Enterprise 1.5.12 base

What's Changed

• fix: bedrock files handling in inference (#5947) by @akshaydeo in #6271
• feat(gemini): support server-side toolCall/toolResponse parts with thoughtSignature round-trip fidelity (#6071) by @akshaydeo in #6272
• file/image embedding flow fixes (#6239) by @akshaydeo in #6273
• fixes params sequence in chat completions (#6235) by @akshaydeo in #6274
• gemini tool call fixes by @akshaydeo in #6280
• core version cut by @akshaydeo in #6291
• reasoning fix by @akshaydeo in #6292

Full Changelog: ent-v1.5.11-base...ent-v1.5.12-base

Core v1.7.13

Core Release v1.7.13

• feat: support Gemini's server-side toolCall/toolResponse parts with thoughtSignature round-trip fidelity - server-side search rounds now surface as web_search_call items carrying their own call ID and queries, unmapped tool types are preserved on the native round-trip instead of being dropped, and each thoughtSignature appears exactly once across the reconstructed parts so Gemini accepts the replayed turn
• feat: async 3D generation on Runware via /videos plus a raw /runware_passthrough route - taskType is now read from extra_params so any Runware async task can be driven through /videos (the 16:9 1080p width/height defaults now apply only to videoInference), outputs.files[].url is surfaced as VideoOutput URLs with the content type derived from the file extension, and the passthrough route forwards raw task arrays for capabilities with no first-class Bifrost surface such as upscaling and background removal
• feat: surface Runware's provider-reported per-task cost across image, video/3D and passthrough so pricing uses the exact figure verbatim instead of a datasheet estimate - this matters for task types like 3D that have no datasheet rate; when no cost is reported the behavior is unchanged
• feat: send s3:// image and document references to Bedrock Converse as the s3Location source member instead of downloading the bytes and re-uploading them - Converse resolves the object itself, which skips a round trip and the 25 MiB inline cap entirely. Image format is derived from the object extension since nothing is fetched and there is no Content-Type to read, and an extension-less object is rejected up front rather than producing an opaque 400
• feat: resolve Vertex URL sources per model family rather than inlining everything - a gs:// URI is now forwarded to Gemini/Gemma as fileData.fileUri (the documented form, resolved under the caller's own project IAM, and the only thing that keeps multi-hundred-MB video inputs viable) and read from Cloud Storage with the request key's own Google credentials for Claude-on-Vertex, which accepts base64 sources only. http(s) is still always fetched: forwarding one was measured against the harness and Vertex rejected every endpoint shape with URL_REJECTED-REJECTED_FC_TOO_MANY_PENDING
• fix: allow Vertex AI to send function declarations and a Google Search tool in the same request without includeServerSideToolInvocations - Vertex accepts the combination natively, so Google Search was being dropped for no reason, and search localization via RetrievalConfig.LatLng is now preserved when both tool types are present
• fix: prefer function declarations over Google Search when tool combination is disabled on Gemini - Google's tool combination is Preview and Gemini 3 only (https://ai.google.dev/gemini-api/docs/generate-content/tool-combination), so on every other model one of the two tool types has to be dropped. Function declarations now win: they carry the caller's own tools, or the ones Bifrost's MCP gateway synthesized from their connected servers, and dropping those leaves the model unable to invoke them at all while it answers as though the capabilities never existed. Dropping Google Search only costs grounding, so the model still answers, just without citations. One is disabled, the other is degraded. Set include_server_side_tool_invocations to send both. A lone Google Search tool still converts back correctly, and retrievalConfig is only emitted when a search tool actually survived conversion
  
  Breaking on the Gemini API surface: a request carrying both function declarations and Google Search without include_server_side_tool_invocations previously kept Google Search and dropped the function declarations. It now does the opposite. Set include_server_side_tool_invocations to true to send both, which is supported on Gemini 3 models. Vertex is unaffected, since it accepts the combination natively and drops neither.
  
• fix: always emit a Gemini candidate carrying its finish reason on generateContent, even when nothing visible was generated - a thinking model that spends its whole output budget before emitting a token is a successful 200 with an empty answer, but Candidates is omitempty, so dropping that candidate produced a body with no candidates key at all and left a lone usageMetadata object that every Gemini-shaped client dereferences blind
• fix: drop payload-free Gemini parts when assembling a candidate - every Part field is omitempty, so such a part marshals to exactly {}; the harness observed one on the wire when a transcription request for an unintelligible tone came back as parts:[{}], where it is noise a client will try to read and it masks the contentless case by making the parts slice look non-empty
• fix: accept a bare model identifier on Bedrock rerank by synthesizing the foundation-model ARN from the resolved region - Rerank is the one Bedrock surface that names its model by ARN rather than by bare ID, so all three rerank drop-ins in the provider harness 400'd on amazon.rerank-v1:0. The partition is derived from the region (aws, aws-cn, aws-us-gov) so GovCloud and China build a correct ARN, and an explicit ARN still passes through untouched
• fix: stop stripping file_url from OpenAI-shaped chat file blocks on marshal - dropping it produced {"type":"file","file":{}} and an upstream complaint about a missing file_id, which hid the fact that a source had been discarded. Providers that cannot take a URL now say so by name, and any OpenAI-compatible endpoint that does accept one keeps working without a Bifrost change
• fix: leave URL content sources Bifrost cannot download in place on the OpenAI and native-Anthropic paths instead of failing the request - only http(s) is fetched, and whether a gs://, s3:// or scheme-less reference is usable is the provider's call, so the source now travels as {"type":"url"} and the platform answers for itself

Installation

go get github.com/maximhq/bifrost/core@v1.7.13

---

This release was automatically created from version file: core/version

Helm Chart v2.1.36

Helm chart release for Bifrost v2.1.36

Core v1.7.12

Core Release v1.7.12

• feat: support Gemini's server-side toolCall/toolResponse parts with thoughtSignature round-trip fidelity - server-side search rounds now surface as web_search_call items carrying their own call ID and queries, unmapped tool types are preserved on the native round-trip instead of being dropped, and each thoughtSignature appears exactly once across the reconstructed parts so Gemini accepts the replayed turn
• feat: async 3D generation on Runware via /videos plus a raw /runware_passthrough route - taskType is now read from extra_params so any Runware async task can be driven through /videos (the 16:9 1080p width/height defaults now apply only to videoInference), outputs.files[].url is surfaced as VideoOutput URLs with the content type derived from the file extension, and the passthrough route forwards raw task arrays for capabilities with no first-class Bifrost surface such as upscaling and background removal
• feat: surface Runware's provider-reported per-task cost across image, video/3D and passthrough so pricing uses the exact figure verbatim instead of a datasheet estimate - this matters for task types like 3D that have no datasheet rate; when no cost is reported the behavior is unchanged
• feat: send s3:// image and document references to Bedrock Converse as the s3Location source member instead of downloading the bytes and re-uploading them - Converse resolves the object itself, which skips a round trip and the 25 MiB inline cap entirely. Image format is derived from the object extension since nothing is fetched and there is no Content-Type to read, and an extension-less object is rejected up front rather than producing an opaque 400
• feat: resolve Vertex URL sources per model family rather than inlining everything - a gs:// URI is now forwarded to Gemini/Gemma as fileData.fileUri (the documented form, resolved under the caller's own project IAM, and the only thing that keeps multi-hundred-MB video inputs viable) and read from Cloud Storage with the request key's own Google credentials for Claude-on-Vertex, which accepts base64 sources only. http(s) is still always fetched: forwarding one was measured against the harness and Vertex rejected every endpoint shape with URL_REJECTED-REJECTED_FC_TOO_MANY_PENDING
• fix: allow Vertex AI to send function declarations and a Google Search tool in the same request without includeServerSideToolInvocations - Vertex accepts the combination natively, so Google Search was being dropped for no reason, and search localization via RetrievalConfig.LatLng is now preserved when both tool types are present
• fix: prefer function declarations over Google Search when tool combination is disabled on Gemini - Google's tool combination is Preview and Gemini 3 only (https://ai.google.dev/gemini-api/docs/generate-content/tool-combination), so on every other model one of the two tool types has to be dropped. Function declarations now win: they carry the caller's own tools, or the ones Bifrost's MCP gateway synthesized from their connected servers, and dropping those leaves the model unable to invoke them at all while it answers as though the capabilities never existed. Dropping Google Search only costs grounding, so the model still answers, just without citations. One is disabled, the other is degraded. Set include_server_side_tool_invocations to send both. A lone Google Search tool still converts back correctly, and retrievalConfig is only emitted when a search tool actually survived conversion
  
  Breaking on the Gemini API surface: a request carrying both function declarations and Google Search without include_server_side_tool_invocations previously kept Google Search and dropped the function declarations. It now does the opposite. Set include_server_side_tool_invocations to true to send both, which is supported on Gemini 3 models. Vertex is unaffected, since it accepts the combination natively and drops neither.
  
• fix: always emit a Gemini candidate carrying its finish reason on generateContent, even when nothing visible was generated - a thinking model that spends its whole output budget before emitting a token is a successful 200 with an empty answer, but Candidates is omitempty, so dropping that candidate produced a body with no candidates key at all and left a lone usageMetadata object that every Gemini-shaped client dereferences blind
• fix: drop payload-free Gemini parts when assembling a candidate - every Part field is omitempty, so such a part marshals to exactly {}; the harness observed one on the wire when a transcription request for an unintelligible tone came back as parts:[{}], where it is noise a client will try to read and it masks the contentless case by making the parts slice look non-empty
• fix: accept a bare model identifier on Bedrock rerank by synthesizing the foundation-model ARN from the resolved region - Rerank is the one Bedrock surface that names its model by ARN rather than by bare ID, so all three rerank drop-ins in the provider harness 400'd on amazon.rerank-v1:0. The partition is derived from the region (aws, aws-cn, aws-us-gov) so GovCloud and China build a correct ARN, and an explicit ARN still passes through untouched
• fix: stop stripping file_url from OpenAI-shaped chat file blocks on marshal - dropping it produced {"type":"file","file":{}} and an upstream complaint about a missing file_id, which hid the fact that a source had been discarded. Providers that cannot take a URL now say so by name, and any OpenAI-compatible endpoint that does accept one keeps working without a Bifrost change
• fix: leave URL content sources Bifrost cannot download in place on the OpenAI and native-Anthropic paths instead of failing the request - only http(s) is fetched, and whether a gs://, s3:// or scheme-less reference is usable is the provider's call, so the source now travels as {"type":"url"} and the platform answers for itself

Installation

go get github.com/maximhq/bifrost/core@v1.7.12

---

This release was automatically created from version file: core/version

Bifrost HTTP v1.6.11

Bifrost HTTP Transport Release v1.6.11

✨ Features

• URL Sources Inlined for AWS-Hosted Claude - URL-sourced images and documents are fetched and inlined on the native-Anthropic path, since Bedrock Mantle rejects {"source":{"type":"url"}}. Fetches go through the SSRF-safe dialer with a size cap, and a failed fetch aborts the request rather than silently dropping an attachment.
• Quarterly Budgets for Customers - Quarterly budgets are now supported by the customer entity, and by virtual key provider configs.
• Fiscal Year Start in Budget Labels - Budget UI labels surface the configured fiscal year start through a new fiscalQuarterNote helper, and QuarterStartSelect is relaid out to a horizontal label and preview row with a right-aligned select.
• Flexible Entity Selector Width - The entity selector accepts contentClassName, so callers can widen or constrain its dropdown instead of being pinned to the default width.

🐞 Fixed

• WebSocket Writes After Disconnect - A broadcast racing a client disconnect could panic on a nil connection or deliver to an unrelated client's socket, because fasthttp recycles the hijacked connection as soon as the upgrade handler returns. Clients now carry an explicit closed flag and a close that blocks until in-flight writes finish.
• Realtime Heartbeat Panic on Disconnect - stopHeartbeat waits for the heartbeat goroutine to exit before the upgrade handler returns. A ping already inside WriteMessage would dereference a recycled connection, and unlike the broadcast path there is no recover, so the panic took down the whole process.
• Stop Sequences Dropped for Nova and Titan - Bedrock's Converse camelCase stopSequences now maps to the neutral stop parameter alongside Anthropic's stop_sequences. 81 catalog rows were silently losing stop, so the provider ran to end_turn instead of stopping.
• Reasoning Replay Rejected on Chat-Shaped Requests - /v1/chat/completions and /v1/messages carry replayed reasoning on reasoning_details, but the fail-soft strip only handled Responses-shaped items. A router that switched models mid-conversation returned "messages.N.content.0: Invalid signature in thinking block" to the client instead of retrying without the signature.
• Thinking Signatures on Responses Content Blocks - Signatures are stripped off content blocks, not just encrypted_content on the reasoning item. A message could need the strip with encrypted_content already absent, and only reasoning items are dropped when nothing survives, so an ordinary message keeps its own content.
• Reasoning Content Rejected by OpenAI and Azure Models - reasoning.content is no longer sent to non-gpt-oss reasoning models, which cap the array at zero entries and reject a populated one with "Invalid 'input[N].content': array too long". Replayed Anthropic thinking blocks were hitting this; summary and encrypted_content already carry everything those models accept.
• Reasoning Effort Cleared for Current Grok Models - The rule substring-matched "grok-3-mini", so grok-4.5, grok-4.6 and grok-4.20-multi-agent silently lost reasoning_effort and answered at the wrong reasoning depth, cost and latency. Replaced with an exact-match deny-list that normalizes routing prefixes, -latest and xAI's 4-digit date suffixes.
• xhigh Reasoning Effort Downgraded for Grok - The shared OpenAI-dialect normalizer downgraded xhigh to high before the xAI compat pass ran, losing the value even with the deny-list corrected. grok-4.5 still downgrades on purpose, matching xAI's documented upstream coercion.
• Empty Structured-Output Streams - content_part.added, output_text.delta, output_text.done and content_part.done are emitted when a tool-based structured-output call is reassembled into a message on the Responses streaming path. Only output_item.added and done were emitted, so consumers reading incremental events saw a stream with no text while tokens were billed. Affects Vertex, Bedrock Mantle and Azure Claude.
• HTTP 529 Rotating Credentials - Anthropic's overloaded_error is treated as a transient server error. It reflects capacity across all callers rather than anything about the credential, so the same key is retried with backoff instead of being rotated away.

🗄️ Database Migrations

• No new database migrations in this release.

Installation

Docker

docker run -p 8080:8080 maximhq/bifrost:v1.6.11

Binary Download

npx @maximhq/bifrost --transport-version v1.6.11

Docker Images

• maximhq/bifrost:v1.6.11 - This specific version
• maximhq/bifrost:latest - Latest version (updated with this release)

---

This release was automatically created with dependencies: core v1.7.10, framework v1.5.10. All plugins have been validated and updated.

Plugin telemetry v1.5.37

Plugin Release: telemetry v1.5.37

• chore: upgraded core to v1.7.10 and framework to v1.5.10

Installation

# Update your go.mod to use the new plugin version
go get github.com/maximhq/bifrost/plugins/telemetry@v1.5.37

---

This release was automatically created from version file: plugins/telemetry/version

Plugin semanticcache v1.5.37

Plugin Release: semanticcache v1.5.37

• chore: upgraded core to v1.7.10 and framework to v1.5.10

Installation

# Update your go.mod to use the new plugin version
go get github.com/maximhq/bifrost/plugins/semanticcache@v1.5.37

---

This release was automatically created from version file: plugins/semanticcache/version

Plugin prompts v1.0.37

Plugin Release: prompts v1.0.37

• chore: upgraded core to v1.7.10 and framework to v1.5.10

Installation

# Update your go.mod to use the new plugin version
go get github.com/maximhq/bifrost/plugins/prompts@v1.0.37

---

This release was automatically created from version file: plugins/prompts/version

Plugin otel v1.4.9

Plugin Release: otel v1.4.9

• chore: upgraded core to v1.7.10 and framework to v1.5.10

Installation

# Update your go.mod to use the new plugin version
go get github.com/maximhq/bifrost/plugins/otel@v1.4.9

---

This release was automatically created from version file: plugins/otel/version

Plugin modelcatalogresolver v1.0.18

Plugin Release: modelcatalogresolver v1.0.18

• chore: upgraded core to v1.7.10 and framework to v1.5.10

Installation

# Update your go.mod to use the new plugin version
go get github.com/maximhq/bifrost/plugins/modelcatalogresolver@v1.0.18

---

This release was automatically created from version file: plugins/modelcatalogresolver/version