v1.2.0

What's Changed

• fix(vertexai): use structured logging key-value style by @major in #6081
• chore: bump fallback_version to 1.1.1.dev0 by @cdoern in #6084
• chore: Limit payload-bearing logs to debug (vector search, rerank, guardrails) by @franciscojavierarceo in #6086
• docs: add Skills API to README, ARCHITECTURE, and provider docs by @varshaprasad96 in #6087
• fix(milvus): use explicit output_fields in query_vector for milvus-lite 3.0 compatibility by @derekhiggins in #6091
• fix(file_processor): offload sync parsing to thread pool by @derekhiggins in #6095
• chore: dummy gpu ec2 runner workflow by @skamenan7 in #6102
• fix(vertexai): prevent RuntimeError from stale client after startup event loop by @goingforstudying-ctrl in #6072
• docs: Adding OGX Paper by @franciscojavierarceo in #6042
• fix(ci): make ci-status wait for flaky test re-runs by @leseb in #6079
• fix(vector_io): propagate search errors instead of returning empty results by @derekhiggins in #6093
• fix(containers): embed distribution configs as OCI labels on published images by @cdoern in #6121
• chore(python-deps): bump pyjwt from 2.12.1 to 2.13.0 by @dependabot[bot] in #6122
• chore: bump fallback_version to 1.1.2.dev0 by @cdoern in #6119
• chore(python-deps): bump pytest-socket from 0.7.0 to 0.8.0 by @dependabot[bot] in #6112
• chore(api-deps): bump openai from 2.41.0 to 2.41.1 in /src/ogx_api by @dependabot[bot] in #6110
• feat(ci): add Trivy security scanning by @nathan-weinberg in #6074
• chore(python-deps): bump pypdf from 6.11.0 to 6.12.0 by @dependabot[bot] in #6106
• fix(conversations): cascade delete orphaned conversation items by @skamenan7 in #6059
• feat(files): fix Files API gaps for OpenAI spec parity by @leseb in #6127
• feat(multi-tenancy): add tenant isolation as a hard partition key independent of ABAC by @leseb in #6126
• chore(python-deps): bump starlette from 1.1.0 to 1.3.1 by @dependabot[bot] in #6125
• chore(github-deps): bump actions/cache from 4.2.3 to 5.0.5 by @dependabot[bot] in #6108
• fix(file_processor): add ZIP decompression limits to MarkItDown processor by @derekhiggins in #6100
• chore(github-deps): bump sigstore/gh-action-sigstore-python from 3.3.0 to 3.4.0 by @dependabot[bot] in #6109
• chore(python-deps): bump cryptography from 48.0.0 to 48.0.1 by @dependabot[bot] in #6124
• chore(deps): remove upper bound constraint on pydantic by @mattf in #6131
• chore(python-deps): bump pypdf from 6.12.0 to 6.13.0 by @dependabot[bot] in #6132
• fix(api-docs): Move vector stores docs to top-level tag by @franciscojavierarceo in #6137
• chore(python-deps): bump python-multipart from 0.0.28 to 0.0.31 by @dependabot[bot] in #6123
• chore: bump fallback_version to 1.1.3.dev0 by @cdoern in #6138
• refactor(vector-io): Convert Qdrant, Milvus, Elasticsearch to eager collection initialization by @mattf in #6144
• docs: document nimble web search provider in guides and starter distro by @wildcard in #6082
• chore(ci): change CI to use ogx_open_client by @aegeiger in #6016
• docs(blog): add guardrails Responses API post by @leseb in #6029
• ci: record the bedrock inference suite in record workflow by @cdoern in #6165
• fix(tests): add Bedrock replay recordings by @skamenan7 in #6166
• fix(bedrock): preserve bearer token env compatibility by @skamenan7 in #6167
• feat(ci): update pip_packages in registry specs during Dependabot PRs by @leseb in #6156
• fix(vertexai): walk into routing tables to reset provider clients by @Artemon-line in #6148
• refactor(core): replace bespoke DFS topological sort with graphlib.TopologicalSorter by @mattf in #6157
• feat(containers): add Containers API surface under /v1alpha by @cdoern in #5913
• refactor(server): decouple stack.initialize from authn and tenancy middleware by @mattf in #6171
• fix(pgvector): ensure vector extension exists before creating connection pool by @Artemon-line in #6168
• chore: bump fallback_version to 1.1.4.dev0 by @cdoern in #6179
• fix(core)!: move rerank code to sentence_transformers by @zy1o in #5882
• fix(tests): allow slower Bedrock chat completion recordings by @skamenan7 in #6175
• ci: support refreshing integration recordings via dispatch on main by @cdoern in #6185
• fix(vertexai): pin google-genai below 2 by @skamenan7 in #6186
• fix(tests): re-key responses recordings broken by reranker provider rename (#5882) by @cdoern in #6187
• feat: add GPU-enabled self-hosted runners for vLLM recording (#5793) by @skamenan7 in #6101
• refactor(server): move route-to-API map construction to lazy first-request build by @mattf in #6173
• refactor: extract ZstdDecompressionMiddleware out of create_app() by @mattf in #6174
• feat: add inline::unstructured file processor by @sahana-sreeram in #6159
• fix: temporarily pin nodejs image version to avoid Premature Close errors by @rhdedgar in #6213
• fix(responses): normalize empty function tool parameters to valid JSON Schema by @derekhiggins in #6021
• fix: support developer chat messages by @skamenan7 in #6077
• feat(file_processors): add remote::unstructured-api provider by @sahana-sreeram in #6076
• feat(file-processors): add async/fallback support to docling-serve by @sahana-sreeram in #6014
• chore(github-deps): bump actions/cache from 5.0.5 to 6.1.0 by @dependabot[bot] in #6201
• chore(python-deps): bump joserfc from 1.6.5 to 1.6.7 by @dependabot[bot] in #6216
• fix(deps): bump urllib3 and python-dotenv constraints for multiple CVEs by @EleanorWho in #6184
• chore(github-deps): bump actions/setup-python from 6.2.0 to 6.3.0 by @dependabot[bot] in #6200
• chore(github-deps): bump actions/setup-java from 5.2.0 to 5.4.0 by @dependabot[bot] in #6202
• fix: require replay checks in ci status gate by @skamenan7 in #6188
• chore(api-deps): bump opentelemetry-exporter-otlp-proto-http from 1.42.1 to 1.43.0 in /src/ogx_api by @dependabot[bot] in #6204
• chore(python-deps): bump python-socketio from 5.16.1 to 5.16.2 by @dependabot[bot] in #6217
• fix(letsgo): use single asyncio.run() in run_letsgo_cmd for clean event loop lifecycle by @mattf in #6206
• fix(file_processors): allow owner-encrypted PDFs in pypdf processor by @Artemon-line in #6182
• fix: honor file_search ranking_options.weights by @Mykelxu in #6198
• chore(api-deps): bump opentelemetry-sdk from 1.42.1 to 1.43.0 in /src/ogx_api by @dependabot[bot] in #6203
• docs: add June 30 blog for ogx connect codex by @skamenan7 in #6118
• chore(api-deps): bump openai from 2.41.1 to 2.43.0 in /src/ogx_api by @dependabot[bot] in #6153
• chore(github-deps): bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #6154
• chore(python-deps): bump pydantic-settings from 2.14.1 to 2.14.2 by @dependabot[bot] in #6150
• chore(python-deps): bump msgpack from 1.1.2 to 1.2.1 by @dependabot[bot] in #6151
• chore(python-deps): bump pypdf from 6.13.0 to 6.13.3 by @dependabot[bot] in #6142
• chore: update ogx stack run references to ogx run by @nathan-weinberg in #6115
• fix(deps): bump aiohttp and pyjwt constraints for CVE-2026-34993 and CVE-2026-48526 by @EleanorWho in #6183
• chore(python-deps): bump langgraph-sdk from 0.3.14 to 0.3.15 by @dependabot[bot] in #6190
• fix(cli): resolve env var templates before validation in list-deps by @nathan-weinberg in #5914
• feat(cli): support OGX_WORKERS env var to override worker count by @derekhiggins in #6221
• fix(ci): include ogx-open-client in unified release pipeline by @aegeiger in #6205
• ci(bedrock): enable OIDC web identity recording by @skamenan7 in #6169
• fix: pin vLLM metrics routing dependency by @skamenan7 in #6220
• feat(security)!: strict TLS mode by @rhdedgar in #5603
• feat(telemetry): expose OTel metrics via a Prometheus scrape endpoint by @cdoern in #6034
• fix(docs): remove stale inline_transformers sidebar reference by @leseb in #6229
• fix(docs): escape angle bracket in unstructured-api provider doc by @leseb in #6230
• refactor(core): move async startup to lifespan and remove temp-loop workaround code by @mattf in #6161
• feat: Add Responses memory read path by @franciscojavierarceo in #6162
• fix(letsgo): add insecure to stack_args to avoid AttributeError by @mattf in #6232
• feat: Add Responses memory write path by @franciscojavierarceo in #6163
• fix(inference): lazily initialize asyncio locks in embedding mixin by @franciscojavierarceo in #6244
• feat(skills): inject skill instructions into Responses API system prompt by @varshaprasad96 in #6146
• chore(refactor, responses): pass CreateResponseRequest object directly through the call chain instead of unpacking individual fields by @mattf in #6227
• feat(client-sdks): add env variable support and api_key to client SDK by @aegeiger in #6228
• chore(github-deps): bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in #6238
• chore(python-deps): bump joserfc from 1.6.7 to 1.6.8 by @dependabot[bot] in #6250
• chore(github-deps): bump dorny/paths-filter from 4.0.1 to 4.0.2 by @dependabot[bot] in #6234
• chore(github-deps): bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #6235
• chore(python-deps): bump aiohttp from 3.13.5 to 3.14.0 by @dependabot[bot] in #6015
• fix(nvidia): log when dynamic model listing fails instead of silently returning empty by @yashanil98 in #6249
• docs(client-sdks): add migration guide for ogx_client by @aegeiger in #6207
• feat(file_processors): wire all providers into inline::auto dispatcher by @alinaryan in #6218
• feat: Add --insecure flag to letsgo and auto-generate self-signed TLS certificate by @mattf in #6243
• fix(watsonx): apply network config to IAM token and model spec requests by @yashanil98 in #6254
• feat(benchmarks): add contextual chunking support to RAG benchmarks by @franciscojavierarceo in #6253
• feat: add resource attributes to distinguish by namespace and cluster by @rhdedgar in #6255
• chore(python-deps): bump tornado from 6.5.5 to 6.5.6 by @dependabot[bot] in #6107
• chore(python-deps): bump langsmith from 0.8.3 to 0.8.18 by @dependabot[bot] in #6149
• chore(python-deps): bump python-engineio from 4.13.1 to 4.13.2 by @dependabot[bot] in #6215
• fix(responses): return error to model on hallucinated tool calls instead of silently exiting by @matteo-grimaldi in #6231
• feat(telemetry): add agentic depth and RAG depth metrics by @EleanorWho in #6252
• fix(vector_io): align Milvus, ChromaDB, and SQLite-vec to upsert semantics by @jakub-walaszczyk in #6260
• fix(auth): recurse into sub-routers when building route auth table by @derekhiggins in #6266
• refactor: route Anthropic messages through InferenceProvider instead of hardcoded provider paths by @mattf in #6264
• docs: fix remote-hosted endpoint URLs broken by the rename by @yashanil98 in #6248
• feat: Add default memory vector store by @franciscojavierarceo in #6267
• feat(file_processors): route docling VLM processing through stack inference API by @alinaryan in #6225
• chore(github-deps): bump github/codeql-action/init from 4.36.2 to 4.36.3 by @dependabot[bot] in #6236
• chore(python-deps): bump langgraph-checkpoint from 4.1.0 to 4.1.1 by @dependabot[bot] in #6191
• fix(vector_io): use pool factory in PGVectorIndex to survive server restarts by @r3v5 in #6261
• fix(deps): bump pillow, nltk, and langchain-core for multiple CVEs by @EleanorWho in #6272

New Contributors

• @goingforstudying-ctrl made their first contribution in #6072
• @Mykelxu made their first contribution in #6198
• @yashanil98 made their first contribution in #6249
• @matteo-grimaldi made their first contribution in #6231

Full Changelog: v1.1.3...v1.2.0