v0.25.1

A maintenance release about settings you could not change — and one you could not even see.

Translation stopped needing a default configuration

Handing a configuration to a translation call did not mean the whole call used it. If you left the source language to auto-detection, that detection step quietly reached for the instance-wide default configuration instead of the one you had just passed. On a site where no configuration is marked as default, translation therefore failed with No default LLM configuration found — while the caller had, visibly, supplied a configuration.

Detection now runs on the configuration you pass. If you worked around this by marking a default you did not otherwise want, you can drop it.

Reported in #520.

The governance retention window is now yours to set

0.25.0 introduced an append-only record of guardrail verdicts and tool-gate denials, and a purge command to age it out. The purge honoured a dedicated retention window for that data — but no field for it ever reached the Extension Configuration form. The window existed, was read on every purge, and could be neither seen nor changed.

privacy.retention.governance now appears alongside the other six retention overrides. Its behaviour is unchanged: 0 still means "use the global window", which is what every installation has been doing implicitly until now.

Settings that read as half-sentences

Seven settings in the Extension Configuration form showed a description that broke off mid-sentence. TYPO3 splits these comment lines on a semicolon before it separates the label from its description, so any semicolon inside a label silently truncated everything after it — including, in several cases, the sentence explaining what 0 means.

The DeepL identifier, minimum skill trust level, health-aware fallback reorder, tool data-class enforcement, content privacy level and the default retention window all read as full sentences again. Only the wording changed; no setting behaves differently.

For integrators

The extension ships as one package and stays that way until 1.0, but the boundaries that would allow a later split into focused packages are now enforced rather than reviewed by hand. Translation, image and speech no longer reach into the tool and agent code or the reverse, the guardrail pipeline depends on neither, and nothing outside the backend depends on controllers or dashboard widgets. Nothing about this changes the public API — it means a wrong-way dependency fails the build instead of quietly making a future split harder.

Installation

composer require netresearch/nr-llm

Publication status

• TER: extensions.typo3.org/extension/nr_llm — 0.25.1 verified
• Packagist: packagist.org/packages/netresearch/nr-llm — 0.25.1 verified
• Documentation: docs.typo3.org/p/netresearch/nr-llm/0.25/en-us/ — render verified

Security

All release artifacts are signed with Sigstore keyless signing.

Verify signatures

cosign verify-blob \
  --bundle nr-llm-0.25.1.zip.sigstore.json \
  --certificate-identity-regexp "https://github.com/netresearch/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  nr-llm-0.25.1.zip

Verify checksums

sha256sum -c checksums.txt

Software Bill of Materials (SBOM)

SBOMs are provided in both SPDX and CycloneDX formats for supply chain transparency.