @ginccc in #810
• feat(llm): per-call telemetry on every provider and both execution paths by @ginccc in #809
• feat(secrets): edit a vault secret's agent grant without its value by @ginccc in #796
• fix(conversation): stop silently losing turns under concurrent writes by @ginccc in #791
• fix(rag): arm ingestion schedules, so a source with a cron actually runs by @ginccc in #818
• fix(security): sanitize the CWE-117 log sinks PR #799 left uncovered by @ginccc in #816
• fix: twelve findings from a pilot demo — LLM history, OIDC roles, group HITL state, and five Manager bugs by @ginccc in #827
• fix(backup): make agent sync work more than once, and let it create by @ginccc in #829
• fix(changelog): close guard evasion, tilde fences, calendar dates by @ginccc in #813
• chore(skills): add a ship-pr skill for the PR and review workflow by @ginccc in #811
• feat(groups): a dashboard view of a running group discussion by @ginccc in #828
• docs(rag): document the workflow step that binds a knowledge base by @ginccc in #820
• fix(ui): the agent wizard could only produce a Jlama agent that never loads by @ginccc in #807
• docs(changelog): collate 19 pending fragment(s) by @github-actions[bot] in #830
• chore(security): allowlist gitleaks false positives of PRs #835, #838, #840, #847 by @ginccc in #857
• fix(templating): never template caller-supplied data; scope prompt snippets to the agent's workspace by @ginccc in #832
• fix(security): owner-check soft-deleted conversations; gate /active and /end by @ginccc in #833
• fix(gdpr): erasure reaches connection grants and in-flight work; reserve gdpr memory keys by @ginccc in #834
• fix(manager): move onto the saved version and make cascade saves safe to retry by @ginccc in #850
• fix(manager): Workforce and group discussions stop, hand over and save what was entered by @ginccc in #851
• fix(manager): align the API client and MSW mocks with the backend contract by @ginccc in #852
• fix(engine): authorize managed-agent calls before creating conversations; copy trigger context per request by @ginccc in #868
• fix(manager): import dialog drops remote agents when the sync source changes by @ginccc in #867
• fix(security): stop trusting engine-reserved context keys from clients by @ginccc in #859
• fix(security): scrub secret input and harden UI CSP and output rendering by @ginccc in #864
• fix(security): bound outbound downloads and close SSRF/redirect/ZIP gaps by @ginccc in #862
• fix(infra): scope deployment surfaces and gate the release pipeline by @ginccc in #865
• fix(security): close authorization and IDOR gaps across REST and tools by @ginccc in #860
• fix(security): bind Slack HITL approvals and namespace channel identities by @ginccc in #861
• fix(security): harden vault checksum, master-key gate, GCM AAD and leak paths by @ginccc in #863
• fix(manager): wait for sonner's unmount timer before a test file ends by @ginccc in #866
• fix(memory): fix the defects a live audit of every memory feature found by @ginccc in #871
• chore(docker): bump oss-fuzz-base/base-builder-jvm from 5e6c559 to d0c7326 in /.clusterfuzzlite by @dependabot[bot] in #884
• fix(templating): render runtime templates with a restricted engine and stop templating data by @ginccc in #858
• docs(governance): release tags carry no v prefix by @ginccc in #872
• fix(ci): keep the Slack notification within Block Kit's 10-field limit by @ginccc in #873
• fix(ci): make the daily and weekly Slack digests reliable by @ginccc in #878
• fix(ui): one icon per meaning across the Manager and the Chat UI by @ginccc in #875
• fix(chat-ui): streaming contract, environment, secret input and rendering by @ginccc in #856
• fix(manager): online pill for non-admins, owner-only Delete on detail pages by @ginccc in #879
• fix(rag): findings from a live RAG + ingestion run — file delete 400, silent failed turns, replace, sitemaps by @ginccc in #877
• chore(release): one command for version bumps, run automatically after every release by @ginccc in #869
• test(manager): no sonner removal timer outlives a test by @ginccc in #876
• docs(agents): correct and slim the AI instructions by @ginccc in #870
• fix(scheduling): DST-correct crons, fair due polling, safe schedule PUT and fenced dismiss; batch cap; capabilityMatch templating; sync counters by @ginccc in #842
• fix(groups): group-conversation state races, deleted discussions coming back, workspace lost updates by @ginccc in #843
• fix(llm): stop tool replay on retry/escalation, keep summary in agent mode, harden tool cache and LLM telemetry by @ginccc in #837
• fix(backup,datastore): ZIP import limits, version-checked writes and deletes, merge rollback, safe regex filters, migration completion by @ginccc in #844
• fix(security): reserve engine-owned context keys; bind teardown, delegation and recruitment to what the caller owns by @ginccc in #831
• fix(http): bound outbound response bodies, close NAT64/6to4 SSRF gap, stop weather tool key leak by @ginccc in #835
• fix(manager): bind chat to its transcript, honour secret input, classify refused sends by @ginccc in #849
• fix(rag): ingestion keeps what exists, removes what is gone, bounds hostile files and request bodies by @ginccc in #845
• fix(manager): secret overwrites, unbound approvals, unverified audit shield by @ginccc in #848
• fix(vault): key-material races, re-runnable KEK rotation, lost-key recovery and an independent audit key by @ginccc in #836
• fix(slack,hitl): bind Slack events and approvals to their integration, conversation and pause; scope approver identity by @ginccc in #839
• chore(ci): gate docker on the auth tier, pin and verify Node, harden the changelog guard by @ginccc in #846
• fix(manager): editors no longer change or drop config data silently by @ginccc in #853
• fix(security): workspace and owner scoping for groups, schedules, triggers, exports and listings by @ginccc in #840
• fix(engine): conversation turn state — queued turns, pauses, ENDED, step props, NATS, schedules, migrations by @ginccc in #841
• fix(manager): operations pages that misreported or acted on stale state by @ginccc in #854
• fix(deploy): credential-free realms, generated installer passwords, Kustomize datastore auth, no automounted tokens by @ginccc in #847
• fix(secrets): secret scope on every property path, LLM parameter guard, no echoed credentials by @ginccc in #838
• fix(memory): claim a global memory key atomically in rememberFact by @ginccc in #893
• chore(deps): MCP server 2.0.1 and Testcontainers 2.0.5, as Quarkus 3.39.5 ships them by @ginccc in #900
• chore(deps): every stable patch/minor upgrade, aligned with Quarkus 3.39.5 by @ginccc in #899
• feat(conversations): follow compatible agent versions; breaking by default by @ginccc in #905
• fix(manager): read the Java preset's text block with CRLF line endings by @ginccc in #891
• feat(manager): add Claude 5.5 and GPT-6 Sol/Luna to model suggestions by @ginccc in #896
• chore(deps): json-path 3; langchain4j and Jackson-3 libraries held to Quarkus 3.39.5 by @ginccc in #901
• chore(deps): Node 24 LTS, frontend-maven-plugin 2, Temurin 25.0.4.1 by @ginccc in #902
• chore(deps): UI majors - vite 8, vitest 5, ESLint 10, i18next 26, lucide 1 by @ginccc in #903
• fix(memory): enforce unique upsert identities on MongoDB usermemories by @ginccc in #897
• fix(backup): agent sync keeps the target's secrets, carries structural changes, stops overwriting local edits by @ginccc in #880
• feat(secrets): atomic create-if-absent in the vault SPI by @ginccc in #898
• fix(migration): retry failed deployments, migrate triggers, refuse unsafe templates by @ginccc in #908
• fix(migration): boot a 5.x database on 6.5 with agents, history and no tokens by @ginccc in #907
• fix(upgrade): safe first-boot retention, liveness startup probe, server-side conversation pass by @ginccc in #909
• feat(manager, chat): compatible saves, deployment impact and version markers by @ginccc in #906
• feat(llm): first-class OpenAI-compatible providers (Grok, DeepSeek, Kimi, Qwen, GLM, MiniMax, OpenRouter, Groq) by @ginccc in #904
• fix(operator): knowledge-base diagnosis, working screen context, and an upgrade path by @ginccc in #920
• fix(llm): carry a failed cascade step's completed tools to the next step by @ginccc in #916
• feat(chat-ui): show "Using {tool}…" from the live tool_call SSE event by @ginccc in #874
• fix(schedules): keep enabled out of the configuration PUT by @ginccc in #918
• feat(workspaces): sharing people can use — directory, notifications, space secrets, review by @ginccc in #890
• fix(manager): drop model suggestions vendors retired, renamed or never had by @ginccc in #922
• fix(release): make main ready to tag 6.5.0 by @ginccc in #923
• chore(ci): time-limit the E2E jobs and their Playwright browser install by @ginccc in #921
• chore(docker): bump ubi10/openjdk-25-runtime from c49d36c to 70b19e9 in /src/main/docker by @dependabot[bot] in #925
• chore(docker): bump oss-fuzz-base/base-builder-jvm from d0c7326 to 09b8394 in /.clusterfuzzlite by @dependabot[bot] in #924
• docs(changelog): collate 24 pending fragment(s) by @github-actions[bot] in #894
• feat(llm): bound every tool call with a per-tool execution timeout by @ginccc in #817
• fix(docs,manager): answer review findings left on merged PRs by @ginccc in #819
• fix(conversations): exact filtered paging, projected listing reads, faster and indexed search by @ginccc in #930

New Contributors

• @github-actions[bot] made their first contribution in #825

Full Changelog: 6.4.0...6.5.0