Kaeso 0.3.0

Six more built-in providers, tighter single sign-on and access rules, and faster, steadier request handling.

Highlights

• Six more built-in providers. DeepSeek, SpaceX (xAI's API), Together AI, Groq, OpenRouter and Mistral can be added with a key and called from any app format. #200, #202, #203, #204, #209, #213
• Single sign-on needs verified domains. SSO admits only addresses at domains verified by DNS and signs in only accounts linked to the organization's provider. #252, #264
• Forwarded addresses need configuring. The gateway trusts forwarded addresses only from loopback, so proxies outside Compose need KAESO_TRUSTED_PROXIES set. #247
• Faster requests and streams. Provider and model lookups, streams to one provider and limit checks no longer queue behind large or busy connections. #222, #224, #230, #242
• Budgets hold under concurrency. Hard budgets reserve a worst case for each concurrent request, and a long stream keeps its reservation past its timeout. #232

Breaking

• Only owners transfer ownership now, and logs.content.disable became logs.content.manage; grant it again where content logging is switched. #229
• The gateway trusts X-Forwarded-For only from loopback, so set KAESO_TRUSTED_PROXIES for a reverse proxy outside the Compose package. #247
• SSO signs in only accounts linked to the organization's provider, so existing members link their account once under Account, Security. #252
• SSO admits only email domains verified with a DNS TXT record, so publish the record and choose Verify domains under Security first. #264
• Identity providers on private networks need KAESO_AUTH_OIDC_ALLOW_PRIVATE_NETWORKS set to true, since that setting now defaults to off. #270

Contributors: @dvnold

Full changelog · v0.2.2...v0.3.0