Skip to content

v2.6.2

Choose a tag to compare

View all tags
@HarshP4585 HarshP4585 released this 20 Oct 18:58
· 420 commits to master since this release
v2.6.2
55fe74f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Jira incidents, Agent Control monitor mode and LLM Evals through the AI Gateway

This release imports Jira issues as incidents and moves LLM Evals cloud calls onto the AI Gateway. Agent Control gets a monitor only mode plus a Python SDK. It also fixes many AI Gateway and LLM Evals issues. It keeps secrets out of the server log, stops provider keys crossing between organizations and enforces read-only roles on the server.

Upgrade notes

  • EvalServer now requires AI_GATEWAY_INTERNAL_KEY and calls cloud judge models through the AI Gateway using your organization's saved LLM keys (#5044, #5047). Standard Docker Compose, Helm (#5048), install script and Ansible setups already set this key, so they need no change.
  • Reviewer and Auditor are now read-only on the server (#5055). This covers use cases, vendors, models, policies, risks, tasks and training records. Before, the API accepted these writes from any logged-in user, even though the UI hid them. Custom roles that already held an editor permission get the new edit permissions automatically, so they keep the writes they had.
  • Badge values: the new CHECK constraints (#4976) stopped the backend from starting on deployments with policies saved as "In review". The migration now converts legacy and differently spelled values before adding the constraints (#5056). If you got past that error by inserting the SequelizeMeta row for 20261014115533 by hand, the constraints were never added. Delete that row and restart the backend to apply them.

License

VerifyWise now uses the VerifyWise Community & Evaluation License (VCEL) 1.0 in place of the Business Source License 1.1 (#4987). VCEL does not include the old license's free internal production use or its conversion to Apache-2.0 after 24 months. See LICENSE.md and LICENSING-FAQ.md. The Python SDK and GitHub Action under EvalServer/ stay Apache-2.0.

Highlights

  • Jira incidents: import Jira issues as incidents and keep their status in sync both ways
  • Agent Control: a monitor only mode for agent keys plus a Python SDK for LangChain, CrewAI and Agent Framework agents
  • LLM Evals: models, prices and errors come from the AI Gateway. Bias, toxicity and hallucination scores now read the right way round. Every built-in metric shows its direction. Runs that produce no scores are marked as failed.
  • AI Gateway: a working /v1 base URL, tool calls (streamed too) through virtual keys, streamed requests counted in spend, the real error reason on failed requests plus a restored guardrail test
  • MCP servers: tool discovery says what changed ("2 new, 1 removed") and links to the server's tools in the catalog (#5053)
  • Virtual keys: every limit is shown. Deleting an endpoint no longer widens a key's access.
  • Invitations: emails are sent in the recipient's language
  • Fixes: use case reports, an AI Advisor NIST AI RMF fix (#4992), the AI Trust Index digest email (now a table) plus the intake forms button, which now shows only in the governance module
  • Security: Reviewer and Auditor can no longer make core governance writes through the API (#5055). Policy reviews can be approved only by an Admin or an assigned reviewer who did not write the policy. One organization's provider keys can no longer reach another organization's eval runs. The server log is admin-only, with secrets redacted. Email template values are escaped.
  • Dependencies: a consolidated Dependabot update across the frontend and backend

Full Changelog: v2.6.1...v2.6.2

Assets 3
Loading